SShortSingh.
TopTechnologyAI & MLStartupsProgrammingScienceBusinessFinanceCrypto & Web3World

Programming

LatestTopDiscussed
0
ProgrammingDEV Community ·

AWS CloudFormation Least-Privilege Roles Can Fail Due to Hidden Cross-Service API Calls

AWS CloudFormation execution roles scoped strictly to visible template services can still fail with AccessDenied errors because CloudFormation's resource providers internally call APIs from adjacent AWS services. Two real-world examples illustrate this: creating an Application Load Balancer required the EC2 permission ec2:GetSecurityGroupsForVpc, and associating a Web ACL required load-balancer-side permissions beyond standard WAF access. These failures occur because CloudFormation's actual API behavior is driven by provider-side implementation, not just the service namespaces listed in the template. Rather than responding by attaching broad managed policies, engineers should treat each AccessDenied message as precise evidence and grant only the specific denied action, using condition keys to limit scope. AWS documentation and integration paths can also evolve over time, so permission sets should be validated against current denied actions rather than static historical lists.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

FAANG Interviewers' Hostile Behavior Seen as Systemic Threat to Fair Hiring

A self-described FAANG insider has raised concerns about a pattern of unprofessional and hostile conduct by certain interviewers at major tech companies. According to the account, some interviewers use condescension, sarcasm, and personal attacks during technical interviews, inducing stress that impairs candidates' cognitive performance. The author attributes this behavior to three factors: individual ego-driven misconduct, a company culture that prioritizes technical skill over interpersonal conduct, and a lack of formal accountability mechanisms for interviewers. The piece warns that if left unaddressed, such practices will deter top talent, undermine diversity initiatives, and ultimately damage FAANG companies' reputations and hiring pipelines. The author calls for systemic reforms to restore fairness and respect to the hiring process.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

How to Prevent Split-Brain and Configure Quorum in a Proxmox HA Cluster

Proxmox High Availability (HA) clusters allow virtual machines and containers to automatically migrate to a healthy node when one fails, eliminating the need for manual intervention. The core communication layer, Corosync, exchanges heartbeat messages between nodes and triggers a re-election when a node becomes unreachable. A major risk in such setups is 'split-brain,' a scenario where two or more cluster segments each believe the other is dead and simultaneously attempt to control the same resources, leading to data corruption or duplicate VM starts. Corosync prevents this through a majority-voting quorum system, where a node must secure more than half of all available votes before taking action — a node that cannot reach quorum shuts itself down to avoid inconsistencies. Proper quorum configuration, including a tiebreaker vote for even-numbered node counts and separate storage and heartbeat networks, is essential for a truly stable Proxmox HA deployment.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Developer builds three-layer regex filter to block untrusted LLM output from personal knowledge base

A developer has built an automated pipeline that every 10 minutes uses a Claude AI model to summarize conversation logs and commit the results to a personal Obsidian Vault on GitHub, with no human review in the loop. Recognizing that the summarizing model could return malicious or accidental content — such as embedded API keys, auth URLs, or prompt-injection text from prior sessions — the developer treats all AI-generated output as untrusted input. To mitigate this, the generation step runs Claude in a maximally restricted mode with no file-write or network tools, enforced empty MCP server config, and a strict JSON schema that rejects any free-form output. A separate Python validation script then re-scans the returned JSON independently, followed by a third regex pass over the written files and git diff before any commit is allowed. The design reflects a zero-trust philosophy: restricting what the model can do during generation is not considered sufficient, so the receiving side independently validates output regardless.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

How Scoped Credentials and Preflight Checks Can Contain SaaS Permission Failures

A software engineering post on DEV Community outlines a pattern for diagnosing permission errors that affect only one code path within a shared-credential setup. The author argues that when a single workload fails — such as a usage-alert handler — the root cause is often a missing capability grant rather than a bad or expired key, and rotating the key first can mask the real problem while expanding security risk. The recommended approach is to define a capability matrix assigning each workload a narrow, named permission, then run a local preflight authorization check before any outbound network call is made. A credential fingerprint derived via one-way hashing helps confirm whether both the working and failing paths loaded the same secret version, without exposing the secret itself in logs. The core principle is that a shared environment variable proves nothing about which operations were actually granted, and keeping authorization intent visible before network code reduces the blast radius of any single misconfiguration.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

GEO as a Discipline Hinges on Understanding How AI Systems Hallucinate

A developer essay on DEV Community argues that AI hallucinations are not solely a product of RLHF post-training but originate as early as pretraining, when models learn false claims or distort facts through statistical compression. Research such as TruthfulQA showed that base models like GPT-3 and GPT-2 confidently reproduced misconceptions even before preference tuning, with larger models proving less truthful than smaller ones. The author outlines five categories of hallucination, ranging from wrong encoded information and flawed weight retrieval to inference errors, confabulation, and post-training behavioral shifts. In real-world AI deployments, the problem widens further, as untrue outputs can stem from faulty retrieval, incorrect tool use, flawed planning assumptions, or one agent treating another agent's invented output as verified fact. The piece concludes that accepting Generative Engine Optimization as a legitimate discipline requires a clear-eyed understanding of these layered failure modes across the entire AI system stack.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

CISA Flags Arista VeloCloud Orchestrator Flaw as Actively Exploited

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-93952 to its Known Exploited Vulnerabilities catalog on 22 September 2026. The vulnerability affects Arista VeloCloud Orchestrator, a management and policy platform for SD-WAN networks, and stems from improper input validation. Because the orchestrator distributes configurations, manages tunnels, and holds credentials for connected edge devices, a successful exploit could give attackers broad control over an organisation's network. CISA's listing shifts the priority for operators from evaluating whether to patch to determining how quickly remediation can be completed. Recommended immediate steps include auditing orchestrator logs for anomalous activity, rotating credentials, and verifying that the management interface is not publicly accessible.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

How Defenders Can Use ZoomEye to Map Their Own Internet-Exposed Assets

Internet-wide scanning tools like ZoomEye, commonly used by attackers to locate vulnerable systems, can also be used by organizations to audit their own externally visible attack surface. A four-step self-assessment workflow involves building technology fingerprints, running scoped queries, comparing results against internal asset inventories, and remediating unexpected exposures. The approach gained urgency after an August 2026 joint advisory highlighted that attackers used ZoomEye and Censys to identify exposed Siemens S7 PLCs before launching exploits. ZoomEye queries run on September 19, 2026, revealed hundreds of millions of publicly reachable instances of common platforms including Apache, nginx, WordPress, and Fortinet. Security experts stress that the gap between what an organization believes is internet-facing and what is actually reachable is a primary entry point for breaches.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Developer finds stricter eval rule discards more data as test repetitions grow

A software developer running a frozen 159-task benchmark suite to compare two AI models discovered that a conservative measurement rule increasingly discarded tasks with each additional test repetition. The stricter rule, designed to filter unstable results, threw away 13 tasks across three repetitions and 17 across six, shrinking the informative dataset and eventually masking a statistically significant difference between the models. A second, less restrictive rule was developed and pre-registered before new test runs began, allowing an independent replication on unseen data. The looser rule reached statistical significance on the fresh data, while pooling all six repetitions under the strict rule returned a non-significant result. The developer concludes that conservative stability filters are not cost-free choices, as they systematically discard genuinely stochastic tasks the more data is collected.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Developer Finds His LLM Eval Harness Was Grading Format, Not Factual Accuracy

A developer building an LLM drift-detection suite discovered that his exact-match grader was penalizing correct answers due to formatting differences, not factual errors. Tasks asking for the chemical symbol for gold and the smallest planet recorded near-100% failure rates across GPT-4o mini, Claude Sonnet 5, and Llama 3.1 8B, even though all models knew the correct answers. The models were responding with full sentences or markdown styling such as '**Au**' rather than the bare two-letter string the grader expected. A near-identical task asking for a country capital passed cleanly because its instructions specified an exact output shape, exposing the inconsistency in how constraints were worded across the suite. The developer notes the measurement is reliable but the precise explanation is still uncertain, and warns others maintaining exact-match eval suites to audit which tasks have failed consistently without anyone checking the raw model output.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

API Model Beat Custom-Trained AI at Same Cost, Prompting Team to Ditch Distillation

A development team initially estimated they could save roughly $86,000 by training a smaller Qwen2.5-7B model instead of using Claude Sonnet to process 6.5 million financial text units. Early benchmarking showed DeepSeek V3.2 underperforming Sonnet on hard test cases, which initially supported the case for building a distilled student model. However, after refining their extraction rubric to allow 'Unknown' as a valid output, a newer DeepSeek model passed all 46 cases across three held-out test sets. Optimized API costs then converged with the estimated $1,000 GPU cost of training and running their own model. With correction cycles far faster via API than through retraining and redeployment, the team decided renting a model was the more practical choice for this workload.

0 comments Read more at DEV Community
0
ProgrammingHacker News ·

Researchers Use Starlink Satellites as Tools to Measure Atmospheric Pressure

Scientists have found a novel way to use SpaceX's Starlink satellite constellation as a planetary barometer. By analyzing the atmospheric drag experienced by Starlink satellites in low Earth orbit, researchers can infer data about upper atmospheric density and pressure. Changes in drag on the satellites reflect variations in the atmosphere, effectively turning the large satellite network into a global sensing instrument. This approach leverages an already-existing infrastructure rather than requiring dedicated scientific hardware. The findings highlight an unexpected scientific utility of large commercial satellite constellations.

0 comments Read more at Hacker News
0
ProgrammingDEV Community ·

NIGHTCELL 7 adds second Viking metal-hip-hop album built entirely with Python code

NIGHTCELL 7, a free browser and desktop sandbox game, has released a second in-game soundtrack album titled 'When the Ravens Lied' by Þrøngva, featuring twelve new tracks blending drop-D Viking metal and hip-hop. The album retells the game's MIRAGE storyline as a Norse saga, in which forged messages from Odin's ravens manipulate two warring halls while a merchant profits from the conflict. Every note was synthesised programmatically using a Python script with numpy and ffmpeg — no samples, AI audio tools, or music services were used. Because the creator cannot hear, the mix was validated through spectrograms and energy analysis, revealing a bass-heavy imbalance that was corrected before final rendering at 320 kbps. Both albums are available free at nightcell7.com/play, streaming on demand, with lyrics embedded in each MP3 and the full synthesiser code published on GitHub.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

ChatGPT Surpasses 1 Billion Weekly Users, Serving 2.5 Million Businesses

OpenAI announced on September 8, 2026, that its ChatGPT product family now exceeds one billion weekly active users and serves 2.5 million businesses worldwide. The figures cover OpenAI's broader product suite rather than any single ChatGPT tier or region. While the milestone signals widespread employee and consumer familiarity with AI assistants, it does not indicate that every organization has a mature or effective AI strategy in place. Experts note the more pressing question for businesses is no longer whether staff will encounter AI tools, but where those tools should and should not be integrated into real workflows. The scale does lower the barrier to experimentation, though deploying AI in systems connected to customer data or operational infrastructure requires careful governance around access, data handling, and oversight.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Microsoft's September 2026 Patch Tuesday Addresses 974 CVEs Including Two Zero-Days

Microsoft released its September 2026 Patch Tuesday update, fixing a record 974 CVEs, among them two actively exploited zero-day vulnerabilities affecting the Windows Update Stack and ALPC component. Both zero-days are local privilege escalation bugs requiring internal inventory tools to detect, as external mapping platforms cannot identify them directly. The update also addressed a Critical Remote Code Execution flaw in Microsoft Exchange, triggerable via a malicious Visio file sent over email, putting internet-facing OWA instances at particular risk. Security teams are advised to combine internal patch management tools with external internet asset mapping to prioritize fixes based on which systems have a public-facing footprint. Platforms that fingerprint exposed services like RDP, SMB, and Exchange OWA can help verify that patching has reduced an organization's external attack surface after deployment.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Two Contentful builds reveal key lessons on content modeling and editorial control

A development team implemented Contentful-based CMS solutions for two clients — nonprofit Addiction Education Society (AES) and AI platform CrewAI — each with distinct editorial needs. For AES, structured content models for resources, stories, and core pages enabled staff to publish updates in minutes instead of days, without relying on developers. CrewAI's solution used reusable Figma-designed components mapped to Contentful models, letting marketing assemble pages while engineers controlled rendering via GraphQL. AES retained its existing WordPress learning system alongside the new Astro-and-Contentful marketing platform to avoid downtime, with a migration path planned for later. The projects highlighted three critical pre-migration questions: what content is reusable, which system owns each publication step, and which existing tools should remain in place.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Why CI Data Beats Surveys for Measuring Developer Experience

Most teams default to surveys when assessing developer experience, but the data needed to understand friction already exists in CI systems, deploy logs, and support channels. Metrics like push-to-merge time, check re-run rates, and rollback frequency can reveal real pain points without requiring new tools or vendor contracts. Tracking these numbers per team or per service — rather than as org-wide averages — exposes the outliers that aggregate figures hide. A high re-run rate on CI checks, for instance, signals eroding trust in the pipeline long before visible failures occur. This approach turns vague complaints into specific, actionable lists, such as identifying exactly which jobs developers no longer believe.

0 comments Read more at DEV Community
0
ProgrammingHacker News ·

Web Tool Mixes Fonts Into Chaotic Hybrids Using OpenType Ligature Abuse

A developer has released a humorous browser-based tool that blends multiple typefaces together to create unconventional, mismatched fonts. The tool exploits OpenType's ligature feature to combine different font styles in unexpected ways. It runs entirely on the client side by loading Python via WebAssembly, making it relatively fast without server processing. The project was shared on Hacker News as a lighthearted experiment rather than a serious utility.

0 comments Read more at Hacker News
0
ProgrammingDEV Community ·

How to Run n8n and a Node.js API Locally Using Docker Compose

A tutorial published on DEV Community walks developers through building a self-hosted workflow automation environment using n8n and a custom Node.js REST API. The setup uses Docker Compose to run both services within a shared internal bridge network, avoiding exposure to the public internet. This approach addresses common concerns around latency, rate limits, and data privacy associated with cloud-based automation tools. A lightweight Express API is containerized using a Node Alpine Docker image, while n8n handles workflow orchestration and communicates with the API via Docker's internal DNS. The configuration also includes a persistent Docker volume to ensure n8n workflows are retained even when containers are stopped or rebuilt.

0 comments Read more at DEV Community
← NewerPage 976 of 3189Older →