标签：#discuss

security, #api, #cybersecurity, #discuss On July 30, 2026, my batch job finished 300,000 domain-to-company lookups. 39,847 of them (13.3%) resolved to defense contractors, military-adjacent parent companies, or headquarters within a few miles of named bases. I wasn't hunting for that. I was just trying to clean a CRM. The same day, lina published a post about hijacking e164.arpa zones and accidentally logging hundreds of thousands of phone calls to military bases. Different protocol, same smell: an infrastructure lookup that was supposed to be boring turned into a classified-adjacent data spill. That parallel is what made me sit down and write this. Here is the exact call I used, with the live response for github.com so you can see the shape of the data before I explain what went wrong. import requests , json , time # Full source notes: https://github.com/On13uka/company-info-api RAPIDAPI_KEY = " YOUR_RAPIDAPI_KEY " BASE = " https://company-info1.p.rapidapi.com " def lookup ( domain ): r = requests . get ( f " { BASE } /lookup?domain= { domain } " , headers = { " X-RapidAPI-Key " : RAPIDAPI_KEY , " X-RapidAPI-Host " : " company-info1.p.rapidapi.com " }, timeout = 20 ) return r . json () print ( json . dumps ( lookup ( " github.com " ), indent = 2 )) The response I got back looked like this. It is a cached sample from a real call — the endpoint was asleep when I drafted this, but the fields are exactly what the pipeline consumed. { "domain" : "github.com" , "company_name" : "GitHub Inc" , "wikipedia" : "GitHub is a developer platform..." , "ceo" : "Thomas Dohmke" , "founded" : "2008" , "headquarters" : "San Francisco, California" , "employees" : "3000+" , "parent_company" : "Microsoft" , "twitter" : "@github" , "github_org" : { "repos" : 200 , "stars" : 50000 , "followers" : 12000 }, "health_score" : 78 } The Finding I started the job because a sales team had 300,000 stale domain records and wanted company names, headcounts, and a rough health score for each. The pla

The dictionary defines nuance as a subtle distinction or variation. In practice, it's the difference...

TL;DR Welcome back to Dev Opportunity Radar. This is a weekly series where I share opportunities,...

On-Device Piano Autocomplete: A 125M Model That Actually Works Meta Description: Discover how a 125M parameter model autocompletes piano music entirely on-device. We break down the tech, real-world performance, and what it means for musicians. TL;DR A developer shared on Hacker News that they trained a 125M parameter language model to autocomplete piano melodies — entirely on-device, with no internet connection required. The project demonstrates that compact, efficient AI models can deliver genuinely useful musical assistance without cloud dependency. This article breaks down how it works, who it's for, and whether it's worth your attention as a musician, developer, or AI enthusiast. Key Takeaways A 125M parameter model can run real-time piano autocomplete on consumer hardware without a cloud backend The model was trained on MIDI data and treats music generation similarly to how LLMs treat text prediction On-device inference means zero latency from network calls, full privacy, and offline usability This project sits at an exciting intersection of music technology, edge AI, and creative tools The approach has real limitations — it's not replacing a composer, but it's a genuinely useful creative assistant Similar techniques are being adopted in DAW plugins and music education software as of mid-2026 What Is "Show HN: I Trained a 125M Model to Autocomplete Piano On-Device"? If you spend time on Hacker News, you've probably seen "Show HN" posts — a dedicated space where builders share projects they've made. This particular submission caught significant attention: a developer trained a 125-million-parameter neural network to autocomplete piano music, and crucially, it runs entirely on your local device . No API calls. No subscription. No sending your musical ideas to a remote server. Just a model sitting on your machine, listening to what you play, and suggesting what might come next. The concept sounds deceptively simple, but the execution involves some genuinely clever

👋👋👋👋 Looking back on your week -- what was something you're proud of? All wins count -- big or small...

It’s been almost 2 months on Dev.to, and I’ve learned a lot from this community. Not just knowledge,...

I run self-hosted Chatwoot as the WhatsApp inbox for a dozen or so small Israeli businesses. Two servers, a few thousand conversations a week, a drip-sequence engine bolted on the side. Chatwoot is good software. The self-hosting docs will get you to a running container. What they will not tell you is which failures actually happen at month six, when you have real customers and real volume. These five all bit me in production, and none of them looked like what they were. 1. Your disk fills from somewhere Postgres never sees I got a disk alert at 86 percent and immediately went looking at the database. That was the wrong place. DB (postgres): 680 MB chatwoot_storage_data: 17 GB Attachments live in ActiveStorage, on a Docker volume, not in Postgres. Every image, voice note, and PDF a customer sends is a file on disk, and none of it shows up when you check database size. If your monitoring watches the DB, it will report everything is fine right up until the container cannot write. The growth curve is a function of how many accounts you host, not how busy any one of them is. Mine sat at roughly 0.05 GB a month until I onboarded seven new businesses over two months, and then it hit 16 GB a month. Check the right volume: docker system df -v | grep chatwoot_storage_data 2. Forty-four percent of my outbound storage was duplicate files This is the part that surprised me. When I actually measured what was on that volume, almost half the outbound media was byte-identical copies of the same file. One 14.5 MB video was stored 48 separate times. One image was stored 325 times. Chatwoot creates a new blob and a new file on disk on every send, even when the bytes are identical. That is correct behavior for a chat app where every message owns its attachment. It becomes expensive the moment you have anything that fans one file out to many conversations. In my case it was not campaigns at all, it was the drip engine sending the same media to 48 separate conversations as ordinary outbo

What if deciding what to eat felt as exciting as winning a championship? It's 2 AM. You're hungry. You open your favorite food delivery app, convinced you'll order something in two minutes. Thirty minutes later, you're still scrolling. Pizza? Burger? Pasta? Fries? Momos? Ice cream? Suddenly, every option looks equally good, and now you're questioning your entire existence just because you wanted dinner. I have this problem almost every time I order food. So when I saw the DEV Challenge, I wanted to build something fun around this tiny but painfully relatable problem. Unfortunately, I couldn't finish it before the deadline, but I still wanted to share the idea because it's one of those projects that made me smile while building it. Meet Foodwars . Instead of endlessly scrolling through hundreds of dishes, why not let your favorite comfort foods battle each other until only one champion remains? What I Built We've all watched cooking shows like MasterChef and somehow turned into professional judges sitting comfortably on our sofas. "That steak is overcooked." "The sauce needed more balance." "I would've plated it differently." As if Gordon Ramsay personally asked for our opinion. Foodwars lets us finally put those imaginary judging skills to good use. Instead of comparing hundreds of dishes at once, the platform randomly pairs comfort foods against each other in head-to-head battles. You become the judge. Pick the winner, move on to the next matchup, and continue until one food survives the tournament. No endless scrolling. No decision fatigue. Just a series of fun, quick decisions that eventually crown your Ultimate Comfort Food . And once the champion is decided... Go order it. Or cook it. Either way, dinner has finally been decided. Demo comfort-foodwars.vercel.app Features of Foodwars Foodwars isn't just a random food picker. Every round is designed to make choosing food feel like a game instead of a chore. 1. Interactive Tournament Brackets Instead of presenting

🚀 Technical Briefing: This tutorial is part of our deep-dive series on Agentic Workflows at Gate of AI . For the full technical breakdown, interactive code sandbox, and the native Arabic translation, visit the original article here . <p>Tutorial</p> <h1>Design a Safer AI Incident Copilot for GCC Operations</h1> <p>An AI incident copilot can help an operations team turn approved engineering facts into a clearer draft for stakeholders. It should not be treated as an autonomous incident commander, a source of truth, or an automatic publishing system. This tutorial explains how to define a safe operating model before choosing a framework, model provider, deployment platform, or integration.</p> <h2>Why incident copilots need a security-first design</h2> <p>During an incident, teams work under pressure. They need to communicate what is happening, who may be affected, what mitigation is under way, and when the next update will arrive. These messages must be accurate, calm, and consistent. An AI assistant may help prepare a first draft, but it can also amplify mistakes if it is allowed to infer missing facts, read untrusted material, or publish messages without review.</p> <p>The available security research on Copilot-style systems is a direct reason to design cautiously. Researchers have demonstrated ways AI systems can be manipulated to provide false references to files, extract some private data, and bypass security protections. The same research describes proof-of-concept abuse that can turn an AI assistant into an automated spear-phishing mechanism after an attacker gains the necessary access. These are not minor quality issues. They show that an AI feature connected to organizational information can become a security boundary.</p> <p>For an incident copilot, the safest initial scope is deliberately narrow: accept a small set of verified facts supplied by an authorized incident lead, create a draft in a fixed communication format, and require a human to review and pub

Opinion: The Diff Is a Claim, the Probe Is the Proof A generated patch is a claim about how a system should behave, and a diff cannot verify that claim on its own. The only honest reviewer is the runtime itself, which means every AI-proposed change deserves a behavioral probe before a human spends attention on it. Free model access changes the economics of that review, because the verification loop no longer costs a developer's full attention or a paid compute budget. The practical implication is that a disposable server, such as the free server option in MonkeyCode, becomes the arbiter of whether a patch is even worth reading. Disclosure: This article was prepared as part of MonkeyCode's product outreach. Review sessions routinely burn forty minutes on a diff that a five-second HTTP probe would have rejected instantly, and that waste is now entirely avoidable. Why Line-by-Line Review Fails on AI Patches A human reviewer reads a diff as prose, searching for the author's intent, but an AI-generated patch has no reliable intent to recover. The model that wrote the change cannot explain why a specific flag was flipped, and the diff itself only records the surface edit. This is a fundamental mismatch between the review tool and the review question. The review question is not "what changed" but "does the system still behave correctly after this change." Runtime shape diffing answers the first question well, and I have argued before that shape is a useful gate, but shape alone misses semantic regressions. A service can keep the same endpoints, the same config keys, and the same file layout while silently returning wrong data. Behavioral probes close that gap because they test the contract between the service and its callers. A probe sends real requests, checks real responses, and records real state transitions, which is exactly the evidence a reviewer needs. This is why I take the position that the probe, not the diff, should be the primary review artifact. Treat Every Pa

You budgeted six months. It took fourteen. You wanted one thing; you got three things that almost do it. And somewhere between the first sprint and the final invoice, you stopped understanding what you were even paying for. If that sounds familiar, this is the breakdown no one gave you before you started. What custom software development actually means Custom software development is building software from the ground up for your specific business, not configuring Salesforce, not installing a plugin. You're solving a problem your operations have, the way your operations actually work. What trips people up: "custom" doesn't mean "built entirely from scratch." Good dev teams use frameworks, libraries, and third-party services. What's custom is the logic of how your data flows, how business rules are enforced, how users interact. Scope range is huge: Custom dev covers everything from a lightweight internal dashboard to a full-scale multi-tenant SaaS platform. This is why cost estimates vary so wildly. 3 things nobody tells you before you sign 1. Scope creep is almost always the client's fault "Users should be able to manage their accounts" sounds simple. It actually contains dozens of decisions: can they change their email? What verification is required? Can they delete their account? Each one is a feature. Each feature has a cost. The fix: Run a discovery phase (2–4 weeks) before writing a single line of production code. It costs money upfront. It saves far more mid-project. 2. The cheapest bid rarely wins long-term A $40k quote and a $180k quote for the same project both happen. The $40k team isn't lying; they're optimistic, underbidding to win work, or scoping something different. What actually happens: you hit $40k, and you're 40% done. Higher bids from experienced teams often include architecture planning, documentation, testing infrastructure, and post-launch support things the cheap bid omitted. These aren't extras. They're what make the software maintainable in t

If you’ve ever tried to reconcile a night of sleep from an Oura Ring , a morning run from a Garmin watch, and active minutes from an Apple Watch , you know the "Dirty Data" struggle is real. Each platform has its own schema, its own definition of "active calories," and its own idiosyncratic export format. In the world of Data Engineering , this is a classic multi-source integration problem. But you don't need a massive Snowflake cluster to solve it. Today, we’re building a high-performance, serverless data pipeline to clean and normalize wearable data using DuckDB , dbt , and GitHub Actions . By leveraging a modern Serverless Data Pipeline and DuckDB's lightning-fast processing, we can turn a mess of CSVs into a structured Parquet -based personal data warehouse. The Architecture: From Chaos to Clarity Before we dive into the code, let’s look at how the data flows from your wearables to a clean, queryable state. graph TD A[Oura JSON] -->|Python Ingestion| D[(DuckDB Raw)] B[Garmin CSV] -->|Python Ingestion| D C[Apple Health XML] -->|Python Ingestion| D D --> E{dbt Models} E -->|Cleaning| F[stg_models] E -->|Normalization| G[int_health_metrics] G -->|Final Output| H[Gold Layer: Parquet Files] H --> I[Visualization / BI] subgraph GitHub Actions D E F G H end Prerequisites To follow along, you'll need: DuckDB : The "SQLite for OLAP" that makes local analytical processing insanely fast. dbt-duckdb : The adapter that lets dbt talk to DuckDB. GitHub Actions : Our free "orchestrator." Tech Stack : DuckDB, dbt, Python, Parquet. Step 1: The Ingestion Layer (Python + DuckDB) The first hurdle is getting disparate files (JSON, CSV, XML) into a unified storage format. DuckDB is magical here because it can query these files directly. We'll use a simple Python script to load these into a local .duckdb file. import duckdb def ingest_raw_data (): # Initialize the database con = duckdb . connect ( ' health_data.duckdb ' ) # Ingest Garmin CSV con . execute ( """ CREATE TABLE raw_garmin

🚀 Technical Briefing: This tutorial is part of our deep-dive series on Agentic Workflows at Gate of AI . For the full technical breakdown, interactive code sandbox, and the native Arabic translation, visit the original article here . An evaluation-first guide to deciding whether GPT-4o mini fine-tuning is justified for a narrowly defined language task. This article uses the available research context rather than assuming unverified API capabilities, model snapshots, pricing, or deployment features. GPT-4o Mini Fine-Tuning: Start With Evidence, Not an Upload Fine-tuning is often presented as the next step after prompt engineering, but the available evidence does not support treating it as an automatic upgrade. Before preparing a dataset or committing to a training workflow, define the task, establish a baseline, select measures that reflect the real objective, and decide what result would justify changing the system. The verified research context is especially relevant for text transformation. A TREC 2024 Plain Language Adaptation of Biomedical Abstracts study evaluated prompt engineering, a two-AI-agent approach, and fine-tuning with OpenAI GPT-4o and GPT-4o mini models. Its objective was to simplify biomedical abstracts for a K-8 audience, approximately 13- to 14-year-old students. The study used qualitative assessments for simplicity, accuracy, completeness, and brevity on 5-point Likert scales, together with readability measures including Flesch-Kincaid grade level and the SMOG Index. Its results are a useful warning against simplistic claims. Prompt engineering with GPT-4o mini and the two-agent approach showed stronger qualitative performance in that evaluation. Fine-tuned models excelled in accuracy and completeness, but were less simple. The paper also reported that GPT-4o mini prompt engineering outperformed the evaluated iterative two-agent and GPT-4o fine-tuning approaches on its qualitative results. That is not a universal verdict on fine-tuning. It is ev

Within minutes of this post going live, this laptop goes back to the company. Work is handed over....

Welcome to this week's Top 7, where the DEV editorial team handpicks their favorite posts from the previous week (Saturday-Friday). Congrats to all the authors that made it onto the list 👏 The Next Evolution of Software Developers Shifts junior training and trust Roberto B. Roberto B. Roberto B. Follow Aug 12 The Next Evolution of Software Developers # ai # learning # mentorship # software 62 reactions 29 comments 7 min read @robertobutti argues that AI isn't replacing developers so much as raising the abstraction layer they work at, the same way high-level languages, frameworks, and cloud platforms did before it. Drawing on their own shifting workday, they make the case that as implementation gets cheaper, ownership of architecture, trade-offs, and outcomes becomes the real differentiator. The End of Undetectable AI Text? Claude’s New Watermark Explained Separating AI provenance from detection myths Sylwia Laskowska Sylwia Laskowska Sylwia Laskowska Follow Aug 11 The End of Undetectable AI Text? Claude’s New Watermark Explained # news # ai # llm 138 reactions 93 comments 6 min read @sylwia-lask cuts through the panic around Anthropic signing the EU AI Act transparency code, separating what is actually confirmed about Claude's new text watermark from the myths that piled up within hours. They also flag the question nobody has answered yet: how do you statistically watermark generated code, where the model has far fewer equivalent tokens to choose from? I Stopped Trusting AI Agents With Tools. So I Built a Gatekeeper. 83 real agents tested zero mocks Debashish Ghosal Debashish Ghosal Debashish Ghosal Follow Aug 13 I Stopped Trusting AI Agents With Tools. So I Built a Gatekeeper. # ai # agents # security # gatekeeper 43 reactions 48 comments 14 min read @debashish_ghosal built a contextual permission engine that sits between an agent and its tools, replacing binary allow-or-deny with four decisions and a deterministic policy the LLM can't talk its way past. After fiel

The Linux kernel, Fedora, and LLVM now require an “Assisted-by” tag on patches created with the help...

WLOADCTL is built as a distributed scheduling platform composed of multiple cooperating processes. Communication between different nodes, such as: Server ↔ Agent Server ↔ Client is handled through TCP/IP socket communication. However, communication between components on the same node relies heavily on Linux Inter-Process Communication (IPC) mechanisms, including: Message Queues Shared Memory Semaphores In some environments, the default Linux IPC configuration may not be sufficient for high-volume scheduling workloads. When this happens, WLOADCTL may encounter message queue-related errors or communication bottlenecks. This article explains how to: Check current IPC limits Increase message queue capacity Inspect IPC resource usage Remove unused IPC resources Understanding Current IPC Limits Before making any changes, it is important to inspect the current IPC configuration. Use: ipcs -l This command displays the system-wide limits for IPC resources, including: Maximum number of semaphore sets Maximum number of semaphores Maximum message queue size Maximum shared memory limits Pay special attention to the Message Limits section. Example: ------ Messages Limits -------- max queues system wide max size of message (bytes) default max size of queue (bytes) If the value of: default max size of queue (bytes) is around: 16384 the queue capacity may be too small for larger scheduling environments. Increasing Message Queue Capacity If the current limits are low, we recommend adjusting the Linux kernel IPC parameters. As the root user, edit: /etc/sysctl.conf and add the following settings: kernel.msgmni=1600 kernel.msgmax=8192 kernel.msgmnb=1638400 Parameter descriptions: Parameter Description Typical Default Recommended msgmni Maximum number of message queues 16 1600 msgmax Maximum size of a single message (bytes) 8192 8192 msgmnb Maximum capacity of a message queue (bytes) 16384 1638400 In WLOADCTL, a typical internal message is approximately: 512 bytes After modifying the con

Well, first real job and I still haven't gotten used to waking up for a 6:30 AM shift... I've been...

So a bit of context, I've been doing testing for V.E.L.O.C.I.T.Y. Drone and initially, I just copied over a binary, but I wanted it to be a bit easier to setup, so I thought I'd make an installer for it, so it can register as a system tray app. So naturally, I looked up what's the best installer and up popped Inno Setup 7. So I used it and it worked fine I guess, then I saw they apparently charge $155 for individuals, up to $1195 for unlimited users and that locks you to a version, if you want a new version, you need to buy a new license... So per my usual, I built my own. It's smaller (tool), faster and completely cross-platform, using zstd with adjustable compression ratio, dependency checking, bundling, CI/CD updating, Delta-Updating, adding MSI compliance for managed deployments too and a few more nice to have features. I'm releasing it under Apache 2.0, so it's actually free and completely open-source, use it commercially, start the next Microsoft and release a billion copies using it, you don't owe me a penny. My reason for creating it, is like so many other times, I found that the industry gatekeeps actually making money out of software, tooling should be free, so the real products can be made, without any hidden fees. So my question to everyone is, do you need an installer? And have you been burnt in the past by hidden costs from 'open-source' releases that charge you once you hit a revenue floor?

Meme Monday! Today's cover image comes from the last thread . DEV is an inclusive space! Humor in poor taste will be downvoted by mods.