TheNote
DEV Community Note
GooglePlay AppStore

DEV Community

Dev.to is a community-driven website focused on software development, programming, and technology. It was launched in 2016 by Ben Halpern, and its main goal is to provide a platform for developers to share knowledge, learn from others, and build a community. The website features a blog-like format, where users can create and share articles on various topics, including coding tutorials, project showcases, industry insights, and more. Dev.to allows users to create accounts, follow other users, and engage with their content through comments and reactions. Dev.to has a strong focus on community engagement, with features like discussion forums, podcasts, and live streams. It also hosts a series of community-driven projects, such as coding challenges and hackathons, to encourage collaboration and innovation. In addition to user-generated content, Dev.to features a job board, where companies can post job openings and developers can search for employment opportunities. The website also offers a newsletter, which provides updates on the latest articles, news, and events. Overall, Dev.to has become a popular platform for developers to connect, share knowledge, and stay up-to-date with the latest trends and technologies in the software development industry.
DEV Community dev.to
RSS dev.to
RSS Hunter RSS Hunter • Aug 19, 2024

Thread Of Notes

Building the foundation Claudius runs on

This article details the server-side setup for a Claude-based chatbot named Claudius, focusing on its identity system, service connectivity, and deployment realities. The identity system ensures that user roles, such as admin, member, or guest, are determined solely on the server and cannot be manipulated by the client. This is achieved using Auth.js with the Google provider and a MongoDB adapter, where roles are resolved based on admin email, an allowlist, or defaulting to guest. The resolved role is then embedded in a JWT for efficient access within the application. The provisioning process also sets default values for user-specific fields and ensures the role is recomputed each sign-in.Connectivity is validated through a health check route that pings MongoDB Atlas and, optionally, makes a small call to Bedrock's Claude Haiku model. This probe verifies that the application can successfully interact with its AI backend and token usage metadata is returned. The application also defines a catalog of AI models with their respective inference profile IDs and pricing information. Environment variables are validated iteratively as needed for each development phase, with the current set including authentication, database, and Bedrock credentials.Several critical issues, or "gotchas," were encountered and resolved during this setup phase. A significant problem involved ensuring the correct database was targeted by both the Auth.js adapter and the application's database helper, as a missing database path in the connection string defaulted to an inaccessible "test" database. Connection pooling was optimized by caching the MongoDB client globally. Dependency management within a monorepo required careful attention to runtime dependencies and the inclusion of platform-specific binaries in optional dependencies for deployment. The foundation for user identity and service interaction is now established, although the core chat functionality is yet to be implemented.
https://dev.to/mongodb/building-the-foundation-claudius-runs-on-5hl5 dev.to
RSS Hunter RSS Hunter • Today

Turn Your Routine Into an Assistant: A Practical Guide to Small AI Helpers

AI should be treated as a function, not a magical genie. Treating AI like a search box for one-off queries is fine, but it's inefficient for repetitive tasks. To build a useful AI assistant, start with a single, narrow, repetitive, boring, and verifiable task. Think of prompts as function signatures, with clear inputs and structured outputs. To ensure reliable summaries, force the AI to quote supporting sentences from the source material. For data cleanup, avoid in-place changes and instead have the AI output a mapping for review. Crucially, verify AI outputs by creating a small "golden set" of correct examples. Implement cheap checks like code assertions and spot-checking to catch errors early. Only introduce agents for tasks that genuinely involve multiple steps or tool calls. Finally, iterate by incorporating successful AI outputs back into the prompt to create a predictable and reliable assistant.
https://dev.to/academy_agineai/turn-your-routine-into-an-assistant-a-practical-guide-to-small-ai-helpers-3fdh dev.to
RSS Hunter RSS Hunter • Today

DeepSeek V4 Flash API Cost: Thinking Mode Corrupts Strict JSON

DeepSeek V4 Flash has a defect in its 0731 build where integer fields in structured JSON output can be corrupted when thinking is enabled. This issue occurs specifically with strict JSON schemas and was observed in a majority of test runs. Disabling thinking, however, resolves the corruption and significantly reduces token usage. The 0731 retrain also introduced a sharper performance drop for multi-step tasks when thinking is off. The model features a cache that stores 1,024-token pages, with hits occurring quickly and entries persisting for at least 45 minutes. Pricing remains consistent at $0.14 per million input tokens and $0.28 per million output tokens, with cache hits being significantly cheaper. Compared to other V4 builds, the 0731 version is most affected by the structured output corruption. The effort dial on the API did not yield measurable differences in performance or token usage. Two-hop math, a complex task, now heavily relies on thinking being enabled for the 0731 build. The context window is substantial, accommodating large prompts, and output limits appear to be negotiable. Users requiring reliable structured output should disable thinking on the 0731 build until the defect is addressed.
https://dev.to/synthorai/deepseek-v4-flash-api-cost-thinking-mode-corrupts-strict-json-31p8 dev.to
RSS Hunter RSS Hunter • Today

MCP Explained: The Protocol Powering AI Agents

Modern AI systems can now perform complex tasks by interacting with external tools, databases, and services, giving rise to AI agents. A significant challenge arises because each application and API exposes its capabilities uniquely, necessitating custom integrations for every AI platform. The Model Context Protocol (MCP) addresses this by providing a standard way for AI models to discover, understand, and use external resources. MCP acts as a common language, allowing AI clients to discover tools, understand their functions, receive structured input, execute them, and get structured results. This protocol is crucial for AI agents that need to perform actions beyond text generation, such as interacting with GitHub, Slack, or databases. MCP involves an MCP client (the AI application), an MCP server (exposing capabilities), and the tools themselves. The process entails the AI client connecting to a server, discovering available tools, invoking a selected tool based on the user's request, and receiving a structured result. For developers, MCP offers standardized integrations, better maintainability, and improved discoverability of tools. Unlike traditional APIs that expose raw endpoints, MCP describes capabilities understandable by AI models at a higher level. While function calling allows AI to invoke predefined functions within an application, MCP provides a broader ecosystem for sharing capabilities across different AI clients. Security is paramount, with MCP servers requiring robust authentication, authorization, and validation. MCP is suitable for various use cases, including coding assistants, enterprise search, and DevOps workflows, and it complements existing APIs rather than replacing them.
https://dev.to/codexlancers/mcp-explained-the-protocol-powering-ai-agents-554k dev.to
RSS Hunter RSS Hunter • Today

Show DEV: Building Smartphone Specs API with .NET and Caddy

Integrating mobile hardware specification APIs has historically been difficult due to incomplete and unnormalized data. Raw string formats for specifications, like screen refresh rates and CPU clock speeds, are cumbersome for programming logic. To address this, the Device Specs API was developed, offering a solution to messy and unstructured data. The new API shifts the parsing burden to the backend, providing clean, strongly-typed, and normalized JSON data. This means numbers are actual numbers, booleans are booleans, and complex specifications are presented as structured arrays. For instance, battery capacity is an integer, and NFC availability is a clear boolean, not text. The API also features deep filtering, allowing users to query very specific hardware parameters via URL parameters. This enables complex searches, such as finding devices with a battery capacity over 5000 mAh, at least 8GB of RAM, from Samsung or Xiaomi, and containing "pro" in their model name. The backend is built with ASP.NET Core Web API, while the frontend utilizes a Blazor WebAssembly/Server hybrid. Caddy is used as a reverse proxy and SSL handler for its automatic HTTPS certificate management and clean configuration. The API's documentation and interactive testing are available online for users to explore and provide feedback.
https://dev.to/granturismo565/show-dev-building-smartphone-specs-api-with-net-and-caddy-38hi dev.to
RSS Hunter RSS Hunter • Today

Responding to Exposed Secrets - An SRE's Incident Response Playbook

Incident response playbooks provide structured processes to manage and minimize disruptions during crises. Before creating a playbook, define its goals, scope, and roles, ensuring clear communication and documentation channels are established. Testing and training are crucial preparation steps. Specific incident types require tailored playbooks; secret leaks present unique detection challenges compared to system outages. Unlike system failures, secret leaks may not immediately trigger obvious alerts, necessitating specialized monitoring for API usage, cloud activity, and database queries. Investigating secret leaks involves determining their full scope and impact, which can be far-reaching. Prevention of secret leaks relies on secure secret management, the principle of least privilege, code scanning, and continuous education. During an incident, containment involves isolating systems, disabling accounts, or revoking compromised secrets after assessing the blast radius. Automated processes and tools can expedite secret rotation and system updates. Deploying secrets in production requires careful strategies like blue/green deployments or canary releases to minimize downtime. Post-incident analysis is vital for identifying root causes and systemic weaknesses without assigning blame. This analysis should inform proactive measures to prevent future incidents, such as improving security practices and updating playbooks.
https://dev.to/gitguardian/responding-to-exposed-secrets-an-sres-incident-response-playbook-3pko dev.to
CdXz5zHNQW_EPwVFzBOM1.webp
RSS Hunter RSS Hunter • Today

🚀 Build an End-to-End AI Video Production Pipeline with Hermes Agent and Remotion

This tutorial showcases how to build an AI-powered video production pipeline using Hermes Agent and Remotion to create short-form vertical videos. The automated workflow automates tasks from researching trending topics to rendering a final polished video. It begins with Hermes Agent researching viral topics, selecting the discovery of methane on an interstellar comet by the James Webb Space Telescope as an example. Then, Agent generates a detailed production script including narration, storyboard, and Remotion cues. A scene-by-scene production plan is created, outlining color palettes, animation styles, and editorial direction. The workflow automatically generates AI artwork for each scene and uses Remotion to build the motion graphics video, even iteratively improving scenes. Natural AI voiceovers are added, followed by background music and sound effects for a polished feel. Animated, word-level captions are generated using Whisper for improved readability and visual appeal. This comprehensive approach allows creators to focus on storytelling rather than manual editing. The workflow is ideal for various projects like educational content, marketing videos, and social media. It offers greater flexibility than traditional video editors for developers and technical creators.
https://dev.to/vivek_shetye/build-an-end-to-end-ai-video-production-pipeline-with-hermes-agent-and-remotion-183i dev.to
RSS Hunter RSS Hunter • Today

OpenAI GPT-Live Brings Continuous Voice Conversations to ChatGPT at Scale

OpenAI has launched GPT-Live, a new generation of voice models for ChatGPT designed for more fluid, real-time conversations. Its full-duplex architecture allows the system to listen and speak simultaneously, enabling natural turn-taking, acknowledgments, and interruptions. This approach addresses the common struggles of voice interfaces with demanding interactions. GPT-Live separates the real-time conversational layer from models handling heavier tasks to avoid dis
https://dev.to/alifar/openai-gpt-live-brings-continuous-voice-conversations-to-chatgpt-at-scale-3608 dev.to
RSS Hunter RSS Hunter • Today

Using AI to Debug Code Without Losing Your Mind

Debugging complex issues with AI is most effective when you provide specific, concrete evidence rather than vague descriptions. Vague questions about application crashes will yield generic advice that is rarely helpful. Instead of describing a problem, show the AI the actual error stack, relevant code snippets, and recent git commits. Creating a small, reproducible case that consistently triggers the bug is even better. Once you provide this context, you can ask targeted questions about the specific behavior you are observing. AI struggles with ambiguity but excels at explaining precise code execution. For example, debugging a memory leak involved providing a heap snapshot and specific code snippets, leading to a quick identification of a missing map entry cleanup. Tools like Chrome DevTools for heap snapshots, clinic.js for profiling, and Node's inspect feature are invaluable for gathering this evidence. Showing git diffs and logs helps pinpoint recent changes that might be causing issues. The key is to use AI as a tool to accelerate your understanding, not as a replacement for your own debugging process. Think of AI as a tireless pair of fresh eyes that can help you analyze the evidence you provide.
https://dev.to/learnairesource/using-ai-to-debug-code-without-losing-your-mind-23if dev.to
RSS Hunter RSS Hunter • Today

I Built a PTE Core Platform While Preparing for Canada PR

A competitive CRS score is crucial for Canada PR, with language proficiency being a significant factor. Initially, IELTS and CELPIP were the main English tests, but resources lacked clear guidance on achieving high scores. The launch of PTE Core in 2024 offered a machine-scored alternative, appealing to those who prefer measurable practice. However, the PTE Core preparation landscape was underdeveloped, with most resources catering to PTE Academic and not fully relevant for immigration candidates. Recognizing this gap, the founder created Phrasel, a platform and community specifically for Canadian immigration aspirants.Phrasel focuses on PTE Core, understanding the unique goals and score thresholds for immigration, unlike generic English exams. The platform prioritizes clarity over an overwhelming volume of practice materials, aiming to identify specific areas for improvement. Its core philosophy is that learners need diagnostic feedback to guide their next steps, rather than just more questions or rigid templates. Phrasel integrates Canada PR specific tools, such as CLB conversion and CRS points, directly into its practice workflow.The platform offers exam-style practice across all four skills, with AI scoring for speaking and writing providing detailed feedback. Full-length mock tests are available, designed to pinpoint strengths and weaknesses for targeted study. Phrasel emphasizes building real language ability over relying on shortcuts or memorized templates, believing that genuine skill development leads to lasting scores. The AI scoring, while a valuable training signal, is presented honestly as a refinement tool rather than a guaranteed predictor of official Pearson scores. Phrasel's development stack includes Next.js, React, Vite, Flask, and AI services for scoring. The founder believes that clear feedback and understanding which skill is hindering progress are key to effective preparation.
https://dev.to/mohammad_tari/i-built-a-pte-core-platform-while-preparing-for-canada-pr-39b8 dev.to
RSS Hunter RSS Hunter • Today

Networking Fundamentals for Developers: The Only Concepts You Need to Get Started

This guide offers essential networking fundamentals for developers, Linux users, and cybersecurity beginners. Networks enable devices to communicate and share data, using MAC addresses for local connections and IP addresses for broader networks like the internet. DHCP servers automatically assign IP addresses, simplifying network management. Subnets divide large networks, while routers connect different networks, using default gateways to route external traffic.DNS translates domain names into IP addresses, with recursive servers finding these addresses and authoritative servers providing official records. TCP ensures reliable, ordered data delivery, ideal for web browsing and file transfers, whereas UDP prioritizes speed for applications like live streaming and gaming. Ports direct network traffic to specific services or applications on a device.ARP maps IP addresses to MAC addresses, facilitating communication within local networks. Tunneling encapsulates packets for transport across different networks. The OSI model outlines seven layers of network communication, from physical transmission to application interaction, providing a standardized framework. Various network protocols, including HTTP/HTTPS for web communication, WebSocket for real-time connections, and FTP for file transfers, govern how data is exchanged. Mastering these fundamentals is crucial for understanding modern computing and for continuous learning in the vast field of networking.
https://dev.to/hamidrezaesh/networking-fundamentals-for-developers-the-only-concepts-you-need-to-get-started-43dp dev.to
RSS Hunter RSS Hunter • Today

pgvector vs Pinecone vs Qdrant: When Is a Dedicated Vector Database Actually Worth It?

For low millions of vectors within existing Postgres setups, pgvector is an ideal initial choice, simplifying operations by keeping filters, joins, and transactions in one place. It serves as a Postgres extension, adding vector column types and ANN indexes, and is open source. Dedicated vector databases like Pinecone or Qdrant become necessary when recall, high query volume, horizontal scale, or operational hand-off become challenging with Postgres. Pinecone is a fully managed, closed-source cloud service, offering zero operational burden but incurring vendor lock-in and consumption-based pricing. Qdrant is an open-source vector database in Rust, offering self-hosting or a cloud option, with strong metadata filtering and quantization. While pgvector excels in operational simplicity and query expressiveness, it can strain under high volumes, contending with transactional workloads. The decision to switch to a dedicated vector DB usually stems from scale, query concurrency isolation, or a desire to offload operational responsibility for search. The real cost of a dedicated vector database isn't the migration itself, but the ongoing operational complexity of managing an additional system in your architecture. Therefore, start with pgvector, transition to Pinecone for managed simplicity, or choose Qdrant for a purpose-built, open-source engine with control. Always benchmark with your own data to make an informed, workload-specific decision.
https://dev.to/libme/pgvector-vs-pinecone-vs-qdrant-when-is-a-dedicated-vector-database-actually-worth-it-2d3o dev.to
RSS Hunter RSS Hunter • Today

Stop Calling Everything Impostor Syndrome: The Myth of "Just Push Harder"

The author distinguishes between impostor syndrome and genuine strategic issues that cause self-doubt. Impostor syndrome involves feeling like a fraud despite objective achievements, as illustrated by personal experiences with AI articles and conference invitations. In these instances, the brain invents explanations for perceived shortcomings. However, not all feelings of inadequacy stem from impostor syndrome. For example, being a bad runner doesn't mean one has impostor syndrome; it might simply mean a lack of talent or incorrect training methods. Giving advice like "work harder" or "keep going" for issues that are strategic, not confidence-related, can be counterproductive. An engineering approach suggests critically analyzing one's strategy rather than solely focusing on boosting confidence. This involves questioning if the time invested is yielding results and considering alternative strategies. It's crucial to differentiate between true impostor syndrome and doubts that signal a flawed approach. Sometimes, perseverance is the answer, but other times, a strategic change is necessary. Learning to make this distinction is the challenging but important part of personal growth.
https://dev.to/sylwia-lask/stop-calling-everything-impostor-syndrome-the-myth-of-just-push-harder-1dmm dev.to
RSS Hunter RSS Hunter • Today

🚦 Event Listeners, Processors, and DbContext — Pitfalls & Best Practices - .NET 10

Dependency injection in .NET requires careful consideration of service lifetimes. A common pitfall arises when a singleton service, like an EventListener, directly depends on a scoped service, such as a DbContext. Injecting a scoped DbContext into a singleton EventProcessor leads to the same DbContext instance being reused indefinitely. This stale DbContext can cause issues like outdated data and concurrency errors.A recommended practice is to keep the EventProcessor as a singleton but inject IServiceScopeFactory. This factory allows the singleton processor to create a new scope and obtain a fresh DbContext whenever it needs one. Alternatively, the EventProcessor itself can be registered with a scoped lifetime. In this scenario, a singleton EventListener would use IServiceScopeFactory to create a scope and resolve a scoped EventProcessor for each event it handles.Ultimately, the core principle is to avoid injecting scoped dependencies directly into singletons. If a singleton service requires access to a scoped service, it should obtain it dynamically through IServiceScopeFactory. Similarly, if a service necessitates a specific lifetime like "scoped," it should be registered with that lifetime and resolved appropriately. Understanding these lifetime management strategies prevents common errors associated with dependency injection.
https://dev.to/rahul1994jh/event-listeners-processors-and-dbcontext-pitfalls-best-practices-net-10-185m dev.to
RSS Hunter RSS Hunter • Today

What Happens to Your Integration When Your Payments Vendor Gets Acquired

Fintech M&A is a frequent occurrence in the UK tech scene and should be considered an engineering risk. Recent examples highlight how acquisitions can alter product trajectories and create integration challenges. Visa's acquisition of Plaid shifted focus towards enterprise terms, making onboarding more difficult for smaller businesses. TrueLayer's API migration required significant developer effort to adapt to new requirements. GoCardless's acquisition of Nordigen led to a scaled-back free tier, forcing some developers to re-evaluate their technology stack. It is statistically likely that any business relying on third-party payment APIs will encounter changes due to acquisitions or pricing shifts. To mitigate this risk, developers should build a thin abstraction layer around vendor SDKs, insulating their core business logic. Storing a canonical payment state in their own database is crucial for maintaining data integrity during vendor changes. Observing early signals like scaled-back free tiers or slower support can indicate impending platform shifts. Budgeting speculative migration time into roadmaps allows for quicker adaptation to unsolicited changes. Ultimately, acknowledging vendor API business risks and creating architectural distance is essential for resilience.
https://dev.to/stella_penso/what-happens-to-your-integration-when-your-payments-vendor-gets-acquired-2kcg dev.to
RSS Hunter RSS Hunter • Today

How I Built ToolHub: A 138-Tool Static PWA That Stays Sub-Second

The author recently published a full architecture retrospective on building ToolHub, a suite of 138 in-browser web utilities that prioritize cleanliness, privacy, and zero bloat. The site is designed to be sub-second fast and fully offline-capable, with key engineering tradeoffs and technical decisions that enable these features. One of the key architectural highlights is the use of Next.js Static Export, which allows for a 100% static export model hosted on edge CDN, resulting in zero server maintenance and ultra-low time to first byte. This approach also enables infinite scaling, but requires that all dynamic content execute strictly on the client side in browser memory. The author also implemented a custom Service Worker caching strategy, which includes stale-while-revalidate for static assets and network-first for HTML document navigations, ensuring complete offline capability across all tools once cached. Additionally, the author developed a programmatic SEO engine that generates static tool pages with full JSON-LD structured data and automated internal linking meshes, all baked into static HTML at build time. The site also features a zero-CLS ad strategy, which prevents layout shifts by reserving explicit fixed-height layout slots for ad units before they load. The author has made the ToolHub site available for users to try, and has also published a full engineering deep-dive on their blog, where they share more details about the technical decisions and tradeoffs that went into building the site. The author is seeking feedback and suggestions from users, and is open to hearing thoughts on the architecture and ideas for new tools. Overall, the ToolHub project demonstrates a range of innovative technical approaches to building fast, offline-capable, and privacy-first web applications.
https://dev.to/axtrivc/how-i-built-toolhub-a-138-tool-static-pwa-that-stays-sub-second-2eno dev.to
RSS Hunter RSS Hunter • Today

Most system design interviews focus on diagrams. Real systems fail because of trade-offs.

The author observes a common problem in system design discussions: an overemphasis on diagrams and a lack of focus on the crucial trade-offs that drive architectural decisions. They pose several fundamental questions, such as balancing consistency versus availability and weighing the benefits of monoliths against microservices. The author also highlights the complexities of event-driven architectures and the acceptable latency for improved scalability. Another key area of concern is when to judiciously avoid or implement caching strategies. These decisions, the author argues, significantly impact production systems more than the visual representation itself. They recently published an article that delves into these real-world architectural trade-offs using practical examples. The author is actively seeking feedback from experienced architects and backend engineers on their insights. They are particularly interested in hearing opposing viewpoints or alternative perspectives. The core question for the community revolves around a single architectural trade-off that profoundly reshaped their approach to designing distributed systems.
https://dev.to/logicallayers/most-system-design-interviews-focus-on-diagrams-real-systems-fail-because-of-trade-offs-2097 dev.to
RSS Hunter RSS Hunter • Today

Nothing throws when redaction fails

Redacting PII effectively requires careful pipeline design, as models often fail silently. Initializing with a rule-based pass before involving a model can worsen outcomes by creating unnatural token patterns that confuse the model. Instead, run both semantic and structural passes independently on the original text, then reconcile the results, ensuring structural offsets remain valid and filtering out low-confidence date detections from the structural pass.Markup in enterprise documents can garble model outputs; extract plain text, redact, and then re-insert into the original structure to improve recall significantly. Implement refusal detection for models that decline redaction, falling back to structural passes and logging these instances to inform prompt adjustments.Crucially, design the system to "fail closed" rather than "fail open" to prevent data leaks when redaction calls time out, treating structural passes as a degraded path and alerting on such events. Version control prompts by logging model ID and prompt hash with every redaction to track performance changes over time.For co-reference in redacted text, use numbered placeholders instead of generic tags, but be aware that the resulting mapping table is also PII and requires appropriate security, or discard if reversibility is not needed. To measure precision, create a canary set of PII-free documents and run it with every change; any redactions in this set signal regressions.When scaling, move beyond a single model by building a routing interface that directs requests to different models based on caller constraints like latency, residency, or language, with the structural pass always serving as a universal fallback. Implement careful caching strategies for prompts longer than 1,024 tokens to optimize cost and throughput. The recommended build order involves extracting text, running independent semantic and structural passes, filtering dates, injecting structural findings, substituting back into markup, detecting refusals, and logging essential metadata, all while continuously testing with a canary set.
https://dev.to/vidanov/nothing-throws-when-redaction-fails-43o9 dev.to
CdXz5zHNQW_YNDXntIFNX.webp
RSS Hunter RSS Hunter • Today

How to Fix CORS Errors in React: The Practical Guide (With Real Solutions)

When building a React app, developers often encounter a CORS error when making API requests. This error occurs because the browser's security policy prevents requests from one origin to another without proper authorization. The most robust solution is to configure the backend application to send the Access-Control-Allow-Origin header. This header specifies which frontend domains are allowed to access the API.For Node.js with Express, this involves using the cors middleware and configuring it to accept specific origins. Similarly, Laravel and Python with Flask offer ways to set these headers directly or through libraries like flask-cors. If direct backend modification is not possible, a proxy can be used during local development. By adding a "proxy" field to the package.json file, the React development server can forward requests to the API. This bypasses CORS restrictions because the browser perceives the request as same-origin.However, this proxy solution is only effective in development and will not work in production. A temporary, less-recommended workaround involves using a public CORS proxy service, but this introduces latency, potential rate limits, and security concerns. If the API requires authentication, such as cookies or JWT tokens, both the frontend fetch request and the backend configuration must be updated to include credentials. Frontend requests need credentials: 'include', and the backend needs credentials: true.Debugging CORS issues involves checking for the presence and correctness of the Access-Control-Allow-Origin header in the network tab of browser developer tools. If preflight requests (OPTIONS) are failing, the backend may not be properly configured to handle them. Ultimately, most CORS errors stem from backend configuration issues, not frontend code. Understanding the environment, frontend, and backend frameworks is crucial for effective debugging.
https://dev.to/blogs_world/how-to-fix-cors-errors-in-react-the-practical-guide-with-real-solutions-33p9 dev.to
RSS Hunter RSS Hunter • Today

Structured authoring without XML - how it works

Structured authoring creates content from reusable semantic building blocks, a concept formalized by DITA XML. Topicary implements these principles without requiring XML knowledge. A core feature is content components, which are written once and can be reused across multiple topics. Updating a component automatically propagates changes to all its references. Users can easily save any block of text as a component using a simple command. Components offer robust "where-used" tracking, allowing authors to assess the impact of edits. Conditional content enables a single topic to be tailored for different audiences by tagging blocks with specific conditions. Authors can preview these conditional views directly within the editor for immediate feedback. Variables streamline content management by allowing single-point updates for recurring elements like product names or version numbers. Topicary supports importing content from various formats, including Markdown, DITA, and MadCap Flare, preserving existing structures and features.
https://dev.to/kuzin/structured-authoring-without-xml-how-it-works-4i1e dev.to
RSS Hunter RSS Hunter • Today

Microsoft Agent Framework Advances to Production-Ready Runtime

Microsoft's Build 2026 announcement focuses on their Agent Harness and Foundry Hosted Agents, now in General Availability. This signifies a shift in how AI agents are perceived and built for production. Research indicates that approximately 98.4% of an agent system is infrastructure, not the AI model itself. The Agent Harness provides this crucial operational core, handling tasks like function invocation, context management, and tool routing. Foundry Hosted Agents offers this harness as a managed, consumption-billed service, simplifying deployment.The Agent Harness addresses common production bottlenecks like wiring agents to tools and persisting conversation history. Microsoft's core bet is that this harness infrastructure, not the interchangeable AI model, is the true product. The harness includes features like function invocation with history, context compaction, a plan-and-execute todo list, file memory, and built-in OpenTelemetry for observability. This ensures that every action, from tool calls to approval decisions, is traceable.Foundry Hosted Agents eliminates the need for complex YAML configurations by providing a managed deployment where users supply only the chat client, instructions, and tools. This managed service shares the same core logic as the locally runnable harness, ensuring consistent behavior across development and production environments. The framework also introduces connectors for GitHub Copilot and the Claude Agent SDK, allowing for model swaps without altering the harness. This unified governance policy plane ensures consistent approval rules and audit trails across different underlying AI models. The durable layer of the agent system, encompassing approval gates, history, and policy enforcement, is highlighted as the key area for engineering investment. Microsoft's offering positions the harness as a stable, supported product, enabling developers to focus on building adaptable applications.
https://dev.to/davekurian/microsoft-agent-framework-advances-to-production-ready-runtime-415d dev.to
RSS Hunter RSS Hunter • Today

Spring AI Prompt Caching and Chat Memory: Where the Tokens Go — LLM Cost Control 2/4

This section focuses on controlling costs associated with output, conversation history, and repeated static content in AI models. Output and reasoning tokens are significantly more expensive than input tokens, with some models costing up to eight times more for output. Reasoning processes can generate hidden "thinking" tokens that also incur higher output rates. Spring AI offers controls like maxTokens for provider-independent length limits and provider-specific settings to manage reasoning effort. Conversation history, which involves resending the entire chat log with each request, drives up input token costs rapidly. Storing and resending history means even small conversations can lead to substantial token usage over time. Spring AI provides MessageWindowChatMemory to manage conversation history by using a sliding window of a specified number of messages. For very long sessions, VectorStoreChatMemoryAdvisor offers an alternative by storing history in a vector store and only retrieving relevant messages. Repeated static content, such as system prompts or tool definitions, is charged on every request without caching. Prompt caching reduces these costs by storing processed prompt prefixes for reuse. Anthropic and AWS Bedrock allow users to specify caching strategies, while OpenAI caches prompts automatically for requests over a certain token count, though cache writes now incur a fee. Local models like Ollama use caching to improve speed by saving GPU processing time, but there are no per-token charges to reduce. Explicit planning for caching and managing cache keys is crucial for cost optimization with these models.
https://dev.to/julia_denysova/spring-ai-prompt-caching-and-chat-memory-where-the-tokens-go-llm-cost-control-24-36i dev.to
RSS Hunter RSS Hunter • Today

Six weeks ago Google had indexed 4 of my pages. It just hit 115. I changed almost nothing

Six weeks ago, the author noted that only 4 out of 122 pages on their new domain, tamethebot.com, were indexed by Google. They attributed this to a crawl-budget limitation on a young domain lacking backlinks, rather than technical issues. A recent update shows a significant improvement, with 115 pages now indexed and only 14 remaining unindexed. The author's initial prediction about the crawl-budget issue proved correct, as the "Discovered - currently not indexed" category dropped to zero.Crucially, almost no changes were made to the website's content during this period; new pages were added at the same rate, and a single experimental "deep" page performed no better than average. The key change that coincided with increased indexing was the publication of the author's previous post, which successfully garnered two dofollow backlinks to the homepage and sitemap. While not definitively provable, this backlink, along with domain aging and regular recrawling, provided Google with a reason to allocate more budget.The author did admit to one technical error: their IndexNow deployment hook was silently failing for weeks, though this did not affect Google's indexing as IndexNow primarily serves Bing and Yandex. The increase in indexed pages has translated into a substantial rise in organic Google sessions, from a small baseline. However, the author cautions that some tracked "active users" are actually data centers, not real humans.In an unexpected turn, while Google's indexer approved the pages, Google AdSense rejected the same content for "low value content" twice. The author acknowledges that the indexer's criteria (is this a real page a searcher might want?) differ from AdSense's (is this a site with enough depth and traffic for an ad business?). The author's next steps involve continuing to write publicly to gain approval from both Google's indexer and AdSense.
https://dev.to/tamethebot/six-weeks-ago-google-had-indexed-4-of-my-pages-it-just-hit-115-i-changed-almost-nothing-2idl dev.to
RSS Hunter RSS Hunter • Today

Best Free Web Application Firewalls Compared (2025)

This text compares various Web Application Firewall (WAF) solutions, categorizing them by type and deployment method. SafeLine Community is a self-hosted reverse proxy deployed via Docker. Cloudflare Free is a cloud-based edge proxy requiring DNS changes. CrowdSec WAF is a module-based self-hosted option, and ModSecurity integrates as a server module. BunkerWeb is an NGINX-based self-hosted solution.In terms of detection, SafeLine and ModSecurity show comparable rates, but ModSecurity has significantly more false positives. Cloudflare Free's detection rate is very low, functioning more as a CDN. CrowdSec and BunkerWeb's performance depends on their underlying rule sets.Several free WAFs offer unlimited custom rules, unlike Cloudflare's restrictive free tier. Bot protection and country blocking are generally stronger in self-hosted options. SafeLine stands out for its simple one-command setup and out-of-the-box functionality. Cloudflare is easy but offers less detection and collects user data.CrowdSec and ModSecurity require more complex setup, with ModSecurity needing extensive tuning. A WAF is recommended for any public-facing website or API. Free WAFs are generally sufficient for personal projects and small businesses, especially when paired with other services.For production environments requiring SLAs and advanced features, paid WAFs are necessary. Free tiers typically lack dedicated support and advanced logging, though detection quality can be similar to paid versions. SafeLine Community and CrowdSec are highlighted as genuinely free options with no hidden costs. Plugin WAFs are less effective than reverse-proxy WAFs as they inspect traffic later. Regular updates are crucial for maintaining WAF effectiveness.
https://dev.to/lialiago/best-free-web-application-firewalls-compared-2025-1l1n dev.to
RSS Hunter RSS Hunter • Today

Building Reliable UDP

TCP is the standard for reliable networking, but UDP offers more control for specialized applications. UDP itself is unreliable, sending packets without guarantees of delivery or order. Many high-performance systems like games and streaming services opt for UDP because it allows developers to build custom reliability mechanisms. This is achieved through an engineering pattern, not a separate protocol, by adding metadata to UDP packets. Key components include sequence numbers to track packets and acknowledgements to confirm receipt. Retransmission timers initiate resends if packets are lost, while duplicate detection handles redundant packets. Packet ordering mechanisms ensure data arrives in the correct sequence for the application. A sliding window allows for multiple outstanding packets, improving throughput. Connection setup, though not inherent to UDP, can be implemented for session management. Heartbeats are used to verify ongoing connections. Congestion awareness is crucial for respecting network capacity. Ultimately, by combining these engineered components, UDP can be transformed into a dependable transport layer tailored to specific application needs, as seen in protocols like QUIC. Reliability in engineering often arises from multiple simple mechanisms working together, rather than a single complex feature.
https://dev.to/derekmwale/building-reliable-udp-51ei dev.to
RSS Hunter RSS Hunter • Yesterday

Nineteen Subdomains, One Allowed IP

A wildcard DNS record enables easy service publishing by automatically resolving any subdomain to a single IP address. Nginx Proxy Manager (NPM) simplifies publishing further, requiring only a few fields to expose services securely with HTTPS. This automation led to the creation of nineteen proxy hosts, all running self-hosted software with varying authentication methods. The core problem identified is that the ease of publishing bypasses critical security decisions about access control.The author's goal was not to hide services entirely but to make them accessible only from a private network built on public infrastructure. The wildcard DNS record, while simplifying setup, does not inherently provide security. NPM uses HTTP-01 challenges for Let's Encrypt certificates, necessitating port 80 to remain open, which is a security vulnerability. A wildcard certificate via DNS-01 would allow port 80 to close but requires granting write access to the DNS zone.Services are published by placing their containers on a shared Docker network, allowing NPM to proxy requests internally. This means services do not need to expose ports directly to the host, enhancing security. A self-hosted proxy gateway on the same VPS routes traffic back to NPM, appearing as inbound HTTPS from the VPS’s public IP. This gateway's behavior, initially mistaken for a routing fault, is integral to the security design.NPM enforces access control using Nginx configuration blocks that allow requests only from the gateway's internal Docker IP or the VPS's public IP, followed by basic HTTP authentication. This ensures that even though services are publicly resolvable and have valid certificates, access is restricted. A specific location for Let's Encrypt challenges remains open to the internet, as required for certificate validation. Two critical hosts, the gateway's admin panel and a config distribution endpoint, are exceptions to the strict access control, as they need to be accessible before full gateway integration.A significant issue arose when a service, which baked its server address into user connection profiles, mistakenly advertised the wrong address. Because NPM forwards the real client IP via the X-Forwarded-For header, the service interpreted this header as its own public address, leading clients to connect to the wrong server. This bug was hidden because the author's own testing, using the gateway, always presented the correct expected address. TLS termination occurs at NPM, with traffic between NPM and backend containers transmitted as unencrypted HTTP over the Docker network.
https://dev.to/jeromefromhk/nineteen-subdomains-one-allowed-ip-3fk5 dev.to
RSS Hunter RSS Hunter • Yesterday

Giving Claude access to your Telegram: the two setups, and why the difference matters

You can connect AI agents to Telegram using an MCP server, but there are two distinct setups with significant security implications. The first type uses a Bot API token, authenticating as a bot. This bot can only access chats it's explicitly added to, and its access is limited and easily revoked. It cannot see private messages or chats where it hasn't been invited.The second type uses an MTProto server, which authenticates with your phone number and logs in as you. This grants the agent access to all your Telegram data, including private messages, groups, saved messages, and contacts. This is achieved by creating a session file that represents a live login.Setting up the Bot API or notifier involves providing a bot token and potentially a chat ID. The MTProto setup requires installation and an interactive login using your API ID and API hash. The location of the configuration file varies significantly depending on the AI client being used, and some clients, like Codex CLI, use a different configuration format (TOML).The primary concern with MTProto servers is that the session file provides full access to your account. This session file should never be stored in synced folders or committed to code repositories. Furthermore, because AI agents treat both data and instructions as text, a malicious message could be crafted to exploit the agent's ability to send messages, posing a security risk.The blast radius of a Bot API token is limited to the chats the bot is in, while an MTProto session file compromises your entire account. MTProto servers are not inherently unusable but require deliberate consideration and should ideally be used with a secondary account to mitigate risks. It is crucial to review the code of these community-developed MCP servers before connecting them to important accounts.
https://dev.to/starsearn/giving-claude-access-to-your-telegram-the-two-setups-and-why-the-difference-matters-3mej dev.to
RSS Hunter RSS Hunter • Yesterday

RAG Cost Estimates: Token Counts, Embeddings, and Node.js Semantic Search

To control RAG costs for a semantic search app, batch document indexing and estimate token spend before rollout. Only send the top retrieved chunks to the chat model for answer generation. A useful token cost estimate should separate embedding input during indexing, retrieval-time operations, and answer generation input and output. Estimating goes beyond simple token counts; it involves evaluating chunk size, overlap, and the top-k setting, as these directly impact prompt length and cost. Practical estimation begins with representative documents and real user questions to calculate token totals for various chunking strategies. Recall is crucial; a lower chunk count is only beneficial if the most relevant passage is still retrieved. Reranking can improve context ordering, allowing fewer chunks to be sent to the chat model.Indexing should be treated as a separate batch job from the user-facing request path. This prevents high ingestion volumes from leading to unexpected prompt bills. Retries during document indexing require idempotency keys or client-supplied identifiers to avoid duplicate data. Before optimizing prompts or models, it is essential to make the document distribution visible and identify oversized chunks. Using provider-specific token counting calls with appropriate backoff and retry strategies is key for accurate estimates.Batch indexing offers benefits for large backfills by allowing for job monitoring and audit trails, keeping uploads separate from embedding creation. It is important not to blur retry policies between polling batch jobs and idempotent write operations. While batch indexing isn't ideal for immediate searchability, a small synchronous path can handle that need. The choice of RAG stack components, like OpenAI, Anthropic, Google Gemini, Pinecone, Weaviate, or Infrai, depends on existing workflows and team priorities. Migration should only occur if it genuinely improves the system, not just for marginal cost savings. Ultimately, the code must deliver grounded answers, and a clean cost estimate is meaningless with weak retrieval.
https://dev.to/tony_chen_2026/rag-cost-estimates-token-counts-embeddings-and-nodejs-semantic-search-45eo dev.to
RSS Hunter RSS Hunter • Yesterday

I priced distribution for an autonomous AI agent. None of the paths close at SMB ARPU.

This post addresses the distribution constraint for autonomous AI companies, arguing it's a significant hurdle without a clear roadmap. Paid acquisition through platforms like Meta Ads is prohibitively expensive for SMBs, with customer acquisition costs vastly exceeding customer lifetime value when factoring in inference and data expenses. The math simply does not close for autonomous agents at typical SMB subscription rates.Cold outreach channels, once a workaround, are increasingly closing to automated, high-volume messaging. Social media platforms are implementing stricter policies against AI-generated spam, making it difficult for agents to send outbound messages programmatically. LinkedIn and Reddit have TOS and behavioral filters that actively penalize automated outreach. Cold email deliverability also suffers due to shared domains and potential blacklisting from a single customer's misuse.The remaining viable distribution channels require human involvement, including content marketing, SEO, community building, founder-led branding, and partnerships. These methods demand consistent effort, judgment, taste, and relationship-building over extended periods. Autonomous agents, by their nature, struggle to execute these inherently human-centric strategies, especially at the early stages of a company's growth.The author contends that while inference costs are decreasing and data acquisition methods are improving, distribution remains a fundamental challenge for autonomous AI. There is no easy "build" or "wait" solution for scaling distribution autonomously. The thesis holds true for specific niches like consumer apps with established paid acquisition or embedded solutions, but not for the general "AI runs your company" vision.Ultimately, true leverage in AI for SMBs lies not in full automation, but in automating the repetitive "grind" of distribution while human judgment guides the process. The author's company, Thread Otter, aims to provide an autopilot that assists in finding and engaging with existing demand, drafting responses in the user's voice, and automating the laborious aspects of outreach, allowing humans to focus on the compounding input of judgment. This approach acknowledges that distribution cannot be manufactured autonomously but can be discovered and managed with human oversight.
https://dev.to/threadotter/i-priced-distribution-for-an-autonomous-ai-agent-none-of-the-paths-close-at-smb-arpu-53kc dev.to
RSS Hunter RSS Hunter • Yesterday

Building a CLI tool with Python(Click)

This piece describes Penny, a simple command-line expense tracker built with Python and the Click library. Penny allows users to add, list, summarize, and clear expenses directly from their terminal without needing a web interface or database. The author chose Click over Python's built-in argparse for its more intuitive, decorator-based approach to defining commands and options.The project is structured into three main files: commands.py for individual command logic, penny.py to group these commands into a single CLI tool, and pyproject.toml for packaging and defining the entry point. Penny stores expense data in a plain JSON file named expenses.json, reading and writing to it for each operation. The add command creates the JSON file if it doesn't exist, appends new expenses, and saves the updated list, providing colored confirmation.The list command displays saved expenses in a tabular format, offering a warning if no expenses are found. The summary command calculates and prints spending totals by category and a grand total, outputting the results as formatted JSON. The clear command includes a confirmation prompt before overwriting the expenses.json file with an empty list.The penny.py file uses Click's group functionality to consolidate all commands under a single penny executable. The pyproject.toml file configures this grouping, making Penny a globally installable command-line tool via pip install .. The author highlights the benefits of Click's declarative style, the suitability of JSON for simple data storage, the importance of small user experience details, and how command grouping elevates a script into a polished CLI application.
https://dev.to/jib2004/building-a-cli-tool-with-pythonclick-26j5 dev.to
RSS Hunter RSS Hunter • Yesterday

Twelve gradients, one id - DHSeaDev

A subtle markup defect involved twelve identical SVG gradients, each defined with the same ID. This resulted in eleven of the twelve gradient definitions being unused, while all visual elements incorrectly referenced the first definition. The page appeared visually correct because all duplicate gradients had identical color stops. This invisibility meant standard site audits, including the author's own five passes, failed to detect the issue. The problem remained hidden until a gradient definition was changed, potentially affecting the wrong element or no element at all. A crucial audit check for duplicate IDs was missing because it had never caused a visible problem before. An initial fix attempt that sequentially renamed IDs created a more severe, visible bug by pairing the wrong definitions with references. This oversight was prevented by a count assertion, which flagged an imbalance between definitions and references. The correct solution scopes ID renames to individual SVG blocks, ensuring definitions only match references within their own scope. This experience highlights the importance of auditing for duplicate IDs, especially with inline SVGs, and verifying find-and-replace operations meticulously.
https://dev.to/dhardingsea_developer_0df/twelve-gradients-one-id-dhseadev-3j5p dev.to
RSS Hunter RSS Hunter • Yesterday

Why Every Developer Should Start Writing (Even If Nobody Reads It)

Writing is an integral part of a software engineer's career, extending beyond just code. Every developer writes commit messages, variable names, bug reports, and documentation, making it a fundamental skill. The true benefit of writing, particularly technical articles, lies not in external readership but in personal growth and improved engineering abilities. Writing forces structured thinking, thereby exposing gaps in one's understanding and acting as a rigorous test of knowledge. Documenting experiences transforms fleeting lessons into enduring knowledge, acting as the highest form of learning.Experienced engineers recognize that excellent documentation accelerates progress and reduces technical debt, creating maintainable knowledge for teams. Platforms like LinkedIn and personal blogs offer opportunities to showcase professional growth and build a durable, searchable knowledge base. This practice of writing creates a "second brain," an external memory that aids future problem-solving and makes technical interviews more natural. Developing a personal brand through writing demonstrates expertise and trustworthiness, proving invisible expertise through visible proof.It is crucial to start writing early, even without expertise or an audience, as growth precedes recognition. The compound effect of consistent writing builds a valuable professional legacy over time. Ultimately, while code builds products, writing builds the engineer behind them, fostering a career that is remembered for both technical skill and thoughtful communication.
https://dev.to/rjshree/why-every-developer-should-start-writing-even-if-nobody-reads-it-48il dev.to
RSS Hunter RSS Hunter • Yesterday

Docker Proves Your App Runs. Kubernetes Proves It's Operable.

The author describes a common debugging scenario where a service is down in Kubernetes despite all technical indicators appearing healthy. This occurs because Docker verifies an application runs, while Kubernetes verifies it is operable. Docker's simplicity hides four critical questions an application must answer in a production environment. The first question is whether the application can be found by name, not just by address, as localhost in a Kubernetes pod refers only to the pod itself. Secondly, applications must be able to handle being cleanly killed by an external system by properly responding to signals like SIGTERM. The third crucial aspect is proving readiness before receiving traffic, as Kubernetes actively probes application health from the moment it starts. Finally, applications need to function without relying on local disk persistence, by using Kubernetes's mechanisms for configuration and storage. Understanding these four questions helps demystify why applications behave differently in Docker and Kubernetes. The author provides examples of how failing to address these points can lead to common production issues. This explanation is not an argument against Kubernetes, but rather an exploration of the operability debt that Docker allows teams to accumulate.
https://dev.to/arbythecoder/docker-proves-your-app-runs-kubernetes-proves-its-operable-439i dev.to
RSS Hunter RSS Hunter • Yesterday

Practice Real-World Testing Scenarios for QA: Challenge 3 - Visual Testing with API Mocking

The author performed visual testing for several applications, including a dashboard with a missing chart, a transportation app showing vehicle status on a map, and a service app for marking tree locations. Visual testing helps detect UI failures early, especially when the UI is stable. Playwright offers free visual testing capabilities, unlike paid tools like Applitools and Percy. A key challenge involves visually testing an Accounts Receivable dashboard where the "Average Days Late" metric fluctuates daily. Testing across multiple languages, including English, Spanish, German, and Japanese, also presents a challenge due to varying text lengths. Additionally, integrated API testing without mocking is required to verify data accuracy. When dynamic values affect visual consistency, testing strategies include masking the dynamic area or mocking the API to return predefined values. The provided links offer a website and APIs for testing these scenarios. The author encourages sharing repositories and asking questions upon completion of the challenge.
https://dev.to/abigail_armijo/practice-real-world-testing-scenarios-for-qa-challenge-3-visual-testing-with-api-mocking-5f6i dev.to
RSS Hunter RSS Hunter • Yesterday

Building Deterministic Multi Agent Workflows with LangGraph

The use of autonomous agents in business processes can be unpredictable and lead to chaotic execution loops, which can be problematic when dealing with high-stakes operations such as commercial contracts or regulatory compliance filings. To address this issue, a structured framework that enforces rigid rules while preserving cognitive flexibility is necessary. LangGraph is an orchestration framework that enables the building of deterministic multi-agent workflows, which can turn unpredictable AI behavior into reliable, state-machine-driven business processes. LangGraph models agent interactions as nodes and transitions as edges, allowing for the implementation of cyclic paths and self-correction. This architecture ensures that every node has access to the accumulated context, and any modifications to the state are explicitly tracked and validated. By using LangGraph, enterprises can build resilient, self-correcting systems that behave predictably even when dealing with highly variable LLM outputs. LangGraph is particularly useful for building strict, auditable business workflows, and its state-first approach ensures that developer-defined rules always take precedence over agent autonomy. Implementing deterministic agent workflows can directly impact operational efficiency, risk profiles, and bottom-line growth, as seen in examples such as commercial insurance underwriting, healthcare revenue cycle management, and supply chain customs brokerage. By using LangGraph, businesses can reduce the risk of errors, improve efficiency, and increase productivity, ultimately leading to cost savings and revenue growth. Overall, LangGraph provides a robust solution for building deterministic multi-agent workflows, enabling businesses to automate complex processes while maintaining control and predictability.
https://dev.to/muhammad_aslam_ff65e35553/building-deterministic-multi-agent-workflows-with-langgraph-4m0i dev.to
RSS Hunter RSS Hunter • Yesterday

Qwen3.8-Max Just Went GA: A Developer's Guide to Alibaba's 2.4T Model

Alibaba has released Qwen3.8-Max, a powerful 2.4 trillion parameter Mixture-of-Experts model. This model features a 1 million token context window and supports text, image, and video inputs. Its API is compatible with OpenAI and Anthropic protocols, easing integration for developers. Pricing is set at $2 per million input tokens and $6 per million output tokens. A significant cost-saving factor is the reduced price of cached input tokens, emphasizing the importance of stable prefixes in prompts.The model's naming convention distinguishes generations from point releases, with Qwen3.8-Max being the latest flagship. While it boasts 2.4 trillion total parameters, only approximately 95 billion are active per token, making inference more efficient. The effective context window is around 991K tokens, with a maximum output token limit of 131K. Developers can utilize its OpenAI-compatible API by updating the base URL and model name.Alibaba's DashScope SDK provides an example of its multimodal capabilities with a code snippet. The model supports various features including function calling and structured outputs, and comes with five built-in tools. Benchmarks show strong performance in multimodal and agentic tasks, though some areas lag behind competitors like Claude 3.5. Open weights are expected to be released soon, along with a smaller 27B parameter version.Currently, a formal model card with detailed training data and safety evaluations is missing. The licensing terms for commercial use will only be clear once the open weights are released. The active parameter count is reported but not yet officially confirmed by Alibaba. Despite these missing pieces, Qwen3.8-Max is recommended for multimodal applications, long-context tasks, and existing OpenAI/Anthropic protocol users.
https://dev.to/arshtechpro/qwen38-max-just-went-ga-a-developers-guide-to-alibabas-24t-model-ff3 dev.to
RSS Hunter RSS Hunter • Yesterday

Tokens por Segundo: Cómo medir y optimizar la velocidad en modelos de IA

La latencia es un desafío crucial al implementar modelos de lenguaje e IA en producción. Ignorar el rendimiento computacional, centrándose solo en la precisión, es un error. La velocidad, medida en tokens por segundo, se ha vuelto una métrica arquitectónica esencial. Esto se debe a que las aplicaciones críticas necesitan respuestas rápidas, especialmente en finanzas y salud. Optimizar el rendimiento de los modelos también conduce a una menor utilización de GPUs y, por ende, a facturas de nube más bajas. Técnicas como el uso de arquitecturas ligeras, la cuantización y el procesamiento por lotes ayudan a mejorar la velocidad sin sacrificar la precisión. Se presenta un ejemplo práctico en Python para medir la velocidad de los modelos en tokens por segundo. Un objetivo de aproximadamente cien tokens por segundo es una buena referencia para interacciones humanas en tiempo real. Los pasos para optimizar incluyen establecer un benchmark inicial, implementar procesamiento por lotes y evaluar modelos destilados o cuantizados. La comunidad comparte herramientas y librerías para el profiling y benchmarking de modelos de IA.
https://dev.to/pivelcode/tokens-por-segundo-como-medir-y-optimizar-la-velocidad-en-modelos-de-ia-46h5 dev.to
RSS Hunter RSS Hunter • Yesterday

I Built an Open-Source AI Agent That Actually Controls Your Computer

AI agents are prevalent but struggle with real-world computer interactions. Existing autonomous agents often fail by declaring tasks complete prematurely, losing context in multi-step workflows, or lacking desktop environment integration. HeyAgent aims to address these issues by acting as a true assistant rather than a simple Large Language Model wrapper. This open-source agent can control desktop applications, interact with browsers, manage files, run terminal commands, and connect to external services. HeyAgent differentiates itself by planning, executing, validating outcomes, and only then confirming task completion to reduce false positives. The project received significant acceleration and support from AWS, which provided crucial cloud infrastructure and computing resources. HeyAgent is built on a model-agnostic tech stack using TypeScript and Node.js, supporting both cloud and local LLMs. Being open-source allows developers to inspect its reasoning, build tools, and contribute improvements. Future development will focus on enhanced planning, more robust desktop automation, and an expanded plugin ecosystem. The team welcomes feedback, ideas, bug reports, and contributions to the project.
https://dev.to/safiyevmarat/i-built-an-open-source-ai-agent-that-actually-controls-your-computer-51a6 dev.to
RSS Hunter RSS Hunter • Yesterday

A Chinese Name Generator Tool

A colleague's poor experience with a random Chinese name generator inspired the author to build a superior one. Existing generators focus solely on sound, neglecting crucial elements like meaning, tone, and cultural significance, which can lead to comical or inappropriate name pairings. Chinese naming traditions incorporate factors beyond phonetics, including stroke count, elemental classifications, and historical usage, all of which are vital for a name to be well-received. Research indicates that a significant portion of people still consider stroke count numerology when choosing names, a practice largely ignored by current tools. The author's project prioritized accuracy by creating a meticulously verified database of Chinese characters. Each character underwent rigorous checks, including cross-referencing with the Kangxi Dictionary for definitions, verifying legitimacy against the Hundred Family Surnames, and consulting onomastic research. This verification process, rather than simple character combination, constitutes the core of the project. The author emphasizes that preventing accidental clashes in meaning or cultural weight is the true challenge in Chinese name generation. The developed tool provides seven verified data points for each generated name. These data points include the characters themselves, their Pinyin pronunciation, stroke count, elemental classification, lucky number, lucky color, and a harmony score. This score is derived from the established sāncái wǔgé framework, a traditional Chinese naming system.
https://dev.to/karma_digitalsolutions_c/a-chinese-name-generator-tool-3667 dev.to
CdXz5zHNQW_UgBCzhzMEb.webp
RSS Hunter RSS Hunter • Yesterday

Untitled

The A2A protocol currently lacks a mechanism to verify the authenticity of an Agent Card. When one agent retrieves another's Agent Card, it only reads metadata without any cryptographic proof of identity. This leaves agents vulnerable to impersonation, as anyone can create a fake Agent Card claiming a specific role. The protocol delegates identity verification to external, often manual, processes. While transport-layer security like mTLS secures the communication channel, it doesn't authenticate the agents themselves.To address this, a public key needs to be bound to the Agent Card, and critical fields must be signed. A verification step, similar to how HTTPS operates, is essential before any agent interactions occur. A manual workaround involves storing a public key in the extensions field and manually verifying message signatures. However, this approach is fragile, relies on inconsistent conventions, and can be exploited by malicious actors.The A2A specification requires a dedicated identity field in the Agent Card. This field should include a public key and a reference to its issuer, such as a Decentralized Identifier (DID). A signature scheme should be defined for the canonical JSON representation of the card. Crucially, verification of this identity must be a mandatory part of the A2A handshake.This proposed solution involves fetching the issuer's public key, verifying the card's signature, and checking for revocation status. This process ensures that the agent's card is trusted by a verifiable issuer and has not been compromised. Without this standardized solution, the current trust model in agent-to-agent communication remains a significant vulnerability, especially as agents begin to handle sensitive data and transactions.
https://dev.to/tracepilot_2841f1db6718a1/untitled-3a63 dev.to
RSS Hunter RSS Hunter • Yesterday

EU AI Act Voice Watermarking: What TTS Builders Must Know

The EU AI Act's voice watermarking rules, effective August 2, 2026, mandate machine-readable marking for AI-generated audio. Failure to comply risks fines up to EUR 15 million or 3% of global turnover. Providers of AI systems creating synthetic audio, including text-to-speech and voice clones, must ensure their output is detectable as artificial. The law emphasizes an outcome-based approach, requiring effective, interoperable, robust, and reliable marking where technically feasible. A layered approach, combining inaudible watermarks with signed metadata, is becoming common. AI systems interacting with humans must also disclose their AI nature, and deepfakes require disclosure. The European Commission provided guidelines and a Code of Practice for compliance, with many companies signing up. Existing systems have a grace period until December 2, 2026, for marking compliance. Exemptions are limited to assistive editing functions that do not substantially alter audio. TTS providers are adopting methods like Google's SynthID and Meta's AudioSeal for watermarking. OpenAI's API allows verification of embedded signals, though it cannot detect unmarked or stripped content. Developers must audit their audio outputs, verify watermark survival through their pipelines, manage disclosure obligations, and maintain generation records. Ignoring these regulations carries significant financial and reputational risks.
https://dev.to/lukeocodes/eu-ai-act-voice-watermarking-what-tts-builders-must-know-5d1i dev.to
CdXz5zHNQW_cG6jtXNdCV.webp
RSS Hunter RSS Hunter • Yesterday

Your call-to-action can be present and still dead-end. Audit for clickable, not just for the URL.

An automated content pipeline failed to detect that video descriptions lacked clickable calls-to-action. The system's check for the presence of a domain string was insufficient because bare URLs without "http://" or "https://" are not automatically linked by platforms like YouTube. This meant that while the descriptions mentioned the offer's domain, viewers could not directly access it. The initial audit incorrectly reported the check as passing, leading to zero conversions despite the presence of the URL text.The solution involved updating the audit to specifically look for a clickable link format, including the necessary URL scheme. This was achieved by using a regular expression that targets "https?://". A more robust and generalized fix was then implemented: a central process that automatically upgrades any bare domain mentions to actual, clickable links before content is published. This function ensures that existing markdown links and full URLs are preserved.The linkifying function uses alternation to prioritize existing links, preventing accidental modification of already functional URLs. This prevented a secondary bug where the naive approach would corrupt existing links. The core lesson is that automated checks for mere presence are deceptive when usability is the actual requirement. A check confirming a link exists is not the same as confirming a human can use it. If automated processes are not yielding results, it's crucial to verify if the tools are assessing the correct, functional criterion.
https://dev.to/penloom_studio_829b7817d3/your-call-to-action-can-be-present-and-still-dead-end-audit-for-clickable-not-just-for-the-url-3i70 dev.to
RSS Hunter RSS Hunter • Yesterday

Autoscaling Doesn't Fit Every Workload Here's How to Tell, and What to Build Instead

The advice "just put it behind an autoscaling group" is commonly used for scaling stateless applications like web servers. It works well because replicas are interchangeable and can be added or removed with minimal impact. However, this approach doesn't suit all workloads, particularly those with specific properties that violate interchangeability.One such property is session affinity, where a session is tied to a particular instance and cannot be easily transferred. Another is slow startup times for new instances, making reactive scaling ineffective if instances aren't ready when needed. For workloads with these characteristics, standard reactive autoscaling is the wrong solution.Instead of immediate reaction, scaling out should use slower, trend-based triggers. This allows new instances sufficient time to become fully operational before they are critically needed. Safely scaling in is also crucial, as simply terminating instances can disrupt ongoing work.Industry solutions like AWS lifecycle hooks enable graceful draining of sessions before an instance is terminated. This pattern involves stopping new work, waiting for existing sessions to complete, and then removing the instance. Large-scale systems, such as video conferencing platforms, already employ these more sophisticated scaling strategies.The key takeaway is to assess instance interchangeability. If any instance can handle any task instantly, autoscaling is appropriate. Otherwise, a slower scaling-out mechanism and proper scaling-in drain logic are necessary to effectively manage session-affine or slow-starting workloads. Forcing such workloads into a reactive, interchangeable model leads to significant failures.
https://dev.to/techwithhari/autoscaling-doesnt-fit-every-workload-heres-how-to-tell-and-what-to-build-instead-45ff dev.to
RSS Hunter RSS Hunter • Yesterday

I put a public graffiti wall on my SaaS homepage

Most SaaS homepages feature a static product screenshot to showcase their offering. However, this product's homepage uses an embedded, functional guestbook called "Owners Were Here" instead. This guestbook, built with a widget builder, demonstrates the product's invisible backend by showcasing real, live submissions. The guestbook serves as a proof of concept, highlighting functionality that screenshots cannot convey. A primary reason for this choice is that forms are difficult to convincingly fake in marketing materials. The embedded guestbook aims to provide immediate, compounding social proof through user contributions. This approach leverages a "graffiti wall" aesthetic that fills organically. When exposing a public endpoint, robust security measures are crucial. These include bot detection via Cloudflare Turnstile, rate limiting, schema validation, and size caps to prevent exploitation. Rendering untrusted user input necessitates careful handling to avoid security vulnerabilities like cross-site scripting. Properly sanitizing text using textContent instead of innerHTML is essential for displaying user-generated content safely. A growing guestbook can negatively impact homepage layout and load times. Implementing a viewport with a maximum height and internal scrolling prevents the guestbook from overwhelming the page. While some junk entries are expected, the core security and functionality of the embedded widget are protected by these design choices.
https://dev.to/ownvital/i-put-a-public-graffiti-wall-on-my-saas-homepage-4n4l dev.to
RSS Hunter RSS Hunter • Yesterday

The Mindset of a Hacker

The author explains the hacker mindset, which is rooted in a growth mindset and applied curiosity. Instead of typical user interaction, hackers explore what happens when trying random actions, akin to learning an undocumented machine. This involves questioning "what happens if I do this" rather than just following intended procedures. Early experiences, like repeatedly rooting a phone despite bricking one, illustrate the prioritization of curiosity over safety. Failure is seen not as an end but as a learning opportunity that improves future attempts. The instinct to explore is more meaningful when coupled with persistence rather than stopping upon receiving an explanation. To innovate effectively, one must first understand existing rules and fundamentals before attempting to deviate from them. Testing in controlled environments is advisable rather than replicating risky childhood experiments. A crucial, often overlooked, aspect is comfort with uncertainty and the persistence to navigate confusing, unclear stages of investigation. This tenacity, the tolerance for the "boring, confusing middle part," distinguishes those who discover novel insights from those who give up. Ultimately, the hacker mindset is a lens for examining systems, seeking discrepancies between intended function and actual behavior, which may reveal security bugs or interesting quirks.
https://dev.to/mirrai/the-mindset-of-a-hacker-1454 dev.to
RSS Hunter RSS Hunter • Yesterday

How to add UI for your RAG?!?

Just built some FastAPI SSE backend streaming LLM responses token-by-token, after i got some free time.Two things broke in production that worked fine locally 🙃:nginx buffers SSE by default. The stream was delivering locally, dead silent on Railway. proxy_buffering off, two hours later, fixed.The LLM API returns an empty_retrieval event when no docs match. I wasn't handling it, so the frontend sat on a loading spinner indefinitely. Added the handler, resolved.https://zooming-charm-production-547e.up.railway.app/
https://dev.to/coji831/how-to-add-ui-for-your-rag-51bl dev.to
RSS Hunter RSS Hunter • Yesterday

How to reduce AWS NAT Gateway costs: 7 ways, ranked by savings

AWS NAT Gateway bills have two main charges: a low hourly fee and a data-processing fee. The data-processing charge, $0.045 per gigabyte, is the primary cost driver and compounds with traffic. To reduce these costs, several strategies can be employed, starting with the most impactful.First, implement free gateway endpoints for S3 and DynamoDB, as this often eliminates 30-60% of the per-gigabyte charges. Next, consider interface endpoints for frequently accessed AWS services. VPC Flow Logs are crucial for identifying high-traffic sources, with fixes often involving caching and better hygiene.To avoid cross-Availability Zone surcharges, route traffic zonally or consolidate gateways deliberately. Consolidating non-production NAT gateways can save on hourly fees for unused resources. For further savings, a NAT instance, like fck-nat, can entirely eliminate the per-gigabyte fee, though it requires managing operations.A flat-priced Network Virtual Appliance (NVA) with egress filtering offers managed replacement for the NAT Gateway, killing the per-gigabyte charge and acting as a firewall. The choice between these solutions depends on traffic volume and operational capacity. The per-gigabyte data-processing charge is typically the most significant cost to address, rather than the hourly fee.
https://dev.to/enforza/how-to-reduce-aws-nat-gateway-costs-7-ways-ranked-by-savings-ll4 dev.to
RSS Hunter RSS Hunter • Yesterday

How would you decide, whether the content is good or bad?

The author discusses the increasing use of AI on the dev.to platform and its implications. A common sentiment is that content quality matters more than AI usage, but the author questions how to define "good" content in this context. AI can easily generate useful and insightful material, making it difficult to discern genuine understanding. The author draws a parallel to developers using AI for projects, noting that while impressive on paper, they often struggle to explain their work in real-time. This highlights a potential flaw in relying too heavily on AI, hindering true learning and skill development. The author expresses personal concern about over-reliance on AI, fearing it compromises their ability to learn and confidently explain their own work. True expertise, they argue, comes from understanding and being able to articulate one's creations. The author suggests that the purpose of platforms like dev.to is to foster genuine learning and sharing, not to present AI-generated content as personal expertise. They propose two key recommendations for using AI constructively: asking expanding questions instead of simply reciting information, and using AI as a supplementary tool that aids learning rather than replaces it. This balanced approach ensures personal growth and facilitates meaningful interactions within the community. The core theme is learning by doing and avoiding over-reliance on AI. Ultimately, good content on dev.to should foster mutual learning between authors and readers, regardless of the topic.
https://dev.to/francistrdev/how-would-you-decide-whether-the-content-is-good-or-bad-295p dev.to
CdXz5zHNQW_x1mHmRWPT1.webp
RSS Hunter RSS Hunter • Yesterday

Unlocking Infinite Automation: Integrating Google Apps Script with Gemini Spark

Gemini Spark is Google's 24/7 autonomous AI agent designed to automate complex workflows across Google Workspace. While it offers robust native integrations with applications like Gmail, Drive, and Docs, connecting to external APIs requires additional configuration. Google Apps Script (GAS) serves as a crucial bridge, enabling enterprises to extend Gemini Spark's capabilities significantly. By deploying GAS as a Model Context Protocol (MCP) server or a webhook endpoint, users can grant Gemini Spark access to specialized APIs and custom business logic.The article demonstrates five representative prompts showcasing Gemini Spark's native functionalities. These include autonomously creating spreadsheets with dynamic formulas, intelligently searching for files within Google Drive, and orchestrating cross-domain workflows like web scraping to document generation. It also highlights Gemini Spark's ability to autonomously set up background event listeners for tasks such as processing incoming emails. However, a test prompt involving direct access to the Google Analytics Data API revealed a current limitation in native connectivity to specialized Google APIs.To overcome these native boundaries, the article details the integration of Gemini Spark with Google Apps Script via custom MCP servers and webhook triggers. It explains how to deploy a GAS Web App as an MCP server, leveraging the GASADK and GoogleApiApp libraries to facilitate JSON-RPC communication. This integration allows Gemini Spark to interact securely with APIs like Google Analytics 4, custom databases, and other complex business logic. By using GAS as an intermediary MCP server, developers can encapsulate secure authentication and data extraction logic. The ultimate goal is to enable Gemini Spark to perform enterprise-grade workflow automation by accessing a wider range of data sources and services.
https://dev.to/gde/unlocking-infinite-automation-integrating-google-apps-script-with-gemini-spark-3kj4 dev.to
CdXz5zHNQW_EaBgJiSslu.webp
RSS Hunter RSS Hunter • Yesterday

LINE MINI App Verification Review: A Pre-Submission Checklist That Prevents Rework

LINE MINI Apps do not automatically require verification, but certain features mandate it for publication. If verification is necessary, LINE meticulously reviews identity consistency, policy compliance, channel configuration, and user flows. To avoid delays, it's crucial to audit the submission thoroughly before requesting a review. Key features requiring verification include production service messages, custom paths, home-screen shortcuts, common profile quick-fill, and verified badges.Before submitting, align organizational identity across the LINE Developers Console, channel information, privacy policy, and channel description. Ensure the company name is consistent in all these locations and languages. Clearly describe the MINI App's workflow, identifying the primary user, core functions, and expected outcomes. Confirm that the Review channel accurately reflects the Published channel's features, transitions, data, authentication, and error states.Prepare comprehensive test scenarios for payments, reservations, and orders, including registration, successful and failed transactions, and data management. Thoroughly check privacy and terms pages for public accessibility, consistent company and service names, and accurate contact information. Verify that the MINI App's business category and content comply with LINE's policies, avoiding restricted categories and prohibited content.Request only necessary API scopes and document their usage. Service messages require a separate approval process and are strictly for confirmations or responses to user actions, not promotions. After verification, many settings become re-review sensitive, so freeze critical configurations like channel identity, legal URLs, and scopes before the initial submission. Plan for the verification timeline, which typically takes one to two weeks, and include a buffer for potential re-reviews. Finally, remember that MINI App verification is distinct from handling inbound customer messages.
https://dev.to/unifyport/line-mini-app-verification-review-a-pre-submission-checklist-that-prevents-rework-3d3m dev.to
RSS Hunter RSS Hunter • Yesterday