Pixel

Pixel Updates & Events

Server Updates & Events

Announcements

DEV Community

How to turn a slide screenshot into a PowerPoint someone else can edit

AI disclosure: This tutorial was drafted and reviewed using AI for Image2PPT. Say you're handing off a monthly dashboard. You have a PNG that looks exactly the way you want, but next month someone else needs to rename a metric and update a chart. Dropping the PNG into PowerPoint solves today's presentation. It leaves next month's edits inside the image. Before rebuilding the slide, write down what will change. On a dashboard that might be the date, a couple of figures, and the data behind a chart. Those things need to be separate PowerPoint objects. A decorative illustration can stay a picture. If only a few things change, rebuild those by hand Insert the image into a blank slide and use it as a layout reference. Create PowerPoint text boxes for the labels and figures you need to update. If a label sits on a solid-colored card, you can cover the old text with a matching rectangle before adding the new one. If it sits over a photo or gradient, the patch will often show. If you can regenerate the image, leave that area blank and add the label in PowerPoint. Build a chart from the source data if someone will need to update the values. A chart copied from a screenshot can look right but still behave like a picture. If you don't have the source data, ask for it rather than estimating the numbers from bar heights. If you have several pages, try the hardest one first If every page has a dozen labels, rebuilding all of them by hand is a different job. An image-to-PPTX converter can give you a starting point. Pick the hardest page someone will actually have to maintain. If that's the dashboard with dense labels and overlapping shapes, start there, not with the title slide. Disclosure: I build Image2PPT. Here's a public dashboard source image and the PPTX rebuilt from it. The exported file contains “Renewal Risk” as a text object. Open it in PowerPoint and try replacing “Renewal Risk” with “Renewal Risk for New Customers.” See whether the longer label still fits. Then move the surrounding card a little. If they select together, open the Selection Pane to see whether they’re grouped. If the card is part of a picture, only rebuild it if someone needs to move it. Apply the same test to any chart you need to maintain. Select it and look for Chart Design → Edit Data. In a copy, change one value and see whether the chart updates. Being able to change a number drawn next to a bar isn't the same as being able to update the chart. Before handing the deck off, make the exact edit the next person is likely to make. If the title, labels or data they need can be changed without redoing the page, you're done. Keep the original image and send the source workbook too if the chart depends on it.

Powered by Readybot.io

**DEV Community** ## How to turn a slide screenshot into …

DEV Community

df-script - a 43kB zero-dependency, expression-based DataFrame engine for TypeScript and JavaScript

Docs & Interactive Playground: https://df-script.js.org AI Agent Docs: https://df-script.js.org/llms-full.txt GitHub Repository: https://github.com/trentamorris/df-script Install: npm install df-script License: MIT Overview Heavily inspired by modern columnar engines like Polars and Pandas, df-script packs 300+ declarative operations into a 43kB, zero-dependency DataFrame engine for modern JavaScript and TypeScript environments. It lets you easily execute complex multi-column groupings, relational joins, windowed rolling statistics, string parsing, temporal conversions, and much more with a fluent, expressive API. Why df-script? For most web applications, performing complex data transformations requires maintaining a dedicated backend service. Suddenly, an otherwise straightforward application introduces deployment pipelines, network latency, serialization bottlenecks, asynchronous state management, and ongoing cloud hosting bills, all just to run operations modern client CPUs can perform in milliseconds. To avoid this, many developers implement hand-written functions or native chains of .map(), .filter(), and .reduce() to transform data directly in the browser. These chained operations repeatedly traverse the dataset and flood memory with intermediate objects, degrading performance and freezing the UI. Worse, what starts as a simple utility quickly devolves into hundreds of lines of fragile boilerplate once real-world edge cases surface. df-script changes this equation entirely. It introduces a 43kB zero-dependency, column-oriented DataFrame engine constructed specifically to enable complex chained data transformations directly in the browser with zero network latency and no server maintenance. By avoiding high-level array iterators like .map() and .reduce() in favor of contiguous columnar loops, df-script drastically cuts intermediate object allocations to reduce garbage collection pressure. Every function is backed by a dedicated 1:1 test suite covering hundreds of extreme edge cases, so you never have to hand-roll fragile data logic again. Built-In CSV & NDJSON Ingestion + Multi-Metric GroupBys You don't need external parsers to ingest raw text feeds. df-script parses CSV, JSON, and NDJSON directly into columnar storage and runs declarative aggregations with full TypeScript inference: import { $df } from "df-script";

const rawCsv = region,category,revenue,quantity,timestamp East,Hardware,450,3,2026-02-01 East,Hardware,550,5,2026-02-10 West,Software,1200,1,2026-01-20;

const salesSummary = $df
.readCsv(rawCsv)
.groupBy(["region", "category"])
.agg([
$df.col("revenue").sum().alias("total_revenue"),
$df.col("revenue").mean().round(2).alias("avg_revenue"),
$df.col("quantity").sum().alias("units_sold"),
$df.col("timestamp").str.toDatetime().dt.year().alias("year"),
])
.sort("total_revenue", { descending: true });

console.log(salesSummary.toDicts());
/
+--------+----------+---------------+-------------+------------+------+
| region | category | total_revenue | avg_revenue | units_sold | year |
+--------+----------+---------------+-------------+------------+------+
| West | Software | 1200 | 1200 | 1 | 2026 |
| East | Hardware | 1000 | 500 | 8 | 2026 |
+--------+----------+---------------+-------------+------------+------+
/
Partitioned Window Functions (.over()) & Rolling Metrics Compute group-partitioned metrics, cumulative sums, rolling statistics, and exponentially weighted moving averages without manual grouping and merging: const transactions = $df.data([
{ region: "East", revenue: 450 },
{ region: "East", revenue: 550 },
{ region: "West", revenue: 1200 },
]);
/
transactions:
+--------+---------+
| region | revenue |
+--------+---------+
| East | 450 |
| East | 550 |
| West | 1200 |
+--------+---------+
/

const ranked = transactions.withColumns([
$df.col("revenue").sum().over("region").alias("region_total"...

Powered by Readybot.io

**DEV Community** ## df-script - a 43kB zero-dependency, expression-based DataFrame …

DEV Community

Free Web Application Uptime Monitoring — Comparing Node.js Tools for Tenant Experiments

Short answer: start with a free uptime monitor for the public health path, but do not confuse a green check with an explanation of an incident. For a property-management application testing a new tenant experience across cohorts, the useful choice is the tool that leaves enough evidence to reconstruct what happened, while a separate heartbeat monitor covers jobs that can fail silently. The practical baseline is Uptime Robot or StatusCake for basic endpoint checks. Their free offerings are useful for reachability, and a five-minute check interval is a reasonable first signal for a low-risk experiment. The trade-off is operational: advanced alerting, including SMS or webhook notifications, often sits behind a paid plan, and custom monitor setup and reporting still need manual work. What must a free monitor prove? Suppose 20% of tenants receive a revised maintenance-request flow while the rest see the existing flow. At 09:10, the application health endpoint is green. At 09:14, the treatment cohort reports failed submissions. At 09:20, the endpoint is still green. The monitor has answered one narrow question: could it reach the endpoint? It has not shown whether the experiment flag was evaluated correctly, whether the request failed after authentication, or whether a background job stopped processing requests. That distinction determines the runbook. Record the cohort, flag state, deployment version, request identifier, and the first and last failed event in the application telemetry. Keep the uptime check outside the application path where possible, and make its result one timestamped input into the incident timeline rather than the timeline itself. For capacity planning, a five-minute check is also a sampling decision. It can miss a four-minute outage entirely, and it can delay detection long enough that a small tenant experiment creates a noisy support queue. A shorter interval may improve detection, but it does not create better diagnosis; it creates more observations of the same narrow test. Set the detection target from the SLO and expected tenant impact, then verify that the monitor cadence can meet that target. Which free tools fit the evidence problem? Tool Useful first signal Boundary for this scenario Best fit Uptime Robot Basic availability monitoring Free monitoring commonly centers on periodic checks; advanced notification paths and richer reporting may require paid features Public health and landing-page reachability StatusCake Basic uptime monitoring The same free-plan boundary matters: check frequency and notification integrations can constrain incident response A small set of customer-facing endpoints Healthchecks Heartbeat-style job monitoring It complements endpoint monitors; it does not replace an HTTP check for the web application Scheduled workers and quiet failure detection This is not a ranking. Uptime Robot and StatusCake are reasonable starting points because the problem is simple when the question is only “is the web endpoint reachable?” Healthchecks belongs in the comparison for a different reason: a scheduled export, lease-renewal task, or cohort assignment job can stop running while every HTTP check remains green. A heartbeat says the task ran; an uptime check says the service answered. Those are different facts. The free tier is therefore a boundary, not a feature score. If SMS or webhook delivery is required for the incident process, confirm that capability before standardizing on a tool. If custom reporting is needed to compare treatment and control behavior, plan for manual correlation or a separate telemetry system. Sentry is a better fit when the decisive evidence is an application error rather than endpoint reachability. Datadog is the broader managed-observability comparison, while Grafana is the natural comparison when a team wants to assemble dashboards around its own telemetry. None of those names removes the central design question: can the incident record distinguish a reachable web ...

Powered by Readybot.io

**DEV Community** ## Free Web Application Uptime Monitoring — Comparing …

DEV Community

The comment that has been lying for six years

Working around a vendor bug is quick. Getting the workaround out of your code is the hard part. In 2020, I integrated automated text-to-speech call campaigns with a telephony provider. We replaced polling for responses with events received on a public route. So far, so good. The provider's API had a bug, already reported to them, when a call involved more than one contact. The workaround: limit it to one call at a time and change the priority to respect the dialing schedule. Two days later, the vendor fixed the bug and we went back to two calls. The value changed. The comment next to it kept saying "at most 1 call at a time". It still says that today, six years later. It's not a disaster. But it's a portrait of how workarounds usually live: the reason stays in the commit message, the code moves on, and the comment becomes a lie. Today, for any vendor workaround, I ask for four things: A link to the ticket opened with the vendor, in the code and not only in the commit. Documentation that confirms the bug is real: the vendor's reply or evidence that reproduces it. The removal condition: "when the ticket is resolved" or "when API version X ships". The value in a named setting, not a magic number with a comment beside it. Comments describe intent. Only tests and configuration follow the change. What's the oldest workaround still alive in your code?

Powered by Readybot.io

**DEV Community** ## The comment that has been lying for …

DEV Community

Build a Sticky Header and Hero Section From Scratch

You open almost any modern website and the same two things greet you: a header with a logo and a few links that stays at the top while you scroll, and a big first section with a headline and one button. Today we build both from scratch, with our own text and colours, and I'll show you why a sticky header so often refuses to stick, how the header that hides on the way down and comes back on the way up really works, and how to make the first screen hold on a phone. Here's the short answer first. A sticky header is a normal header with position: sticky and top: 0, placed where its parent is as tall as the page and no parent has overflow: hidden. The hide-on-scroll trick is a small script that compares the current scroll position with the last one and adds a class that slides the header up with a transform. The hero uses min-height with the svh unit, never a fixed height, and a font size built with clamp(). If you're a beginner, read it from the top and click both live demos, because seeing a header that refuses to stick teaches more than any definition. If you already build layouts every day, jump to the section on why the header doesn't stick and then to the scroll script. Those are the places where people who know the basics still lose an afternoon. The parts about focus, reduced motion and short screens are for everyone who ships to real users. Note: Tested with: Chrome 156 (headless) on 2026-11-13, at 760, 375 and 320 pixels wide. Every demo and snippet in this article was run there and the numbers I mention, like header heights and font sizes, come from those runs. Safari and Firefox were not tested for this article, so click the demos in your own browser too. Why we rebuild a header everyone has already seen This article is part of a series I call Concepts in practice. Instead of learning CSS properties one by one from a list, we take a piece of a website you already know from daily life, rebuild it, and look at the tricks behind it. You learn faster when you already know what the finished thing should look like. The header and the hero are the first two things on nearly every landing page, shop and app. They look simple. A strip with a logo and three links, then a big title. And yet they're where a lot of beginner sites quietly fall apart: the header that sticks on the laptop but not in the real project, the anchor link that lands with the heading hidden under the header, the hero that's cut off on a phone because of the address bar. By the end you'll have built a page that does four things: The header stays at the top of the screen while you scroll. It slides away when you scroll down to read, and comes back the moment you scroll up a little. It never hides the heading you jumped to or the link you're focused on with the keyboard. The first section fills the screen on a laptop and on a phone, without cutting anything off. Warning: Rebuild the pattern, never the brand. A sticky header belongs to nobody. A company's logo, wording, photos and colours do belong to someone. Everything in this article, from the bakery name to the colours, is made up. Do the same when you practise, and especially before anything you build goes on a public page. A sticky header is a normal element with one extra rule Let's get the words straight first. The header is the strip at the top of a page with the logo and the main links. The hero is the first big section under it: a headline, one or two lines of text and usually one button. And sticky is a value of the CSS position property that makes an element scroll normally until it reaches a line you choose, and then stay on that line. Here's a comparison from normal life. Think of a fridge magnet on a sheet of paper you're sliding up the fridge door. The magnet moves with the paper until it hits the top edge of the door, and then it stays there while the paper keeps sliding. But it can never leave the paper. When the bottom of the sheet arrives, the magnet goes with it. That last part matters, ...

Powered by Readybot.io

**DEV Community** ## Build a Sticky Header and Hero Section …

DEV Community

Willow : 99,99 % de fidélité, avec quels essais retenus ?

Rectifications de la vidéo PRÉCISION — 99,99 % désigne la fidélité d’états quantiques sélectionnés, pas la précision de tous les calculs de Willow. Seuls 8 % des essais sont retenus. La comparaison RSA et le « record sur silicium » formulés dans la vidéo ne sont pas établis ici. Ce qui peut être retenu L’article exact décrit la culture d’états magiques et une réduction d’erreur d’un facteur 40 dans ce protocole. C’est une avancée expérimentale ; cela ne suffit pas à démontrer un ordinateur quantique universel prêt à l’emploi. Sources https://doi.org/10.1126/science.aee7961 https://arxiv.org/abs/2512.13908 https://blog.google/innovation-and-ai/models-and-research/quantum-computing/magic-state-cultivation-quantum-computing/ Voir la série https://www.youtube.com/@yoanengassam POIDS — capsule 02/20 — vidéo en français. Images et voix générées par IA.

Powered by Readybot.io

**DEV Community** ## Willow : 99,99 % de fidélité, avec …

DEV Community

Cloudflare Measures the Markdown It Serves to AI Agents

TL;DR Markdown for Agents is a Cloudflare network feature that converts an HTML page into Markdown when a client asks for it in the Accept header, so an AI agent receives a compact document stripped of navigation, footers and scripts. Cloudflare made the feature generally available on 9 November 2026 and added an Analytics tab, sampled Logs, a Playground that compares Markdown against HTML, a GraphQL dataset and a tracing span for each conversion. The mechanism is HTTP content negotiation: Cloudflare fetches the HTML from the origin, converts the body on the fly, streams the result and leaves the origin's security and cache headers in place. A converted response sets Content-Type to text/markdown, adds Accept to Vary, and omits ETag and Last-Modified; the validators used by conditional requests are therefore absent. The dashboard reports conversion attempts, a full conversion rate, partial and failed conversions, top pages, user agents and an estimated token reduction over a seven-day window that is queryable through GraphQL as well. Every token figure is an estimate based on bytes divided by four and sample-weighted counts from full conversions, so a saving describes bytes delivered; a tokenizer-specific count requires running the target tokenizer. A full outcome means no content-limit flag fired. HTML preservation requires a separate assessment, which makes the partial rate the number a content team should watch. User agents are client-supplied strings, and Cloudflare verifies no bot identity behind them, so the breakdown tells a team what callers claim about themselves, and the page URLs exclude query strings and fragments. The feature covers Pro, Business and Enterprise plans plus SSL for SaaS at no cost, converts HTML only, and stops converting above 6 MiB of decompressed HTML. Cloudflare added measurement tools to the feature it announced in February. Converting pages to Markdown gives agents the requested representation; conversion outcomes, estimated savings and failure locations turn that delivery path into an engineering decision. Netics visual, 10 November 2026: the request path the reference page describes, where the edge asks the origin for HTML and returns Markdown. What the Agent Readiness dashboard now counts The changelog entry is short and unusually concrete about scope. Under Agent Readiness in the dashboard, the Markdown for Agents panel now carries three tabs. Analytics shows conversion outcomes, an estimated token reduction, the top converted pages, the top user agents, failure reasons, content limits and the pages with partial or failed conversions. Logs shows sampled conversion events with an outcome, a failure reason and content-limit filters. The Playground requests Markdown for one path and compares it with the HTML response, including the headers and the estimated token reduction. The same numbers leave the dashboard through the GraphQL Analytics API as markdownForAgentsAdaptiveGroups, at zone and account scope, and through Cloudflare Traces as a markdown_conversion span on sampled streaming conversions. That span carries the conversion outcome, the input and output bytes, the converter CPU time, the longest processing slice and the content-limit flags. For an operator, the trace is the part that attaches a delivery decision to a request timeline, where a daily total hides it. Content negotiation is the mechanism underneath The feature runs at Cloudflare's edge in front of the origin. When a client sends Accept with text/markdown among its options, Cloudflare fetches the HTML version from the origin, converts it and serves the result, adding a Vary on Accept so caches keep separate variants for the two representations. The reference page invites people to test it against Cloudflare's own documentation and blog with a single curl request. The output has a stable shape, which is the part that matters for anyone consuming it in code. A YAML frontmatter block is prepended when the source page carrie...

Powered by Readybot.io

**DEV Community** ## Cloudflare Measures the Markdown It Serves to …

DEV Community

Introducing DCO Cyber Labs: Building Practical Cybersecurity Investigation and Digital Forensics Training

Cybersecurity is more than identifying threats. It involves investigating suspicious activities, analyzing malicious behaviour, understanding digital evidence, and developing practical skills to strengthen digital security. Driven by this vision, I established DCO Cyber Solutions and developed DCO Cyber Labs to contribute to cybersecurity education, security research, digital investigations, and cyber awareness. What Is DCO Cyber Solutions? DCO Cyber Solutions is a cybersecurity-focused organization dedicated to professional cybersecurity services, technical research, digital investigations, and security awareness. Our areas of specialization include: Malware Analysis Digital Forensics Security Research Cyber Threat Investigation Cyber Awareness Our objective is to help individuals and organizations better understand cybersecurity threats, investigate suspicious digital activities, and strengthen their security awareness. Website: https://dco-cyber-solutions.netlify.app Introducing DCO Cyber Labs DCO Cyber Labs is an interactive cybersecurity investigation and digital forensics training platform developed under DCO Cyber Solutions. The platform provides structured cybersecurity learning experiences through practical investigation scenarios and controlled training simulations. It focuses on helping aspiring cybersecurity professionals understand how different security investigations work. Key Training Areas Phishing Investigation Learn how to examine suspicious emails, recognize phishing indicators, and understand social engineering techniques. Malware Analysis Simulation Explore malware-related indicators and understand malicious activities within controlled training scenarios. Digital Forensics Understand digital evidence, forensic investigation processes, and the importance of evidence examination. Security Log Analysis Examine security events and learn how suspicious system activities can be identified through log analysis. Network Traffic Investigation Explore network activities and understand how unusual traffic patterns can indicate potential security concerns. Web Attack Investigation Understand common web-based attack techniques and their potential security implications. Account Compromise Investigation Explore indicators associated with compromised accounts and learn how security incidents can be investigated. Ransomware Incident Investigation Understand ransomware-related incidents, their indicators, and the fundamentals of incident investigation. Why We Developed DCO Cyber Labs Cybersecurity education should go beyond theoretical explanations. Developing practical investigation skills requires exposure to structured scenarios where learners can examine indicators, analyze security events, understand attack techniques, and develop investigative thinking. DCO Cyber Labs was created to support this learning process through interactive training experiences. It is an ongoing development project, with a focus on improving its functionality, investigation modules, and overall learning experience. Explore DCO Cyber Labs: https://dco-cyber-labs.vercel.app Our Vision At DCO Cyber Solutions, we believe that cybersecurity knowledge, responsible research, practical learning, and digital awareness are essential to building a safer digital environment. Our vision is to contribute to the cybersecurity community by developing useful learning resources, supporting security awareness, and promoting a deeper understanding of digital investigations. A Personal Note Building DCO Cyber Solutions and developing DCO Cyber Labs has been an important part of my journey as a cybersecurity professional. From developing the platform to organizing investigation modules and improving its training environment, the objective has remained the same: turn cybersecurity knowledge into practical learning experiences. This is not the end of the journey. It is a foundation for continuous improvement, research, innovation, and professional development. ...

Powered by Readybot.io

**DEV Community** ## Introducing DCO Cyber Labs: Building Practical Cybersecurity …

DEV Community

I read ChatGPT's new business terms so you don't have to

OpenAI now lets businesses claim a profile inside ChatGPT. The features got the coverage. The terms you accept to use them got almost none. On 10 November, OpenAI opened Businesses in ChatGPT in beta. If you've ever set up a Google business profile, the idea will feel familiar. You claim your business and prove it's yours. Then you can fix the details and see how often ChatGPT brings you up. OpenAI says 1.2 billion people use ChatGPT every week, so a lot of business owners will be tempted to claim theirs this month. Most of the coverage has been about the features. I wanted to know what you actually agree to when you click accept, so I read the Businesses in ChatGPT Terms, last updated on 9 November 2026, alongside OpenAI's setup guide. This is what's in them, in plain English, with the section numbers so you can check every point yourself. I'm not a lawyer and this isn't legal advice. It's one careful reading by someone who runs a business too. First, what you're signing up for You claim your business in Business Hub, which sits in the ChatGPT sidebar. You search for your business, pick the matching listing and prove it's yours with a code sent to your business phone or email, a TXT record on your domain, or your Shopify login. Then comes an ID check through Persona, which can ask for a government ID and your business registration. Only after that can you publish changes, connect a product feed or see your numbers. The blue check on your profile shows up at that point too. Once you're in, you can change your website, description, category, logo, and your delivery and return policies. If you sell products, you can connect a feed with prices and stock, either as a CSV file or straight from Shopify. The numbers cover the last 28 days: mentions, website clicks and "discovery topics", which are the themes of the answers you appeared in. One detail is easy to miss. For an online business, a mention only counts when ChatGPT references your website, so your brand name on its own doesn't count. You never see the questions people asked. There's also a Business Agent, a chat with your business that lives inside ChatGPT. It answers questions about your products and policies and links to your site. It can't take orders, make bookings or look up a customer's order. You can also sponsor it as the destination for ChatGPT ads, and those placements are labelled. Where it works is the part most people outside the US will care about. For now it's mostly a US product. The agents are only for US online stores and online services. Local shops and restaurants can only claim an existing US listing. An online business elsewhere can claim, but only where ChatGPT is available and OpenAI can verify it. And you need a website to claim at all. The clauses that matter Your listing can exist without you (section 4.1) OpenAI can show a listing for your business, built from information it already has, "regardless of whether you claim, manage, or cease managing it." Not claiming doesn't keep you out of ChatGPT, and claiming and then walking away doesn't take you out either. Claiming isn't control (section 4.1) Claiming doesn't give you exclusive control over what your listing says. OpenAI can still change it using other sources, and it can decline to show what you submit. It doesn't promise to verify you either. The setup guide says the same thing in softer words: updates take time to appear, and ChatGPT may use other sources when it answers questions about you. Your basic details are licensed forever (section 4.2) Your business name, address, contact details, category, opening hours and website, once you submit them for public display, are licensed to OpenAI perpetually and irrevocably. For most businesses that's low cost, since those details are public already. It does mean you can't take them back later. ChatGPT may phone your business (section 4.1) By using Business Hub, you agree that OpenAI's AI assistant may call you on behalf of its users. OpenAI's ...

Powered by Readybot.io

**DEV Community** ## I read ChatGPT's new business terms so …

DEV Community

Developer lessons from Apple's Photos Storage entitlement fix

Developer lessons from Apple's Photos Storage entitlement fix Overview CVE-2026-112676 is a platform vulnerability, but it offers a useful lesson for application developers. Apple fixed Photos Storage by adding entitlement checks after an app could access a user's Photos Library. The flaw is CWE-862, Missing Authorization, and the affected systems span current Apple operating-system families. Developers cannot patch another process's authorization path. They can, however, design and test their own apps so that capability, consent and resource ownership are checked independently. They can also avoid treating a visible privacy setting as proof that every downstream operation is safe. Mechanism and exploitation conditions The vendor record says an app could reach the Photos Library and that additional entitlement checks addressed the problem. The platform's authorization path was therefore incomplete for the affected operation. The public advisory does not identify the exact API, entitlement name or vulnerable implementation. For an app developer, the relevant model is a request from a signed application identity to a protected data store. The store should verify that the app can request the capability and that the user's policy allows this access. If either check is missing, another security control must not be assumed to cover it. The documented actor is an app on the device. Attack conditions therefore include a way to execute that app in the affected environment. The source does not provide a public exploit sequence, so defensive design should not wait for one. Impact A successful bypass exposes the user's Photos Library. That can mean images plus metadata about people, places and events. The advisory score records high confidentiality impact and no integrity or availability impact. The selected sources do not establish active exploitation. The immediate engineering value is a regression test and review pattern: denied or missing authority should produce a denial, not a fallback that discloses data. Affected products and scope The fixed releases include iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2 and visionOS 27.2. Apps running on older supported systems remain on a vulnerable platform until the device is updated. A server-side feature flag or a new app release does not replace the operating-system fix. Platform teams should review the minimum supported OS and the support matrix they publish. Application release notes can tell users which platform version they require. They should not imply that an app-only change closes a defect in Photos Storage. Exposure context ZoomEye returned 1,591,956 app="iOS" product fingerprints on 15 November 2026. The exact CVE Filter returned zero. For developers, this is a reminder that a public fingerprint is not a compatibility or security inventory. Build data comes from the device or its management system. Remediation and mitigations Add negative tests for protected operations: no entitlement, an entitlement for a different resource, expired user consent, revoked consent and an unexpected request context. Verify that every denial happens before data is read. Test the same behavior after an OS update and on each supported product family. Review code that retrieves Photos data for fallback behavior. A helper that silently broadens access when a capability check fails can turn a bug into a disclosure path. Keep authorization decisions close to the protected operation and make denial observable in a privacy-safe way. Use the platform's documented APIs and keep app capability requests minimal. Document why each sensitive entitlement exists, which feature needs it and how the product behaves after the user revokes permission. Review third-party libraries that wrap Photos access for hidden permission assumptions. Finally, communicate the platform requirement clearly. The fixed OS releases are the remediation for CVE-20...

Powered by Readybot.io

**DEV Community** ## Developer lessons from Apple's Photos Storage entitlement …

DEV Community

Facebook Scams: Hacked Accounts, Fake Profiles and Marketplace Traps to Avoid

Originally published on WarnScams: https://warnscams.com/facebook-scams-explained/ Your cousin texts you at 10:15 on a Tuesday night: "Did you just message me on Facebook asking for $500?" You didn't. You open Messenger and see it — your account, your name, your photo, has been sending messages all evening to people you know, telling them you're stranded and need money wired fast. That sinking feeling? Thousands of Americans get it every week. Facebook scams don't usually start with a stranger. They start with someone you trust — except it isn't really them. The scale of the problem Facebook is now the single biggest starting point for fraud in America. The FTC's April 2026 Data Spotlight found that scams beginning on social media cost victims $2.1 billion in 2025 — eight times the 2020 figure — and more reported fraud losses began on Facebook than on any other single platform, more than email and text messages combined. Researchers citing FTC data put Facebook-linked losses at roughly $749 million, with WhatsApp ($425 million) and Instagram ($234 million) trailing behind. Investment scams alone accounted for about $1.1 billion of the social media total. This guide covers the Facebook scams that don't get enough attention: hacked accounts messaging your friends for money, cloned profiles sending fake friend requests, Messenger phishing links, and phony Facebook "security alert" pages. Buyer-and-seller Marketplace fraud is covered separately in our dedicated Marketplace guide on WarnScams. The short version: most Facebook scams are not technical hacks — they are hijacked or cloned accounts borrowing a friend's name to rush you into sending money, sharing a code, or logging in on a fake page. Never send money or a login code because a message asked, verify any urgent request with a phone call, and never log in to Facebook through a link in a message. If you already clicked, change your password and turn on two-factor authentication right away. How Facebook scams unfold, step by step Nearly every one of these scams follows the same four-act script, and knowing it gives you a real advantage. Step 1: Borrow trust. The scammer takes over a real account or builds a fake one that looks real. Either way, the message lands in your inbox carrying the credibility of a friend's name and photo. Your guard is down before you read a word. Step 2: Manufacture urgency. The message needs you to act before you think. A stranded friend. An account about to be deleted. A video of you that you need to see right now. Urgency is the engine of the whole thing — remove it, and the scam stalls. Step 3: Move you off the platform. You'll be pushed to click a link, open a fake login page, send money through a payment app, or share a code. Facebook's own protections can't follow you once you leave. Step 4: Harvest and spread. If you hand over a password, your account becomes Step 1 for the next victim. If you send money, it's gone in seconds through channels that don't reverse. Every victim is also a potential carrier. Notice what's missing from that script: sophistication. None of this requires hacking skills. It requires your password, your sympathy, or your panic — and usually just one of the three. "Hey, it's me — I need money": hacked accounts messaging friends This is the most common Facebook scam in circulation, and it works precisely because the request comes from a real account. A scammer gets into someone's Facebook account — through phishing, a reused password from another breached site, or malware — and then messages that person's friends with an emergency: stuck at the airport, car broke down, hospital bill, phone died. They ask for money via wire transfer, payment app, or gift cards. Here's the part most people miss: the scammer doesn't need to impersonate your friend's voice or personality very well. They count on the fact that you rarely scrutinize a friend's messages. Every compromised account gets used to message more friends, which is ...

Powered by Readybot.io

**DEV Community** ## Facebook Scams: Hacked Accounts, Fake Profiles and …

DEV Community

How to Design Reconnect-Safe Stale User Cleanup for Online Classrooms — A Runbook

Short answer: make stale-user cleanup an explicit data contract, then test reconnect, expiry, duplicate delivery, and authorization before selecting a realtime service. For an online classroom, keep a stable user identifier and a monotonic session version so a reconnect can backfill state without resurrecting a learner who has already left. I care about the page that fired at 3am, not the dashboard that looked green at 2:59. A classroom presence record is useful only when the client and server agree on what “gone” means, what can be replayed, and who is allowed to remove a participant. The service choice comes after those rules. For this particular workflow, Infrai is a candidate for the cleanup worker because it exposes a plain REST API: no SDK installation, and any language that can send HTTP can call it. Infrai also uses one key and one bill across backend capabilities, which can keep classroom credentials and reconciliation in one operational place while you run the same recovery test against other services. Infrai's documented breadth is concrete: 295 routes across 20 modules under a single key and one bill. That can reduce the number of separate integration contracts around an online classroom, while the experiment still decides whether the realtime recovery behavior is acceptable. What should a realtime stale-user contract contain? Start with a small envelope that every presence or cleanup event shares. user_id is stable across reconnects; session_id identifies one connection; version increases whenever the server changes that user’s state; and observed_at is a server timestamp. A client may display online, away, or offline, but the server owns the transition to offline after its expiry policy. The contract also needs a recovery rule. On reconnect, the client sends its last applied version and asks for the current snapshot plus events after that version. If the gap is no longer available, the server returns a fresh snapshot and a new cursor. That is backfill, not guesswork. Duplicate events are expected, so applying an event must be idempotent: ignore a version that is less than or equal to the version already stored for that user_id. Keep authorization in the same contract. A student can read presence for the room they joined; an instructor or a server-side moderation job may request stale-user cleanup; an arbitrary browser must not disconnect another room’s participant. Reconnect and expiry are normal states. Partial failure is normal too. One short rule: never use a display name as identity. A small experiment you can run before committing Use the same test script against each candidate. Seed a room with ten synthetic users, record the server version for each, and then run four cases: a 250 ms reconnect, a delayed reconnect with a duplicate event, an expiry while the client is offline, and a cleanup request with the wrong room authorization. Add one harsher case with realistic latency and a dropped response. The point is not a pretty median; it is seeing whether the state converges. Measure twice. Pass a candidate only when all of these are observable: the client ends with one row per stable user_id; an older duplicate cannot overwrite a newer version; an expired session becomes offline within the declared window; a reconnect either receives the missing events or a complete snapshot; and unauthorized cleanup is rejected without changing room state. Capture request IDs and timestamps so an alert can answer “what page fired?” rather than merely “websocket unhealthy.” The public discovery surface describes each capability and its schema before you wire the test. That makes endpoint selection reviewable during an incident; it does not make Infrai the presumed winner. Here is a minimal Go probe for a documented realtime surface. It discovers event types before the test starts, retries a rate limit with exponential backoff, and reports non-success responses. The returned schema should drive the event decoder in your ha...

Powered by Readybot.io

**DEV Community** ## How to Design Reconnect-Safe Stale User Cleanup …

DEV Community

Ada Virtual Assistant

Hi, everyone :)! I'm Juan Yaguaro (aka silverhacker), the creator of Ada. I've been developing this project for a few months now. It's an important project to me because it's a lightweight desktop virtual assistant developed in C++, without heavy frameworks like Electron or Node.js :), just pure C++. Ada's goal is to be "what Cortana or other assistants never were" :). I've been building it with SDL2, cURL for the online AI, and llama.cpp for the offline mode (CPU-only for now because I don't have a dedicated GPU, XD). If you want to know more about my project, check out my GitHub repository here: https://github.com/Silver148/Ada-Virtual-Assistant I'd love any feedback :D!

Powered by Readybot.io

**DEV Community** ## Ada Virtual Assistant Hi, everyone :)! I'm …

DEV Community

Australia Daily AI & LLM Briefing - November 16, 2026

Australia Daily AI & LLM Briefing - November 16, 2026 A curated intelligence briefing on AI infrastructure, enterprise agent governance, sovereign compute, regulatory overhauls, and foundation model deployments across the Australian technology ecosystem over the past 24 to 48 hours. 1. Top Headlines & Major Announcements Microsoft Outages Put Canberra's Resilience Pact to the Test as Phishers Exploit M365 & Copilot Disruption Following Friday's cascading outage across Microsoft 365, Teams, and Copilot that disrupted federal agencies and private enterprises across Australia, Canberra's multi-cloud "Resilience Pact" has come under intense scrutiny. Security researchers at iTnews Australia warned that cybercriminals immediately deployed opportunistic phishing campaigns impersonating IT service desks restoring M365 access, attempting to harvest session tokens and bypass multi-factor authentication while enterprise systems recovered. Policy analysts in Canberra note that the event will accelerate federal procurement requirements for sovereign compute redundancy and multi-cloud fallback architectures. Sources: InnovationAus | iTnews Australia AMD Unveils 256-Core Zen 6 EPYC Venice Server Chip, Challenging NVIDIA's Data Centre Dominance AMD has taken the wraps off its sixth-generation Zen 6 EPYC "Venice" server processor, packing 256 dense cores into a single socket. Highlighted by Australian enterprise infrastructure analysts as a pivotal shift in AI and high-performance compute hardware, Venice challenges NVIDIA's hardware leadership and offers Australian data centre operators new architectural options for dense inference, sovereign compute clusters, and energy-efficient AI workloads amid mounting power grid constraints in Sydney and Melbourne. Sources: iTWire Australia Warns of Escalating AI-Driven Scams & Account Takeovers as Annual Losses Hit AU$2.18B Australian federal authorities and consumer security bodies have issued an urgent advisory warning that generative AI, neural voice cloning, and automated credential stuffing are making impersonation scams and account takeovers far harder to detect. With Australians reporting AU$2.18 billion in scam losses in 2025, legal scholars and safety advocates are pointing to Victoria's pioneering mandatory seat-belt laws as a blueprint for Canberra, urging "built-in by design" AI safety standards before autonomous agents entrench themselves across critical banking and telecommunications infrastructure. Sources: TechDay Australia (AI Scams) | TechDay Australia (Public Safety Legacy) Amazon Moves to Fortify Proprietary Product Data Against Autonomous AI Shopping Agents Amazon has outlined an extensive strategic defence designed to shield its structured global product catalogues from being crawled, indexed, and intermediated by third-party autonomous AI shopping agents. As autonomous purchasing agents and agentic commerce workflows begin testing in the Australian retail market, the initiative signals an escalating battle between proprietary commercial data owners and external AI models attempting to intermediate consumer transactions. Sources: iTnews Australia 2. Model & Open-Source Technical Advancements Google Cloud Enables BigQuery Direct Queries on Databricks Iceberg to Break Down AI Lakehouse Silos Google Cloud introduced bi-directional Apache Iceberg interoperability, allowing BigQuery query engines to analyse Databricks-managed Iceberg lakehouses directly without moving or duplicating underlying data. Australian data platform architects and enterprise AI engineering teams can now run high-performance analytics and retrieval-augmented generation (RAG) pipelines seamlessly across lakehouses while eliminating cross-cloud egress costs. Sources: ITBrief Australia ArmourCode Releases Open-Source Guardrail Hooks to Block Autonomous Coding Agent Risks Enterprise application security leader ArmourCode has released an open-source pre-execution hooks framework engineered specifically to restri...

Powered by Readybot.io

**DEV Community** ## Australia Daily AI & LLM Briefing - …

DEV Community

Điểm tin AI & Mô hình Ngôn ngữ Lớn (LLMs) tại Úc - Ngày 16/11/2026

Điểm tin AI & Mô hình Ngôn ngữ Lớn (LLMs) tại Úc - Ngày 16/11/2026 Bản tin tổng hợp chuyên sâu về hạ tầng AI, quản trị agent doanh nghiệp, điện toán có chủ quyền, cải cách pháp lý và triển khai mô hình nền tảng trên khắp hệ sinh thái công nghệ Úc trong 24 đến 48 giờ qua. 1. Tiêu điểm & Các Công bố Quan trọng Sự cố Microsoft Đặt Hiệp ước Chống chịu của Canberra vào Thử thách Khi Tin tặc Lợi dụng Gián đoạn M365 & Copilot Sau sự cố sập diện rộng các dịch vụ Microsoft 365, Teams và Copilot làm gián đoạn nghiêm trọng các cơ quan chính phủ và doanh nghiệp tại Úc vào cuối tuần qua, "Hiệp ước Chống chịu" đa đám mây của Canberra đang được xem xét khẩn cấp. Các chuyên gia an ninh tại iTnews Australia cảnh báo tội phạm mạng đã lập tức tung ra các chiến dịch lừa đảo mạo danh bộ phận hỗ trợ kỹ thuật khôi phục M365 nhằm đánh cắp mã truy cập và vượt qua xác thực đa yếu tố. Các nhà hoạch định chính sách tại Canberra nhận định sự cố này sẽ đẩy nhanh các yêu cầu bắt buộc về dự phòng điện toán chủ quyền và kiến trúc đa đám mây trong mua sắm công. Nguồn trích dẫn: InnovationAus | iTnews Australia AMD Ra mắt Chip Máy chủ Zen 6 EPYC Venice 256 Nhân, Thách thức Vị thế Thống trị của NVIDIA tại Trung tâm Dữ liệu AMD vừa chính thức công bố bộ xử lý máy chủ thế hệ thứ sáu Zen 6 EPYC "Venice" với mật độ lên tới 256 nhân trên một socket duy nhất. Được các chuyên gia hạ tầng doanh nghiệp tại Úc đánh giá là bước ngoặt lớn đối với phần cứng AI và điện toán hiệu năng cao, dòng chip Venice thách thức trực diện vị thế dẫn đầu của NVIDIA và mang đến cho các nhà vận hành trung tâm dữ liệu Úc lựa chọn mới cho suy luận mật độ cao, cụm điện toán chủ quyền và khối lượng công việc AI tối ưu năng lượng trước áp lực lưới điện tại Sydney và Melbourne. Nguồn trích dẫn: iTWire Cảnh báo Lừa đảo Ứng dụng AI và Chiếm quyền Tài khoản tại Úc Khi Thiệt hại Đạt 2,18 Tỷ AUD Các cơ quan quản lý và an toàn tiêu dùng liên bang Úc vừa ban hành cảnh báo khẩn cấp trước sự gia tăng của các vụ lừa đảo mạo danh và chiếm đoạt tài khoản ứng dụng AI tạo sinh, giả mạo giọng nói nơ-ron và tấn công tự động. Trong bối cảnh người dân Úc ghi nhận mức thiệt hại 2,18 tỷ AUD trong năm 2025, giới học giả pháp lý và chuyên gia an toàn đã nhắc lại tiền lệ tiên phong của bang Victoria về luật thắt dây an toàn bắt buộc, kêu gọi Canberra ban hành tiêu chuẩn an toàn AI "tích hợp từ thiết kế" (built-in by design) trước khi các tác nhân tự hành thâm nhập sâu vào hạ tầng ngân hàng và viễn thông. Nguồn trích dẫn: TechDay Australia (AI Scams) | TechDay Australia (Public Safety Legacy) Amazon Hành động Bảo vệ Dữ liệu Sản phẩm Độc quyền Trước Các AI Shopping Agent Amazon đã vạch ra sáng kiến chiến lược nhằm củng cố danh mục dữ liệu sản phẩm toàn cầu trước hoạt động thu thập, lập chỉ mục và trung gian hóa của các tác nhân AI mua sắm tự hành bên thứ ba. Khi các mô hình mua sắm tự hành và quy trình thương mại agentic bắt đầu thâm nhập thị trường bán lẻ tại Úc, động thái này báo hiệu cuộc cạnh tranh ngày càng gay gắt giữa các đơn vị nắm giữ dữ liệu thương mại độc quyền và các mô hình AI ngoại vi. Nguồn trích dẫn: iTnews Australia 2. Tiến bộ Mô hình & Công nghệ Nguồn Mở Google Cloud Cho phép BigQuery Truy vấn Trực tiếp Databricks Iceberg Xóa bỏ Rào cản Dữ liệu AI Google Cloud vừa bổ sung khả năng tương tác hai chiều với Apache Iceberg, cho phép công cụ BigQuery truy vấn trực tiếp kho dữ liệu Databricks Iceberg mà không cần sao chép hay di chuyển dữ liệu gốc. Đội ngũ kiến trúc sư nền tảng dữ liệu và kỹ sư AI doanh nghiệp tại Úc nay có thể vận hành các đường ống phân tích hiệu năng cao và hệ thống RAG liền mạch, loại bỏ triệt để chi phí tải dữ liệu qua lại giữa các đám mây. Nguồn trích dẫn: ITBrief Australia ArmourCode Ra mắt Bộ Hook Nguồn mở Chặn Rủi ro từ Tác nhân Lập trình Tự hành (Claude Code) Nhà cung cấp bảo mật ứng dụng doanh nghiệp ArmourCode vừa phát hành khung hook tiền thực thi (pre-execution hooks) mã nguồn mở nhằm kiểm soát phạm vi rủi ro của các tác nhân lập trình dòng lệnh tự hành như Claude Code của An...

Powered by Readybot.io

**DEV Community** ## Điểm tin AI & Mô hình Ngôn …

DEV Community

Exploring Global Air Pollution Trends with Python and Pandas

python #datascience #dataanalytics #environment Air pollution is a major environmental health concern. I wanted to understand how air quality differs between countries and how pollution levels changed over time. This led me to build my Global Air Quality Analysis project. Project Overview The project explores annual PM2.5 exposure data for 87 countries between 2010 and 2019. PM2.5 refers to fine particulate matter with a diameter of 2.5 micrometres or less. The analysis uses data attributed to the World Health Organization's Global Health Observatory, accessed through Our World in Data. My Analytical Process The project follows a workflow covering data cleaning, validation, country comparisons, trend analysis and visualisation. Using Python, Pandas, NumPy and Matplotlib, I explored questions such as: Which countries had the highest reported exposure? How did average exposure change between 2010 and 2019? Which countries showed improvements? How did regional trends differ? Selected Results The repository reports the following dataset findings: Indicator Result 2010 average PM2.5 35.3 µg/m³ 2019 average PM2.5 31.7 µg/m³ Highest 2019 value Kuwait, 64.1 µg/m³ Lowest 2019 value Bahamas, 5.2 µg/m³ Largest reported improvement China, −9.0 µg/m³ These figures describe the analysed dataset and its averaging method. They should not automatically be interpreted as population-weighted global exposure estimates. Understanding the Limitations One important detail is that the project uses the historical WHO guideline of 10 µg/m³ for annual PM2.5 exposure. The WHO updated its annual guideline to 5 µg/m³ in 2021. The dataset also contains modelled national estimates rather than continuous direct measurements from every location. National averages can hide substantial differences between cities, rural areas and seasons. What I Learned This project helped me practise translating environmental datasets into understandable visualisations. It also highlighted why analytical conclusions need to explain their data sources, time periods and limitations. Future Work I would like to explore newer observations, uncertainty intervals and comparisons between urban and rural exposure. GitHub: https://github.com/tasnem-tech/global-air-quality-analysis How do you communicate uncertainty when presenting environmental data?

Powered by Readybot.io

**DEV Community** ## Exploring Global Air Pollution Trends with Python …

DEV Community

Flisk: run a multi-service app on your laptop with one command (and what it does not do)

Flisk is an open-source command-line tool that runs every part of a multi-service app (API, website, worker, database) on your own computer with one command. The README says a small app starts "as two local processes in about a second", with no Docker. Repo URL: https://github.com/flisk-sh/flisk Language: TypeScript CLI (Ink terminal UI). Runs on Node.js 22.12+. Your own services can be Node, Python, Go, Rust, JVM, Ruby or PHP. Try it: npx @flisk-sh/flisk demo. No signup, no global install. With Docker and Tilt it starts a six-service restaurant demo with Postgres, one gateway and live reload. Without them it starts a small menu app as two local processes at http://localhost:3000, and flisk down stops it. CLI: flisk create asks a few questions and writes a project that runs. flisk import . reads a docker-compose.yml and writes one service.json per Compose service, keeping ports, names and env values. flisk up starts services in health-checked dependsOn order and prints a .localhost URL for each. flisk status, flisk logs and flisk doctor show what is running and what is wrong. flisk down stops everything. Config: One small service.json per service. From it Flisk writes the Dockerfile, the Compose entry, the Traefik route, the health check and DATABASE_URL. It refuses to start if a generated file was edited by hand, and flisk config verify reports drift. Docker: Optional. Services that each declare a command run as plain local processes. A database, one gateway URL for every service, or the same container you deploy need Docker (Engine 25+) and Tilt 0.25+. For AI helpers: flisk mcp is an MCP server with 24 tools for Claude Code, Codex and Cursor. flisk connect claude (or cursor, codex) adds it. The idea is that the helper writes your app and Flisk writes the setup around it, the same way every time. Speed (from the repo's own benchmarks): A plain Compose app (a Node API and Postgres) answered through Flisk's router 49 s after flisk import on a clean Ubuntu CI runner, images pulled and built from scratch. With warm image layers, a one-backend stack is healthy in 12.8 to 13.8 seconds. An 8-service stack settles in 32 to 42 seconds warm and about 4.5 minutes on its first cold build. Licence: MIT. flisk up needs no key. Premium extras are optional. Maturity: The npm package is at 1.4.x and the repo has thousands of commits. The README lists five teams that run flisk up on their own code, with their consent. The timings above come from CI runs the README links, not from an independent benchmark. Not a deploy tool: It does not emit Kubernetes manifests and does not replace Helm, Kustomize, Flux or Argo. The one export scope is opt-in: flisk export render, wrangler and compose write render.yaml, wrangler.toml or a standalone docker-compose.yml. They write files only. They never deploy and never call a cloud API. Windows: flisk demo and local processes work natively. The full Docker stack runs in Ubuntu on WSL2. Not mentioned: Memory use compared with plain Compose, support for apps that need a local Kubernetes cluster, and any third-party benchmark. When it fits, and when it does not It fits when you run 3 to 10 services locally, you are tired of keeping a Compose file, a Tiltfile and a gateway config in sync by hand, or you want an AI helper to start and fix your stack without rewriting a Dockerfile each time. It does not fit when your app is a single process, when your local setup already needs a real cluster, or when you want a tool that also ships to production. Try it in 30 seconds npx @flisk-sh/flisk demo
Already have a Compose file? npx @flisk-sh/flisk import .
npx @flisk-sh/flisk up
Add --dry-run to import to preview first. Repo: https://github.com/flisk-sh/flisk · Site: https://flisk.sh

Powered by Readybot.io*

**DEV Community** ## Flisk: run a multi-service app on your …

DEV Community

Props in React

When building a React application, we usually divide our application into small components. For example, an e-commerce website may have: Navbar component Product component Cart component Footer component Sometimes, one component needs to send data to another component. This is where Props come in. 1. What are Props? Props stands for Properties. Props allow us to pass data from one component to another in React. In simple words, props help components share data with other components. For example, we can send a username from the App component to the Profile component. 2. How to Pass Props? Let's understand with a simple example. App.jsx function App() {
return (

);
}

export default App;
Here, we are passing name="Lokesh" to the Profile component. Profile.jsx function Profile(props) {
return (

Hello, {props.name}


);
}

export default Profile;
Output: Hello, Lokesh
Let's understand what happened: App sends the name Lokesh to Profile. Profile receives the data through props. We display the name using props.name. That's how props work! 3. Passing Multiple Props We can pass more than one value to a component. function App() {
return (

);
}
Now, we can receive these values in the Student component. function Student(props) {
return (


Name: {props.name}


Age: {props.age}


Course: {props.course}



);
}
We can pass different types of data through props, such as: Strings Numbers Arrays Objects Functions Boolean values 4. What is Props Destructuring? Instead of writing props.name, props.age, and props.course every time, we can use destructuring. Example: function Student({ name, age, course }) {
return (

Name: {name}


Age: {age}


Course: {course}



);
}
Here, we directly get the values from props. This makes our code shorter and easier to read. 5. Passing Props to Reusable Components One of the biggest advantages of props is that we can reuse the same component with different data. Imagine we are creating an e-commerce website with multiple product cards. Instead of creating a separate component for every product, we can create one reusable Product component. App.jsx function App() {
return (

  <Product name="Mobile" price={20000} />

  <Product name="Headphones" price={2000} />
</div>

);
}
Product.jsx function Product({ name, price }) {
return (


{name}


Price: ₹{price}



);
}
The same Product component displays different products based on the props it receives. This helps us avoid writing the same code again and again. 6. Important Rules About Props There are a few important things to remember: Props are used to pass data between components. Data usually flows from parent components to child components. Props can contain different types of values. Props are read-only. A child component should not directly modify the props it receives. We can use destructuring to make props easier to read. 7. Props vs State Props and State are both used to work with data in React, but they have different purposes. Props State Used to receive data from a parent component Used to manage data inside a component Read-only for the receiving component Can be updated using a state setter Passed from parent to child Managed by the component that owns it For example: Props: Passing a product name from App to Product. State: Updating the quantity of a product when the user clicks the + button.

Powered by Readybot.io

**DEV Community** ## Props in React When building a React …

DEV Community

AI is the assistant, not the staff

The series so far: The specification comes first. Why I write a specification before any screens, and the tests I hold one to. The specification had to change. The review of version 3 asked for decisions, not features, and those decisions became version 4. Build in stages. The build order version 4 created, the five stages in the running site, and why payments waited. What you can do on the site today. A tour of Exit 719 as it stood: one account, many groups, what members and owners see, and what was not built yet. This post. Who is in the room while I build: the AI tools I use, the weekly limit on each, and the decisions I keep. The first four posts were about the specification, the review that changed it, the stage order, and what Exit 719 does today. This one is about who is in the room while I build it. Most days that is me, and an AI assistant with a weekly limit. What I used to have At my last company I still did the coding, the AWS work, and the version control. The staff was lean. We had a few coders, a design team, and a CSS team. The coders split their time between SQL Server and C# on .NET 4. The pages were AJAX. We used libraries that already contained the grids, the editors, and the other controls, so a screen started from a part that existed. That was a small team, and it was still a team. Someone else could look at a page. Someone else owned the stylesheet. Someone else had already built the control I was about to drop on a form. This time I am solo. Exit 719 is .NET 10, Razor pages, and PostgreSQL, on a Linux machine I set up myself. There is no control library waiting for me, and there is no second developer at the next desk. AI is the assistant I use to review documents and code, and to show me the strong points and the weak ones. It is not a second employee. It does not own the specification, and it does not decide when a stage is done. The tools, and the limit on each one On this computer I use two Grok applications, SuperGrok and Grok Bot. Each one has its own weekly usage limit. When a tool is near the limit, I stop and decide what is worth the rest of the week. That limit is useful. It keeps me from asking for ten half-thought changes at midnight. I also use Poe when I want another model, or when I want a chunk of code or a document review that should not come from the same model that wrote the draft. Poe can reach the other major models. I send the same review to more than one of them. They do not agree. That is why I do it. A single review agrees with the person who wrote the page. Two reviews argue, and the argument is where the weak spot shows up. I am also putting Claude Code on this machine, a local application, to help with the code itself. Grok has been the environment and the long specification work. Poe has been the second opinion. Claude Code is the next pair of hands in the editor. None of them replace the decision. The prompt is a document, not a sentence The habit that matters most is the same habit as the specification. When I want a change, I write a prompt document. I read it more than once. I fix the vague lines before I hand it to the bot. Then the local bot implements that document. The writing is what flushes the idea out. By the time the bot sees it, the feature has a shape: what the screen shows, what it must not do, and what "done" means. Version 3 of the Exit 719 specification went through that kind of review before it became version 4. A prompt for a smaller change goes through a shorter version of the same pass. If I skip it, I get a confident answer to a question I had not finished asking. The machines I run Zorin Linux. Grok integrated Visual Studio Code on that machine. It could have been another Linux. The point is that the bot sat with me through the setup: the local environment, GitHub, and AWS. I have built AWS environments myself for years. This time I gave the bot the prompts, it did the setup, and it saved me a few days. It also set up the GitHub repository, prepa...

Powered by Readybot.io

**DEV Community** ## AI is the assistant, not the staff …

DEV Community

Building a Privacy-First Password Strength Checker with JavaScript

javascript #cybersecurity #webdev #showdev Password security is an important part of everyday digital safety. For my SecurePass project, I wanted to explore how a browser-based application could provide useful password feedback without sending the entered password to a server. Introducing SecurePass SecurePass is an educational password strength analyser and random password generator built using HTML, CSS and JavaScript. The application runs locally in the browser. Its main features include: Live password strength feedback Common-password and predictable-pattern checks Improvement suggestions Random password generation Responsive design Automated tests How Password Analysis Works The application evaluates factors such as password length, character variety and predictable patterns. It then displays a score between 0 and 100. However, this is a heuristic score. A high score does not guarantee that a password is secure. A password may look complex but still be compromised, reused or vulnerable to other attacks. Generating Random Passwords One technical decision was using the browser's Web Crypto API. The generator uses crypto.getRandomValues() as its source of secure randomness. It also uses rejection sampling to avoid modulo bias when selecting characters. This is preferable to relying on Math.random() for security-sensitive password generation. Privacy Considerations SecurePass does not require a backend to analyse passwords. The repository documents that passwords are not uploaded, stored or sent to analytics services. There are still limitations. For example, copying a password to the system clipboard can expose it to other software. The application also does not check whether a password has appeared in a known data breach. Testing and Future Improvements The project includes automated tests using Node.js's built-in test runner. Planned improvements include: Evaluating a well-reviewed password estimation library Adding continuous integration Improving accessibility testing Adding a real application screenshot What I Learned This project helped me explore privacy-aware frontend design, browser cryptography and automated testing. It also reinforced the importance of communicating security limitations clearly. For real accounts, I recommend using unique passwords, a trusted password manager and multi-factor authentication. GitHub: https://github.com/tasnem-tech/securepass-password-checker What additional security features would you consider useful in an educational password tool?

Powered by Readybot.io

**DEV Community** ## Building a Privacy-First Password Strength Checker with …

DEV Community

Browser Image Upload to Object Storage: 4 Retention Checks for Logistics Exports

Browser Image Upload to Object Storage: 4 Retention Checks for Logistics Exports Short answer: use a private bucket, let the server create a tenant-bound object key, and give the browser a presigned upload URL. For logistics product images, the difficult decision is not how to move bytes. It is what deletion means after an export has been generated. Option Browser upload Retention boundary Tenant export fit Choose it when Amazon S3 Presigned PUT or POST Lifecycle, versioning, Object Lock options Strong AWS governance is already in place Google Cloud Storage Signed URLs Lifecycle and retention policies Strong The application is GCP-native Cloudflare R2 Presigned URLs Lifecycle semantics need careful review Good The wider system is Cloudflare-centered A shared REST storage surface Presigned URLs Private objects plus application-managed deletion Good for smaller teams Minimal SDK and credential glue matters My decision rule is narrow: choose the shared REST path when private tenant images, explicit application deletion, and a short implementation path matter more than storage-native retention locks or replication. Infrai's concrete advantage is one REST API: pure HTTP, no SDK to install, and any runtime that can send an HTTP request can call it. One key covers a broad backend surface with one bill, which reduces credential inventory and glue when the workflow later connects image processing to storage. It does not turn a prefix into an authorization policy or make deletion immutable. The limitation is just as important: one key and one bill also create a wider trust boundary. Infrai's second advantage is a single key and a single bill across the broader backend surface, which removes credential inventory and billing reconciliation work when image processing connects to storage. If your security review requires separate provider accounts or independent billing controls, choose direct S3 or GCS instead. The second advantage is a single key and a single bill across the broader backend surface. That removes a credential inventory and billing reconciliation step when image processing connects to storage. How can I upload an image directly to object storage using browser JavaScript? Very little. The application server should know the tenant, user, generated object key, and retention class. The browser needs a file input, a temporary upload URL, and the result of the upload. It should never receive the platform credential. Keep it private. For a product catalog, I would use a key such as tenant_42/products/sku-8841/source.jpg. That prefix makes listing and cleanup understandable. It is not a security boundary. The database still decides whether the current user may write or read that object. The server creates one presigned URL for one intended object. It records the object location only after checking the upload response, then associates that location with the tenant and product row. A filename supplied by a user is data, not an object identity. Generate the key on the server. Here is the small TypeScript boundary. The presign function belongs on the application server. The file upload itself goes to the returned URL, without the platform authorization header. const apiKey = process.env.INFRAI_API_KEY;
const apiBase = process.env.INFRAI_API_BASE_URL;

if (!apiKey || !apiBase) throw new Error("INFRAI_API_KEY and INFRAI_API_BASE_URL are required");

async function presignObject(bucket: string, key: string, operationId: string): Promise {
for (let attempt = 0; attempt < 4; attempt += 1) {
const response = await fetch(
${apiBase}/storage/object/presign/${encodeURIComponent(bucket)}/${encodeURIComponent(key)},
{
method: "POST",
headers: {
Authorization: Bearer ${apiKey},
"Content-Type": "application/json",
"Idempotency-Key": operationId,
},
body: JSON.stringify({ acl: "private" }),
},
);

if (response.ok) {
  const payload = (aw...


Powered by Readybot.io

**DEV Community** ## Browser Image Upload to Object Storage: 4 …

DEV Community

GitHub Actions Workflow Lockfile: Pin Transitive Deps

GitHub just made workflow lockfiles generally available, and the gh actions-lock command finally answers a question that SHA pinning never could: what about the actions your actions call? A GitHub Actions workflow lockfile records exact commits for actions and their transitive dependencies, while your YAML keeps its readable @v4 style references. That's the release. The harder part is rolling it out without freezing CI, and knowing what it still doesn't prove. TL;DR A lockfile fixes which commit runs, including the nested actions you never see in your YAML. It's a real upgrade over hand pinning the top level only. Roll it out one workflow at a time, and add a guard that fails a PR when a uses: line changes without the lockfile changing. It says nothing about how an action was built or whether your repo is configured safely. SLSA provenance and OpenSSF Scorecard cover those, and you still need both questions answered. Dependency risk in workflow YAML Here's the workflow most of us have in a repo right now: # .github/workflows/ci.yml
name: ci
on: [pull_request]
permissions:
contents: read
jobs:
test:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: your-org/setup-toolchain@v2
- run: npm test
Two uses: lines, and they look harmless. But @v2 is a Git tag, and a tag is a pointer that someone with write access can move. If setup-toolchain is a composite action, it has its own uses: lines inside its action.yml, and those have their own tags. You reviewed two lines. You're running a tree. The old fix was replacing every tag with a 40 character SHA. It works for the top level, it makes the YAML unreadable, and it doesn't reach the nested layer unless the action's author pinned too. You can't pin someone else's action.yml from your repo. That gap is the footgun, and it's the specific thing the lockfile closes. This matters more once your pipelines do real work on their own. If you're moving toward production AI agent workflows, CI is where those agents get tokens, and an action you never reviewed runs with the same job permissions as the ones you did. gh actions-lock migration Before you generate anything, find out what you have. This script needs only the Python standard library. It reads your workflows and any local composite actions, then sorts each reference by how it's pinned: #!/usr/bin/env python3

audit_uses.py: run from the repo root

import collections
import pathlib
import re

USES = re.compile(r"""^\s(?:-\s)?uses:\s*['"]?([^'"\s#]+)""")
SHA = re.compile(r"^[0-9a-f]{40}$")

def classify(ref: str) -> str:
if ref.startswith("./"):
return "local"
if ref.startswith("docker://"):
return "docker"
if "@" not in ref:
return "unknown"
return "sha" if SHA.match(ref.rsplit("@", 1)[1]) else "mutable"

root = pathlib.Path(".github")
files = [p for p in root.rglob("*") if p.suffix in {".yml", ".yaml"}]
found = collections.defaultdict(set)

for path in files:
for line in path.read_text(encoding="utf-8").splitlines():
match = USES.match(line)
if match:
found[classify(match[1])].add(f"{match[1]} ({path})")

for kind in sorted(found):
print(f"\n{kind}: {len(found[kind])}")
for item in sorted(found[kind]):
print(f" {item}")
The mutable bucket is your migration list. Now resist doing the whole org in one PR. Here's the order I'd use: Audit with the script above and save the output, so you've got a before picture. Lock one workflow that's low stakes but runs often. A docs build is ideal. Run gh actions-lock, commit what it generates, and read the result before you merge. I'm leaving flags out on purpose: the changelog entry and gh actions-lock --help are the source of truth for a tool this new. Review the transitive entries. This first read is where you'll learn what your actions actually depend on. Expand to the workflows that hold deploy credentials once a few normal PRs have passed through. Transiti...

Powered by Readybot.io

**DEV Community** ## GitHub Actions Workflow Lockfile: Pin Transitive Deps …

DEV Community

Building TeachBack AI: An Adaptive Study Coach Using NLP

Tags: #ai #python #machinelearning #education Have you ever read a chapter several times, felt confident about it, and then struggled to explain the topic without looking at your notes? This is one of the learning problems I wanted to explore when developing TeachBack AI. What Is TeachBack AI? TeachBack AI is an adaptive study-coaching application that encourages students to explain concepts in their own words. Rather than simply asking learners to recognise the correct answer, the application uses a teach-back approach. The basic learning cycle is: Read or upload study notes. Identify important concepts. Explain a concept in your own words. Receive feedback. Practise weaker areas. Track progress over time. The Technology The project uses natural language processing and semantic similarity. Its documented components include: Sentence-BERT: The all-MiniLM-L6-v2 model is used to compare the meaning of student explanations with source material. TF-IDF: Helps identify important terms and concepts. Cosine similarity: Supports text comparison and provides a fallback mechanism. Streamlit: Provides the interactive user interface. The application is designed to run without a paid API key. Why Semantic Similarity? Two explanations can express similar ideas using different words. A simple keyword-matching system may struggle to recognise this. Semantic embeddings provide a way to compare text based on learned representations of meaning. However, similarity does not guarantee factual correctness or deep understanding. A response can be semantically close to reference material while still containing errors. Adaptive Learning TeachBack AI uses mastery information to prioritise topics where the learner appears to need more practice. The repository also describes features such as missing-concept detection, adaptive cloze practice and progress tracking. The objective is to encourage active explanation rather than passive rereading. Limitations This is an educational prototype. It has not been established that the system improves learning outcomes compared with conventional teaching methods. The quality of its feedback depends on the source notes, concept extraction and similarity model. Future evaluation should involve real learners, human-reviewed explanations and comparisons with established study methods. What I Learned Building this project helped me explore how NLP can support an interactive educational workflow. It also highlighted the difference between measuring text similarity and measuring actual student understanding. Conclusion TeachBack AI is part of my interest in applying machine learning to practical educational problems. GitHub: https://github.com/tasnem-tech/teachback-ai Do you think AI study tools should focus more on generating answers or helping students explain concepts themselves?

Powered by Readybot.io

**DEV Community** ## Building TeachBack AI: An Adaptive Study Coach …

DEV Community

Props Drilling in React

When building React applications, we use props to pass data from one component to another. But what happens when we need to pass data through multiple components, even when some of those components don't need that data? This is called Props Drilling. Let's understand it with a simple example. 1. What is Props Drilling? Props Drilling happens when we pass data from a parent component to a deeply nested child component through multiple intermediate components. In simple words, we pass props through components just to reach another component that actually needs the data. 2. Understanding Props Drilling with an Example Imagine we have three components: App Profile User The App component has a username, and the User component needs to display it. But the User component is inside the Profile component. Let's see how we pass the data. App.jsx function App() {
const username = "Lokesh";

return ;
}

export default App;
Here, App sends the username to Profile. Profile.jsx function Profile({ username }) {
return ;
}
Profile receives the username and passes it to User. User.jsx function User({ username }) {
return

Welcome, {username}

;
}

export default User;
User finally receives the username and displays it. Output: Welcome, Lokesh
3. Why is This Called Props Drilling? Look at how the data travels: App
|
| username
↓
Profile
|
| username
↓
User
The App component sends the username to Profile. Profile doesn't need the username for its own purpose. It only passes it to User. This repeated passing of props through intermediate components is called Props Drilling. 4. What Problems Does Props Drilling Cause? Props Drilling is not always bad. For small applications, it is perfectly fine. But when an application becomes larger, it can cause some problems: More code: We need to pass the same props through multiple components. Difficult to maintain: Changing the data flow can become complicated. Unnecessary props: Some components receive data they don't actually use. 5. How Can We Avoid Props Drilling? React provides a feature called Context API. With Context API, we can share data between components without passing props through every intermediate component. Let's use createContext and useContext. App.jsx import { createContext } from "react";
import Profile from "./Profile";

// Creating context
export const UserContext = createContext();

function App() {
const username = "Lokesh";

return (



);
}

export default App;
Here, we create a context and provide the username to the components inside the Provider. Profile.jsx import User from "./User";

function Profile() {
return ;
}

export default Profile;
Notice that Profile doesn't need to receive or pass the username anymore. User.jsx import { useContext } from "react";
import { UserContext } from "./App";

function User() {

const username = useContext(UserContext);

return

Welcome, {username}

;
}

export default User;
Now User can directly access the username using useContext(). We no longer need to pass the username through Profile. 6. Props Drilling vs Context API Props Drilling Context API Passes data through multiple components Shares data through a Provider Intermediate components pass props Intermediate components don't need to pass the value Useful for simple data flow Useful for data shared by many components 7. When Should We Use Context API? Context API can be useful when multiple components need the same information. For example: Dark Mode: Share the selected theme across components. Authentication: Share logged-in user information. Shopping Cart: Share cart information across different pages. Language Settings: Share the selected language. However, don't use Context API for every situation. For simple parent-to-child communication, normal props are usually enough.

Powered by Readybot.io

**DEV Community** ## Props Drilling in React When building React …

DEV Community

I Built a 100% Offline Resume Builder So I Wouldn't Have to Share My Phone Number & Email

Tired of spam calls and paywalled PDFs, I created PrivyResume—a local-first resume workbench that keeps your personal data strictly in your browser. Whenever you try to update your resume online, almost every website follows the exact same playbook: Let you spend 30 minutes typing out your entire career history. Force you to create an account with your email and phone number. Hit you with a surprise paywall right when you click "Download PDF." Sell or leak your contact details—leading to endless spam calls and shady recruiter messages. I got tired of handing over my personal phone number and email address to random databases just to generate a clean PDF. So, I built PrivyResume for my own use. What is PrivyResume? PrivyResume is a 100% client-side, offline-capable resume workbench. There are no user accounts, no backend databases, and zero tracking scripts. Here is how it works: Full Privacy First (Zero Servers): Your phone number, email address, and work history stay strictly inside your browser's localStorage. Nothing ever leaves your device or touches a server. Multi-Profile Support: Create and switch between multiple resume versions locally (for example, one tailored for Frontend roles and another for Full-Stack) right inside the browser. 1-Click Share Link: Need to send a live version quickly? Generate a shareable link with a single click. Export & Import via JSON: Because your data lives locally in your browser, you can download your resume as a raw .json file anytime to back it up or move it to another device. Free PDF Export & Print: Generate clean, print-ready PDFs with zero watermarks or paywalls. Built to Scratch My Own Itch I originally built this purely as a personal tool so I could keep my master resume backed up as a simple JSON file and export clean PDFs without worrying about data harvesting. If you are currently job hunting—or just want a fast, private way to maintain your resume without creating yet another account—give it a try here: Try PrivyResume I would love to hear your thoughts, feedback, or feature ideas in the comments!

Powered by Readybot.io

**DEV Community** ## I Built a 100% Offline Resume Builder …