# false positive Published articles for false positive. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## Tapjacking Protection: Rejecting Android Touches Behind an Overlay DevFeed: [Tapjacking Protection: Rejecting Android Touches Behind an Overlay]() Original publisher: [Read original article]() Author: Shai Almog Published: 2026-08-25T00:00:00Z Content type: release Language: en Sources: [CodeName One]() Topics: [Android](), [Security]() Tags: [android](), [android-12](), [false-positive](), [hardening](), [protection](), [report]() ### AI overview Codename One adds Android tapjacking and screen-overlay protection. The feature can report or block gestures that begin behind another application's overlay and can ask Android 12 or newer to prevent overlays on sensitive screens. ### Source excerpt Codename One can now report or block Android gestures that begin behind another application's overlay, and can ask Android 12 or newer to hide overlay windows on sensitive screens. ## Calibrating LLM-Based Population Estimates with Human Validation DevFeed: [Calibrating LLM-Based Population Estimates with Human Validation]() Original publisher: [Read original article]() Author: Hiroshi Urata Published: 2026-08-12T00:29:34Z Content type: article Language: en Sources: [Indeed]() Topics: [Large Language Model](), [human feedback](), [data](), [LLM evaluation / benchmarking]() Tags: [classification](), [data](), [data-science](), [dataset](), [evaluation](), [false-negative](), [false-positive](), [llm](), [machine-learning](), [measurement](), [validation]() ### AI overview The article explains how human validation can calibrate LLM-based population estimates. It distinguishes an LLM's apparent positive rate from true prevalence, uses human-validated samples to estimate sensitivity and specificity, and applies those error estimates to correct population-level measurements and quantify uncertainty. ### Source excerpt Key Idea Human validation is not only for evaluating an LLM. It can also calibrate how the LLM is used as a scalable measurement instrument for population estimation. An LLM can classify thousands of records at low cost, but the proportion it classifies as positive is not necessarily the true proportion in the population. By [...] ## Outlier Handling at Scale in Experimentation DevFeed: [Outlier Handling at Scale in Experimentation]() Original publisher: [Read original article]() Author: Margarida Moreira da Silva Published: 2026-07-01T13:44:26Z Content type: article Language: en Sources: [Booking.com Data Science]() Topics: [experiments](), [data](), [Simulation](), [Ground truth / benchmark quality](), [plotting]() Tags: [data](), [experimentation](), [experiments](), [false-positive](), [outlier-detection](), [simulation](), [variance]() ### AI overview The article examines how extreme values affect experimentation at Booking.com. It describes permutation tests and simulated A/A experiments for diagnosing distorted p-value distributions, and reports that increasing outlier magnitude and frequency can cause test failures. ### Source excerpt At Booking.com, thousands of experiments run simultaneously across highly heterogeneous users, from individual travellers to large travel agencies. This means our experiment data regularly contains legitimate but extreme values. When these go unhandled, they distort the statistical conclusions we draw, leading us to scale ideas that don't create value, or to discard ones that do. So, we need outlier handling methods that are reliable, automated, and applicable across diverse metrics without manual intervention. The Problem When extreme values are present in experiment data, they can compromise the estimation of average treatment effects (ATE), leading to unreliable test results and reduced statistical power. Even a single observation can inflate variance enough to mask a real effect or produce a spurious one. In practice, this means we risk shipping changes that appear positive but are not, or killing promising features because noise masked their real effect. At Booking.com's scale, this increase in false conclusions quickly compounds into a meaningful impact on customer experience and business outcomes. A Diagnostic Tool: the Permutation Test One way to assess whether extreme values are distorting results is the permutation test. By permuting over experiment data, we generate hundreds of simulated AA experiments where we know the ground truth: there is no real effect. Plotting the resulting p-values, we expect a uniform distribution. If it instead looks skewed, the underlying data distribution is compromising the validity of results. Plot 1: P-value distributions from simulated A/A tests. Clean normally-distributed estimated effects produce a uniform distribution (left), while the presence of extreme outliers results in skewed p-values (right), indicating a distorted false positive rate.Simulation Evidence: What Drives Failure? We ran AA permutation tests across a range of simulated data distributions to understand when they fail (i.e. not show a uniform p-value di ## Cuckoo Filters: Cache-Friendly Membership Checks With Deletions DevFeed: [Cuckoo Filters: Cache-Friendly Membership Checks With Deletions]() Original publisher: [Read original article]() Author: hello@ankit-rana.com Published: 2026-03-17T00:00:00Z Content type: tutorial Language: en Sources: [Ankit Rana | Mechanical Sympathy]() Topics: [CPU Cache](), [Caching](), [hash]() Tags: [cache](), [capacity](), [cpu-cache](), [cuckoo-filter](), [data-structures](), [false-positive](), [hash](), [insert](), [performance](), [probabilistic](), [spatial-locality](), [systems]() ### AI overview This article explains how Cuckoo filters support deletions while improving CPU cache behavior compared with counting Bloom filters. They check two specific buckets using compact fingerprints, but insertions can fail when kick-out chains exceed their limit, requiring capacity planning or overflow handling. ### Source excerpt A Cuckoo filter stores a one-to-two byte fingerprint in a hash table and finds it by checking exactly two buckets, the primary index and its XOR-derived alternate, instead of k random bit positions scattered across a large array. That spatial locality is the whole win on real CPUs. The trade-off is a hard edge: when the kick-out chain exceeds its limit, the insert fails outright. ## The Agentic OODA Loop: How AI and Humans Learn to Defend Together DevFeed: [The Agentic OODA Loop: How AI and Humans Learn to Defend Together]() Original publisher: [Read original article]() Author: Manoj Nair Published: 2025-11-10T05:00:00Z Content type: article Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [Securing AI](), [ai security](), [Security](), [Artificial Intelligence]() Tags: [adaptive](), [agentic](), [agentic-security](), [agents](), [ai](), [autonomous](), [autonomous-agents](), [awareness](), [blog](), [collaboration](), [context](), [cycles](), [executive](), [false-positive](), [loops](), [model](), [pmm](), [policy](), [real-time](), [reasoning](), [security](), [systems](), [visibility]() ### AI overview This article presents the Agentic OODA Loop as a model for human and AI security engineers to defend AI-native systems. Inspired by the fighter-pilot cycle of Observe, Orient, Decide, and Act, it advocates adaptive defense that gains real-time visibility, reasons about context, automates policy enforcement and remediation with human oversight, and continuously learns from alerts, false positives, and exploit attempts. ### Source excerpt Discover how AI and human security engineers collaborate to defend against evolving threats at machine speed. Learn about the new mindset for adaptive, intelligent, and symbiotic defense in the age of Agentic AI. ## Beware the false false-positive: how to distinguish HTTP pipelining from request smuggling DevFeed: [Beware the false false-positive: how to distinguish HTTP pipelining from request smuggling]() Original publisher: [Read original article]() Author: James Kettle Published: 2025-08-19T14:30:44Z Content type: article Language: en Sources: [PortSwigger Research]() Topics: [HTTP](), [vulnerability]() Tags: [2025](), [false-positive](), [how-to](), [http](), [tcp](), [tls](), [vulnerability]() ### AI overview This article explains how to distinguish HTTP pipelining, keep-alive, and connection reuse from genuine HTTP request smuggling vulnerabilities. It recommends disabling connection reuse when testing and introduces Burp Suite tools that help analyze low-level HTTP behavior. ### Source excerpt Sometimes people think they've found HTTP request smuggling, when they're actually just observing HTTP keep-alive or pipelining. This is usually a false positive, but sometimes there's actually a real ## Speed with Rigor: testing smarter with group sequential design DevFeed: [Speed with Rigor: testing smarter with group sequential design]() Original publisher: [Read original article]() Author: Gabriela Lewenfus Published: 2025-08-05T17:25:29Z Content type: article Language: en Sources: [OLX]() Topics: [Testing](), [A/B Testing](), [experiments](), [data](), [implementation]() Tags: [a-b-testing](), [ab-testing](), [data](), [efficiency](), [experiment](), [experimentation](), [false-positive](), [implementation](), [pitfalls](), [sequential-testing](), [statistics](), [testing]() ### AI overview The article explains how group sequential testing can replace fixed-horizon A/B tests with monitoring at predefined intervals while controlling error rates. It discusses how this approach addresses peeking, may allow ineffective tests to stop early, and involves practical trade-offs and implementation challenges. ### Source excerpt generated by chatgptIntroduction In the world of A/B testing and experimentation, it's tempting to check results frequently and stop tests earlier if they seem significant (a practice known as peeking). However, this practice dramatically inflates the false positive rate, leading to misleading conclusions. Imagine you're running an A/B test, and after just 10 days, the results look like a clear win. You might be tempted to end the experiment early and move forward with the release of the new feature. After all, why wait another two weeks as originally planned? But here's the catch: the more often you check the results, the higher the chance you'll spot a "win" that isn't real. Frequent peeking increases the risk of false positives -- in other words, drawing the wrong conclusion just by chance. To prevent peeking while ensuring statistical power, a common practice is to set a minimum sample size that must be reached before ending the experiment. However, this fixed horizon approach can extend the experiment's duration and delay decision-making. Group sequential testing (GST) provides a statistical framework to monitor results at predefined intervals while maintaining control over error rates. At OLX, we migrated from fixed horizon experiments to GST to achieve faster insights, lower costs, and greater efficiency, enabling our teams to make smarter, data-driven decisions with speed and confidence. In this post, I'll explain how GST works, how it can accelerate experiments while still preventing the pitfalls of peeking, and how we can use it even to stop ineffective tests early. Finally, I'll discuss real-world trade-offs and implementation challenges. Peeking is a trap Before we dive into GST, let's first understand what "peeking" is and why it's so concerning. Peeking occurs when the experimenter repeatedly checks an experiment's results and finishes it once a statistically significant effect appears. This inflates the false positive rate, leading to unreliable conclu ## Always Check Your Tests Against Faulty Inputs DevFeed: [Always Check Your Tests Against Faulty Inputs]() Original publisher: [Read original article]() Published: 2025-07-21T05:19:00Z Content type: tutorial Language: en Sources: [ipSpace.net blog]() Topics: [Testing](), [Network]() Tags: [automation](), [blog](), [blog-post](), [false-negative](), [false-positive](), [false-positives](), [netlab](), [network](), [ospf](), [testing](), [tests]() ### AI overview The article explains that tests must be checked with faulty inputs, not only under correct conditions. It uses a netlab integration test for mismatched OSPF network types as an example of a test that could miss the targeted error, and warns that false positives can be more harmful than false negatives. ### Source excerpt A while ago, I published a blog post proudly describing the netlab integration test that should check for incorrect OSPF network types in netlab-generated device configurations. Almost immediately, Erik Auerswald pointed out that my test wouldn't detect that error (it might detect other errors, though) as the OSPF network adjacency is always established even when the adjacent routers have mismatching OSPF network types. I made one of the oldest testing mistakes: I checked whether my test would work under the correct conditions but not whether it would detect an incorrect condition. Read more ... ## Собственный контент-фильтр на базе LLM: от эксперимента до стабильной системы DevFeed: [Собственный контент-фильтр на базе LLM: от эксперимента до стабильной системы]() Original publisher: [Read original article]() Author: Martianov (red\_mad\_robot) Published: 2025-06-27T15:23:17Z Content type: tutorial Language: ru Sources: [Redmadrobot EN](), [Redmadrobot RU]() Topics: [Large Language Model](), [Artificial Intelligence](), [llama]() Tags: [ai](), [false-positive](), [few-shot](), [few-shot-learning](), [filter](), [llama](), [llm](), [tag-6faff4be08e9](), [tag-b6293b9d443d]() ### AI overview The article describes how red_mad_robot developed a proprietary LLM-based content filter for AI services. It explains why heuristic methods such as regular expressions and keyword filters produced false positives and were easy to bypass, and outlines the use of real anonymized user queries and a structured model prompt to improve moderation. ### Source excerpt Привет! Меня зовут Миша Мартьянов, я инженер по исследованиям и разработке в red_mad_robot. Моя работа -- искать новые идеи, проверять гипотезы и улучшать продукты. На этом пути иногда приходится изобретать уникальные решения. Например, мы создали собственный фильтр, чтобы отсеивать нежелательный контент с помощью LLM. Рассказываю, как мы к этому пришли и с какими сложностями столкнулись. Читать далее ## CVE-2019-3826 as a false positive in OPA Gatekeeper Images DevFeed: [CVE-2019-3826 as a false positive in OPA Gatekeeper Images]() Original publisher: [Read original article]() Published: 2023-10-31T00:00:00Z Content type: opinion Language: en Sources: [Chainguard: Unchained]() Topics: [chainguard images](), [Security](), [Vulnerabilities](), [Prometheus](), [opa](), [GitHub]() Tags: [analysis](), [chainguard](), [chainguard-images](), [cve](), [cve-2019-3826](), [cves](), [deployment](), [false-positive](), [opa](), [prometheus](), [security](), [vulnerabilities](), [vulnerability](), [vulnerability-scanner]() ### AI overview This article explains that CVE-2019-3826 affects applications using Prometheus for metrics when they expose the web UI. It presents the Chainguard OPA Gatekeeper Image as unaffected because it does not expose that UI, making the scanner result a false positive. ### Source excerpt Unveil the false positive of CVE-2019-3826 and combat phantom menaces with Chainguard's vigilant security. ## How "junk CVEs" can misclassify ordinary bugs as vulnerabilities DevFeed: [How "junk CVEs" can misclassify ordinary bugs as vulnerabilities]() Original publisher: [Read original article]() Published: 2023-10-17T00:00:00Z Content type: opinion Language: en Sources: [Chainguard: Unchained]() Topics: [Vulnerabilities](), [chainguard images](), [Maintainers](), [NVD](), [Open Source]() Tags: [chainguard-images](), [code](), [cve](), [cves](), [developer](), [false-negative](), [false-positive](), [maintainers](), [nvd](), [open-source](), [vulnerabilities](), [vulnerability-management]() ### AI overview The article explains the concept of "junk CVEs," in which scanners report ordinary bugs as vulnerabilities. Through a fictional Halloween story, it describes how maintainers may dispute these reports and promotes Chainguard Images as a way to reduce reported vulnerabilities. ### Source excerpt Unveil 'junk CVEs' with Chainguard Images, your ally against disguised vulnerabilities, ensuring a secure codebase this Halloween. ## Why Chainguard uses Grype as its first line of defense for CVEs DevFeed: [Why Chainguard uses Grype as its first line of defense for CVEs]() Original publisher: [Read original article]() Published: 2023-10-06T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [grype](), [chainguard](), [Vulnerabilities](), [Security](), [Open Source](), [chainguard images](), [container images](), [Go](), [trivy]() Tags: [chainguard](), [chainguard-images](), [container-images](), [cve-remediation](), [cves](), [false-negative](), [false-positive](), [go](), [grype](), [open-source](), [prisma-cloud](), [sbom](), [security](), [snyk](), [trivy](), [vex]() ### AI overview Chainguard explains why it selected Grype as the foundation of its internal vulnerability detection system. The article describes scanning early in the software delivery pipeline, using Grype as a Go library to scan Wolfi APK packages before container images are built, and contributing vulnerability data and improvements to the open-source project. It also briefly compares Grype's open data pipeline with Trivy's. ### Source excerpt Chainguard harnesses Grype's open-source power to ensure minimal CVEs in images, prioritizing user security. ## Taming bad Python packages: Assessing Python malware detectors with a benchmark dataset DevFeed: [Taming bad Python packages: Assessing Python malware detectors with a benchmark dataset]() Original publisher: [Read original article]() Published: 2023-08-23T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [Benchmark](), [dataset](), [Security](), [Open Source](), [psrt]() Tags: [benchmark](), [chainguard](), [dataset](), [false-positive](), [false-positives](), [malware](), [open-source-security](), [pypi](), [pypi-malware](), [python](), [research](), [review](), [security]() ### AI overview This article describes a benchmark dataset containing malicious and benign Python packages, created to evaluate PyPI malware checks and alternative approaches to detecting malicious open-source software. The reported analysis found high alert rates among both popular and randomly selected packages, indicating substantial false-positive concerns. ### Source excerpt Enhance your Python security! Learn how Chainguard's new dataset is revolutionizing malware detection in Python environments. ## A purl of wisdom on SBOMs and vulnerabilities DevFeed: [A purl of wisdom on SBOMs and vulnerabilities]() Original publisher: [Read original article]() Published: 2023-02-14T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [open-source-security](), [Vulnerabilities](), [supply-chain-security]() Tags: [chainguard-images](), [component](), [components](), [container-images](), [false-positive](), [nvd](), [package-url](), [purl](), [sbom](), [sboms](), [scanner](), [software-bill-of-materials](), [software-supply-chain](), [vulnerabilities](), [vulnerability-data](), [vulnerability-scanner](), [vulnerability-scanning]() ### AI overview The article argues that Software Bill of Materials (SBOMs) would be more useful if the National Vulnerability Database (NVD) widely adopted the package URL (purl) naming scheme. Analysis of real scanner false positives suggests that purl information could reduce the false positive rate by more than 50%. ### Source excerpt SBOMs could be a lot more useful if the NVD implemented widespread usage of the purl naming scheme, which could reduce the false positive rate by over 50%. ## Performance in Jetpack Compose DevFeed: [Performance in Jetpack Compose]() Original publisher: [Read original article]() Author: Denys Rudenko Published: 2022-10-03T16:41:03Z Content type: tutorial Language: en Sources: [Stories by Denis Rudenko on Medium]() Topics: [Jetpack Compose](), [ui](), [Code]() Tags: [android](), [android-app-development](), [article](), [compiler](), [compose](), [false-positive](), [jetpack-compose](), [lambda](), [modifiers](), [performance](), [recomposition](), [scopes](), [skip](), [ui](), [val](), [var](), [variables]() ### AI overview A practical guide to improving Jetpack Compose performance through stable parameters, skippable composables, optimized recompositions, remembered lambdas, and compiler and layout-inspector metrics. ### Source excerpt Article tells about my research on how to write efficient Compose code. It consists of 6 sections and a TL;DR/Summary in the end. We will cover: Optimising recompositions When should you use @Immutable and @Stable annotations; Unstable classes, variables, lambdas; Non-restartable & skippable composables; Lambda modifiers; Passing lambdas providing required fields instead of fields in composables; Inlined composables; When you should use remember { }. We'll be using Compose Compiler Metrics and layout inspector tools to know: - If a class is stable or not; - If the composable function is skippable/restartable; - Amount of skipped recompositions. 1. Unstable objects on UI layer. To understand why we should care about stability, let us peek into a very important metric called skippability. It allows compose runtime to skip recomposition of a composable when all the parameters it uses are considered stable. What is considered stable by the compiler? - All primitive value types: Boolean, Int, Long, Float, Char, etc. - Strings - Lambdas (not always, we will get to it later) We want composable functions to use stable params to become skippable. 1) Don't use var when seeking stability. Fields declared as var are considered unstable: https://medium.com/media/724da23ba38eaa9d3312318e7e8038b9/hrefhttps://medium.com/media/f8dd8a39bce60e48b5ff8bdd4a02b9ef/href UserDetails composable will be recomposed even if the user never gets modified. Using val instead of var in User class will fix this issue. 2) Not all lambdas are considered stable. Let's look at the following examples: https://medium.com/media/fbbff417d165a501b21a3e5d2c6f087f/hrefhttps://medium.com/media/c6aaae01fda67c633edcdf7bb351e620/href Since the lambdas capture outside scopes, they won't be automatically inferred as stable and reused as expected. If the lambda requires access to external variables, the compiler will add those variables as fields, which are passed into the constructor of the lambda. We go a 2 ways of ## Leak detection: Android Studio vs LeakCanary ⚔ DevFeed: [Leak detection: Android Studio vs LeakCanary ⚔]() Original publisher: [Read original article]() Author: Py ⚔ Published: 2020-10-30T00:13:40Z Content type: tutorial Language: en Sources: [Py ⚔]() Topics: [Android Studio](), [Memory Leaks](), [Android](), [Code]() Tags: [android](), [android-studio](), [coding](), [community](), [development](), [engineering](), [false-positive](), [inclusive](), [leak](), [leakcanary](), [memory](), [memory-leaks](), [software]() ### AI overview The article compares Android Studio's Activity/Fragment leak filtering with LeakCanary's lifecycle-based detection. It explains that Android Studio may flag newly created or cached Fragments as potential leaks, while LeakCanary watches destroyed objects and checks whether they remain retained after garbage collection. ### Source excerpt I recently came across this comment in a post: The thing really annoying about LeakCanary or Android Studio, most of the time leaks identified by LeakCanary do not appear in Profiler/Memory/memory leaks, I wonder if LeakCanary is showing false positives or Android Studio is missing positives. That's a good question, let's dig into code and figure this out! False positive leaks in Android Studio Before answering the question, we need to talk about where the idea of false positive leaks comes from: Android Studio. That warning was originally a longer description: Activity and Fragment instances that might be causing memory leaks. For Activities, these are instances that have been destroyed but are still being referenced. For Fragments, these are instances that do not have a valid FragmentManager but are still being referenced. Note, these instance might include Fragments that were created but are not yet being utilized. The documentation provides more insights on false positive leaks: In certain situations, such as the following, the filter might yield false positives: A Fragment is created but has not yet been used. A Fragment is being cached but not as part of a FragmentTransaction. The phrasing is vague but it looks like false positive leaks only applies to Fragments. Android Studio leak filtering Android Studio dumps and analyzes the heap when you press the Dump Heap icon. Leaking instances are displayed by enabling the "Activity/Fragment Leaks" filter, which updates the bottom panel to only show leaking instances. The filtering is performed by ActivityFragmentLeakInstanceFilter: const val FRAGFMENT_MANAGER_FIELD_NAME = "mFragmentManager" /** * A Fragment instance is determined to be potentially leaked if * its mFragmentManager field is null. This indicates that the * instance is in its initial state. Note that this can mean that * the instance has been destroyed, or just starting to be * initialized but before being attached to an activity. The * latter gives us ## Saving Money and Protecting Privacy With Bloom Filters DevFeed: [Saving Money and Protecting Privacy With Bloom Filters]() Original publisher: [Read original article]() Author: Tristan Garwood Published: 2018-08-27T17:08:17Z Content type: article Language: en Sources: [Localytics]() Topics: [DynamoDB](), [data](), [pii](), [NoSQL](), [Amazon S3](), [Amazon Web Services](), [Back end](), [Caching](), [implementation](), [Latency]() Tags: [aws](), [backend](), [bloom-filter](), [cache](), [data](), [dynamodb](), [false-positive](), [filter](), [gdpr](), [implementation](), [latency](), [low-latency](), [memory](), [native](), [nosql](), [pii](), [privacy](), [s3]() ### AI overview The article explains how Localytics used Bloom filters with DynamoDB, S3, and caching to enforce GDPR opt-out checks in a high-throughput ingestion pipeline. The design reduces unnecessary DynamoDB lookups while preserving verification of possible matches and dropping data from opted-out users. ### Source excerpt The EU General Data Protection Regulation (GDPR) went into effect on May 25th, 2018 and stipulates that companies processing personally identifiable information (PII) must carry out requests from end users to be 'forgotten' from their systems. Implementing this right to be forgotten (RTBF) for our products means that ## Build Stability DevFeed: [Build Stability]() Original publisher: [Read original article]() Author: Square Engineering Published: 2015-06-01T16:09:00Z Content type: article Language: en Sources: [Square Corner Blog RSS Feed]() Topics: [ci](), [Development](), [Ruby](), [Bash]() Tags: [bash](), [best-practices](), [build](), [ci](), [continuous-integration](), [engineering](), [false-positive](), [ruby](), [tests]() ### AI overview This article explains how Square improved CI build stability by treating test results as measurements with possible false negatives and false positives. It describes Ruby and Bash build-script safeguards and nightly reruns of successful builds to detect false positives. ### Source excerpt How we stopped rerunning failed tests and kept it that way