# name Published articles for name. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## Best Practices for Scoping and Organising Snowflake Semantic Views DevFeed: [Best Practices for Scoping and Organising Snowflake Semantic Views]() Original publisher: [Read original article]() Author: Nithya Rangarajan Published: 2026-11-05T15:01:08Z Content type: article Language: en Sources: [Snowflake Builders]() Topics: [semantic-layer](), [Data Management](), [Data Quality]() Tags: [access-control](), [agentic-ai](), [ai-agents](), [best-practices](), [composition](), [context](), [cortex](), [evaluation](), [governance](), [name](), [ownership](), [semantic-layer](), [semantics](), [size](), [snowflake](), [snowflake-semantic-views](), [sql](), [topology]() ### AI overview The evaluation found that semantic view topology and size did not change answer accuracy in the tested setup, while duplicate dimension names caused a hard-to-spot wrong answer. The article recommends maintaining domain views under team ownership and composing them for use cases; tested topologies were effectively equivalent, so governance and shareability should guide the choice. Accuracy stayed stable up to 118K tokens across 104 tables and 20 questions, though the test used only 1-3 joins and distinct names in added tables. Prefix entities and relationships by domain, and give ambiguous dimensions unique business-role names with clear descriptions. For access, direct semantic view queries need SELECT on the view, while agents in default mode generate SQL against physical tables and require table grants. Explicit strict SQL generation routes through the view under its owner's rights, avoiding those grants but limiting calculations to defined metrics, dimensions, and facts. Strict mode must be enabled; it is private preview at the time described. ### Source excerpt Snowflake Semantic Views provide a governed, reusable layer that defines how tables relate, what metrics mean, and who can access what. This article describes a set of best practices and lessons learned for scoping, naming, sizing, and securing semantic views in an enterprise setting. Each recommendation is grounded in evaluation data from a 20-question test suite run across multiple architectures on the Tasty Bytes dataset. At the time of writing Composable semantic views and strict mode are still in private preview. Introduction Does one big semantic view hurt accuracy? Should you organise by team or by use case? I tested both. Neither topology nor size changed the answers, but a single duplicated column name did. Semantic views are quickly becoming the standard way to expose governed data to Cortex Agents, Snowflake CoWork, BI tools, and downstream SQL consumers. Over the past several months I have worked with multiple customers on their introduction of semantic views as part of their AI and analytics strategy. Every organisation's data architecture, team structure and governance requirements are different, and those differences shape how semantic views should be scoped. A semantic view is also highly visible: it defines the metrics and dimensions that business users, analysts and AI agents all rely on. Decisions about what goes into it, who owns it, and how it is secured have broad consequences. This article covers: ownership and composition patterns semantic view sizing naming conventions for disambiguation access control, including the new strict SQL generation mode Each recommendation comes with results from controlled experiments. Ownership and Composition The most common scoping question enterprise architects face is: should we organise semantic views around who owns the data, or around how it gets queried? The answer is both, at different layers. Ownership and Scope A two-layer model separates the concerns cleanly: Base layer -- ownership. Each team maintai ## Strict Request Input Casting in Laravel DevFeed: [Strict Request Input Casting in Laravel]() Original publisher: [Read original article]() Author: Paul Redmond Published: 2026-11-05T01:18:05Z Content type: article Language: en Sources: [Laravel]() Topics: [Laravel](), [input](), [Error Handling](), [Sanitization]() Tags: [array](), [arrays](), [boolean](), [cast](), [error](), [flag](), [form](), [handling](), [input](), [json](), [laravel](), [laravel-tutorials](), [name](), [request](), [string]() ### AI overview Laravel 13.40 adds `strict: true` to request `integer()`, `boolean()`, `float()`, and `string()` helpers (and the `str()` alias). Strict mode validates values before casting and returns the supplied default for invalid input, avoiding cases where malformed input becomes `0` or an array-to-string error. Rules differ by type: integers reject decimals, leading zeros, and out-of-range values; floats accept whole numbers and exponent notation; booleans recognize true/false forms and otherwise use the default; strings reject arrays, booleans, and null, with empty input also falling back. Defaults may be closures or `null`, and are returned without casting. The flag is also available on other classes using `InteractsWithData`. Since strict mode silently falls back without reporting invalid input, the article recommends validation when bad or missing values should produce an error users can correct. ### Source excerpt Laravel 13.40 adds a strict flag to the request integer(), boolean(), float(), and string() helpers, so bad input returns your default instead of 0 or an error. The post Strict Request Input Casting in Laravel appeared first on Laravel News. Join the Laravel Newsletter to get Laravel articles like this directly in your inbox. ## Gemini Omni 1.2 Flash now available on AI Gateway DevFeed: [Gemini Omni 1.2 Flash now available on AI Gateway]() Original publisher: [Read original article]() Author: Zachary Chen Published: 2026-11-05T00:00:00Z Content type: release Language: en Sources: [Vercel News]() Topics: [Generative AI](), [generative-ai-tools](), [vercel ai sdk](), [Streaming]() Tags: [ai](), [ai-gateway](), [ai-sdk](), [audio](), [edits](), [extend](), [gemini](), [gemini-omni](), [gemini-omni-1-2-flash](), [google](), [model](), [name](), [native](), [reference](), [sdk](), [source](), [text](), [up](), [video](), [videos]() ### AI overview Google's Gemini Omni 1.2 Flash is available through AI Gateway using one API key, without a separate Google account. It generates 3-15 second videos with native audio, edits clips of the same duration using up to six reference images, and supports extensions of 3-10 seconds per call up to 30 seconds total. Follow-up refinement uses `previousInteractionId`. Output options are 360p, 720p, 1080p, or 4K in 16:9 or 9:16. The excerpt shows `generateText` saving the returned MP4 file and `streamText` handling it through `fullStream` once delivered as a completed file. AI Gateway also offers usage and cost tracking, retries, failover, routing, and reporting; it states that inference follows provider pricing with no markup or platform fee, including BYOK requests. ### Source excerpt Gemini Omni 1.2 Flash from Google is now available on AI Gateway. Generate videos from text prompts with one API key and no separate Google account. Gemini Omni 1.2 Flash generates 3-15 second videos with native audio and edits 3-15 second source clips with up to six reference images. Extend videos by 3-10 seconds per call, up to 30 seconds total, or refine generated clips in follow-up calls using previousInteractionId. Output supports 360p, 720p, 1080p, and 4K in 16:9 or 9:16. Use generateText or streamText in AI SDK to receive the generated video as a file. Generate a video Use google/gemini-omni-1.2-flash as the model name. This example generates a three-second, 360p clip and saves it as video.mp4: Receive video in a streaming response With streamText, read fullStream to handle generated files as they arrive. The video is delivered as a completed file: AI Gateway provides a unified API for calling models, tracking usage and cost, and configuring retries, failover, and performance optimizations for higher-than-provider uptime. It includes built-in custom reporting, Zero Data Retention support, budgets for API keys, routing rules, and more. AI Gateway reflects provider pricing with no markup and does not charge a platform fee on inference, including on Bring Your Own Key (BYOK) requests. Explore more models in the AI Gateway model catalog. Read more ## China-Aligned Hackers Hijack Sogou Input Method DNS Requests to Deploy DarkVigil Backdoor DevFeed: [China-Aligned Hackers Hijack Sogou Input Method DNS Requests to Deploy DarkVigil Backdoor]() Original publisher: [Read original article]() Author: The Hacker News Published: 2026-11-04T11:24:31Z Content type: news Language: en Sources: [Cyber Newsroom]() Topics: [Domain Name System (DNS)](), [DLL hijacking]() Tags: [2021](), [2026](), [actor](), [backdoor](), [china](), [communications](), [cve](), [cve-2026-120422](), [cyber-espionage](), [deploy](), [dns](), [dns-hijacking](), [domain](), [domain-name](), [domain-name-system](), [hackers](), [hijack](), [hijacking](), [http](), [input](), [malware](), [name](), [nation-state](), [supply-chain](), [vulnerability]() ### AI overview ESET attributed a surveillance campaign active from July 2026 to SlippyNunchucks, which hijacked DNS requests from Windows versions of Sogou Input Method to deploy the DarkVigil backdoor. SGTool.exe normally fetches a vocabulary promotion configuration over HTTP; tampered DNS redirected that request to staging servers, whose malicious configuration instructed the app to download a legitimate Adobe executable and a rogue DLL containing DarkVigil, then launch it through DLL sideloading. DarkVigil uses DMTP for command and control and can orchestrate plugins for persistence or data collection. ESET reported targeting in six countries and said it found no tactical overlap with Mustang Panda activity. Tencent fixed the issue, CVE-2026-120422, in version 16.10 on October 29, 2026, by moving the affected requests to HTTPS. ### Source excerpt China-Aligned Hackers Hijack Sogou Input Method DNS Requests to Deploy DarkVigil Backdoor A China-aligned threat actor known as SlippyNunchucks has been attributed to a Domain Name System (DNS) hijacking operation abusing insecure HTTP communications in Windows versions of Sogou Input Meth ... Read more Published Date: Nov 04, 2026 (5 hours, 37 minutes ago) Vulnerabilities has been mentioned in this article. CVE-2026-120422 CVE-2026-51990 CVE-2021-38003 ## Character-Name Concentration in LLM Fiction: Measuring Displacement and Mitigating Repetition DevFeed: [Character-Name Concentration in LLM Fiction: Measuring Displacement and Mitigating Repetition]() Original publisher: [Read original article]() Author: Alejandro Mozo Quesada (Universidad de M\\'alaga, Spain), Sergio G\\'alvez Rojas (Universidad de M\\'alaga, Spain), Francisco L\\'opez Valverde (Universidad de M\\'alaga, Spain) Published: 2026-11-03T05:00:00Z Content type: article Language: en Sources: [arXiv: Artificial Intelligence]() Topics: [Large Language Model](), [LLM evaluation / benchmarking]() Tags: [ai](), [ai-slop](), [cs-ai](), [cs-cl](), [fiction](), [language-model](), [languages](), [large-language-model](), [llm](), [llms](), [measuring](), [metric](), [name](), [prompt](), [sampling](), [speculative-decoding](), [stories](), [study](), [temperature](), [tracker]() ### AI overview Across 20 LLMs and 44,782 stories in four languages, speculative naming reduced character-name concentration at the corpus level without logit access or retraining. It asks models to propose candidate name sets, scores them with a SlopTracker combining a per-model fingerprint and runtime counter, then selects names using a temperature-controlled rule or strict HARD variant. The sampling scaffold alone reduced Slop Ratio by 89% on average; adding the dynamic tracker raised the reduction to 95%, lowering mean collision probability from 7.3% to 0.4%. Known-name collisions fell to zero, within-story collisions dropped from 4.3% to 0.2%, and 42-69% of names remained attested real names, depending on language. Static banlists instead shifted concentration toward emergent names and more than halved the share of attested names. The ranking was stable across languages, model families, and counting conventions; effects on creative diversity beyond names remain untested. ### Source excerpt arXiv:2611.01284v1 Announce Type: cross Abstract: Character names in large language model (LLM) fiction concentrate on a handful of recurrent names such as 'Elara' and 'Elias', a measurable face of AI slop. Existing fixes either require logit access or retraining, or operate per request and cannot control concentration across a corpus. How much prompt-level strategies reduce concentration, and at what cost to name naturalness, has not been systematically measured. We present an empirical study of name-concentration control across eight strategies and introduce speculative naming, a fine-tuning-free method that adapts the draft-verify-reject paradigm of speculative decoding from tokens to names. The method requests candidate name-sets through verbalized sampling, scores them against a SlopTracker that combines a per-model fingerprint with a runtime counter, and selects through a temperature-controlled rule or its strict variant (HARD). We use 20 LLMs to generate 44,782 stories in four languages from text and visual stimuli (88,919 named characters), and measure concentration with a list-free collision metric (Slop Ratio, SR) decomposed into known and emergent components. List-based strategies do not remove slop: static banlists displace concentration to emergent names and more than halve the share of attested real names. Speculative naming removes it: the sampling scaffold alone cuts SR by 89% on average, the dynamic tracker brings the total reduction to 95%, mean collision probability falls from 7.3% to 0.4%, and known-name collisions hold at zero while naturalness stays close to baseline (42-69% attested by language) and within-story collisions drop from 4.3% to 0.2%. The strategy ranking is stable across languages, model families, and name-counting conventions. Name concentration is thus controllable at the corpus level without logit access or retraining; broader creative diversity beyond naming remains open. ## Below the Waterline: Why AI's True Cost Is Measured Per Task, Not Per Token DevFeed: [Below the Waterline: Why AI's True Cost Is Measured Per Task, Not Per Token]() Original publisher: [Read original article]() Author: David Lyman Published: 2026-11-02T21:22:59Z Content type: article Language: en Sources: [SD Times]() Topics: [Language models](), [cloud cost management](), [LLM observability](), [Fine-tuning]() Tags: [admission](), [ai](), [but](), [cost](), [economics](), [enterprises](), [executive](), [first](), [foundation](), [getting](), [ignore](), [it](), [it-budgets](), [j](), [latest-news](), [leading](), [live](), [name](), [r](), [sd](), [times](), [token](), [tokenomics](), [tokens]() ### AI overview The article argues that enterprises should measure AI by total cost and value per task, not by token or API bills alone. Total cost of AI includes compute, storage, networking, energy, software, and the engineering, operations, and legal labor needed to run systems; value may include revenue, savings, cleared backlogs, or avoided hires. It recommends tracking task inputs such as prompt and retrieval tokens, agent steps, cache misses, human intervention, rework, and runaway retries. The article also describes hybrid model use: reserve frontier models for demanding reasoning, and consider private or local models for tasks such as document retrieval, translation, log parsing, and PII filtering. Broadcom says its AI gateway can route requests between public and local models, and reports 40%-90% savings for suitable private-cloud workloads. The excerpt cautions that online token rates may omit production operations and cites a survey in which three in four enterprises could not confidently prove AI business value to their CFO. ### Source excerpt Tokenomics, by the admission of the man leading the foundation named after it, is a terrible name. But the concept behind it is getting harder for enterprises to ignore. J.R. Storment, executive director of the Tokenomics Foundation, said during a recent SD Times Live! Supercast on the economics of AI that he first heard the... ... continue reading The post Below the Waterline: Why AI's True Cost Is Measured Per Task, Not Per Token appeared first on SD Times. ## Your CI pipeline needs a lockfile, too DevFeed: [Your CI pipeline needs a lockfile, too]() Original publisher: [Read original article]() Author: Amit Merchant Published: 2026-11-02T00:00:00Z Content type: article Language: en Sources: [Amit Merchant]() Topics: [CI/CD](), [least privilege](), [npm]() Tags: [ci](), [composer](), [cryptographic](), [data](), [dependency](), [ecosystem](), [file](), [javascript](), [like](), [locks](), [miscellaneous](), [name](), [needs](), [npm](), [other](), [package](), [php](), [pipeline](), [records](), [resource](), [with]() ### AI overview GitHub Actions workflow lockfiles let workflows keep readable action references while recording the exact commits they resolve to in `.github/workflows/actions.lock`. Install the `github/gh-actions-lock` extension and run `gh actions-lock` to generate the file. GitHub Actions uses it to resolve references to recorded commits, and Dependabot can update corresponding lockfile entries when it updates supported action dependencies. This helps keep workflow code consistent, but does not make dependencies trustworthy or lock other build inputs such as runner images or arbitrary action inputs. The article says to continue reviewing dependencies, minimizing permissions, and securing the pipeline. ### Source excerpt Lockfiles might be familiar to you if you've ever worked with package managers like npm or Yarn (for the JavaScript ecosystem) or Composer (for the PHP ecosystem). A lockfile, as the name suggests, is a data file generated by these package managers that "locks in" or, in other words, records exact dependency versions, cryptographic hashes, or resource-access states. ## CVE-2026-63346 - Refitter: C# source injection through OpenAPI header parameter names DevFeed: [CVE-2026-63346 - Refitter: C# source injection through OpenAPI header parameter names]() Original publisher: [Read original article]() Author: CVEFEED.io; github.com Published: 2026-10-30T23:17:14Z Content type: news Language: en Sources: [Latest High/Critical Vulnerabilitiy Feed]() Topics: [C#](), [OpenAPI Specification](), [client library]() Tags: [2026](), [api](), [application](), [assembly](), [behavior](), [c-sharp](), [class](), [client](), [code](), [cve](), [cve-2026-63346](), [header](), [interface](), [library](), [name](), [net](), [net-8](), [openapi](), [parameter](), [source]() ### AI overview Before Refitter 2.1.2, an OpenAPI header parameter name was inserted unescaped into a Refit `[Header("")]` attribute. An attacker-controlled description could therefore inject valid C# into generated code; a `[ModuleInitializer]` could run the injected code when the compiled assembly loads at startup, even if the API client is never called. The excerpt says default validation does not block this path and notes that query `AliasAs` and enum/default value sinks are escaped. The behavior was verified with Refitter 2.0.0 and .NET 8; the issue is fixed in 2.1.2. ### Source excerpt CVE ID :CVE-2026-63346 Published : Oct. 30, 2026, 11:17 p.m. | 39 minutes ago Description :Refitter is a tool for generating a C# REST API client using the Refit library. Prior to 2.1.2, the header parameter name in `parameters[].name` with `in: header` is emitted verbatim into a Refit `[Header("")]` attribute string without escaping quotation marks. An attacker-influenced OpenAPI description can pass default validation without `--skip-validation` and break out from the parameter-list position by closing the parameter and method syntax, attribute, interface, and namespace. The generated file can remain valid C# while containing a top-level file class with a `[ModuleInitializer]` method, which executes attacker code when the compiled assembly is loaded at application startup, even if the client is never called. Query `AliasAs` and enum/default value sinks are escaped; this flaw is in header-name attribute-string emission. The behavior was verified with Refitter 2.0.0 and .NET 8. This issue is fixed in version 2.1.2. Severity: 8.6 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more... ## SurveyMonkey vs. Google Forms: Which should you use? \[2026\] DevFeed: [SurveyMonkey vs. Google Forms: Which should you use? \[2026\]]() Original publisher: [Read original article]() Author: Ryan Kane Published: 2026-10-27T04:00:00Z Content type: comparison Language: en Sources: [Zapier]() Topics: [Forms](), [Tool]() Tags: [2026](), [app-picks](), [brand](), [corporate](), [decades](), [form](), [forms](), [free](), [google](), [health](), [health-tracking](), [like](), [market-research](), [name](), [one](), [other](), [over](), [popular](), [research](), [score](), [vs]() ### AI overview Google Forms is a practical free choice for simple personal or internal forms: it requires a Google account, supports unlimited questions and up to 500,000 responses per form, and links results to Sheets. Its branding options and branching logic are limited, and Gemini form generation generally requires a paid plan. SurveyMonkey is better suited to complex business surveys and research. It offers 500+ templates, conversational AI editing, a question bank, advanced logic, question randomization, A/B testing, analytics, and access to a respondent panel. Its free plan is limited to 10 questions and 10 visible responses per survey; paid plans have response caps and can cost substantially more. Offline collection is available only on Enterprise. Both connect to Zapier; SurveyMonkey also lists 200+ native integrations, while Google Forms fits closely with Google Workspace. ### Source excerpt Google Forms and SurveyMonkey are leaders in their category for different reasons: one is a simple form tool that nearly everyone already has free access to, and the other has been the poster child for survey creation for over two decades. SurveyMonkey, despite its cuddly name, has evolved into a distinctly corporate tool focused on things like market research, Net Promoter Score surveys, and brand health tracking. Google Forms, meanwhile, is hugely popular for sending out free forms and surveys ## AI will keep uncovering critical software flaws for years, says Cloudflare CEO DevFeed: [AI will keep uncovering critical software flaws for years, says Cloudflare CEO]() Original publisher: [Read original article]() Author: Skye Jacobs Published: 2026-10-25T16:20:00Z Content type: news Language: en Sources: [TechSpot]() Topics: [Security research](), [code security](), [vulnerability management](), [Software](), [Cloudflare]() Tags: [2026](), [3](), [about](), [ai](), [bugs](), [ceo](), [cloudflare](), [critical](), [eff](), [game](), [government](), [hacking](), [keep](), [name](), [other](), [php](), [prince](), [reuters](), [security](), [software](), [store](), [the-web](), [vulnerabilities](), [vulnerability](), [websites]() ### AI overview Cloudflare CEO Matthew Prince expects frequent serious software vulnerabilities for the next few years as AI tools make it faster and easier for researchers and attackers to find flaws and build exploits. He says Cloudflare knows of additional severe vulnerabilities in unnamed critical software. Wiz Research reported that frontier models helped it develop and adapt exploits across applications in hours; the EFF attributes a sharp rise in reported vulnerabilities to frontier AI from OpenAI, Anthropic and others. The article says complex code may no longer be protected by the difficulty of analyzing it. The EFF recommends keeping browsers and apps updated, using unique passwords with a password manager, blocking trackers, and watching for phishing; website operators should ensure PHP fixes are applied. Prince expects fixes to leave software safer over time, but the article says the extent of damage before then remains uncertain. ### Source excerpt Prince told Reuters that Cloudflare is aware of "a bunch of additional severe vulnerabilities that are present in other pieces of critical software," though he did not name the affected programs. He compared them to the PHP bugs that recently forced government websites, the game store GOG, and many smaller... Read Entire Article ## Critical Flaw in Python's Popular Pillow Image Library Allows Code Execution via a Crafted Image DevFeed: [Critical Flaw in Python's Popular Pillow Image Library Allows Code Execution via a Crafted Image]() Original publisher: [Read original article]() Author: The Hacker News Published: 2026-10-23T09:36:00Z Content type: news Language: en Sources: [Cyber Newsroom]() Topics: [Library](), [Image](), [Python]() Tags: [2013](), [2026](), [application-security](), [artificial-intelligence](), [can](), [code](), [code-execution](), [commands](), [critical](), [cve](), [execution](), [file](), [image](), [library](), [name](), [open](), [operating-system](), [python](), [run](), [server](), [software-security](), [system](), [used](), [vulnerability](), [web-security]() ### AI overview Pillow 13.0.0 fixes several security flaws, including an EPS filename issue that can reach command execution through Ghostscript when a server opens an attacker-named file and has `gs` installed. The flaws affect Pillow 2.6.0 through 12.3.0; maintainers rate the EPS issue moderate because filename control is required, while CVE scores are higher. Other fixes cover a JPEG/FlashPix command-execution path under specific conditions, a JPEG thumbnail overflow reported to cause crashes, and a TIFF in-memory-save overflow that can crash a process and was escalated only with a separate memory-disclosure flaw. The excerpt recommends upgrading and rebuilding bundled copies; Pillow 13 requires Python 3.11 or newer. Until then, it advises keeping Ghostscript off upload-processing hosts, avoiding attacker-controlled EPS filenames, using specified precautions for JPEG thumbnails, and treating TIFF saves to memory buffers as sensitive. ### Source excerpt Critical Flaw in Python's Popular Pillow Image Library Allows Code Execution via a Crafted Image Pillow, the most widely used image library for Python, can be made to run operating system commands on a server by specifying the name of a file it is told to open. The flaw, CVE-2026-112900, is in th ... Read more Published Date: Oct 23, 2026 (10 hours, 4 minutes ago) Vulnerabilities has been mentioned in this article. CVE-2026-112900 CVE-2026-112403 CVE-2026-112393 ## How to build approval workflows from the SCIM manager attribute DevFeed: [How to build approval workflows from the SCIM manager attribute]() Original publisher: [Read original article]() Author: WorkOS Published: 2026-10-23T00:00:00Z Content type: tutorial Language: en Sources: [WorkOS]() Topics: [business logic](), [API Governance](), [Error Handling]() Tags: [2](), [2023](), [2026](), [3](), [access-tokens](), [admin](), [all](), [build](), [directory](), [email](), [fallback](), [how-to](), [id](), [idp](), [key](), [manager](), [maps](), [name](), [sync](), [workflows]() ### AI overview Directory Sync can supply manager_id, manager_name and manager_email in each Directory User's custom_attributes, but the fields are optional and provider coverage varies. Use manager_id as the approval-chain key: it may identify a manager by Directory User id or, for HR integrations and unmatched SCIM references, by idp_id/provider value. Verify joins and route unresolved or inactive managers through a fallback approver; never auto-approve or drop requests. Enable the attributes after deploying code that tolerates missing values. The environment-wide toggle can take up to an hour to propagate and emits update events for changed users, so distinguish initial backfill from a real manager change and run a full pull afterward. Reconcile periodically because some null/undefined changes emit no event. For Google Workspace, which lacks manager_id, manager_email can support lookup, subject to alias mismatches. ### Source excerpt Directory Sync maps manager_id, manager_name and manager_email from the IdP. Where they land, how to key approval chains on them, and the no-manager fallback. ## LastWords: Boring Problems Revisited DevFeed: [LastWords: Boring Problems Revisited]() Original publisher: [Read original article]() Author: Huayang Li, Richard Sproat Published: 2026-10-21T04:00:00Z Content type: article Language: en Sources: [arXiv: Machine Learning]() Topics: [Artificial Intelligence](), [Machine learning](), [Large Language Model]() Tags: [ai](), [cs-cl](), [cs-lg](), [frontier-models](), [machine-learning](), [name](), [natural-language-processing](), [neural](), [open](), [text]() ### AI overview The paper revisits number name reading, a text normalization problem once considered difficult for purely neural methods. The authors report that at least one recent frontier model has practically solved it, while arguing that open issues remain for constrained, limited-resource problems and that future machine learning approaches may address them without the massive resources of frontier models. This overview is based on the supplied abstract. ### Source excerpt arXiv:2610.24894v1 Announce Type: cross Abstract: In 2022, the second author published a Last Words piece in Computational Linguistics in which he pointed out that, despite the advances in AI up to that point, there were still some problems in natural language processing that on the one hand seemed trivial and perhaps boring, but on the other were hard to solve using purely neural methods. One such problem discussed in that context was text normalization, and a particular subproblem of that, namely number name reading. The piece came out just a few months before the first release of ChatGPT, and needless to say, a lot has happened since then. Indeed, as we document here, the problem (of number name reading) has practically been solved, at least by one of the latest frontier models. However, we believe that there are still open issues for such limited domain, constrained and limited resource problems, and that in some future machine learning approach, the massive resources of the latest frontier models would not be needed to solve them. ## Millions of routers can be hijacked over Wi-Fi thanks to a 16-year-old bug DevFeed: [Millions of routers can be hijacked over Wi-Fi thanks to a 16-year-old bug]() Original publisher: [Read original article]() Author: Julio Franco Published: 2026-10-20T22:08:00Z Content type: news Language: en Sources: [TechSpot]() Topics: [bug](), [Network](), [OpenWrt]() Tags: [1-5](), [2018](), [about](), [ai](), [ai-tools](), [article](), [broadcom](), [bug](), [can](), [conference](), [identifier](), [issue](), [name](), [networking](), [october](), [over](), [paris](), [routers](), [security](), [thanks](), [the-web](), [vulnerability](), [wi-fi](), [wifi]() ### AI overview WPSplinter is a flaw in Broadcom's older WPS code that can let an attacker within Wi-Fi radio range read router memory or run code without the Wi-Fi password, a completed pairing, or internet access. Quentin Kaiser demonstrated different outcomes: extracting a Wi-Fi key from an Orange Belgium gateway and obtaining a remote shell on a Proximus router. He confirmed affected gateways at three Belgian ISPs and estimates exposure in Belgium at about 1.5 million devices, with potentially hundreds of millions worldwide; the model list is incomplete. Broadcom says it replaced the code and had known of the flaw since 2018, while Kaiser says the patch was incomplete. No CVE was issued, which he says may have kept the warning from reaching router makers and ISPs. Changing the Wi-Fi password does not help. Disabling WPS may not disable the vulnerable code; the excerpt suggests turning off gateway Wi-Fi, using bridge mode, and connecting an up-to-date router if firmware status is uncertain. Kaiser also posted a detection script on GitHub. ### Source excerpt Security researcher Quentin Kaiser detailed the flaw at the Hexacon conference in Paris on October 16. He calls it WPSplinter, a name he only gave it because Broadcom refused to issue an official identifier. Read Entire Article ## Five million to one: two Arduino boards, 20 years apart DevFeed: [Five million to one: two Arduino boards, 20 years apart]() Original publisher: [Read original article]() Author: Arduino Team Published: 2026-10-20T12:57:43Z Content type: article Language: en Sources: [Arduino Blog]() Topics: [Arduino](), [VENTUNO Q](), [Image]() Tags: [000](), [2](), [3](), [about](), [accessibility](), [accessible](), [aggregation](), [ai](), [ai-hardware](), [ai-systems](), [ai-tools](), [arduino](), [desk](), [first](), [i](), [logo](), [name](), [philosophy](), [product](), [technology](), [ventuno-q]() ### AI overview The stated five-million-to-one performance gap is an illustrative estimate, not a practical head-to-head test. The article compares the VENTUNO Q's 40 dense TOPS with an estimated 8 million operations per second for the UNO Rev3, then explains that raw figures can mislead when they use different numeric formats. Its image-classification example uses 224 x 224 RGB images, INT8 data and a model with roughly 100 MB of parameters: the VENTUNO Q is described as processing about 5,000 photos per second, while the UNO would take about 17 minutes per photo, or roughly 58 days for 5,000. But the UNO's 32 KB of flash and 2 KB of RAM cannot hold the model, so its throughput is a thought experiment assuming unlimited external memory. The article's practical point is that modern hardware enables workloads earlier boards could not support, while both boards aim to make hardware development accessible. ### Source excerpt By Marcello Majonchi, Chief Product Officer at Arduino Sitting on my desk I have two boards. They carry the same logo, have a somewhat similar name. Their technology could not be more different, and yet the philosophy behind them is exactly the same. On the left I have an early Arduino® UNO™ Rev3, featuring a [...] The post Five million to one: two Arduino boards, 20 years apart appeared first on Arduino Blog. ## Java vs. JavaScript: What's the Difference? (They're Not the Same Thing) DevFeed: [Java vs. JavaScript: What's the Difference? (They're Not the Same Thing)]() Original publisher: [Read original article]() Author: Dev Support Published: 2026-08-13T17:48:00Z Content type: comparison Language: en Sources: [Treehouse]() Topics: [java vs javascript](), [Programming](), [Java](), [JavaScript]() Tags: [browser](), [bytecode](), [coding](), [compile](), [compiler](), [creators](), [errors](), [java](), [java-vs-javascript](), [javascript](), [jit](), [jvm](), [language](), [languages](), [learn](), [learn-programming](), [like](), [llearn-to-code](), [marketing](), [modern](), [name](), [netscape]() ### AI overview Java and JavaScript are separate languages whose similar names stem from a 1990s marketing decision. The excerpt says Java is compiled to bytecode and run on the JVM, while JavaScript is interpreted or JIT-compiled by a browser or a runtime such as Node.js. Java requires types to be declared and fixed; JavaScript types are flexible and inferred at runtime. The source characterizes Java's typing as catching errors earlier and helping predictability at scale, while JavaScript's flexibility can make code faster to write at the cost of some safety. The excerpt ends during its discussion of where the languages run. ### Source excerpt If you've ever typed "is Java the same as JavaScript" into a search bar, you're in good company. It's one of the most common questions in coding, and the confusion is completely understandable -- the names are nearly identical, both... The post Java vs. JavaScript: What's the Difference? (They're Not the Same Thing) appeared first on Treehouse Blog. ## Server-Timing header DevFeed: [Server-Timing header]() Original publisher: [Read original article]() Author: Joost de Valk Published: 2026-06-18T00:00:00Z Content type: tutorial Language: en Sources: [The Website Specification]() Topics: [database monitoring](), [cache-control](), [synthetic monitoring](), [Interaction to Next Paint]() Tags: [cache](), [cloudflare-pages](), [core-web-vitals](), [counts](), [database](), [devtools](), [header](), [http](), [infrastructure](), [interface](), [name](), [optional](), [overhead](), [performance](), [performance-metrics](), [real-user-monitoring](), [rum](), [server](), [timing]() ### AI overview The article explains how the Server-Timing HTTP response header exposes server-side performance metrics in browser DevTools and through JavaScript for real-user monitoring. It describes emitting and collecting metrics, notes cross-origin access requirements, and cautions against exposing sensitive infrastructure details. ### Source excerpt Server-Timing surfaces backend metrics -- database time, cache hits, edge processing -- in browser DevTools and to RUM via the PerformanceServerTiming API. Send it when you measure server-side latency, and keep the values free of sensitive infrastructure detail. ## Beyond Positions: Kotlin's New Name-Based Destructuring DevFeed: [Beyond Positions: Kotlin's New Name-Based Destructuring]() Original publisher: [Read original article]() Author: Nav Singh Published: 2026-03-18T01:24:50Z Content type: article Language: en Sources: [Nav Singh]() Topics: [destructuring](), [Kotlin]() Tags: [android](), [android-app-development](), [androiddev](), [destructuring](), [kotlin](), [kotlin-native](), [name]() ### AI overview Kotlin 2.3.20 introduces experimental name-based destructuring, which binds each declared variable to a property with the same name instead of relying on the order of componentN() functions. The excerpt illustrates how position-based destructuring can assign values unexpectedly when variable order differs from property order. The compiler option -Xname-based-destructuring controls interpretation; the example enables only-syntax mode. The excerpt also shows square brackets for position-based destructuring in Complete mode, but does not explain the Name-Mismatch mode. ### Source excerpt Image generated using Perplexity Name-based destructuring declarations were introduced in Kotlin 2.3.20 and match variables to properties rather than relying on position-based componentN(). Previously, destructive declarations used position-based destruction: data class User(var firstName: String, var lastName: String) val user = User("Alice", "Husseini") // componentN() val(firstName,lastName) = user println(firstName) println(lastName)Drawback of the componentN() based approach Destructuring relies on the order of componentN() functions, lastName receives the value of firstName, and firstName receives the value of lastName 👇 data class User(var firstName: String, var lastName: String) val user = User("Alice", "Husseini") // componentN() val(lastName,firstName) = user println(firstName) -> Husseini println(lastName) -> AliceName-based destructuring ✨ It's an Experimental feature. We can control how the compiler interprets destructuring declarations with the -Xname-based-destructuring compiler option. kotlin { // .. compilerOptions { freeCompilerArgs.add("-Xname-based-destructuring=only-syntax") } }Each variable refers to a property by name.val user = User("Alice", "Husseini") // Name-based destructuring (val firstName = firstName, val lastName = lastName) = userModeshttps://kotlinlang.org/docs/whatsnew2320.html#languageMode -- Name-Mismatch⚠ Warning ⚠Name-Mismatch warningMode -- Complete Position-based destructuring using square brackets []: data class User(var firstName: String, var lastName: String) val user = User("Alice", "Husseini") // componentN() val [firstName,lastName] = userReferences What's new in Kotlin 2.3.20 | Kotlin Stay in touch https://www.linkedin.com/in/navczydev/ JavaScript is not available. navczydev - Overview navczydev.bsky.social Beyond Positions: Kotlin's New Name-Based Destructuring was originally published in ProAndroidDev on Medium, where people are continuing the conversation by highlighting and responding to this story. ## Manage artifact attestations with deletion, filtering, and bulk actions DevFeed: [Manage artifact attestations with deletion, filtering, and bulk actions]() Original publisher: [Read original article]() Author: Allison Published: 2025-07-01T17:36:50Z Content type: release Language: en Sources: [GitHub Changelog]() Topics: [sonatype](), [API Governance]() Tags: [advanced](), [api](), [api-documentation](), [artifacts](), [builds](), [community](), [creation-date](), [delete](), [discussion](), [documentation](), [feedback](), [github](), [interactive](), [list](), [malicious](), [manage](), [multiple](), [name](), [ui](), [updates]() ### AI overview Artifact attestations can now be deleted through the UI or API, including attestations associated with malicious or vulnerable artifacts. API endpoints support bulk operations, and the interactive `/attestations` list lets users select one or more attestations for actions such as deletion. The list can be filtered by predicate type, subject name, or creation date and sorted by oldest or newest creation date. ### Source excerpt You can now manage artifact attestations more effectively with new updates to the UI and API, including deletion, filtering, and bulk actions. Here's what's new: Delete attestations: Easily delete artifact... ## postmarketOS in 2025-02: MSM89x7 Audio, Modern Xiaomis in Community, New Name Foreshadowing DevFeed: [postmarketOS in 2025-02: MSM89x7 Audio, Modern Xiaomis in Community, New Name Foreshadowing]() Original publisher: [Read original article]() Published: 2025-03-04T00:00:00Z Content type: news Language: en Sources: [postmarketOS]() Topics: [Developer Events](), [Cross-Compilation]() Tags: [2017](), [2025](), [alpine](), [alpine-linux](), [audio](), [community](), [devices](), [end-of-life](), [event](), [fairphone](), [fosdem](), [hackathon](), [mainline](), [modern](), [name](), [nura](), [open-source](), [open-source-community](), [os](), [postmarketos](), [tablet]() ### AI overview postmarketOS reported broad February 2025 development across device support, build tooling, kernels and system services. MSM89x7 kernels moved to 6.13, bringing audio support to almost every supported device and charging support to all except Redmi 4A; follow-up changes added flashlight and suspend support. pmbootstrap's opt-in `cross-native2` method uses the package's own build system for cross compilation and is reported to speed builds substantially. Stricter dependency handling now installs only declared build dependencies, so APKBUILDs relying on the previous behavior may need missing packages added to `makedepends`. The project also added six device ports, improved CI reliability with a custom QEMU runner (though some jobs still fail to start), and established automatic daily off-site backups. It plans to rename the project while keeping its logo and branding, inviting community suggestions of one to three syllables; Trusted and Core Contributors will choose, and the current name will remain through at least v25.06. ### Source excerpt We already wrote plenty about FOSDEM 2025 and the Hackathon we did afterwards. But that was just the start of February! Two weeks later, a mainlining workshop in Aachen (DE) took place. Aelin organized it and posted some notes including "1 Xiaomi tablet now boots mainline quite well and can boot to system from UFS" and "it is damn hard to explain this to people with almost no technical knowledge in this area, but we tried our best and they learnt a lot". Another week later, Rob represented postmarketOS on the Saturday of the OSC 2025 Tokyo Spring event hosted at the Komazawa University in Tokyo (JP): "It was quite busy and several good discussions were held with different members of the Open-Source community." Thanks Aelin, Rob and all who came by! Post the Market: A New Fame We plan to give postmarketOS a new name. Back in 2017 when postmarketOS was first getting off the ground, this project was smaller scale. Just a port of Alpine Linux to devices abandoned by their manufacturers. Now, the year is 2025 and while many of our ports are still for devices past their manufacturer's supported period, we also have a lot of devices running postmarketOS far before they reach their official End of Life. For the Fairphone 4 and Fairphone 5 we even had ports on the day they were released! This is one of the reasons why we are looking for a new name. Another is that postmarketOS is not easy to pronounce. It is five syllables, including the OS at the end. To some it sounds more like a sentence than a name. Last but not least, the capitalization is a bit awkward at this point: Our official branding is postmarketOS with lowercase p, but of course people end up writing PostmarketOS (especially at the beginning of sentences) or even PostMarketOS. So we are looking for a new name! To be clear, we only want to change the name. The beloved logo and all the rest of our branding will stay the same. What's the new name? You tell us. Since postmarketOS isn't just the distro, but also the ## Legacy Docker Registry closing down DevFeed: [Legacy Docker Registry closing down]() Original publisher: [Read original article]() Author: Allison Published: 2025-01-23T16:46:23Z Content type: release Language: en Sources: [GitHub Changelog]() Topics: [GitHub Container Registry](), [GitHub]() Tags: [2021](), [2025](), [api](), [automatically](), [container](), [container-registry](), [deprecate](), [deprecation](), [docker](), [docker-registry](), [exception](), [github](), [github-container-registry](), [github-packages](), [legacy](), [migrate](), [name](), [need](), [packages](), [registry]() ### AI overview GitHub will deprecate its legacy Docker registry for GitHub Packages on February 24, 2025, and packages left there will be deleted and unavailable. Most packages were automatically migrated to GitHub Container Registry (GHCR) when it became generally available in 2021; requests for those packages will forward to GHCR, so their owners need take no action. Packages with namespace conflicts--where the same package name exists in both registries--were excluded from migration. The excerpt advises checking GitHub's API endpoint for affected packages that need migration. ### Source excerpt GitHub will deprecate the Docker registry for GitHub Packages on Feb 24th, 2025 in favor of the GitHub Container Registry, which supports Docker packages. All packages in the Docker registry... ## Client IDs are now included in App API responses DevFeed: [Client IDs are now included in App API responses]() Original publisher: [Read original article]() Author: Allison Published: 2024-08-23T22:12:53Z Content type: release Language: en Sources: [GitHub Changelog]() Topics: [GitHub API](), [API](), [REST API]() Tags: [api](), [apis](), [app](), [application](), [applications](), [client](), [enterprise](), [features](), [github](), [id](), [identifier](), [ids](), [installation](), [name](), [primary](), [responses](), [rest](), [rest-api](), [support](), [unique]() ### AI overview GitHub is adding `client_id` to all API responses that describe a GitHub App and gradually shifting App-related APIs to use it as the primary identifier. Unlike an app name, which can change, or a database `app_id`, which is not sufficiently globally unique, the client ID is globally unique. The change builds on support for using client IDs to mint JWTs for installation tokens and prepares for upcoming enterprise features to manage applications programmatically. The added field makes it easier to find an app's client ID. ### Source excerpt The client_id field is now included in all API responses that describe a GitHub App. We are shifting to use the client ID as the primary identifier for an app,... ## What's in a Name? DevFeed: [What's in a Name?]() Original publisher: [Read original article]() Author: Google Testing Bloggers (noreply@blogger.com) Published: 2024-03-26T12:34:00Z Content type: tutorial Language: en Sources: [Google Testing Blog]() Topics: [identifier]() Tags: [abstraction](), [adam-raider](), [apis](), [behavior](), [code-health](), [functions](), [identifier](), [name](), [reading](), [tips](), [tott](), [unique]() ### AI overview The excerpt argues that thoughtful names reduce the effort of reading code, and that renaming becomes more costly as a name becomes more public, especially for APIs. It recommends naming functions for what they do rather than when they are called, using an appropriate level of abstraction (for example, `logout` calling `clearUserToken`), and choosing precise names over vague suffixes such as `Manager` or `Util`. It also suggests taking time to consider names and asking a teammate when stuck. ### Source excerpt This is another post in our Code Health series. A version of this post originally appeared in Google bathrooms worldwide as a Google Testing on the Toilet episode. You can download a printer-friendly version to display in your office. by Adam Raider "There are only two hard things in computer science: cache invalidation and naming things." --Phil Karlton Have you ever read an identifier only to realize later it doesn't do what you expected? Or had to read the implementation in order to understand an interface? These indirections eat up our cognitive bandwidth and make our work more difficult. We spend far more time reading code than we do writing it; thoughtful names can save the reader (and writer) a lot of time and frustration. Here are some naming tips: Spend time considering names--it's worth it. Don't default to the first name that comes to mind. The more public the name, the more expensive it is to change. Past a certain scale, names become infeasible to change, especially for APIs. Pay attention to a name in proportion to the cost of renaming it later. If you're feeling stuck, consider running a new name by a teammate. Describe behavior. Encourage naming based on what functions do rather than when the functions are called. Avoid prefixes like "handle" or "on" as they describe when and provide no added meaning: button.listen('click', handleClick) button.listen('click', addItemToCart) Reveal intent with a contextually appropriate level of abstraction: High-abstraction functions describe the what and operate on high-level types. Lower-abstraction functions describe the how and operate on lower-level types. For example, logout might call into clearUserToken, and recordWithCamera might call into parseStreamBytes. Prefer unique, precise names. Are you frequently asking for the UserManager? Manager, Util, and similar suffixes are a common but imprecise naming convention. What does it do? It manages! If you're struggling to come up with a more precise name, consider sp ## Actions runs triggered from tags or forks with the same name as a protected branch will now be blocked DevFeed: [Actions runs triggered from tags or forks with the same name as a protected branch will now be blocked]() Original publisher: [Read original article]() Author: Kevin Duck Published: 2023-08-10T19:23:40Z Content type: release Language: en Sources: [GitHub Changelog]() Topics: [CI/CD](), [branch protection rules](), [Security]() Tags: [actions](), [blocking](), [branch](), [community](), [deploy](), [deployment](), [deployment-protection](), [deployments](), [environments](), [forks](), [github](), [github-actions](), [guardrails](), [hardening](), [learn](), [name](), [next](), [policies](), [security](), [tags]() ### AI overview GitHub is hardening environment deployment branch policies: runs triggered from forks whose branch names match a protected branch, and tags with the same name as a protected branch, will be blocked from deploying to environments protected by those policies. ### Source excerpt GitHub environments can be configured with deployment branch policies to allow-list the branches that can deploy to them. We are now security hardening these branch policies further by blocking runs... [Next page]()