Cloudflare security-audit-skill, RepRapMicron, and AI agent memory – Oct 19

security-audit-skill: Cloudflare's coding-agent skill for security audits

cloudflare/security-audit-skill

• ★ 31.3k
• ⮂ 1,960

security-audit-skill is an open-source MIT-licensed JavaScript repository from Cloudflare that adds a security-auditing capability to coding agents. It runs multi-phase security audits and produces findings that are independently verified and machine-readable, so audit results can be consumed programmatically rather than read as prose. The repo has 31,272 stars and 1,960 forks on GitHub.

all-MiniLM-L6-v2: compact sentence embedding model

sentence-transformers/all-MiniLM-L6-v2

• ♥ 6,357
• ⇣ 208.9M

all-MiniLM-L6-v2 is a sentence-transformers model that maps sentences and paragraphs to a 384-dimensional dense vector space, used for tasks such as clustering and semantic search. It is Apache-2.0 licensed and ships in multiple formats including PyTorch, TensorFlow, ONNX, OpenVINO, and Rust. With 208,935,949 downloads and 6,357 likes on Hugging Face, it is one of the most widely used embedding models.

Hybrid Reasoning Agents: LLM agents that think in latent space, act through text

• ▲ 339
• 💬 163

An arXiv computer science paper (cs.CL, submission 2610.18861) proposing LLM agents that perform internal reasoning in latent space while acting and communicating through text. Authored by Jiaru Zou, Yunzhe Qi, and colleagues, it attracted a Hacker News discussion scoring 339 points with 163 comments, indicating practitioner interest in alternatives to purely text-based agent reasoning. The fetched abstract page confirms only the title, authors, and category.

bge-m3: multilingual multi-function embedding model from BAAI

BAAI/bge-m3

• ♥ 3,909
• ⇣ 31.7M

bge-m3 is a sentence-similarity embedding model from BAAI, built on XLM-RoBERTa and usable via the sentence-transformers library. It stands out for multi-functionality (dense, sparse, and multi-vector retrieval), multi-linguality across 100+ languages, and multi-granularity handling of inputs up to 8192 tokens. Released under the MIT license, it has 3,909 likes and 31,687,693 downloads on Hugging Face.

bert-base-uncased: Google's base English BERT masked-LM model

google-bert/bert-base-uncased

• ♥ 3,433
• ⇣ 30.5M

bert-base-uncased is Google's original BERT base model for English, pretrained with a masked language modeling objective and commonly used for fill-mask tasks and as a starting point for fine-tuning. It lowercases all input text and is available in the transformers library across PyTorch, TensorFlow, JAX, Rust, CoreML, and ONNX formats. It is Apache-2.0 licensed and has 30,543,278 downloads with 3,433 likes on Hugging Face.

I built a programming language that LLMs can't use

• ▲ 145
• 💬 110

A blog post by Dominik Picheta introducing KillSwitch, an esoteric programming language deliberately designed so that LLMs and coding agents cannot work with it effectively. The author benchmarks major models against the language to probe how much of their coding ability reflects genuine understanding versus pattern-matching on familiar syntax. The post drew 145 points and 110 comments on Hacker News.

ai-memory: long-term memory layer for AI coding agents

akitaonrails/ai-memory

• ★ 10.7k
• ⮂ 758

ai-memory is an MIT-licensed Rust project that provides persistent long-term memory for agent-based coding CLIs such as Claude Code and OpenAI Codex. Its main use case is handoff between different agent vendors: you can quit one agent mid-task and start another in the same directory, continuing without re-explaining architecture, failed approaches, or open questions. The repo has 10,711 stars and 758 forks.

Fine-Tuning Qwen3-8B with Tinker: From 50% to 76% Accuracy, and Burning Through My Budget

• ♥ 40
• 💬 13

This is a submission for the Hacktoberfest Open-Source AI Challenge Week 2: Side Hustle Oktoberfest?… Context: Dev.to – AI/ML.

My AI Experiment Was Going Great Until My Client Replied 😂

• ♥ 34
• 💬 1

Quick confession. Last Sunday I opened dev.to and my brain made a tiny error noise. 😵 Opus against… Context: Dev.to – Web Dev.

If you don't run your own LLM proxy, how do you know whats going on?

• ▲ 110
• 💬 77

A blog post arguing that operating your own proxy in front of LLM API providers is the only way to actually observe what is happening with your traffic. The author contends that without an intermediary you lack visibility into requests, responses, and provider behavior. It prompted an active Hacker News discussion (110 points, 77 comments) about practical implications for teams building on LLM APIs.

os-taxonomy: open dataset of primary school learning topics

withmarbleapp/os-taxonomy

• ★ 5,799
• ⮂ 975

os-taxonomy is a JavaScript-based open dataset that structures what children learn across primary and elementary education. It decomposes curriculum content into fine-grained "micro-topics", links them in a prerequisite graph showing learning dependencies, and aligns them to national curriculum standards. The repository has 5,799 stars and 975 forks, and is released under the ODbL-1.0 license.

Training a 97.5M Python coding model from scratch for $1.40 in GPU time

• ♥ 5
• 💬 1

I wanted to really understand how language models are built, and the best way I know to understand… Context: Dev.to – Machinelearning.

Popcraft

Paste one URL into Claude, ChatGPT, Cursor or Claude Code and your agent can plan, cost-preview and generate video, images, music and SFX with Seedance 2.5, Veo 3.1, Kling 3.0, Nano Banana Pro and 20+ more. OAuth sign-in, no API key. 100 free credits. Worth checking for pricing vs value, integrations, data ownership, and workflow fit.

shim-cli

An open-source hook and local proxy for Claude Code, Codex, Copilot CLI and VS Code. In Claude Code it masks secrets and personal data in tool results before the model reads them, and shim watch shows what a session sent and cost. No account, no telemetry. Worth checking for pricing vs value, integrations, data ownership, and workflow fit.

Bee Frontier and Bee Eclipse

Bee Frontier and Bee Eclipse are Amazon's new personal AI devices that help you remember what matters. Frontier is a wearable for your wrist or clothing, while Eclipse attaches magnetically to your phone. Both capture conversations and turn them into useful summaries, reminders, and follow-ups without retaining audio… Worth checking for pricing vs value, integrations, data ownership, and workflow fit.

Openbroca

Openbroca is a native Swift AI dictation app for Mac, with a ~6.5 MB download. Press a shortcut, speak naturally, and get clean text right where you're typing. It removes fillers and repetition while keeping your meaning and tone, with no prompt tweaking. Includes a personal dictionary that learns from corrections, Ty… Worth checking for pricing vs value, integrations, data ownership, and workflow fit.

3AM Super Intelligence

Meet 3AM, the AI on-call engineer for systems you can’t rewrite. It finds the root cause, rehearses the fix, and resolves the incident with one tap in Slack, all from inside your network. Worth checking for pricing vs value, integrations, data ownership, and workflow fit.

SpeechFast

Hold fn and talk. SpeechFast types clean text at your cursor, in any app. Everything runs on your Mac. The speech model is downloaded once; after that, no audio and no text ever leaves your machine. It works offline, on a plane, behind a locked-down corporate network. Dictate in Mail, Slack, Notion, your code editor,… Worth checking for pricing vs value, integrations, data ownership, and workflow fit.

Gen Alpha's struggling with telling the difference between AI slop and real videos. Even If AI stagnates, they got Gen Alpha to milk.

A Reddit discussion on r/artificial reports that Gen Alpha children struggle to tell AI-generated realistic videos apart from genuine footage. The poster says their young cousins watch AI-generated content on YouTube Shorts and can distinguish AI animation from AI realism, but cannot reliably separate AI realistic videos from real videos, attributing this partly to their still-developing judgment. The thread is flagged only as a community signal, not verified research.

Is anyone else feeling severe burnout from the current pace of AI releases?

This is a discussion post on r/artificial where the author describes exhaustion from trying to keep up with AI progress, comparing it to a treadmill that keeps speeding up. They point to a relentless cycle of new models, benchmark claims, and so-called paradigm-shifting agents arriving every week, and ask whether others in the community feel the same fatigue. It reflects a common practitioner concern about sustainability in the field.

No scripts: a virtual fly driven by its real brain wiring diagram (70k simulated neurons), live 24/7

A community-shared project is a virtual fly whose behaviour is not driven by reinforcement learning or behaviour trees, but by a spiking simulation of a real fly connectome covering roughly 70,000 simulated neurons. The body is a MuJoCo fly model whose legs are moved by an imitation-learned network. The fly can see, smell wind-borne odours, respond to spiders, groom, land, and eat, streaming live around the clock.

Is AI helping speeding up the medical research?

This is a community discussion thread on Reddit's r/artificial asking whether AI is measurably speeding up medical research, particularly for chronic illnesses that currently have no cure. The original poster questions how much AI is truly helping humanity reach a point where more chronic conditions could be cured permanently. No specific research findings or evidence are included in the available context, only the framing of the question itself.

a year of running a multi-model router for real work: seven things that survived, three that died

A community post-mortem describing roughly a year of daily, real-work use of a multi-model router that puts three models behind one interface: a drafter, a critic, and a long-context search component. The setup keeps a lessons file with provenance and a garbage collector that deletes any lesson not cited within 30 days. Among the findings that survived: assigning models roles rather than personalities, with the critic restricted to reading rather than acting.

In the AI era and Windows 11 times, can you troubleshoot old school ms-dos PC?

A Reddit post in r/artificial points to a browser emulator at retro.bioneural.de that simulates an old-school MS-DOS PC for hands-on troubleshooting practice. Users can add retro PC components, configure the BIOS (though not everything is set), and install, delete, or break MS-DOS software as on real hardware. The post frames it as challenges for IT admins, ranging from simple to difficult scenarios.

Even LinkedIn is getting tired of your AI-written posts

A community discussion on Reddit's r/artificial subreddit about backlash against AI-generated posts on LinkedIn. Commenters reportedly react to the growing volume of machine-written content on the professional network and the fatigue it creates among readers. For practitioners, the thread reflects a broader signal that audiences are increasingly detecting and rejecting obvious AI-authored text, a consideration for anyone deploying automated content generation.

Which AI limitations have you stopped waiting on and just learned to work around?

A discussion thread on r/artificial asking practitioners which AI shortcomings they have stopped expecting to be fixed and instead adapted their workflows around. The poster cites examples such as models returning wrong dates, struggling with long documents, and drifting from instructions, and asks what practical workarounds people use day to day. The thread is a community-sourced catalogue of coping strategies rather than a technical analysis.

Updates to site guidelines and AI/LLM tags

An announcement post on Lobste.rs describing changes to the community's site guidelines and its handling of AI/LLM-related tags. The author states that an increasing number of moderation actions have been needed around the topic, prompting the policy update. The post has drawn 67 comments, indicating active community discussion about how AI/LLM content should be moderated and categorized on the link-aggregation site.

It's enough – vibecoding tag crossed from useless to harmful

This is a meta-discussion on Lobste.rs, started by user viraptor, arguing that the site's vibecoding tag has crossed from being useless to actively harmful, and proposing to deal with it. The thread drew heavy engagement with 257 comments, 11 submissions already posted under the tag, and net +284 score, reflecting community disagreement about how to handle AI-assisted coding content on the aggregator.

My obituary for programming

An essay by Jeremy Scheff, published October 8, 2026 on his personal blog dumbmatter.com, framed as an obituary for programming in light of AI. It belongs to his ongoing blog, which covers programming and related topics, and is tagged AI and Programming. The fetched page contains only the opening of the piece, so its specific arguments and conclusions are not available from the context provided.

August in Servo: CSS Grid, text selection, and more

A monthly progress report from the Servo browser engine project, covering work in August on CSS Grid support, text selection, and accessibility and navigation improvements. Servo positions itself as a lightweight, high-performance alternative for embedding web technologies in applications. The post is relevant to practitioners tracking an independent browser engine written in Rust.

High performance policy routed IPsec mesh SD-WAN

ranet3 is an engineering writeup (and tool) for building a high-performance IPsec mesh SD-WAN. It implements userspace ESP (RFC 4303) in tunnel mode over UDP (RFC 3948), uses IKEv2 (RFC 7296) with hybrid ML-KEM post-quantum key exchange per RFC 9370, and includes an embedded Babel routing speaker with RTT metrics and source-specific routing, plus SRv6 steering. Relevant to engineers designing encrypted site-to-site networks.

The Brain Sandwich

The Brain Sandwich is an essay proposing a workflow for using AI coding agents responsibly: first understand the problem yourself, let an agent help produce the work, then verify and explain what it did before sharing it. The author frames it around frustrations raised in a 1:1 with a colleague, including the heavy load of code reviews generated by AI-assisted development.

A Management Interface Vulnerability in PAN-OS Needed Credentials. Attackers Used It Anyway

• ♥ 7
• 💬 1

A management interface vulnerability in PAN-OS, CVE-2026-0322, needs admin credentials. CISA added it to its exploited list anyway. Here is what we checked. Context: Dev.to – DevOps.

Verification: community signal; use the linked source as context, not final confirmation.

CVE-2026-102764: BeyondTrust Remote Support Authentication Bypass by Spoofing Vulnerability

This is a spoofing-based authentication bypass vulnerability in BeyondTrust Remote Support, tracked as CVE-2026-102764. It appears on the CISA Known Exploited Vulnerabilities catalog, which signals active exploitation and drives federal remediation deadlines. The entry context is limited: affected versions, exploit mechanics, and mitigation steps were not provided, so the primary advisory should be consulted before acting.

Verification: cisa kev confirmed.

CVE-2025-61624: Fortinet Multiple Products Path Traversal Vulnerability

CVE-2025-61624 is a path traversal vulnerability affecting multiple Fortinet products, listed in the CISA Known Exploited Vulnerabilities catalog, which indicates it is being actively exploited in the wild. The NVD entry was not retrievable at fetch time, so affected versions, CVSS score, and specific mitigation steps could not be confirmed from the available context. Engineers should consult Fortinet's advisory and CISA KEV guidance directly for patching deadlines and affec…

CVE-2026-21589: Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability

CVE-2026-21589 is a vulnerability affecting multiple Atlassian products in which files or directories are accessible to external parties. It has been confirmed as listed in CISA's Known Exploited Vulnerabilities catalog, indicating active exploitation and pressing need for patching. The NVD entry and the vendor advisory should be consulted for exact affected versions and mitigation steps; the page snippet fetched here contained no version or technical detail.

RepRapMicron

• ▲ 369
• 💬 57

RepRapMicron (μRepRap) is an open-source 3D printer project aiming to bring fabrication down to the micron scale, extending the RepRap self-replicating printer lineage. The hardware design is written in OpenSCAD and released under GPL-3.0, and the repository has 253 stars. Discussion on Hacker News drew 369 points and 57 comments, reflecting community interest in micron-scale printing.

Java sealed classes and exhaustive pattern matching

• ▲ 158
• 💬 113

A technical blog post by Neil Madden explaining how Java 17's sealed classes work with exhaustive pattern matching. Sealed classes let a developer explicitly list the permitted sub-types of an interface or base class, so the compiler can verify that a switch over those types covers every case. The post illustrates this with a sealed interface implemented by records such as TypeA and TypeB. The discussion drew 158 points and 113 comments on Hacker News.

Free Pascal compiler now supports dynamic packages

• ▲ 145
• 💬 36

This article announces that the Free Pascal compiler, the compiler behind the Lazarus IDE and its Delphi-like component framework, now supports dynamic packages. Dynamic packages allow units to be loaded at runtime rather than linked statically into every executable, which affects how Lazarus applications are built and deployed. The item drew 145 points and 36 comments on Hacker News.

PalmOS Lemmings

• ▲ 116
• 💬 26

A C-language reimplementation of the classic puzzle game Lemmings targeting PalmOS devices. The source is provided as-is for educational purposes, per the README, making it a reference for anyone studying how 1990s games were ported to early handheld hardware. The repository has 129 stars and 17 forks, and a related Hacker News thread drew 116 points and 26 comments.

DmNote: customizable key viewer overlay for DJMAX and other games

DmNote-App/DmNote

• ★ 4,878
• ⮂ 377

DmNote is an open-source desktop overlay that displays a player's keyboard input on screen, aimed at rhythm-game players streaming or recording DJMAX RESPECT V, though it works with any game. It is built with React 19, TypeScript, Vite 7, and a Tauri backend, using the Windows Raw Input API for key detection and global input events on macOS. The repository is TypeScript under GPL-3.0 and has 4,878 stars and 377 forks.

The Browser Already Has a Priority System. Your debounce(300) Does Not.

• ♥ 6

I watched a search box die in the most boring way possible. Three letters. The caret blinked,… Context: Dev.to – Javascript.

XBOX Nano Controller

The next generation of gaming brings our largest digital library yet to our smallest Xbox ever. With more dynamic worlds, faster load times, and the addition of Xbox Game Pass (sold separately), the all-digital Xbox Series S is the best value in gaming. Worth checking for pricing vs value, integrations, data ownership, and workflow fit.

A New Way to Think About Borrow Checking (In Reverse)

An essay by Evan (verdagon.dev) proposing a reverse framing of borrow checking: instead of checking borrows forward from creation, reason backwards in time so each borrow already knows how the future will use it. The post is aimed at language designers and Rust practitioners interested in alternative approaches to ownership and aliasing rules. Only a short page snippet was available, so implementation depth and evaluation results could not be confirmed.

Superoptimizing an FPU emulator

A blog post by purplesyringa about applying superoptimization to a floating-point unit (FPU) emulator. Superoptimization, as the post defines it, is a process where a compiler automatically finds the optimal sequence for a loop-free sequence of instructions. The article is aimed at practitioners interested in low-level optimization techniques and was surfaced on Lobste.rs with community verification.

Inline rendering with document.currentScript

An engineering note by Lean Rada (dated 7 Mar 2025, about a 10-minute read) showing how to render simple dynamic content in a page using the browser's document.currentScript API. The author argues that for quick, simple cases you can skip heavier options such as Handlebars templates or a PHP backend, and instead have a script inspect its own tag to inject rendered output in place.

SQLite 3.54's diskused command needs a build flag sqlite3_analyzer never required

• ♥ 10

SQLite 3.54 replaces sqlite3_analyzer with a built-in diskused() function. It ran a disk-space report in 0.025s against the old tool's 0.061s, but on a build without SQLITE_ENABLE_DBSTAT_VTAB it fails with no error and no output at all. Context: Dev.to – DevOps.

Postgres 19 Slipped to November: Every Pulled Feature and Why

• ♥ 10

PostgreSQL 19 was planned for October 2026, and the project's roadmap still says so. General… Context: Dev.to – DevOps.

Latch

Latch locks distracting apps until you scan your key, and the key lives where you have to walk: an NFC sticker on the fridge, a printed QR code, or a number of steps. No account, no ads, no analytics. iPhone and Android; Pro is $9.99 once. Worth checking for pricing vs value, integrations, data ownership, and workflow fit.

Inbox Zero

Inbox Zero is a product launch drawing early attention on Product Hunt. Worth checking for pricing vs value, integrations, data ownership, and workflow fit.

Vampire Crawlers™

From the somehow triple-BAFTA‑winning creators of Vampire Survivors, Vampire Crawlers: The Turbo Wildcard from Vampire Survivors turns the snowballing thrill of Survivors into a hyper turn‑based, card‑driven BLOBBER with rogue-lite elements. Build busted decks, explore familiar dungeons from a new perspective, and unl… Worth checking for pricing vs value, integrations, data ownership, and workflow fit.

Someone behind the software

• ▲ 395
• 💬 157

An essay by Karri Saarinen arguing that well-made products carry traces of their makers: their experience, their values, and their beliefs about how things should work. It resonated strongly on Hacker News, drawing 395 points and 157 comments, with readers debating the practical implications for how teams build and ship software.

Promise Delivered: Welcome to the DEV Hall of Fame (65 Authors, 65 Masterpieces)

• ♥ 119
• 💬 57

Status: Promise delivered ✅ The Doors Are Open A little over a month ago, I published… Tagged with community, discuss, showdev, writing.

🐾 DEV Pet Corner #2: Show Us Your Pets!

• ♥ 73
• 💬 24

TL;DR DEV Pet Corner is back for another Sunday! It's a weekly series where we take a little break…

Dogs seem to agree with humans that 'bouba' is round and 'kiki' is spiky

• ▲ 192
• 💬 117

A science article reporting research on the bouba/kiki effect in dogs, the cross-cultural human tendency to associate the nonsense word 'bouba' with round shapes and 'kiki' with spiky ones. The findings suggest this sound-shape mapping is not unique to humans or dependent on language and alphabet, pointing to a deeper, possibly shared perceptual basis. The Hacker News thread drew 192 points and 117 comments.

William Gibson and the trademarking of cyberspace

• ▲ 140
• 💬 41

An article debunking a long-circulating web story about the word "cyberspace." Autodesk did trademark the term, and novelist William Gibson did object, but the tale that Gibson retaliated by trademarking the name of engineer Eric Gullichsen was a prank started by Timothy Leary. The piece reconstructs the episode from a 1990 Barcelona gathering of the people involved. It drew 140 points and 41 comments on Hacker News.

The Garden I Wait for Every Winter

• ♥ 42
• 💬 18

October always makes me look at my garden a little differently. The monsoon is beginning to fade,…

I Built a New Tab Extension for DEV

• ♥ 30
• 💬 8

I spend a lot of time on DEV these days. Reading posts, finding interesting projects, participating… Context: Dev.to – Showdev.

React 19.2 useEffectEvent: Why It Won't Fix Your Deps Array

• ♥ 8

React's useEffectEvent (stable in 19.2) kills stale closures in Effects without a ref trick — but it's not a deps-array shortcut. Guide + cheat sheet. Context: Dev.to – React.

US Artificial Intelligence Expansion Faces Major Hurdles

A community discussion on r/artificial about the hurdles limiting the expansion of artificial intelligence in the United States. The thread is flagged as a community signal rather than verified news, and no article content was retrievable beyond the Reddit page itself. Practitioners may find it useful as a gauge of public sentiment, but specific claims or findings cannot be confirmed from the available context.

ARP! Tell your network to explain itself

A blog post by Ben about tracking the devices on a home network when you cannot remember which IP addresses were assigned to which devices, or what the router handed out. The approach leans on ARP, the protocol that maps IP addresses to hardware MAC addresses, as a way to make the network report which hosts are actually present rather than relying on memory or manual notes.

Men in tech #YesAllMen

This is a recorded conference talk hosted on media.ccc.de, apparently from the EMF 2026 event, addressing men's role in sexism within the technology industry under the hashtag #YesAllMen. The page snippet only confirms the talk exists on the Chaos Computer Club media platform and offers podcast and video feeds in SD quality; no details of the talk's arguments or speakers are provided in the available context, so the specific claims cannot be summarized here.

Outside the Scope of Our Support

A blog post by the author fireborn about reporting a bug to Google Disability Support. The bug in question kills touch exploration for every screen reader on Android until the phone is rebooted, and the post recounts the support experience where the issue was deemed outside the scope of support. It is relevant to practitioners dealing with accessibility defects and vendor support processes on Android.

What the heck is /pkg?

A blog post investigating a newly noticed /pkg/env/global/bin entry that appeared in the PATH on macOS 27.0. The author first encountered it while troubleshooting a PATH issue and initially suspected something had gone wrong with their system. The post explains that this directory is part of the operating system, though its purpose remains undocumented and unclear, even to the community examining it.

QML for C & Zig

This is a practitioner-written engineering note shared on Lobste.rs explaining how to use QML, the Qt declarative UI language, from C and Zig rather than the usual C++ route. It is shared as a GitHub gist by rcalixte. The context available here is limited to the link metadata and no content from the gist itself, so specific implementation details, code examples, and lessons learned could not be verified from the supplied material.