“acsync” — Fediverse search results on home.social

Bulletin ID: 2026-081-AWS

Scope: AWS

Content Type: Important (requires attention)

Publication Date: 08/13/2026 10:30 AM PDT
Description:
OpenSearch SQL plugin is a plugin that enables SQL and PPL query capabilities on Ope...

https://aws.amazon.com/security/security-bulletins/rss/2026-081-aws/

#aws #security

Daily CyberSecurity @[email protected]

2026-10-14

Attackers are exploiting CVE-2026-76519 (CVSS 9.8), a critical Cisco Secure Email Gateway vulnerability allowing root RCE via attachments. Patch right now.

#CVE202676519 #Cisco #EmailSecurity #AsyncOS #RCE #ZeroDay #Cybersecurity

https://securityonline.info/cisco-secure-email-gateway-cve-2026-76519-exploited/?utm_source=mastodon&utm_medium=jetpack_social

#cve202676519 #cisco #emailsecurity #asyncos #rce #zeroday

What's New @[email protected]

2026-10-12

NestJS v12.1.3

Flush buffered logs when application initialization fails; Run transient global enhancers on controllers; Guard async request hook completion in the Express platform; Destroy the StreamableFile source when the client disconnects; Run wildcard middleware on the bare global prefix path in Express…

https://whatsnew.fyi/product/nestjs/releases/v12.1.3

#NestJS #Programming

#nestjs #programming

mnl mnl mnl mnl mnl @mnl

2026-10-13

That is why it’s so frustrating to hear takes that #llms #llm #ai can only be used this one way, the ones being sold to you, the one the obviously shortsighted industry has latched on to, and yet also is fairly successful (at what costs), instead of being curious and thinking how a stochastic word transformer could be used that is different than lobbing missiles at the Gordian knot of software complexity.

It’s just as shortsighted. You don’t need any big model these days to do this kind of research, a 3B model that runs on your phone is enough to assist writing better software, and way more powerful than chatgpt3.5 on which I cut my teeth.

I’m not a “good” software developer by any means, I forget all the APIs, I mix up details, I program on paper with diagrams (always have), and working out the above took me a few years, but the last models (opus 5.5 in particular, but really since gpt5.2) have eliminated the need for any detail work, so that now everything is geared towards language and composability. Except I don’t spend my days thinking about how to compose functions as I used to do before llms, and very rarely sketched out larger systems (say, an async task system or an event queue), and maybe once or twice in my life designed an entire codebase from beginning to end (in a professional setting).

Async task systems / event queues are not the punctuation of the things I build, my work is currently at the level of “how can I compose a GPU compiler with a realtime vision pipeline and a dataset versioning system targeting on demand heterogeneous and unreliable spot-instance clustering”. That’s legit a week-long task to get something up in prod, and maybe a longer arc of a few months to come up with something consistent and elegant.

The attached screenshots are the kind of work and thinking that goes into it. Those are 3 prototypes / tools I made over the last two days to work out how to deal with these massive amounts of information, the part I do struggle with. Compiler / cluster / benchmark / realtime vision is fine, those I can prompt in a couple of sentences because I worked out the “theory”.

#llms #llm #ai

Dev Community @[email protected]

2026-10-12

While working on an employee management platform, I ran into a problem that looked small at first.

The user was already logged in.

The application knew who they were. Their role was available. Their session was active.

Yet, when they opened the AI assistant and asked about their attendance or leave, the assistant could still ask them to provide their employee ID or name.

Something wasn't connected properly.

The problem wasn't the chatbot's intelligence

My first instinct was to think about how to improve the assistant's instructions.

But the more useful question was: why does the assistant need to ask for information that the application already has?

A chatbot prompt can tell an AI how to behave. It cannot magically give the backend the correct identity, permissions, or database context.

If those things aren't connected properly, even a well-written prompt can produce a frustrating experience.

Three things I started separating

1. Identity: Who is making this request?

This should come from the authenticated session or a verified access token.

The user shouldn't need to introduce themselves every time they open a feature.

2. Authorization: What are they allowed to do?

Knowing someone's identity doesn't mean they can access every resource.

An employee might be allowed to view their own attendance, while an HR administrator may have permission to manage attendance records for multiple employees.

The backend must enforce these permissions. The AI should not decide them on its own.

3. Data scope: Which records should this request use?

Even after identifying the user and checking their permissions, the application must scope the database query correctly.

For example, an employee asking about their leave balance should get data associated with their authenticated employee record—not whichever employee ID happens to appear in a chat message.

These are separate responsibilities. Treating them as one problem creates confusing behavior and can introduce security vulnerabilities.

What the backend should do instead

A simplified version of the flow looks like this:

async def get_my_leave_balance(
current_user,
db,
):
employee = await get_employee_for_user(
db=db,
user_id=current_user.id,
)

if employee is None:
raise EmployeeNotFoundError()

return await get_leave_balance(
db=db,
employee_id=employee.id,
)

This is illustrative pseudocode; the helper functions and exception would need to be implemented in the actual application.

The important part is where employee.id comes from: a trusted relationship between the authenticated user and their employee record.

The client or chatbot shouldn't be able to choose another employee's identity just by supplying a different ID.

For administrative actions, the backend would also need to verify the user's role and the specific permission required for that operation.

The bigger lesson

Building AI features has made one thing particularly clear to me: adding an AI model doesn't remove the need for good backend architecture.

Authentication, authorization, data access, and business rules still need to work correctly.

The AI can help interpret a request. The application must determine whose request it is, what that person can access, and which data the answer should be based on.

That distinction matters even more when the assistant can do things rather than simply answer questions.

I'm still learning, building, and finding these gaps in real projects. And sometimes, the most useful engineering lesson comes from a feature that technically works but still behaves in a way that makes no sense to the user.

My takeaway: Don't ask the user to repeat information your system should already know. Pass the right context through the right layers, and enforce the important rules on the backend.

I'd be interested to hear how other developers handle authenticated user context in AI assistants, especially in applications with multiple roles and organizations.#ai #webdev #python #architecture #software #coding #development #engineering #inclusive #community
A Logged-In User Shouldn't Have to Introduce Themselves to Your Chatbot

#ai #community #software #webdev #coding #python

Dev Community @[email protected]

2026-10-14

The OpenAI Python SDK is mostly a base_url and an api_key. If an API speaks the same shapes — /images/generations, /chat/completions, /videos — the SDK you already have installed works against it.

LivePair exposes exactly that surface: an OpenAI-compatible endpoint covering 60+ image and video generation models (Seedream, Seedance, Wan, Qwen Image, Ideogram, Minimax) plus a set of chat models. One base_url change, and client.images.generate() produces media from models that don't exist on OpenAI.

Disclosure: I work on LivePair. Everything below is runnable against the live API — the catalog, prices, and shapes are public at GET /v1/agent/models.

Setup

pip install openai requests

Grab a key: sign up at livepairai.com → Settings → API keys → lp_…. Billing is a prepaid credit balance — each call debits the per-model price, no subscription.

from openai import OpenAI

client = OpenAI(
base_url="https://livepairai.com/v1/agent",
api_key="lp_...", # sent as a Bearer token, so the stock SDK works
)

Images — client.images.generate just works

img = client.images.generate(
model="seedream-5.0",
prompt="a lighthouse on a cliff at dusk, cinematic lighting",
size="1024x1024",
)
print(img.data[0].url)

That's the unmodified OpenAI call. The catalog decides what model can be — seedream-5.0, qwen-image-3, ideogram-3-turbo, and so on. size accepts the standard 1024x1024 / 1792x1024 / 1024x1792 values and maps onto each model's aspect-ratio ladder.

Chat — client.chat.completions.create

r = client.chat.completions.create(
model="deepseek/deepseek-v4.1-flash",
messages=[{"role": "user", "content": "Explain the CAP theorem in two sentences."}],
max_tokens=256,
)
print(r.choices[0].message.content)

Video — Sora-shaped, poll-then-download

The video endpoint mirrors OpenAI's Videos API shape: POST /videos returns a job immediately, GET /videos/{id} polls status, GET /videos/{id}/content streams the mp4. Newer SDK releases have a client.videos namespace; here's the plain-HTTP version so the contract is visible:

import time, requests

H = {"Authorization": "Bearer lp_...", "Content-Type": "application/json"}
BASE = "https://livepairai.com/v1/agent"

job = requests.post(f"{BASE}/videos", headers=H, json={
"model": "wan-3.0-t2v",
"prompt": "drone shot over a foggy forest at dawn, slow push-in",
"size": "1280x720", # 16:9; 720x1280 → 9:16
"seconds": "5",
}).json()

vid = job["id"]
while True:
v = requests.get(f"{BASE}/videos/{vid}", headers=H).json()
if v["status"] in ("completed", "failed"):
break
time.sleep(5)

if v["status"] == "completed":
mp4 = requests.get(f"{BASE}/videos/{vid}/content", headers=H) # 302 → media URL
open("out.mp4", "wb").write(mp4.content)

Prices are data, not a pricing page

GET /v1/agent/models returns every model with a priceUsd field — the exact per-call debit before you make it:

models = requests.get(f"{BASE}/models").json()
for m in models["models"]:
print(m["id"], m["mode"], m["priceUsd"])

GET /v1/agent/balance shows your prepaid balance and recent ledger entries.

Why bother

The useful part isn't another API key — it's that image gen, video gen, and chat land on the same OpenAI surface you already integrate, priced per call against a balance you can watch. For pipelines that need several model families (compare outputs, fallback chains, cost routing), switching models is a string, not a new provider account.

There's also a no-account path if you're wiring autonomous agents: the same endpoints answer 402 Payment Required and settle per call in USDC via x402, so a client that can sign a payment header can call without any signup at all.

Gotchas

n > 1 isn't supported on image generation — loop instead.
Video is async by design; budget ~1–3 min per clip depending on model.
A generation that fails provider-side refunds to the balance automatically.
Results aren't published anywhere and are deleted after 48h — save the bytes.

Docs: livepairai.com/docs, machine-readable spec at /v1/agent/openapi.json, MCP server for agent clients under /mcp.#ai #api #openai #python #software #coding #development #engineering #inclusive #community
Generate images and video with the OpenAI SDK — no OpenAI key required

#ai #community #software #coding #python #development