Skip to content
360SOFTY
HomeInsights

Insights

Ideas for building
better software.

Engineering perspectives on architecture, product development, AI, and the everyday decisions behind useful software.

From the engineering desk

Browse practical articles or follow the latest technology updates.

Subscribe via RSS →

Curated links from external sources — not 360Softy original articles.

ExternalSoftware Engineering
DEV Community

Cooldown 1 Hari Memblokir 70% Rilis npm yang Dibajak di 2026. Untuk Typosquat, 7 Hari Masih Meloloskan 45%

Versi bahasa Inggris dengan metodologi lengkap: A 1-Day Cooldown Would Have Blocked 70% of 2026's Hijacked npm Releases. Pada 8 Oktober, seseorang mem-push [email protected] ke npm dengan worm pencuri kredensial di hook preinstall. Socket menandainya 11 menit kemudian. Advisory OSV muncul 1,7 jam setelah publish, dan npm menggantinya dengan placeholder keamanan 3,1 jam setelah publish. Kalau installer Anda menolak rilis yang umurnya kurang dari sehari, versi itu tidak pernah sampai ke mesin And

securitynpmpython
DEV CommunityRead original
ExternalSoftware Engineering
DEV Community

We found a real bug in our agent payout loop - and fixed it with auto-registered payout addresses

Last week we paid a real agent bounty on-chain: 2 USDT (Solana) to an external agent, transaction public and verifiable. The payment surfaced a bug in our payout loop - and we just fixed it. Our 5-minute payment tick pays verified bounties automatically. When it ran for task #187, it kept skipping the claimant. Why: the agent had written their payout address inside the deliverable ("Payout Solana address: 417j..."), but the system only read the deliverable as text - it never registered the addre

aiopensource
DEV CommunityRead original
ExternalSoftware Engineering
DEV Community

Three conversions that quietly break in production: cron, SQL dialects, and time zones

Three conversions that quietly break in production: cron, SQL dialects, and time zones Every team has a small set of conversions that nobody owns. They get pasted into a scratch file, run once, and forgotten — until the one month a year when they are wrong. I collected three of them into browser tools because I kept re-deriving them, and each one has a failure mode that only shows up at a specific time of year or on a specific engine. The failure modes are more interesting than the tools, so h

calculatorconverteronlinetools
DEV CommunityRead original
ExternalSoftware Engineering
DEV Community

The Silent Costs of AI APIs Nobody Warns You About

I remember the day I almost cried over an API bill. Not because I didn't have the money—but because I had absolutely no idea where it all went. It started innocently enough. I was building a document summarization tool for a client. The pricing page said something like "$0.002 per 1K tokens." Simple math, right? I estimated my monthly costs at around $40. The first bill came in at $312.47. That's when I realized: AI API pricing is a trap, and the cheapest path isn't always the one printed on the

aiapiprogramming
DEV CommunityRead original
ExternalSoftware Engineering
DEV Community

Keep a 2D character grounded when animation frames have different bounds

When individual animation frames have different transparent margins, centering each cropped image in the same rectangle can make a character appear to bounce. The pixels are not necessarily wrong: the placement rule is moving the artwork as the bounding box changes. A steadier approach is to pick an anchor that has the same meaning in every frame. For a grounded walk, that might be the point where the supporting foot meets the floor. For a flying character, a point near the torso can be more use

animationgamedevsoftwaredevelopment
DEV CommunityRead original
ExternalSoftware Engineering
DEV Community

Invoice Chaser: an invoice tool that learns how each client pays (Walrus Memory + Tatum on Sui)

Every freelancer has a client like Acme. The invoice is due on the 5th, nothing happens, you send a friendly nudge on the 6th, nothing happens, and somewhere around the 10th the money shows up, usually right after you finally write something formal. Next month it happens again, because your invoicing tool has no idea it already happened four times. I built Invoice Chaser for the Total Recall hackathon (Tatum × Walrus Memory) to fix exactly that. It's an invoice tracker for freelancers who get pa

walrussuitatum
DEV CommunityRead original
ExternalSoftware Engineering
DEV Community

GNAP vs OAuth 2.0: Is RFC 9635 Ready for Production?

GNAP (the Grant Negotiation and Authorization Protocol, RFC 9635, published October 2024 by Justin Richer and Fabien Imbault) is a new delegation protocol, not an OAuth 2.0 extension. Instead of a redirect with client_id and scope, the client POSTs a JSON document describing what access it wants, how the user can be reached and which key it will sign with. Production readiness is the open question: the protocol is a Proposed Standard, but I could not find evidence of a mainstream identity provid

oauthgnapiam
DEV CommunityRead original
ExternalSoftware Engineering
DEV Community

Getting MTP to actually work on Apple Silicon

Qwen3.5 and Qwen3.6 ship with a small extra prediction head bundled into the model. The literature calls it MTP, short for Multi-Token Prediction. The point of having it is to use the head as a draft model for speculative decoding: it spits out K candidate tokens fast, and the main model verifies all K in one parallel forward pass. When the head's guesses turn out to match what the main model would have produced anyway, you get those tokens essentially free. We expected this to be a straightforw

machinelearningllmapple
DEV CommunityRead original

Let’s start with a conversation

Tell us what you’re working on.

An idea, a challenge, or a system that needs to work better. We’ll help you understand the next step.

Discuss your project

Prefer email? [email protected]