TrendPulse
🇬🇧 English 🇨🇳 中文
🔖 Saved RSS
🌍 Dev.to

Confidential Transfers Have a Kill Switch: What It Costs You

Originally published on xroot.dev . The post on what is native and what is a third-party layer drew the same follow-up in three different ways: if the confidential features are native, can they be turned off? Yes. Every confidential operation on a Token-2022 mint depends on one on-chain program, the ZK ElGamal proof program, and the validator carries two feature gates for it: one that disables it and one that re-enables it. Both switches have been used. This post is what each one doe...
Tech
🌍 Dev.to

SIMD-0500 Will Block Making Old Programs Immutable

Originally published on xroot.dev . "Revoke the upgrade authority" is the last line of every honest token launch checklist and the first thing an auditor looks for. It is the on-chain promise that the code holding your money will never change. It has always been one instruction: set the program's upgrade authority to none, and the program is frozen forever. For a class of programs, that instruction will fail once SIMD-0500 activates; as of 17 September 2026 the gate exists in the validat...
Tech
🌍 Dev.to

Token-2022’s New Extensions: Pausable and Permissioned Burn

Originally published on xroot.dev . The post on permissioned tokens explained Token ACL: an allowlist that is a compliance feature when a regulated issuer runs it and a honeypot when an anonymous deployer does. The same year that program shipped, Token-2022 gained two extensions with the same double edge. Pausable lets an authority halt every transfer, mint and burn on a mint. Permissioned Burn puts a gate on who may destroy tokens. Both are legitimate, both are on mainnet, and bot...
Tech
🌍 Dev.to

Token Balances That Change Without a Transaction on Solana

Originally published on xroot.dev . You hold a token. You did not trade, transfer, stake or touch it. Your balance is different this morning than it was last night, and there is no transaction in your history to explain it. On Solana that is not a hack and not a display bug. It is one of two Token-2022 extensions doing exactly what they were built for: making the number a wallet shows depend on time , not on transactions. The raw amount in your account never changed. The interpretation ...
Tech
🌍 Dev.to

Sent SOL to an Address That Doesn’t Exist Yet? SIMD-0312 Fix

Originally published on xroot.dev . It is the most common support ticket in crypto, on every chain, and on Solana it has a specific mechanical cause. Someone is given an address — a deposit address, a program-derived address, an account a dApp is about to create — and sends SOL to it before the account exists. The SOL arrives. The address now has a balance and no account behind it. And when the program that was supposed to create the account finally tries, the system program refuses, becaus...
Tech
🌍 Dev.to

Solana’s Minimum Stake Delegation Is Now 1 SOL

Originally published on xroot.dev . For as long as Solana has had staking, the minimum you could delegate has been one lamport — a billionth of a SOL. It is why the network has tens of thousands of stake accounts holding a few thousandths of a SOL: airdropped stake, split leftovers, test delegations that were never cleaned up. Each one is a full account the runtime tracks and rewards, and each one costs more to process than it earns. That ended on 18 June 2026, when version 5 of the stak...
Tech
🌍 Dev.to

git blame Told Me I Wrote 767 Lines I Didn't Write

git blame Told Me I Wrote 767 Lines I Didn't Write Before writing about a gate, I checked who wrote it. The gate is 767 lines of JavaScript that refuses to ship a generated document when the model asserts a number or a tool that isn't backed by the source files. It sits in a document-generation pipeline I run locally — the same source material, retargeted per audience, which is exactly the setup where a model starts filling gaps to fit. I wired the gate into that pipeline four days ago, w...
Tech
🌍 Dev.to

SPL Token Was Replaced In Place: p-token, Explained

Originally published on xroot.dev . Every token you have ever held on Solana that is not Token-2022 lives under one program: the classic Tokenkeg… address. It is the most-called program on the chain, it has not materially changed in years, and most people assume it never will, because changing it would mean changing an address that half the ecosystem has hard-coded. SIMD-0266 did not change the address. It changed what runs behind it. On 13 May 2026, at the start of epoch 971, a featur...
Tech
🌍 Dev.to

After the Rent Cut, Your Old Solana Accounts Are Over-Funded

Originally published on xroot.dev . The rent-cut post explained the economics: Solana is cutting the price of account storage by 90% in five feature-gated steps, and accounts funded at the old price keep every lamport they were funded with. The follow-up question arrived within a day of publishing it: if my account holds more rent than it now needs, can I get the difference back without closing it? For four kinds of account, yes. Here is the arithmetic per type, the instruction that ...
Tech
🌍 Dev.to

Use `model: inherit` to Keep APC Agents Portable

A portable agent definition has a subtle design choice: should it name a model? My thesis is that model: inherit is the better default for an APC agent unless a particular model is genuinely part of the project's contract. It keeps the role portable while letting the runtime make an operational choice. APC is the repository-owned context layer: AGENTS.md and .apc/ describe what a contributor or agent needs to know about a project. APX is the daily-use runtime and tooling layer that read...
Tech
🌍 Dev.to

Telnet Is Still Open: Why the IoT Botnet Notices Keep Describing the Same Reachable Population

Telnet Is Still Open: Why the IoT Botnet Notices Keep Describing the Same Reachable Population When a national CERT publishes a notice about active botnet families, the intrusion methods listed are usually unremarkable. The August 2026 notice from China's National Network and Information Security Notification Centre named five cross-border families — Mirai, CondiBot, Gafgyt, TBot and SoftBot — and described initial access through Telnet and SSH brute force against unchanged factory credentia...
Tech
Why Data Validation Should Happen Before It Reaches Your Database
🌍 Dev.to

Why Data Validation Should Happen Before It Reaches Your Database

When an application accepts customer information, the database is usually treated as the final destination. But by the time data reaches the database, it may already be too late to fix problems efficiently. This is especially true for address data. A customer might enter an incomplete street name, an incorrect ZIP Code, or an outdated address. If the application stores that information without checking it, the bad record can move into billing systems, customer databases, fulfillment workflows...
Tech
HackerNews

Think Like an Attacker: CI/CD Security in the AI Era

Article URL: https://medium.com/@Koukyosyumei/think-like-an-attacker-ci-cd-security-in-the-ai-era-39f717f5e9cd Comments URL: https://news.ycombinator.com/item?id=49754622 Points: 2 # Comments: 0
AI
HackerNews

The new CC, an AI agent built for families

Article URL: https://blog.google/innovation-and-ai/models-and-research/google-labs/cc-expanding-to-groups/ Comments URL: https://news.ycombinator.com/item?id=49754898 Points: 1 # Comments: 0
AI