About 35,000 Internet-Visible Responses Show AD FS Login Endpoint, Most Over Port 443

·2 views

A count of internet-facing responses found 35,111 containing the AD FS login path /adfs/ls, of which 20,623 answered on port 443. The measurement, taken 27 October 2026 using the ZoomEye search engine, also found 290 hosts with a certificate whose common name includes "adfs" and 53,359 certificates matching the name in a broader query. The author notes the certificate figure is imprecise, since such names may belong to federation servers, load balancers, mail gateways or internal hosts. Because AD FS handles single sign-on and its signing key or admin accounts could let attackers mint tokens accepted by many applications, Microsoft treats it as a tier-zero asset. The article recommends checking that only the login endpoint and required supporting paths are reachable from the internet, and that administrative interfaces are restricted to a management network.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Why Every Engineering Project Must First Justify Its Existence

The article argues that before any architecture or deployment work begins, teams should ask whether a given artifact needs to exist at all. It uses an apple as an analogy, noting that the eaten fruit rests on a vast web of trees, pollinators, farming, transport, and digestion that is easy to overlook. The author suggests that judging a system by its visible output alone understates the dependencies beneath it. The same reasoning applies to small software tools, which appear cheap but require tests, releases, documentation, and ongoing maintenance. The piece concludes that underestimating these hidden dependencies is a common planning mistake.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Fixing Deploy-Time 502 Errors in Cloud-Migrated Node.js Services

Teams migrating services to the cloud often see brief 502 error bursts during every deploy. The cause is usually that the service lacks proper health checks and does not shut down gracefully when it receives SIGTERM. Because the orchestrator and load balancer signal removal at different times, requests can reach a process that has already exited. Missing readiness checks and a mismatch between Node's keep-alive timeout and the load balancer's idle timeout cause further errors. Repeated failures lead teams to deploy less often and tolerate noise, which makes releases riskier. The article recommends separate liveness and readiness endpoints along with graceful draining, though serverless platforms and single-instance setups may not need this.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Rewording README and docs text so developers can follow it

Most documentation is accurate but written by authors who know the code too well to notice where newcomers get lost. Rewording should focus on the README intro, function descriptions, error messages, and jargon, since those are what readers encounter first or when something breaks. Before editing, exact identifiers like function names, flags, environment variables, and version numbers should be marked and kept unchanged so the surrounding prose can be rewritten safely. A good intro should state in two or three sentences what the project does, who it is for, and why to keep reading. Error messages should explain what went wrong and what to do next, and internal shorthand or unexplained jargon should be replaced with plain terms.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Env-Secrets-Scanner Skill Flags Exposed Credentials Before They Reach Git

A new env-secrets-scanner skill for Hermes AI is designed to catch leaked credentials such as .env files, private keys, and API tokens before they are committed to a repository. It uses a dependency-free Python script that runs offline and detects common secret patterns, including GitHub, Slack, Stripe, AWS, Google, and JWT tokens, as well as credentials embedded in URLs. The tool skips template files like .env.example and ignores build folders, and it masks any findings in its report so results can be shared safely. Developers can run it on a whole project, only staged changes, or as a pre-commit hook, with exit codes suited to CI/CD pipelines. The skill is available on GitHub through the hermes-skills repository.

0 comments Read more at DEV Community