Apache STeVe v3: How the ASF Rebuilt Its Member Voting System from Scratch

·1 views

The Apache Software Foundation (ASF), which governs some of open source's most critical projects, recently ran its annual Members' Meeting election on a fully rebuilt version of its voting platform, Apache STeVe v3. The system allows roughly 800 ASF members to elect a Board of Directors and admit new members without any corporate or vendor influence over the process. Built on modern tools including Python's asfquart framework, Bootstrap, and SortableJS, the new version was developed as a standard open-source Apache project with public code and community-driven decisions. A key feature of STeVe v3 is its privacy architecture: every vote is encrypted using Argon2 key derivation and Fernet symmetric encryption, ensuring no ballot can be linked to an individual voter — even by the system's own administrators. The tally process intentionally takes 15 to 60 minutes due to the computational cost of reversing the encryption, a deliberate design choice that strengthens security as hardware improves over time.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Developer Documents HTML Dashboard Build Focusing on Accessibility and Structure

A developer shared progress on a Fullstack Roadmap project, detailing the construction of a structured dashboard using layered HTML containers. The project incorporated key UI components such as a sidebar for navigation, a form for filtering module progress, and cards for organized content presentation. A major focus was placed on accessibility, specifically the correct use of ARIA attributes: aria-label for describing visual-only elements and aria-current for identifying the active page. The developer noted that most bugs encountered during the project were related to improper or missing ARIA implementations. The post emphasizes that using familiar tools intelligently, rather than chasing new ones, can yield strong results, and invites fellow beginners to reflect on the importance of accessibility in user experience.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How Developers Can Use Internet Scanning Tools to Spot Accidentally Exposed APIs

Misconfigured firewalls or overlooked load balancer settings can inadvertently expose internal APIs and development environments to the public internet, creating serious security risks. Tools like ScanSearch function as search engines for internet-connected devices and services, allowing developers to query for exposed endpoints, open ports, and HTTP responses at scale. Developers can use such tools to verify that internal services remain inaccessible externally, detect misconfigurations like exposed Git repositories or environment files, and map unintended public-facing assets. A common vulnerability involves API documentation endpoints — such as Swagger UI at paths like /api-docs — being publicly accessible without authentication, potentially giving attackers a full blueprint of an API. Proactively searching for these exposures using targeted queries helps development teams identify and remediate risks before malicious actors can exploit them.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Developer Proposes Two-Tier LLM Routing to Cut Costs Without Sacrificing Output Quality

A software developer has outlined a two-tier LLM pipeline that routes tasks to a cheaper model by default and falls back to a more capable, costlier model only when the output fails a deterministic check. The key design principle is that no language model is allowed to judge its own or a peer's output — validation is handled exclusively by objective tools such as test suites, JSON schema validators, or regex checks. Every routing decision is logged to a JSONL audit file, making the system's behavior traceable and measurable over time. The pipeline is built to be provider-agnostic, compatible with any service that supports the OpenAI-compatible chat API. The author notes the article was prepared as part of outreach for MonkeyCode, a platform that provided free model access used during development.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Why Picking the Best AI Coding Tool Is the Wrong Question to Ask

A DEV Community analysis argues that comparing AI coding tools on autocomplete speed is a fundamental mistake, as each tool operates in a distinct environment with different strengths. Cursor and Windsurf function as agentic code editors, Claude Code runs as a terminal agent on local repositories, GitHub Copilot spans IDEs and cloud pull-request workflows, and Replit Agent generates runnable prototypes in a hosted browser environment. The article warns that overlapping subscriptions rarely add value, and that local terminal agents like Claude Code carry higher security risk if default read-only permissions are loosened. Rather than relying on feature comparison tables, the piece recommends running structured pilots on a non-sensitive repository, giving each tool an isolated branch and measuring time-to-result, human prompts needed, and any dangerous commands issued. The core advice is to first identify where the AI needs to run your work, then select the tool category that matches that context.

0 comments Read more at DEV Community