Audit Finds 66% of 10,238 Code Blocks Unowned, All Traced to One Missing Declaration

·1 views

A codebase audit revealed that 6,718 of 10,238 code blocks had no declared owner, accounting for 66% of the total. All orphaned blocks were found in a single tools directory that had simply never been added to the ownership model, making the fix a single declaration rather than thousands of individual corrections. A separate finding flagged 916 orphan Rust functions spread across 14 crates, representing a genuine backlog requiring multiple review passes. The audit also exposed a counting inconsistency in proof declarations, where three different search methods returned three different totals, highlighting an undefined term rather than a data error. The exercise underscores how grouping and concentration data alongside raw counts is critical to distinguishing a systemic gap from a true backlog.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Dev fixes memory-killing build step by replacing redundant rebuilds with record lookups

A software developer noticed their project's acceptance-check step was repeatedly killed by the OS out-of-memory killer four times over two days. Investigation revealed the step, named a 'read', was actually triggering a full recompile of all 15 project units just to extract pass/fail booleans — duplicating work already done by prior control runs. Each control run had already stored its result alongside the exact commit hash it ran against, making re-execution unnecessary. The fix replaced the costly rebuilds with a simple comparison of stored commit identifiers, adding a 'stale' counter to flag outdated records instead. The developer concluded that any observational step consuming resources disproportionate to mere data-gathering is likely re-deriving facts that already exist.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Solo founder builds OSPulse to catch supply-chain threats before CVEs are assigned

Rob, founder of small indie firm Fortitude Omnis Group Ltd, has introduced OSPulse, a software supply-chain security tool designed to detect risks before official vulnerability identifiers exist. Unlike mainstream tools from VC-backed competitors such as Snyk and Sonatype, OSPulse monitors maintainer churn, ownership changes, and commit-velocity drops across more than ten data feeds. A standout feature called PoisonBox runs every npm package install inside an isolated disposable microVM, using an eBPF kernel probe to record all processes, file access, and outbound connections without touching the host machine. Rob also disclosed a pricing bug in which the checkout displayed £249 per month while Stripe was configured to charge £2,988 as a lump sum, a discrepancy caught before any customer was billed and since resolved by tying all pricing to a single source of truth. The introduction was posted on developer community platform DEV as part of a self-introduction thread.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How Data Modeling, Schemas, and Joins Shape Power BI Report Performance

A practical guide published on DEV Community explains core data modeling concepts in Microsoft Power BI, a business intelligence tool used to connect data sources and build reports and dashboards. The article compares three structural approaches — flat table, star schema, and snowflake schema — outlining the roles of fact and dimension tables in each design. It highlights why a well-structured data model matters, noting that poor design leads to slow performance, inflated file sizes, and inaccurate report figures. The guide also covers how relationships and filter direction operate within the data model, and how Power Query joins differ from model-level relationships. A recommended approach for structuring a typical BI solution is included, with star schema presented as a scalable and report-friendly option despite its data redundancy trade-offs.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

CVE-Based Scanners Miss the Fastest Supply-Chain Attacks, Analysts Warn

Security scanners that rely on CVE databases are structurally blind to supply-chain attacks because a CVE can only be assigned after a flaw is discovered, catalogued, and published — a process that takes time attackers do not wait for. High-profile incidents including the event-stream npm compromise in 2018, the ua-parser-js hijack in 2021, and the polyfill.io domain sale in 2024 all caused damage before any CVE existed. Even xz-utils, which did receive CVE-2024-3094, had visible human warning signs — a new contributor slowly gaining trust and a tarball diverging from its git source — nearly a year before the identifier was assigned. Analysts argue that meaningful early detection requires monitoring project-level signals such as maintainer turnover, sudden drops in commit activity, ownership transfers, and artefact-to-source mismatches. These indicators consistently appear before an advisory is written and do not depend on a vulnerability number to be actionable.

0 comments Read more at DEV Community