Client-Side PDF Viewers: Local Processing Alone Does Not Guarantee Security

·13 views

Running PDF processing in the browser can reduce exposure from server-side handling, but it is an architectural choice rather than a full security guarantee. Developers should verify where document data actually travels, including uploads, external APIs, OCR or conversion services, logs, analytics, and temporary storage. Browser risks such as malicious extensions, injected scripts, and cross-site scripting can still expose content the page can access. Security also needs to cover operations like search, annotation, redaction, and export, since hiding text visually does not necessarily remove it from the file. Reviews should combine network inspection, source-code review, and testing across every workflow.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Essay Likens Current AI Anxiety to Fears Around Early Capitalism

A Hacker News post linked to an essay titled "Cognitive Mercantilism" argues that today's worries about artificial intelligence resemble the apprehensions that accompanied the rise of early capitalism. The essay, hosted on a personal site, was submitted on October 26, 2026, and drew four points but no comments. Its title frames AI as a possible instrument of economic power, similar to how mercantile policies once shaped national wealth. The author appears to suggest that historical responses to market upheaval, such as regulation and labor organization, could inform current debates over AI oversight. The post's modest engagement suggests the piece has so far attracted only niche attention.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Free-Tier Batch Job Survives Restart by Caching Model Calls as Files

A developer ran an overnight log-classification batch on a free server, only to find that a silent restart caused the job to re-ask questions it had already answered. The root problem was an incorrect definition of completion, along with appending output without any safeguard against duplication. Temperature zero was found not to guarantee identical responses, so the developer shifted focus to durably recording what the model actually returned. The solution borrows record-and-replay techniques from HTTP tooling: each request payload is hashed, and its response is saved under that hash. Repeat requests are then served from disk, and a replay mode allows the whole pipeline to run with the network disabled.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

iOS 27 Adds LongRunningIntent and Related App Intents APIs for Siri Integrations

Apple's iOS 27 update expands the App Intents framework with new APIs, including LongRunningIntent, CancellableIntent, EntityCollection, and SyncableEntity, as presented at WWDC26 Session 345. The changes aim to make Siri integrations more resilient to long-running work and keep entities consistent across devices. Previously, the system gave a standard intent only about 30 seconds to finish, which could cause complex tasks like batch photo processing to fail. LongRunningIntent extends background execution time and builds on the progress-reporting infrastructure that has existed since iOS 17.0. The core purpose of App Intents, making app content discoverable to Siri, Spotlight, Shortcuts, and widgets, remains unchanged.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Why UTC Alone Doesn't Guarantee Clock Agreement: Five Myths That Break Deploys

A developer article argues that developers often assume UTC timestamps mean servers agree on the time, which is not guaranteed since a shared format does not synchronize clocks. It identifies five common misconceptions, including treating time agreement as exact rather than within a tolerance and using wall-clock time to measure elapsed intervals. The piece explains that wall clocks can be corrected or jump, while monotonic clocks may not advance during suspend, so the right clock depends on the question being asked. It also notes that cron is not a catch-up scheduler and can be affected by timezone settings, clock corrections, and unescaped percent signs. The author provides diagnostic methods for developers to measure drift and clock behavior on their own systems.

0 comments Read more at DEV Community