Dev Team Builds Dashboard-Sharing Feature With Built-In Permission Controls

·1 views

A development team has publicly outlined its week-long sprint to take a dashboard-sharing feature from concept to production. The feature will allow users to save a dashboard view — including filters, date ranges, and chart settings — and share it with teammates in just a few clicks. Permission controls distinguishing Viewers from Editors are being designed first, before any UI work, to avoid security vulnerabilities that arise from retrofitting access control later. Edge cases such as real-time access revocation mid-session are among the scenarios being tested on Thursday before a planned Friday release. The team says the feature aims to replace the common workaround of screenshotting dashboards and sharing them over messaging apps like Slack.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

ASP.NET Core 10 Adds Built-In Authentication Metrics to Distinguish Auth Outcomes

ASP.NET Core 10 introduces built-in authentication and authorization instruments via System.Diagnostics.Metrics, allowing developers to differentiate between three distinct handler outcomes: no credentials present, credentials rejected, and successful authentication. Previously, both unauthenticated and rejected requests would surface identically as 401 responses, making root-cause diagnosis difficult. The new aspnetcore.authentication.authenticate.duration histogram exposes an aspnetcore.authentication.result attribute that labels each outcome, while a separate aspnetcore.authentication.challenges counter tracks how often a scheme was challenged. Developers can integrate these metrics into an OpenTelemetry pipeline by registering the Microsoft.AspNetCore.Authentication meter, though a separate exporter and backend are still needed for production storage. The framework also attaches an error.type attribute on failures, deliberately using exception types rather than messages to avoid leaking sensitive data such as tokens or user identifiers into metric labels.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Developer releases free open-source installer after finding Inno Setup costs up to $1,195

A developer has released a free, open-source software installer tool under the Apache 2.0 license after encountering steep licensing fees with Inno Setup 7, which charges individuals $155 and up to $1,195 for unlimited users. The tool was originally built to simplify deployment of V.E.L.O.C.I.T.Y. Drone, a project the developer had been testing. The new installer supports cross-platform use and includes features such as zstd compression, dependency checking, CI/CD updating, delta updates, and MSI compliance for managed deployments. The developer cited frustration with industry practices that restrict access to essential tooling behind paywalls or revenue-based licensing thresholds. The release is fully open-source with no commercial restrictions, meaning anyone can use it freely regardless of revenue or distribution scale.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

15-Year-Old JavaScript Color Library Harbored Hidden Heap-Crash Bug in Two Functions

A developer discovered a heap-exhaustion vulnerability in TinyColor2, a widely used JavaScript color library with over 5,200 GitHub stars, while porting it to Rust. The bug exists in the analogous() and monochromatic() functions, which loop indefinitely and crash the process when passed negative or fractional count arguments such as -1, 0.5, or 1.5. The flaw went undetected for roughly 15 years because a default assignment — results = results || 6 — silently catches all falsy inputs like null, NaN, and undefined, making the functions appear safe during casual testing. Only specific truthy invalid values bypass this default and trigger infinite loops that exhaust available memory with exit code 134. The reporter proposed input validation guards similar to those already present in the library's polyad() function, which correctly rejects non-integer or out-of-range arguments.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Grokbot Review: xAI and Cursor's $200/Month Computer-Use AI Agent Tested

Grokbot is a joint product from xAI and Cursor that functions as an AI agent capable of operating a computer, not just generating text responses. Each bot created by a user runs on a dedicated cloud machine equipped with a browser, file manager, and its own operating system, and continues running independently after the user disconnects. A reviewer spent one week building and testing three separate bots to evaluate how well the product performs in real-world use. Key findings from the testing included observations about a shared-login limitation, reliability issues, and comparisons with competing tools such as Claude Code and Codex. The reviewer concluded that Grokbot offers value in specific use cases but may not justify its cost for all users.

0 comments Read more at DEV Community