Developer builds AWS IAM tool that diagnoses access errors with live account checks

·1 views

A developer built an open-source tool called Rosetta to diagnose AWS AccessDenied errors more precisely than AI chatbots can. The problem it addresses is that the same error message can stem from six different root causes, making AI-generated answers little more than educated guesses. In text-only mode, Rosetta lists all plausible causes at equal confidence, honestly reflecting the ambiguity. When supplied with a read-only AWS role ARN, it queries the account directly using IAM simulation APIs and narrows the diagnosis to a single cited cause with high confidence. The tool is designed to replace manual console investigation by replacing guesswork with authoritative, evidence-backed answers.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

How Browser Garbage Collection Works and Why It Causes Memory Leaks

Browser JavaScript engines like Chrome's V8 and Firefox's SpiderMonkey use garbage collection to free memory that is no longer reachable by running code. The process relies on a mark-and-sweep algorithm that traces object references from root variables and clears anything unreachable. However, memory leaks commonly occur when detached DOM nodes, closures, or event listeners silently retain references longer than intended. Removing a DOM element from the document does not free its memory if a JavaScript variable still holds a reference to it. Similarly, unremoved event listeners can keep both the callback function and the associated node alive in memory indefinitely.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How to Screen a New AI Coding Model for Real Work in Under an Hour

A software developer has outlined a practical three-phase protocol for quickly evaluating new open-weight AI models before committing time to deeper testing. The method uses real work tasks — such as refactoring code, diagnosing flaky tests, and tracing build errors — to expose common failure modes like hallucinated functions or ignored constraints. A key part of the screen involves challenging the model's initial responses to assess whether it corrects itself honestly or doubles down on wrong answers. The final phase tests multi-file context handling, which can reveal degradation that short prompts conceal. The article notes that free model access and free inference options have removed cost as a barrier to running such evaluations.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

AI Browser Agents Can Be Hijacked by Hidden Web Page Instructions, No Click Needed

Researchers have disclosed a vulnerability called 'PleaseFix' in which AI browser agents can be manipulated by malicious instructions embedded in web page content, requiring zero user interaction. The flaw stems from the agent's inability to reliably distinguish between user-issued commands and text scraped from a webpage, making any loaded page a potential attack surface. Hidden text — such as white-on-white content, HTML comments, or image alt tags — can enter the agent's context window and be treated as a legitimate instruction. Traditional browser defenses like same-origin policy and content security policies were not designed to counter such semantic, plain-language attacks. Experts say there is no straightforward patch, as the issue is structural to how AI agents process untrusted content during browsing sessions.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

What Forensic Evidence Can and Cannot Prove in a GitHub Investigation

A forensic investigator recently completed a GitHub case examining what appeared to be a coordinated network of fabricated accounts and automated repository creation. The investigation uncovered strong indicators including repeated repository structures, shared content templates, recurring metadata, and cross-account behavioral patterns. Despite compelling correlated evidence, at least one key attribution hypothesis did not meet the required evidentiary threshold, which the investigator describes as the methodology functioning correctly rather than failing. The case highlights a core principle in digital forensics: observations such as automated-looking behavior or shared metadata must be tested through multiple evidentiary steps before conclusions about control or identity can be drawn. A sensitivity test on 26 shared content templates showed the relationship held even after removing the strongest individual data point, demonstrating the value of robust, removal-resistant evidence.

0 comments Read more at DEV Community