Developer builds browser-only tool platform, honestly discloses two server-side exceptions

·1 views

A developer created Tabreon, a platform of 30 free online utilities spanning text, PDF, image, QR, and developer tools, all designed to run as client-side JavaScript without uploading files to a server. The project enforced this as a formal architectural constraint, requiring each tool to justify any server-side processing before it was permitted. Twenty-eight of the thirty tools fully honour this principle, using browser APIs such as Web Crypto, Canvas, and libraries like pdf-lib. Two tools — HEIC image conversion and SVG-to-PNG rasterization — require server processing due to patent restrictions on HEIC decoding and reliability concerns with cross-browser SVG rendering. Rather than obscure this, the developer explicitly documented the exceptions in the privacy policy and README, applying rate limiting and ensuring no files are logged or retained after conversion.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

ASP.NET Core 10 Adds Built-In Authentication Metrics to Distinguish Auth Outcomes

ASP.NET Core 10 introduces built-in authentication and authorization instruments via System.Diagnostics.Metrics, allowing developers to differentiate between three distinct handler outcomes: no credentials present, credentials rejected, and successful authentication. Previously, both unauthenticated and rejected requests would surface identically as 401 responses, making root-cause diagnosis difficult. The new aspnetcore.authentication.authenticate.duration histogram exposes an aspnetcore.authentication.result attribute that labels each outcome, while a separate aspnetcore.authentication.challenges counter tracks how often a scheme was challenged. Developers can integrate these metrics into an OpenTelemetry pipeline by registering the Microsoft.AspNetCore.Authentication meter, though a separate exporter and backend are still needed for production storage. The framework also attaches an error.type attribute on failures, deliberately using exception types rather than messages to avoid leaking sensitive data such as tokens or user identifiers into metric labels.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Developer releases free open-source installer after finding Inno Setup costs up to $1,195

A developer has released a free, open-source software installer tool under the Apache 2.0 license after encountering steep licensing fees with Inno Setup 7, which charges individuals $155 and up to $1,195 for unlimited users. The tool was originally built to simplify deployment of V.E.L.O.C.I.T.Y. Drone, a project the developer had been testing. The new installer supports cross-platform use and includes features such as zstd compression, dependency checking, CI/CD updating, delta updates, and MSI compliance for managed deployments. The developer cited frustration with industry practices that restrict access to essential tooling behind paywalls or revenue-based licensing thresholds. The release is fully open-source with no commercial restrictions, meaning anyone can use it freely regardless of revenue or distribution scale.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

15-Year-Old JavaScript Color Library Harbored Hidden Heap-Crash Bug in Two Functions

A developer discovered a heap-exhaustion vulnerability in TinyColor2, a widely used JavaScript color library with over 5,200 GitHub stars, while porting it to Rust. The bug exists in the analogous() and monochromatic() functions, which loop indefinitely and crash the process when passed negative or fractional count arguments such as -1, 0.5, or 1.5. The flaw went undetected for roughly 15 years because a default assignment — results = results || 6 — silently catches all falsy inputs like null, NaN, and undefined, making the functions appear safe during casual testing. Only specific truthy invalid values bypass this default and trigger infinite loops that exhaust available memory with exit code 134. The reporter proposed input validation guards similar to those already present in the library's polyad() function, which correctly rejects non-integer or out-of-range arguments.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Grokbot Review: xAI and Cursor's $200/Month Computer-Use AI Agent Tested

Grokbot is a joint product from xAI and Cursor that functions as an AI agent capable of operating a computer, not just generating text responses. Each bot created by a user runs on a dedicated cloud machine equipped with a browser, file manager, and its own operating system, and continues running independently after the user disconnects. A reviewer spent one week building and testing three separate bots to evaluate how well the product performs in real-world use. Key findings from the testing included observations about a shared-login limitation, reliability issues, and comparisons with competing tools such as Claude Code and Codex. The reviewer concluded that Grokbot offers value in specific use cases but may not justify its cost for all users.

0 comments Read more at DEV Community