Developer builds custom PNG decoder to add QR code phishing scanner to Cloudflare Workers API

·1 views

A developer at Presend built a QR code phishing detection endpoint for their API that decodes uploaded images and checks embedded URLs against a malware database. Because the API runs on Cloudflare Workers, standard Node.js libraries like pngjs were unavailable, forcing a custom PNG decoder to be written from scratch using the runtime's native DecompressionStream API. The project required manually implementing PNG chunk parsing, scanline filter reversal, and pixel reassembly. A critical bug was discovered during testing: most QR code generators output 1-bit PNGs by default, but the decoder had only been built and validated against 8-bit images, meaning it would have failed on the majority of real-world inputs. The fix involved adding support for sub-byte pixel packing, where multiple pixels are stored within a single byte, padded per scanline as specified in the PNG standard.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

No Single Best AI Agent Memory Tool Exists in 2026, Says Decision Framework

A decision map published by Mnemoverse — one of the seven tools featured — argues that no single best AI agent memory system exists in 2026. The guide, updated against vendor documentation in July and August 2026, proposes that the key question is how much of an application a memory system should own, not which tool scores highest on benchmarks. Seven tools are mapped to distinct use cases, ranging from embeddable open-source SDKs like Mem0 to temporal fact-tracking via Zep and full agent runtimes through Letta. The post acknowledges an inherent conflict of interest, as the publisher holds a position in one of the reviewed products. Readers are advised to verify all claims against each vendor's own documentation before making a commitment, given how rapidly these products evolve.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Flutter Pagination Fix With async* Has Concurrency Flaws, BlocSignal Offers Alternative

Mobile developer Ali Wajdan proposed using Dart async* generators and StreamIterator to solve the common infinite scroll race condition in Flutter apps, where rapid scroll events trigger duplicate network requests and broken state. While the approach moves mutable state like page counters and loading flags inside the generator, critics point out it does not eliminate the need for a manual concurrency guard. Dart's StreamIterator.moveNext() is not concurrency-safe and throws a runtime error if called again before a previous request resolves, a limitation Wajdan himself acknowledged. The iterator also lacks built-in support for reactive UI states such as error handling, pull-to-refresh, and bottom loading indicators, requiring developers to maintain an external state container regardless. A pattern called BlocSignal has been proposed as a more complete architectural solution to address these remaining concurrency and state management gaps.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Whisper AI Runs 5x Faster on AMD NPU Than CPU, Using a Tenth of the Energy

A developer has successfully run OpenAI's Whisper large-v3-turbo speech recognition model on the AMD XDNA2 NPU inside a MSI Stealth A16 AI+ laptop running Arch Linux. Using the FastFlowLM (FLM) runtime alongside AMD's XRT userspace API and the in-tree amdxdna kernel driver available since Linux 6.14, the setup transcribed a 30-second audio clip in approximately 5.2 seconds, achieving a real-time factor of around 0.18. Crucially, CPU utilization barely rose above idle during transcription, confirming the workload ran almost entirely on the dedicated neural processing unit. The NPU completed the same task at roughly one-tenth the energy cost compared to running Whisper on the CPU via whisper.cpp with 16 threads. The writeup details the full software stack, configuration steps, and benchmark methodology needed to replicate the setup on compatible Ryzen AI hardware.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How Developers Can Bypass Anti-Bot Blocks in Programmatic Screenshot Tools

Headless browsers used for automated screenshots are frequently flagged by bot-detection systems like Cloudflare, Akamai, and DataDome because they expose telltale signals such as navigator.webdriver being set to true, missing browser properties, and unnaturally precise mouse movements. Detection systems typically look for combinations of these signals rather than a single flag, making partial fixes counterproductive. Developers can address most cases by using stealth plugins, setting realistic HTTP headers, running a genuine Chrome binary instead of Chromium, and introducing randomized delays and mouse jitter to mimic human behavior. For sites with heavier fingerprinting, additional measures such as residential proxy rotation and persistent browser profiles with stored cookies and browsing history can help establish a more convincing user identity. Understanding which tier of bot detection a target site uses — basic user-agent checks, passive fingerprinting, or active CAPTCHA challenges — is recommended before choosing a technical approach.

0 comments Read more at DEV Community