Developer builds first TypeScript library for FIDO's new passkey-export standard, finds 5 spec bugs

·1 views

The FIDO Alliance recently released the Credential Exchange Format (CXF), the first open standard for transferring passkeys, passwords, and TOTP secrets across credential managers, with Apple and Bitwarden among early adopters. Finding no TypeScript implementation available, developer Amos Wenger built cxf-kit, an open-source library featuring a parser, serializer, conformance validator, and CLI. While building against the August 2025 proposed standard, Wenger identified five specification bugs, including contradictions between the spec's own examples and its grammar, a CDDL typo that misdefines a data type, and a logical conflict in array declarations. A fifth gap leaves file-credential packaging entirely undefined, forcing each implementation to devise its own convention. The library, released as MIT-licensed version 0.1.1 on GitHub and npm, includes a lossless round-trip guarantee and a hardened CLI that is tested to never expose stored credential values in output.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Developer Questions Continued Reliance on 15-Year-Old WebSocket Library

A discussion has emerged in the developer community questioning why a 15-year-old WebSocket library remains widely used. The post, published on DEV Community under the handle @rabbx/ws, raises concerns about the longevity and continued adoption of the aging library. The author implies that modern alternatives may exist but are being overlooked by developers. The piece prompts reflection on why the tech community sometimes resists moving on from legacy tools despite their age.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Some Top-Level Domains Can Function as Standalone Websites

Top-level domains (TLDs) can host actual websites, just like regular domains, because registry operators can add DNS A records directly to a TLD's apex zone. The .ai TLD once ran a live web server that gained attention on Hacker News, though its A record has since been removed. Currently, the .uz TLD resolves to a working website, albeit with a mismatched TLS certificate. This is technically possible through the same DNS mechanism that allows website owners to point their apex domain to a web server. The phenomenon remains a niche curiosity in the domain and networking community.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How AI Agents Work and How Developers Can Build One Using Popular Frameworks

AI agents differ from basic chatbots by autonomously planning, using tools, and completing multi-step tasks without continuous human input. As of 2026, the technology is considered mature enough for production environments, and frameworks like CrewAI and LangChain have made building such agents more accessible to developers. CrewAI allows developers to define specialized agent roles and assign tasks, while LangChain offers lower-level control for custom Python-based agent builds. A practical example outlined in the tutorial involves two agents — a researcher and a writer — working sequentially to produce a fully sourced report on a given topic. Developers can also leverage Anthropic's Claude directly, which includes built-in tool-use and agentic capabilities without requiring an external framework.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Why Tailoring Your Resume to Each Job Posting Improves Hiring Chances

Job seekers who send the same resume to every position often struggle to land interviews, even when they are qualified for the roles. Applicant Tracking Systems help recruiters filter candidates by searching for specific skills, keywords, and job titles, making it harder to find applicants who do not explicitly mention relevant experience. Different job postings for the same title can require entirely different skill sets, meaning a generic resume may fail to reflect what each employer is actually seeking. Career experts recommend carefully reading each job description, aligning resume content with highlighted requirements, and replacing vague responsibility statements with specific, measurable achievements. The goal is not to rewrite the entire resume each time, but to ensure the most relevant experience is clearly presented for each individual role.

0 comments Read more at DEV Community