Developer details three hidden bugs found while building a browser-based video compressor

·1 views

A developer building a fully browser-based video compression tool encountered three distinct bugs during implementation. The first involved AVI files lacking per-packet timestamps, which caused muxing failures fixed by adding the ffmpeg flag that synthesises timestamps from frame rate. The second was an audio passthrough bug in the mediabunny library, where a negative first audio timestamp of around -0.023 seconds caused audio to be re-encoded and bloat output file size instead of being copied unchanged. The third issue involved enabling multithreaded ffmpeg.wasm, which requires cross-origin isolation headers that can break third-party embeds on the same site. The developer noted that both core bugs were undetectable through code review or unit tests, only surfacing with specific real-world input files.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Developer builds 59 privacy-first browser tools in vanilla JS with zero dependencies

A developer has publicly launched Antigravity Tools, a collection of 59 free, browser-based utilities built entirely in vanilla JavaScript with no external dependencies, backend servers, or analytics. The project was motivated by privacy concerns with popular online tools, such as JWT decoders and regex testers, which can log user data on remote servers. All operations run locally in the browser using native APIs including Web Crypto, Canvas, Web Audio, and IndexedDB. The toolkit covers a wide range of developer needs, including JWT inspection, RSA key generation, JSON formatting, cURL conversion, regex testing, and AI prompt utilities. The tools are available for free at antigravitytools.app.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Six Design Controls for Reliable Localized Password Reset Email Delivery

A technical guide outlines six key controls for building secure, localized password reset email systems for media platforms. The approach centers on keeping HTML templates in versioned, application-owned source code rather than provider-hosted editors, ensuring preview and production emails use the same rendering path. Localization requires an explicit fallback chain with approved catalog revisions, and reset URLs must be generated by the application rather than embedded in translation files. A durable outbox with idempotency keys and expiry-aware retry limits ensures delivery evidence is preserved and expired links are not resent. The framework also mandates plain-text alternatives alongside HTML to cover all mail clients and avoid gaps in delivery coverage.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

5 Messaging Patterns That Keep Distributed Services Reliable at Scale

Modern distributed systems like food delivery platforms often rely on asynchronous messaging instead of direct service calls, making them more resilient to failures. Key patterns include message queues that hold requests when a receiver is down, and publish-subscribe topics that fan a single event out to multiple independent consumers. Competing consumers allow many workers to drain a shared queue simultaneously, enabling rapid scaling during traffic spikes. A dead-letter queue captures repeatedly failing messages so one corrupt entry cannot block the entire pipeline. Idempotent consumer design ensures that processing the same message more than once — a common occurrence due to network retries — produces no duplicate side effects such as double-charging a customer.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Developer builds open-source security scanner for MCP servers amid rising CVEs

A developer has released sentrymcp, an open-source security scanner for Model Context Protocol (MCP) servers, built in Rust and available under the MIT license. The tool was created after the developer found no purpose-built scanner existed, despite over 40 CVEs disclosed against MCP implementations this year. It performs static analysis to detect path traversal, command injection, missing authentication, and tool poisoning, while a runtime proxy mode monitors for 'rug pulls' — cases where a server silently alters a tool's description after user approval. Research from Endor Labs found that 82% of over 2,600 real MCP implementations use file operations prone to path traversal, and nearly 40% of scanned servers lack authentication entirely. The project can be run via a Docker one-liner, and its findings are ranked by severity with references to CWEs or the OWASP MCP Top 10.

0 comments Read more at DEV Community