Developer finds mortgage calculators mislabeling break-even results as gains

·5 views

A developer auditing a financial calculator platform discovered that break-even outcomes were being displayed as positive results, with labels like 'Save $0.00/mo' shown in green. The root cause was a binary conditional logic flaw — using >= instead of > — which silently routed zero-value results into the 'good' category rather than a neutral one. Seven out of eight calculators on the site shared the same pattern, consistently labeling no financial gain as a win. One calculator, for debt consolidation, produced an even more unstable result: floating-point rounding meant the same break-even input could display as either a saving or a cost with no visible difference. The fix involved adding a third conditional branch for zero and introducing a grey 'neutral' pill style, giving null results their own distinct visual treatment.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Open-Source AI Agent Uses Multi-Layer Gate to Block Its Own Bad Prompt Edits

AgentSelfEdit is an open-source tool that allows an AI agent to rewrite its own system prompt based on execution feedback, using A/B testing to evaluate changes. By version 0.3.0, the project's developer concluded that the real critical component was not the optimizer but the promotion gate — a deterministic, multi-check system that decides whether a rewritten prompt is safe to adopt. The gate incorporates seven checks, including confidence thresholds, edit distance limits, frozen sections, and an Oracle Drift Guard designed to catch cases where the optimizer, scorer, and benchmark all reinforce a shared but incorrect notion of success. Crucially, no LLM is involved in the promotion decision; all checks are code-based to prevent the system from effectively grading its own work. In field testing, the gate recorded zero false positives, blocked all eight adversarial edits tested, and produced no bad promotions across synthetic and Docker-backed workflows.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Linux Server Firewall Test Shows How UFW Hides Ports from Nmap Scans

A cybersecurity learner used a TripleTen CloudShare lab environment to test how enabling UFW, a Linux host-based firewall, affects server visibility during network reconnaissance. Using Nmap from a Kali workstation, they scanned a Linux play-server at IP 10.170.0.22 before and after configuring the firewall. Before UFW was enabled, the scan revealed one open port — TCP port 22 running OpenSSH — while the remaining 999 ports appeared closed. After UFW was configured with a default deny-incoming policy and SSH explicitly allowed, the same scan showed those 999 ports as filtered rather than closed, indicating the firewall was actively blocking probe responses. The experiment demonstrated how firewall rules change a server's network footprint and how tools like Nmap can be used to verify that defensive security controls are functioning correctly.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

OpenAI GPT-6 Astra Hits 'Critical' Cyber Risk Rating Under Safety Framework

OpenAI has launched GPT-6 Astra, its latest flagship large language model, which has been classified at the 'Critical' cybersecurity risk level under the company's Preparedness Framework, triggering additional deployment restrictions. Astra is rolling out to select organizations and will be accessible via ChatGPT, the OpenAI API, and Amazon Bedrock, with enterprise access disabled by default and requiring manual activation. In benchmark testing, Astra scored 100% on ExploitBench and 42.4% on ExploitGym for exploit development, significantly outperforming its predecessor GPT-5.6 Sol. During pre-launch testing on recently disclosed vulnerabilities, Astra independently identified two previously unknown zero-day flaws, which OpenAI is now reporting to the relevant software vendors. Analysts note that the 'Critical' designation reflects an evolution in testing methodology rather than a sudden change in the model's capabilities, raising broader questions about unmeasured cyber risks in other deployed AI models.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How SegWit Fixed Bitcoin's Transaction Malleability Problem and Boosted Capacity

Bitcoin transactions historically included a scriptSig field containing the digital signature, which accounted for roughly 60% of total blockchain size. This signature data could be subtly altered by malicious actors to produce a different transaction ID while keeping the signature technically valid, a flaw known as the transaction malleability problem. The vulnerability caused issues when confirmed transaction IDs differed from their originals, and it also hindered the Lightning Network, which relies on spending unconfirmed transactions. Segregated Witness, or SegWit, addressed this by moving signature data into a separate witness field that is excluded from transaction ID calculation, making IDs tamper-resistant. This architectural change simultaneously reduced effective transaction size, increasing Bitcoin's throughput capacity without a direct block size increase.

0 comments Read more at DEV Community