Developer finds 'real reading' metric fired exclusively by bots, never humans

·1 views

An independent developer running a small personal website built two custom analytics events — one tracking 15 seconds of page time and another tracking 50% scroll depth — to distinguish genuine readers from automated scrapers. After reviewing the full event history, they found that all recorded triggers came from bots, with nine sessions reporting an impossible 1600×1600 square screen resolution and a zh-CN language tag, while the developer's own test sessions accounted for the rest. The site has logged zero confirmed human reading events since launch. The developer identified a core methodological flaw: the events were validated only against known positives (themselves reading the page) and never against known negatives, allowing bot activity to go undetected. They have since corrected the error in their tools and published the raw session data, urging other developers to validate engagement metrics against known negatives, not just expected positive cases.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

How a Hidden BOM Character in PowerShell Broke API Auth for an Hour

A development team's automated deploy tool successfully pushed an API token to production, but every subsequent API request failed due to a Unicode byte-order mark (U+FEFF) being silently prepended to the token. The BOM originated from Windows PowerShell 5.1's default UTF-8 console encoding with a 3-byte preamble, which was injected when piping the secret to the platform CLI. Diagnosing the issue was significantly delayed because the platform's secret store marked the variable as Sensitive and write-only, making it impossible to read back and inspect through the dashboard, CLI, or API. Commonly cited fixes such as setting $OutputEncoding or [Console]::OutputEncoding were tested and found ineffective in this case. The team ultimately resolved the issue by bypassing the pipe entirely, writing the secret to a temporary file using explicit BOM-free UTF-8 encoding and redirecting that file to the process's standard input.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Tutorial: Screen SEC insider buying data using Python and a free API

A developer tutorial published on DEV Community demonstrates how to build a Python-based insider-buying screener using SEC Form 4 data via the AlphAI API. The script accepts a watchlist of tickers and a dollar threshold, then outputs a Markdown table and CSV file showing insider purchase transactions within a 30-day window. Testing the tool against 25 well-known tickers between August 20 and September 18, 2026, returned no qualifying purchase events, while a separate feed of recent insider activity surfaced 11 purchases across seven smaller tickers. Key transaction details such as dollar value, stake change percentage, and director status are pulled from the API and kept alongside each purchase for context. The script requires Python 3.10 or newer with no additional dependencies, and the repository includes saved sample runs that can be reproduced without an API key.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

LimeWire's Tech Column Critiques Cloud Centralization and AI Liability Gaps

The revived LimeWire brand has published the second issue of its editorial column, C:\LimeWire\Shared, presenting a sweeping critique of modern cloud infrastructure and artificial intelligence practices. The piece argues that despite the illusion of a decentralized internet, over 90% of global web traffic is funneled through just four providers: AWS, Azure, Google Cloud, and Cloudflare. It also challenges the 'human-in-the-loop' design pattern in autonomous AI systems, contending that human oversight is often inserted not for safety but to shield corporations from legal liability. Drawing on literary references from Jorge Luis Borges, Harry Harrison, and cultural theorists, the column blends provocative writing with substantive systems architecture arguments. The publication follows the column's first viral issue, which focused on reported Microsoft and OpenAI data-scraping practices.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

What a Virtual CISO Does and When Your Company Actually Needs One

A Virtual CISO (vCISO) provides part-time or contract-based senior cybersecurity leadership — covering strategy, compliance, and board communication — at a fraction of a full-time executive's cost. The model is most relevant for companies with 50 to 500 employees that have outgrown self-managed security but cannot yet justify a $350,000-plus hire. Common triggers for engaging a vCISO include enterprise customer security audits, investor accountability questions, uncoordinated incident responses, or rapid growth in regulated industries like fintech or healthtech. Unlike a full-time CISO, a vCISO focuses on leadership and strategy rather than day-to-day execution, typically owning compliance programs, security roadmaps, and incident response planning. The arrangement is designed to close the gap between ad hoc internal security and dedicated executive oversight without the associated executive overhead.

0 comments Read more at DEV Community