Developer finds same silent-failure bug three times in a fortnight across unrelated systems

·1 views

A software developer discovered that a recurring logic error across three separate systems was collapsing an 'untestable' or 'unknown' state into a binary pass/fail result, masking the true cause of failures. In one case, a Rust project's CI pipeline showed red for 13 days not because code was broken, but because billing issues prevented jobs from ever running — yet the tooling displayed both outcomes identically. A second incident involved a conversation-archive checker where short text probes under 12 characters were silently counted as missing records, causing 18 out of 65 items to be falsely flagged. The developer argues the fix is straightforward: always track three states — hit, miss, and untestable — rather than forcing unknowns into one of two available buckets. A third example, involving a monitoring script the developer had personally mislabelled in their own notes, underscored that even stored verdicts can become stale and misleading over time.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

How to Design Secure Server-Rendered Login Sessions for EdTech Apps

A software developer has outlined a structured approach to handling authentication in server-rendered educational applications, emphasizing that session creation, verification, refresh, and logout should each be treated as distinct state transitions. The design recommends issuing a short-lived session cookie only after a phone verification code is confirmed, with the server maintaining full control over the session lifecycle and audit trail. A key concern addressed is account recovery in school settings, where a learner may lose their phone while a parent, teacher, or administrator still needs safe access to recover the account. The browser receives only an opaque HttpOnly cookie, keeping the underlying session store — whether SQL, Redis, or another service — invisible to the client. The article also provides a Python transport adapter that centralizes endpoint logic and ensures the application, not the auth provider, determines when each session transition is permitted.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Why Security Teams Must Shift From Gut Instinct to Metrics-Driven Decisions

Security programs have long relied on intuition rather than measurable outcomes, but growing attack surfaces and tighter budgets are forcing a change in approach. Metrics-driven security means defining success numerically before deploying controls, tracking the same data consistently over time, and actually letting those numbers drive program decisions. Common pitfalls include measuring activity instead of outcomes, using vanity metrics, and tracking too many numbers without clear ownership. Key areas worth monitoring include mean time to detect and respond to incidents, vulnerability patching speed, privileged account MFA coverage, and phishing simulation trends. Organizations are advised to select a small set of metrics aligned to their specific threat model and business priorities rather than adopting a one-size-fits-all list.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Founder Grows SaaS Product Buildside to 130 Users in Two Weeks via Public Building

Entrepreneur Uriel Bitton shared how he grew his SaaS product Buildside to 130 users within just two weeks of launch. His primary growth strategy centered on building in public, openly documenting his development journey on social media. The approach attracted an early user base without relying on traditional paid marketing. Bitton published his experience on DEV Community in early September, tagging it under topics including SaaS, founder journeys, and social media growth. His story highlights how transparency and community engagement can serve as effective tools for early-stage startup traction.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Measure Your Team's Code Review Limits Before AI Pull Requests Overwhelm Them

Researcher Margaret-Anne Storey recently introduced the concept of 'cognitive debt' — the gradual erosion of shared understanding about how a system works — during a DORA community session. A software developer writing on DEV Community argues this debt is quietly accumulating in teams that review AI-generated pull requests at scale, without realising their review process has become ineffective. The author warns that standard delivery metrics like merge rate and time-to-approve can appear healthy even as review quality collapses, masking real risk behind green dashboards. Drawing a parallel to mutation testing in software quality assurance, they propose seeding review queues with known-defective 'canary' pull requests to measure how reliably reviewers catch real problems. They recommend starting with one canary per twenty pull requests, tracked over four-week windows, to establish a statistically meaningful detection rate before cognitive debt causes a serious incident.

0 comments Read more at DEV Community