Developer's harassment evidence tool was silently saving Cloudflare error pages as proof

·3 views

A developer building a web service to preserve evidence of online harassment discovered that screenshots meant to capture offending posts were instead saving Cloudflare block pages, due to a retired third-party embed wrapper and a misconfigured setting that treated errors as successful captures. The tool used automated browser screenshots as its core evidence feature, but platform-level restrictions from X and YouTube forced multiple infrastructure changes along the way. A setting called ignore_host_errors allowed the pipeline to store plausible-looking error screens without raising any alerts, meaning the flaw only surfaced when someone tried to actually use the evidence. Additional issues included a timezone parameter silently breaking all captures after a provider update, and a switch to asynchronous processing that inadvertently decoupled screenshot storage from saved records. The developer resolved these problems by switching to official platform embeds, logging raw API error responses to the database, and managing timestamps independently rather than relying on third-party rendering.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Developer builds browser-only dev tools after realizing he kept leaking production JWTs

A developer has launched a free, browser-based toolkit at devtools-hub-sigma.vercel.app after recognizing a personal habit of pasting sensitive data, including production JWTs, into random online tools. The site offers eight utilities — including a JWT decoder, JSON formatter, Base64 encoder, and cron parser — that run entirely client-side with no backend involved. The developer noted that most free online tools unnecessarily send user-pasted data to remote servers, even though browser APIs like atob() and JSON.parse can handle the work locally. Because no server is in the processing path, there is nothing to log, offering a stronger privacy guarantee than a policy-based promise. The project was built using Next.js, TypeScript, Tailwind, and shadcn/ui, and is deployed on Vercel.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Developer Builds ArthMitra, a Hindi-English Voice Agent for Financial Literacy in India

A developer has created ArthMitra, a voice-first financial literacy assistant called Anisha, designed specifically for Indian users who can interact in Hindi, Hinglish, or other native languages. The agent was built during the 10 Days of Voice Agents — VoiceForBharat Edition, using Deepgram for speech recognition, Groq's Llama 3.3 as the language model, Murf Falcon for text-to-speech, and LiveKit for real-time audio streaming. Key features include tools that fetch live currency exchange rates, check eligibility for government schemes like PMJDY and Mudra, and retrieve current bank interest rates from a local dataset to prevent AI hallucinations. The developer addressed code-mixed pronunciation issues by enforcing native Devanagari script in the system prompt, ensuring accurate text-to-speech output. The project is open-source, with setup instructions and code available on GitHub for others to build similar voice agents.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Developer Builds Hindi-Speaking AI Farm Advisor for Indian Farmers in 10 Days

A developer built 'Samar', an AI-powered agricultural voice assistant designed to help Indian farmers get real-time farming advice in Hindi and English over the phone. The system was created as part of the '10 Days of Voice Agents — VoiceForBharat Edition' challenge by Murf AI. Samar uses Deepgram for speech recognition, Google Gemini as its language model, and Murf Falcon text-to-speech to deliver natural-sounding Hindi responses in Devanagari script. The assistant can provide weather forecasts, crop market prices, and pest diagnosis, while also supporting human escalation and call analytics dashboards. The developer plans future improvements including regional language support for Tamil and Telugu, WhatsApp integration, and an offline mode for low-connectivity areas.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How to debug logrotate when it silently fails to rotate logs

logrotate misconfigurations do not produce errors or failed exit codes, meaning disk-full crashes can be the first sign something went wrong. The copytruncate directive, commonly used when processes cannot reopen log files via SIGHUP, creates a race condition on high-throughput servers that can drop or duplicate log entries. A safer alternative is using a postrotate hook to signal the process, such as running nginx -s reload, which allows a clean log file handoff with no data loss. Running logrotate with the -d debug flag before deploying any config change lets administrators preview what the tool would do without actually rotating files. Additional common pitfalls include missing compress directives on high-volume logs and processes holding open file descriptors on already-rotated files, the latter of which can be identified using lsof +L1.

0 comments Read more at DEV Community