DocFence 0.50.0 Blocks MD5 Digest Algorithm in OOXML Package Signature Coverage

·8 views

DocFence version 0.50.0 introduces a hard rejection of the MD5 digest algorithm across all DigestMethod URIs within its bounded package-signature coverage chain, including SignedInfo references, manifest references, and relationship references. Any binding using MD5 renders declaration coverage unavailable, while SHA-1 and other algorithms remain structurally accepted for compatibility with OPC conformance language. The tool examines only stored Algorithm URIs and does not recompute digests, verify certificates, or establish cryptographic trust, leaving those responsibilities to a dedicated XMLDSIG verifier. A 69-test suite validated the changes, and a scan of public OOXML Signature Security artifacts found 243 DigestMethod declarations using SHA-256 with none using MD5. DocFence's rules DFP092 and DFP093 function strictly as declaration gates, not as a cryptographic policy engine.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Python Multithreading Is Not Fake — But It Depends on the Task

A developer noticed significant speed gains after parallelizing a network data-fetching tool with Python threads, despite a colleague's claim that Python multithreading is 'fake' due to the Global Interpreter Lock (GIL). The GIL restricts Python so that only one thread executes bytecode at a time, which led to the misconception. However, the GIL is released during I/O waits, allowing other threads to run while one waits for a network response, which explains the real speedup observed. For CPU-bound tasks like image processing or heavy math, the GIL never releases meaningfully, making multithreading genuinely ineffective. The key distinction is that Python threads deliver real concurrency for I/O-bound work but not for CPU-bound operations.

0 comments Read more at DEV Community

ProgrammingHacker News ·

Opinion: Why Interstellar Travel May Remain Beyond Human Reach

A recently published opinion piece argues that humans will never succeed in traveling beyond the solar system. The article, hosted on erscream.com, outlines reasons why interstellar travel is likely to remain impossible for humanity. The piece has gained some traction on Hacker News, attracting a small number of upvotes. The post currently has no comments, suggesting it is in early circulation. The core argument centers on the immense physical and practical barriers that stand in the way of human interstellar exploration.

0 comments Read more at Hacker News

ProgrammingDEV Community ·

Developer Guide: How to Embed Virtual Cards via Partner API in 2026

A technical guide aimed at backend engineers outlines the key considerations for integrating virtual card issuance through partner APIs rather than building in-house. It covers critical architecture decisions including authentication flows, idempotency handling, and webhook design to prevent errors like duplicate card issuance. The guide highlights that white-label card API providers allow companies to plug into card programs without needing an EMI license or a full compliance department. A dedicated section addresses crypto-funded cards, noting that converting assets like BTC or USDT into spendable balances introduces unique failure modes absent in fiat-only systems. The guide also distinguishes card issuing APIs from broader Banking-as-a-Service platforms, emphasizing the importance of correctly scoping the integration from the outset.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Developer Builds Lightweight API Integration Proxy Using Django to Simplify Auth and Logging

A developer has created a lightweight API integration proxy called Asstgr, built on Django and PostgreSQL, to streamline how applications interact with multiple third-party APIs. The tool consolidates authentication, execution, and logging into a single layer, so applications can focus purely on business logic rather than managing per-API credentials and formats. The synchronous MVP uses the Requests library to dynamically construct downstream API calls via a unified execution endpoint. The developer chose Django for rapid prototyping and plans to migrate to asynchronous frameworks such as FastAPI or Go once the core logic is stable. Upcoming features include payload encryption, async execution via HTTPX, and caching with Redis.

0 comments Read more at DEV Community