EU Moves to Make Huawei Ban Legally Binding Across Critical Infrastructure

·2 views

The European Commission reissued its recommendation in May 2026 to exclude Huawei and ZTE from critical telecom infrastructure, reinforcing a stance it first took in 2020. A January 2026 revision to the EU Cybersecurity Act would transform six years of voluntary guidance into a binding legal obligation, proposing a 36-month phase-out window covering mobile, fixed broadband, and transport infrastructure. Only 13 of 27 EU member states had taken concrete action under the original 2020 framework, highlighting weak compliance with voluntary measures. The proposed legislation is still under review by the European Parliament and Council, with key questions remaining around the phase-out timeline and how heavily exposed nations like Germany may seek to negotiate its terms. Cost estimates for the transition vary sharply — from €10–13 billion by the Commission to €35 billion by industry groups — a gap analysts say reflects the absence of a shared model for mapping the full scope of vendor dependencies involved.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

How a BFF Layer Cut 52 API Requests to One and Caught a Data Leak

A development team replaced direct browser-to-backend API calls with a Backend-for-Frontend (BFF) layer after a bills worklist page was generating 52 network requests and loading nearly 10,000 rows into the browser just to display one paginated screen. The BFF, built as a set of resource routes on an existing Express server, consolidates permission checks, server-side filtering, sorting, and pagination into a single endpoint per screen. Three months after implementation, the layer handles 80 routes across 9 features and has meaningfully reduced client-side processing. During rollout, the team discovered two caching vulnerabilities: a browser cache misconfiguration briefly exposed one user's data to another, fixed by adding a Vary: Cookie header, and an in-memory server cache risked cross-tenant data leaks until it was strictly keyed by user ID. The experience led the team to treat every cache header as a security setting and enforce tenant scoping from auth tokens rather than query parameters.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

MVC to VIPER: Five Mobile Architecture Patterns, One Core Idea Explained

Software developer Maneshwar argues that the five major mobile app architecture patterns — MVC, MVP, MVVM, MVVM-C, and VIPER — are all variations of the same fundamental concept rather than distinct ideas. Every pattern revolves around three components: a View that renders the interface, a Model that handles business logic and data, and a middle-layer translator that prevents the two from communicating directly. MVC, the oldest of the five, originated from Smalltalk research at Xerox PARC in the late 1970s and separates data from display through a Controller. The key differences between patterns lie in how much responsibility that middle translator holds and how that responsibility is divided or delegated. MVP improves testability by making the View passive and logic-heavy, while each subsequent pattern further refines how concerns are separated as app complexity grows.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Web Security Basics Every Full-Stack Developer Should Know

Web security involves protecting applications, user data, and infrastructure from malicious actors who exploit vulnerabilities beyond normal usage patterns. Full-stack developers must safeguard assets including user accounts, passwords, authentication tokens, personal information, API endpoints, and databases. Security risks can surface at every layer of a web application, from the frontend and network to the backend API, authentication middleware, and database. Common threats include cross-site scripting (XSS), injection attacks, broken access controls, insecure direct object references (IDOR), and denial-of-service attacks. Understanding how data travels through each layer of an application is a foundational step toward identifying and addressing these risks.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Codename One Adopts Daily AI Scans to Stay Ahead of Apple and Google Changes

Codename One, an open-source framework for building cross-platform apps from a single Java or Kotlin codebase, has launched a daily automated task that reads official Apple and Google notices and checks them against its own codebase. Previously, the team only discovered platform changes after a developer's build failed, reversing the ideal order of detection and response. The new system requires a primary source, an applicability test, and a concrete code artifact before any work is filed, reducing false positives from routine policy wording updates. Early results include a fix for Android 16 back-navigation handling in PR #5673, which registers a callback bridge to prevent the Back gesture from exiting the app unexpectedly. A separate ContactPicker feature in PR #5680 also emerged from the scan, offering a permission-free way for users to select a contact without granting broad address-book access.

0 comments Read more at DEV Community