FINRA Short Volume and OSV Vulnerability Data: Free APIs Developers Often Misread

·1 views

Two widely used public datasets — FINRA's daily short volume file and OSV.dev's security advisory API — are freely accessible with a single HTTP request and require no account or API key. FINRA publishes per-symbol short volume data every trading day, but analysts frequently conflate it with short interest, which measures persistent open positions rather than intraday trading flow. Similarly, OSV.dev aggregates vulnerability advisories across major package ecosystems, and a scan of three commonly pinned library versions returned 70 advisories, including 24 rated High or Critical. Key pitfalls include silently dropping advisories with missing severity ratings and treating a version match as confirmed exploitability, when it only indicates a package is in scope for triage. Both datasets are authoritative but carry narrower meanings than their headline figures suggest, and accurate interpretation depends on understanding their underlying methodology.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

How a Dispatch Table Pattern Can Replace Messy If-Else Chains in Code

A software developer shared how repeated copy-paste logic in a large if-else chain handling third-party API payloads prompted a refactoring exercise. The codebase processed different JSON event types — orders, refunds, and shipments — using nearly identical logic duplicated across each conditional branch. The developer identified that each branch shared the same function signature, making it a classic candidate for a dispatch table or strategy pattern. By mapping event type discriminators to individual handler functions stored in a plain object, the sprawling conditional block could be replaced with a single lookup. The approach improves testability, reduces duplication, and makes adding new event types significantly simpler.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How Claude Code hooks can enforce strict directory boundaries for unattended agents

Claude Code offers two mechanisms to restrict where an AI agent can write files, but they serve different purposes and are not interchangeable. The permissions.deny setting works as a block-list, but cannot replicate an allow-list because its precedence rules cause a blanket deny to override any exceptions. For finer control — such as limiting an agent to a specific subdirectory within a project — developers need to implement a PreToolUse hook, a command that intercepts file-writing tool calls before they execute. The hook receives the pending operation as JSON on stdin and can respond with an allow, deny, ask, or defer decision, along with a reason passed back to the model. This approach provides binding, code-enforced scope control that remains active even when no human is monitoring the agent.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How to Detect a Song's BPM and Key: Manual, DAW, and Tool Methods

Finding a song's tempo and musical key is essential for producers, DJs, and remixers working with audio. The quickest manual method involves counting the beat for 15 seconds and multiplying by four, though ambiguity can arise when a track feels half or double its actual tempo. DAW-based grid alignment offers a more precise approach, revealing tempo changes, live timing drift, and misaligned samples across an arrangement. Dedicated analysis tools like KeyFinder can automate the process, detecting BPM, musical key, scale type, and Camelot code from audio files or live system audio. Each method suits different workflows, with manual counting offering speed, DAW alignment offering accuracy, and software tools offering efficiency for batch processing or session prep.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Developer Migrates Jenkins Freestyle Jobs to Declarative Pipelines on AWS

A developer documented their process of setting up Jenkins on an AWS Ubuntu EC2 instance, configuring Docker-out-of-Docker to allow Jenkins to build images via the host machine's Docker socket. The project initially used Freestyle jobs to run Node.js commands, but their limitations in handling multi-step workflows prompted a migration to Pipeline jobs written in Groovy. The new declarative pipeline, stored as a Jenkinsfile directly in the repository, defined clear stages for code checkout, dependency installation, testing, artifact packaging, and pushing Docker images to DockerHub. Credentials were secured using Jenkins' Secret text plugin within a withCredentials block to prevent sensitive data from appearing in build logs. The developer plans to extend the setup with Multibranch Pipelines and Jenkins Parameters to further automate and configure builds across multiple repository branches.

0 comments Read more at DEV Community