SShortSingh.
Back to feed

Fix Chaotic Microservices Architecture by Documenting Before Rewriting

0
·6 views

A software architect working on a growing gamedev project with roughly twenty services argues that architectural disorder is best addressed through documentation rather than rewrites. The project's services evolved organically without deliberate design, leaving decisions scattered across chat logs and individual memory, causing incidents and ballooning estimates. The proposed first step is a one-page 'service passport' for each service, capturing its purpose, responsibilities, stack, owner, and operational details. These passports are maintained by service owners, updated alongside code changes, and kept brief to avoid becoming abandoned wiki pages. Aggregated into a registry and a plain-text call graph stored in version control, they create a living map that exposes real boundaries, orphaned services, and integration risks before they cause costly failures.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Log in to join the discussion and vote.

Log in

Related stories

0
ProgrammingDEV Community ·

BDD Frameworks in Kotlin: Choosing the Right Tool Based on Who Reads the Output

A developer with over 15 years of JVM acceptance testing experience has published a guide comparing BDD frameworks available for Kotlin, including Cucumber, JBehave, Kotest BehaviorSpec, Spek, JGiven, Serenity BDD, and Concordion. The author argues that framework selection should hinge on a single key question: who reads the test output and whether they are required to act on it. For teams where only developers consume test results, lightweight tools like Kotest or JUnit with descriptive test names are recommended, as adding a BDD framework introduces overhead without benefit. When non-technical stakeholders such as product owners or analysts need to review outcomes, a human-readable artefact becomes necessary, making tools like Cucumber or Serenity BDD more relevant. The author also challenges the common assumption that Cucumber is essential for non-developer collaboration, noting that acceptance criteria are typically written in project management tools like Jira rather than directly in feature files.

0
ProgrammingDEV Community ·

Starlette ASGI Flaw CVE-2026-48710 Enables Auth Bypass via Malformed Host Header

A medium-to-high severity vulnerability tracked as CVE-2026-48710 (BadHost) has been discovered in the Starlette ASGI framework, affecting versions 0.8.3 through 1.0.0. The flaw stems from Starlette reconstructing request URLs by concatenating unvalidated client-supplied Host headers, causing authorization middleware to evaluate an attacker-controlled path while the router serves the actual protected endpoint. CISA added the vulnerability to its Known Exploited Vulnerabilities catalog on September 2, 2026, citing evidence of active exploitation in the wild. Researchers at X41 D-Sec and Horizon3.ai demonstrated that the flaw can chain with a separate LiteLLM command-injection bug (CVE-2026-42271), enabling unauthenticated remote code execution and exposure of AI infrastructure credentials, with the combined chain rated CVSS 10.0. Users are advised to upgrade to Starlette version 1.0.1, which addresses the vulnerability by properly validating Host header values.

0
ProgrammingDEV Community ·

Six Reasons AI Models Ignore Your MCP Tool — and How to Fix Each One

An analysis of 4,749 public MCP servers reveals six common reasons why registered tools are overlooked or bypassed by AI models. The most frequent issues include indistinct tool descriptions that fail to differentiate similar tools, and missing parameter descriptions that leave models unable to determine what values to supply. Generic or synonymous tool names — such as get_thing versus fetch_thing — also cause models to guess incorrectly, while oversized tool lists can overwhelm the context window and dilute model attention. Additional culprits include case-sensitivity mismatches that make a tool appear broken after a single failed call, prompting the model to abandon it entirely. The findings suggest that small, precise changes to naming, descriptions, and schema definitions can significantly improve how reliably AI models select and use the correct tool.

0
ProgrammingDEV Community ·

UpstreamWitness: Open-Source Tool Tracks Whether Upstream Projects Adopted Your Fix

A developer has released UpstreamWitness, an open-source evidence-tracking tool designed for security researchers, bug bounty workers, and open-source contributors. The tool monitors public upstream activity — such as commits, pull-request states, releases, and symbol changes — following a user's original submission date or PR. It classifies findings into four outcome tiers, from confirmed merges to no detectable signal, while explicitly noting that correlation does not constitute proof of attribution or payment. The tool operates strictly on public repository data, avoiding any handling of confidential vulnerability reports or private communications. Built on Python 3.11–3.13, the project is available on GitHub and its creator is seeking real-world public test cases to guide further development.