Geo-Blocking at WAF Level Can Eliminate Over 90% of Malicious Server Traffic

·1 views

A developer's 30-day server log analysis found that 77% of incoming traffic originated from countries outside their target market, and 92% of attacks came from those same regions. Geo-blocking works at the Web Application Firewall level, dropping unwanted connections before they reach the application server, saving CPU, bandwidth, and database resources. The setup involves either allowlisting target countries or blocklisting high-risk regions such as North Korea, Iran, Russia, and China, depending on the use case. Certain sources like search engine crawlers and CDN proxy IPs are typically exempt from geo-rules to avoid disrupting SEO and legitimate traffic. Businesses must weigh the trade-off that traveling customers in blocked regions would require a VPN to access services.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Developer Finds Self-Test Suite Misses All Critical Failure Paths in Commit-Message Script

A developer discovered that the --selftest block in their git_commit.py script contains eight assertions that exclusively test a regex filter, leaving all five real failure branches completely untested. The script, which reads staged diffs and calls an AI CLI tool to generate commit messages, has distinct exit paths guarding against subprocess timeouts, an empty staging area, a missing binary, and non-zero process exits. The gap went unnoticed until the developer audited their own test coverage after reading about the pitfalls of counting assertions without examining what they actually exercise. By contrast, two other files in the same repository had self-tests written the same week that properly stubbed network and subprocess calls to exercise genuine failure modes. The case highlights how a passing test suite can create false confidence when tests validate only low-risk pure functions while skipping the error-prone code paths that matter most.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Godot Class Cache Bug Passed CI but Crashed Local Game Builds

A developer building Nocturne Vania, a pixel-art Metroidvania in Godot 4, encountered a startup bug after adding a new bell tower area that used GDScript's class_name keyword for global type references. Existing local checkouts retained a stale global_script_class_cache.cfg file, causing parse errors when the game tried to resolve class names not yet registered in the cache. CI pipelines never caught the issue because they always reimported the project before running tests, regenerating the cache automatically. The fix replaced global class name references with explicit script path inheritance and preloaded script resources, removing dependency on the cache being up to date. The patch spanned 19 files with 81 additions and 33 deletions, and a static check was added to prevent cache-sensitive global names from appearing outside their own declarations.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Developer builds open-source security layer for MCP tool servers used by AI agents

Model Context Protocol (MCP), used by AI tools like Claude Desktop and Cursor to connect agents to external services, has no built-in security model — leaving authentication, authorization, and audit logging entirely to developers. A developer identified critical gaps including plaintext credential storage, lack of read/write scoping, and untracked tool calls that could modify or delete data without any record. To address this, they built Heddle, an open-source runtime that sits between a YAML config file and the MCP protocol, enforcing security policies on every tool call. Heddle routes each call through a six-layer pipeline covering rate limiting, access mode checks, trust tier enforcement, input validation, and more. The project was motivated by a real misconfiguration the developer caught during testing, where a supposedly read-only agent had access to a write-capable HTTP tool that would otherwise have gone undetected.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Overuse of 'Agent' Label Is Causing Real Engineering Mistakes, Experts Warn

The term 'AI agent' is being applied so broadly — to simple chatbots, looped scripts, and tool-calling functions — that it is creating genuine engineering missteps in production systems. Engineers working in the AI space argue that a true agent must have an objective, make its own decisions, handle failures, and know when it has finished a task. In practice, most successful agent deployments are narrow and purpose-built, handling specific tasks like customer support triage or document extraction rather than acting as general reasoning engines. Teams achieving good results focus on clean tool design, robust failure handling, and full observability rather than simply upgrading to the latest AI model. The core warning is that vague terminology leads teams to over-engineer simple pipelines or under-engineer genuinely complex ones, wasting significant time and resources.

0 comments Read more at DEV Community