How a Two-Week Security Exception Quietly Survived for Three Years

·1 views

A software team approved a temporary security exception — including shared credentials and relaxed firewall rules — to meet a supplier integration deadline, with a documented two-week expiry. Three years later, the exception was discovered still active, with no one able to explain its origin, as the staff who requested and approved it had since moved on or left. The incident revealed a systemic flaw: the organisation had a formal process for granting security exceptions but no mechanism to enforce their removal. An audit found that years of deadline-driven workarounds had created an unknown number of similar deviations, making the real security posture significantly weaker than policy suggested. The team responded by building expiry enforcement directly into technical systems and instituting a mandatory quarterly review where every open exception must be verbally justified by name.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

AI Image Models Struggle to Keep Asymmetric Character Details Consistent

A developer maintaining an AI-illustrated character named Tsuduri found that image generation models frequently place asymmetric design features, like a hair ornament, on the wrong side depending on the character's pose. The core problem is that AI models conflate screen-relative directions with the character's own coordinate system, which only align in certain views. The author developed a lean workflow: store the design rule in the character's own frame of reference, start each generation with a single pose-specific reference image, and validate at least two asymmetric traits against the actual output. Research supports the difficulty — a 2026 preprint testing 22 models found object-relative spatial accuracy averaged 41.8% lower than viewer-relative accuracy, with the best model achieving only 44.3% on object-relative tasks. The recommended fix is to layer prompts with both an invariant rule tied to the character's body and a view-specific instruction for each individual generation.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Local 27B Vision Model Outperforms Apple's Dedicated OCR on Document Structure

A developer testing OCR tools compared Apple's Vision framework (VNRecognizeTextRequest) against a locally running 27-billion-parameter vision-language model (VLM) on a custom test image containing Korean text, a structured table, and a homoglyph-heavy string. While Apple Vision was 300 times faster and made only 2 character errors versus the VLM's 8, it critically failed to preserve table row structure, returning data column by column and making it impossible to match values to the correct entries. The VLM, despite being slower and slightly less accurate on individual characters, correctly maintained reading order and table layout. The author concludes that tool selection must be based on the full task requirement — character recognition versus document structure preservation — not benchmark accuracy alone. A key finding applicable beyond OCR: silent structural failures, like column-shredded output that looks syntactically valid, cannot be caught by simple escalation logic, making cheap-first pipelines risky when information relationships matter.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Why AI-Generated Nginx Configs Still Need Manual Verification Before Going Live

A developer used a coding assistant to draft an Nginx configuration for a Laravel app hosted on an Ubuntu VPS, finding the output usable but not production-ready. The AI had no knowledge of the server's actual PHP version, PHP-FPM socket path, directory structure, or DNS setup, meaning its assumptions could silently break the site. Key checks included verifying the correct document root points to Laravel's public directory, confirming the exact PHP-FPM socket file present on the machine, and ensuring the configured domain names match live DNS records. The developer also highlighted that leaving Nginx's default site enabled can cause incoming requests to bypass the app's config entirely, masking real errors. The broader takeaway is that AI-generated infrastructure configs can be a useful starting point, but every assumption they make must be validated against the actual server environment before deployment.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Jumia Kenya Data Analysis Reveals Discounts Alone Do Not Drive Customer Engagement

A data analyst built an interactive Excel dashboard using a scraped dataset of 112 products from Jumia Kenya, covering prices, discounts, ratings, and review counts. Before analysis could begin, significant data cleaning was required, including converting price strings to numbers, extracting numeric ratings from messy text fields, and handling invalid negative review counts. A key decision was to label the 49% of products with no reviews or ratings explicitly rather than discarding them, as their absence was itself a major finding. The completed dashboard, featuring pivot tables, slicers, and KPI cards, revealed near-zero correlations between discount levels and customer engagement. The analysis concluded that heavy discounting is not a substitute for product quality or visibility, with 90% of deeply discounted products showing low or no customer engagement.

0 comments Read more at DEV Community