How iPhone HEVC Videos Fail Silently as Telegram Avatars and How to Fix Them

·1 views

iPhones have recorded video in HEVC (H.265) format by default since iOS 11, but Telegram's profile video avatar feature only accepts H.264-encoded clips, causing uploads to fail without any error message. The platform also rejects 10-bit HDR footage, non-square aspect ratios, files with audio tracks, and clips longer than 10 seconds or larger than roughly 2 MB. A developer diagnosed these undocumented requirements by cross-referencing Telegram's Bot API docs with repeated failed upload attempts. The fix involves a two-pass FFmpeg process that crops the video to an 800x800 square, converts pixel format to yuv420p, strips audio, trims to 10 seconds, and outputs an MP4 with the moov atom at the front. The developer subsequently built a Telegram bot using the aiogram library to automate this conversion for any uploaded video file.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

GitHub Agentic Workflows Flaw Lets Attackers Steal Private Repo Data via AI Agent

Security researchers at Noma Security discovered a prompt injection vulnerability, dubbed GitLost, in GitHub's Agentic Workflows feature, which entered public preview in February. The exploit allows an attacker to post a malicious public issue on a target repository, tricking the AI agent into reading private repository contents and posting them in a public comment. No stolen credentials are required — the attacker only needs access to a public surface where the agent reads and writes. The attack is amplified when organizations grant their workflow agent a cross-repository read token, a common configuration for legitimate use cases like shared schemas or release notes. GitHub has issued a fix, but security experts advise teams to carefully review token scopes and agent permissions before deploying Agentic Workflows on sensitive repositories.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Rust Rewrite of VictoriaMetrics Beats Original Go Version on All Benchmarks

Developers have released EsMetrics, a from-scratch Rust implementation of the VictoriaMetrics time-series database, licensed under Apache 2.0. Benchmarked against the official Go release (v1.146.0) using the TSBS suite, EsMetrics achieved up to 43% higher ingestion throughput on Linux and 66% on Windows. Query latency improved across all ten TSBS query types, with mean reductions ranging from 11% to 82% depending on platform and query type. The team enforced strict byte-for-byte response matching with the original Go server to ensure correctness, validating results across 750 replayed queries and over 600 ported unit tests. Developers cautioned that results come from two machines running a single workload family, and all raw data and caveats are published in the project repository.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Five Months of Daily Coding Practice and My Apprentice Still Cannot Program

A developer has shared a candid account of mentoring an assistant with no prior programming experience over five months, during which the learner dedicates five hours daily to practice. Despite being motivated and studious, the apprentice struggles to debug subtle errors, adapt to new problem contexts, or explain the code he writes. The mentor argues that the real culprit is an industry that sells misleading promises — such as 'learn Python in 21 days' courses — that prioritise syntax repetition over genuine problem-solving ability. He contends that true programming skill requires building judgment through real errors and corrections, a process he estimates takes at least one year before a learner develops independent critical thinking. The piece serves as a warning that AI-generated code and automated course exercises can produce functional output without fostering the deep understanding needed to work as a professional developer.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How to Check Breached Passwords Safely Using HIBP's k-Anonymity Method

Have I Been Pwned (HIBP) offers a privacy-preserving way to check whether a password has appeared in known data breaches without exposing the password itself. The technique, called k-anonymity, works by sending only the first five characters of a password's SHA-1 hash to HIBP's API, which returns hundreds of matching hash suffixes for local comparison. Because the server never receives the full hash or the original password, neither HIBP nor any network observer can determine which specific password was queried. The final match is performed entirely in the user's browser or application, keeping the credential private throughout the process. HIBP's database currently covers over 900 million breached credentials, and the API requires no authentication key, making it straightforward to integrate into signup or login flows.

0 comments Read more at DEV Community