How MeritTrac Fixed iOS Video Streaming Blocks for Real-Time Exam Proctoring

·1 views

MeritTrac engineers encountered two critical technical barriers while extending 360° camera proctoring support to iOS devices: silent WebSocket rejections due to strict iOS WebKit TLS certificate rules, and high disk I/O latency from continuous media buffer writes. To bypass iOS's refusal to accept WebSocket connections on non-matching SSL certificates, the team mapped dynamic wildcard subdomains to server IPs, aligning them with their wildcard SSL certificate. PFX certificates were decoded directly into memory from environment variables, eliminating any physical disk footprint on cloud nodes. Incoming video chunks were managed using sequence-aware in-memory buffer piping, preserving correct frame order even during network fluctuations. Together, these three architectural patterns — wildcard subdomain mapping, in-memory TLS handling, and sequence-aware stream buffering — resolved the iOS streaming challenges in their Node.js media server.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Vox Pupuli Launches Public Dashboard Tracking Container Downloads and CVEs

Open-source Puppet community group Vox Pupuli has launched a public statistics page at voxpupuli.org/container_statistics, offering visibility into download counts and security vulnerabilities across its container portfolio. The page is generated automatically every 24 hours using a custom script hosted in the container_statistics GitHub repository and deployed via GitHub Actions to a gh-pages branch. Download figures are scraped from package HTML pages, while CVE data is produced by running two scanners — Trivy and Anchore's Grype — against each container image. Among the most-downloaded containers are openvoxdb and openvoxserver, each exceeding 150,000 pulls, while openvoxserver's latest tag also carries the highest CVE count at 789 total findings. Users can reproduce the statistics locally by running the provided bin/container-statistics script with either a download or CVE report flag.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

AgentForge Adds Three-Layer Error Recovery to Multi-Agent AI Pipelines

The AgentForge team published a technical post on August 8, 2026, detailing how failures cascade in multi-agent AI systems when one agent's timeout can disable dependent agents downstream. To address this, AgentForge implements three recovery layers: automatic retries with exponential backoff, circuit breakers that switch to cached fallback data after repeated failures, and orchestrator-level replanning to skip, substitute, or halt failed agents. The team illustrated the approach with a real incident in which their market data API went down during trading hours, triggering the circuit breaker within one minute and automatically routing the pipeline to a delayed cached feed. A full report was still generated with a data-disclaimer warning, and no manual intervention was required throughout the outage. AgentForge's open-source MVP is available on GitHub, with the team positioning fault tolerance as a built-in default rather than an optional feature.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How a Hidden Form Wiped a CDN Cache and Led to Stronger CSRF Protection

A PHP video admin panel was vulnerable to Cross-Site Request Forgery (CSRF) after a hidden HTML form on an unrelated forum page silently triggered a full CDN cache purge by exploiting an active browser session. The incident exposed a common security gap: relying solely on session cookies to authenticate state-changing admin actions. To fix this without disrupting a LiteSpeed page cache or SQLite-backed session storage, the developer adopted a signed double-submit cookie pattern instead of the traditional synchronizer token approach. This stateless method stores a signed HMAC token in both a cookie and a form field, then verifies both match on every unsafe request, without any server-side session writes. The implementation also uses the __Host- cookie prefix and token expiry checks to prevent subdomain or network-level cookie injection attacks.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

AI Voice Systems Routinely Fail Disabled Users Due to Biased Training Data

Millions of disabled people face daily failures with AI voice assistants because their speech patterns fall outside the narrow range of audio these systems were trained to recognise. A January 2026 Forbes analysis by disability inclusion writer Gus Alexiou argued this is a structural flaw, noting that AI optimised for standardised interaction effectively excludes the 1.3 billion people the WHO identifies as having significant disabilities. On 3 February 2026, the UK's Department for Work and Pensions convened a roundtable bringing together major tech firms — including Google, Meta, Microsoft and Amazon — alongside disability organisations to address the gap between AI's potential and its current performance for disabled workers. Separately, researchers from Virginia State University and Morgan State University published a paper in Frontiers in Digital Health warning that standard AI evaluation metrics, focused on accuracy and generalisability, treat disabled users as statistical outliers rather than legitimate end-users. The studies and policy discussions collectively highlight a systemic absence of methodology for assessing whether AI tools are genuinely accessible to disabled people.

0 comments Read more at DEV Community