How One Developer Built a Battery-Efficient Geofencing Engine for Auto-Silent App Muffle

·1 views

Developer Muffle was created to automatically silence phones when users enter locations like mosques, clinics, or classrooms, addressing the common problem of forgotten phone silencing. Instead of polling the GPS chip at fixed intervals — a known battery drain — the app relies on Google Play Services' GeofencingClient, which intelligently combines cellular, Wi-Fi, and GPS data to minimize power use. A BroadcastReceiver handles boundary-crossing events, keeping the app dormant until triggered rather than running a persistent background service. Testing revealed that GPS inaccuracy in dense urban areas caused delays of up to three minutes, prompting the addition of a user-adjustable geofence radius and a confidence buffer. The developer also encountered aggressive battery optimization on certain Android OEM devices, requiring logic to detect such systems and prompt users to whitelist the app for reliable operation.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

JWT 'kid' Parameter Flaw Enables SQL Injection and Path Traversal Attacks

A security vulnerability in how servers process the JSON Web Token 'kid' header parameter allows attackers to manipulate key selection without breaking cryptography. Because the RFC defines no required format or character restrictions for 'kid', most libraries pass the raw value directly to database queries or file reads without sanitization. In the SQL injection variant, an attacker injects a UNION payload to make the server use an attacker-chosen HMAC key, then re-signs a forged token that passes verification. In the path traversal variant, injecting a sequence like '../../../../dev/null' causes the server to read an empty file, letting the attacker sign tokens with a predictable null-byte key. The vulnerability is rated CVSS 7.5 High, requires no prior authentication, and fully compromises authentication integrity.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Four Major WebSocket Frameworks Leave Origin Validation Off by Default, Enabling CSWSH

Cross-Site WebSocket Hijacking (CSWSH) exploits a gap in the Same-Origin Policy, allowing attackers to establish a persistent, bidirectional, authenticated channel by tricking a logged-in user's browser into initiating a WebSocket connection to a malicious page. Unlike standard HTTP requests, the WebSocket upgrade bypasses CORS preflight entirely, sending session cookies cross-origin without restriction — a deliberate protocol design dating back to RFC 6455. Four of the five dominant WebSocket frameworks ship with Origin validation disabled by default, leaving applications exposed unless developers explicitly enable the check. Real-world consequences have been severe: CVE-2020-25095 enabled unauthentiated remote code execution on LogRhythm, CVE-2023-0957 led to full Gitpod account takeover, and CVE-2024-51775 exposed Apache Zeppelin data to unauthenticated remote attackers. Security researchers trace the recurring vulnerability to an engineering culture where WebSocket endpoints are added to cookie-authenticated apps without applying the same CSRF-era protections already in place for HTTP routes.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Developer builds Rust-based version bump tool claiming 10,000x speed over Python

A developer rebuilt the popular bump-my-version CLI tool in Rust after finding the Python original took a full second to increment a single version number. The new tool, called bump2version 0.2.0, automates updating version strings across multiple files such as Cargo.toml, package.json, and CHANGELOG.md in a single operation. It uses pure-Rust git integration via the gix library, avoiding subprocess calls entirely, and enforces memory safety with no unsafe code. Beyond a standalone CLI, the project exposes bindings for Python and Node.js, making the same Rust core accessible across three ecosystems. The developer acknowledged receiving outside assistance with parts of the system design during the project.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Passwordless Auth Exposes Tokens in Logs, Headers, and Email Forwarding Chains

Security researchers have highlighted how passwordless authentication methods such as magic links and TOTP, despite being designed to reduce phishing risk, introduce multiple new attack surfaces. Magic link tokens embedded in GET request URLs are routinely captured in server access logs from nginx, Apache, and CDN proxies, where they remain readable until log rotation. A critical vulnerability, CVE-2026-39912 (CVSS 9.1), exposed over 7,000 instances of V2Board by returning auth tokens directly in HTTP response bodies without requiring authentication. Browser Referer headers can leak tokens to third-party analytics platforms, while email security gateways may silently consume single-use tokens during URL prefetching scans. Additionally, attackers who briefly gain inbox access can plant silent forwarding rules that continue delivering future magic link tokens even after a password reset, leaving no failed login alerts for the application to detect.

0 comments Read more at DEV Community