IETF Web Bot Auth Leaves Human Verification Unsolved, Developer Proposes Fix

·1 views

The IETF Web Bot Auth working group has published a charter draft that deliberately excludes end-user authentication from its scope, focusing only on identifying which AI agent is making a request. While services like Cloudflare and AWS can cryptographically confirm a request originates from a known bot such as ChatGPT, they cannot confirm a consenting human is behind it. A developer has proposed a lightweight alternative using a signed HTTP header called X-Trust, which carries a behavioural trust score derived from browser signals like keystroke timing and scroll patterns. The score updates during a session and lets the receiving server decide how to respond, without forcing CAPTCHAs or identity checks. The developer acknowledges the system is not fraud-proof and flags unresolved concerns about whether the scoring model may disadvantage users with motor impairments.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

AWS Guide: Replace Hardcoded RDS Credentials in Lambda with IAM Token Auth

A technical guide published on DEV Community outlines how AWS developers can eliminate static database passwords from Lambda functions by using IAM authentication with RDS Proxy. Instead of storing plaintext credentials in environment variables, Lambda generates a temporary IAM token via boto3 that is valid for 15 minutes and used as the database password. The setup requires enabling IAM authentication on both the RDS instance and RDS Proxy, creating a MySQL user tied to AWS's AWSAuthenticationPlugin, and attaching an rds-db:connect IAM policy to the Lambda execution role. This approach removes the risk of credential leaks through misconfigured policies, accidental log exposure, or compromised deployment artifacts. The method leverages the same IAM mechanism already standard across AWS services, eliminating the need for manual secret rotation.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

agent-usage 0.10.0 Adds Per-Agent, Model, and Billing Charts to Local Dashboard

Version 0.10.0 of agent-usage, an open-source local dashboard for AI coding tools, is now available on npm. The update introduces usage charts broken down by individual agent, billing domain, and model, giving developers a clearer view of where their quota and spending go. Supported tools include Codex, Claude Code, OpenCode, and Grok, among others. The package can be installed globally via npm and runs on macOS with Node 24 or higher under an MIT license. A Cursor connector is included but remains experimental, while a planned menubar feature has not yet shipped.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

AI Speeds Up Shipping, But Experts Warn Trust Has Become the Real Differentiator

A PS5 Linux kernel maintainer recently resigned, citing frustration with developers using AI language models to contribute code they did not fully understand — a incident that sparked widespread debate on Hacker News. The episode has reignited concerns about whether the rapid adoption of AI tools is eroding professional standards in software and product development. Industry observers argue that while AI has made generating content and code nearly costless, it has not reduced the cost of establishing trust with buyers or users. Businesses that document what AI produced, what was verified, and how errors were caught are seen as better positioned to stand out in crowded markets. The emerging view is that human judgment — knowing what not to ship — is now the scarce, premium skill in an era of near-unlimited AI-generated output.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How One Software Firm Ditched Hourly Billing and Rebuilt Client Trust With 4 Rules

AnyPlace founder and software architect describes how recurring budget overruns and client dissatisfaction led him to ban hourly retainer billing at his firm. The company instead adopted four engineering rules across 50-plus builds, including weekly sprint demos with live working code delivered directly into client-owned repositories. A mandatory discovery phase produces a fixed-scope architectural document, making any mid-project changes explicit business decisions rather than silent budget creep. All code, cloud infrastructure, and CI/CD pipelines are provisioned inside the client's own accounts, eliminating vendor lock-in from the outset. The firm argues that giving clients full ownership and continuous visibility paradoxically increases retention, because dependable delivery removes the motivation to leave.

0 comments Read more at DEV Community