iOS Certificate Management: Key Practices for Teams and Solo Developers

·1 views

iOS development certificates come in two types — development and distribution — each with strict limits and a one-year validity period, after which app updates cannot be submitted without renewal. Expired certificates do not affect apps already installed by users, but developers must repackage with a new certificate before submitting any version update. Teams face added complexity, as each member must import a shared P12 file, making centralized certificate management and secure password handling essential. Tools like Appuploader's sync feature or Fastlane match can streamline certificate sharing across machines without exposing private keys during transfer. Experts recommend beginning the renewal process at least one month before expiration and storing P12 files only in password-protected, encrypted formats.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Web Share API brings native OS share sheet to browsers with minimal code

The Web Share API, accessed via navigator.share(), allows web pages to trigger the same native share sheet that mobile apps use, requiring just a few lines of JavaScript. A developer implemented the feature on Forgemage.net, a marketplace for the game Dofus, to let users easily share item requests with others. The API has two key requirements: the page must be served over HTTPS, and the share call must be triggered directly within a user gesture, with no intervening network requests or the browser will reject it. Developers must also ensure shared URLs are absolute rather than relative, as relative paths are meaningless outside the context of a specific host. Fallback handling covers browsers that lack support and cases where the user dismisses the share sheet, making the feature straightforward to implement progressively.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Blameless Postmortem Template Helps Web Agencies Learn From Incidents Without Blame

A blameless postmortem is a structured process that examines how systems, tools, processes, and context combined to cause an incident, rather than assigning personal fault. Published on DEV Community, the template is designed for small web agencies and is intended to be completed in a focused 45–60 minute meeting with a concise written document. The approach separates technical learning from HR, legal, or disciplinary processes, while still requiring clear ownership of corrective actions. Teams are guided to build timelines from evidence, review detection and response quality, and produce a small set of specific actions with assigned owners and due dates. The template also defines common postmortem triggers, such as customer-visible downtime, data loss, emergency rollbacks, and repeated or near-miss incidents.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

GPU Has Two Parts: Why VRAM, Not Cores, Determines If Your Model Loads

A GPU card consists of two distinct components: processing cores that perform calculations, and VRAM (video memory) that stores data — a distinction that confuses many engineers new to AI infrastructure. When a large language model is deployed, its weights are loaded into VRAM, not into the cores themselves. The cores continuously stream data from VRAM to perform each calculation, which is why language models generate text word by word rather than all at once. On AWS EC2 instances, the prominently listed system RAM figure is irrelevant to model loading — only the GPU's VRAM capacity determines whether a model fits. For example, a g6.4xlarge instance lists 64 GiB of system RAM but only 24 GB of VRAM on its NVIDIA L4 GPU, and AWS does not display VRAM directly on its EC2 pricing page, requiring a separate cross-reference.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Developer builds nightly AI agent attack system, finds gaps in Google's own tools

A developer created an automated security tool called Crucible that stress-tests AI agents for prompt injection and other vulnerabilities by running adversarial attacks every night at 3am UTC. The system plants detection tripwires in each agent's environment rather than relying on the AI itself to report whether it was compromised. Testing revealed that Google's Model Armor guardrail layer failed to block attacks that succeeded at baseline, including an injection hidden inside a scanned invoice image. Crucible was also pointed at Google's official sample customer-service agent, where a normal-sounding customer message bypassed a guarded discount-approval tool after an explicit rejection. The developer reported the finding to Google's Bug Hunters program, which escalated and closed it as 'Infeasible,' citing the sample-code scope of the repository.

0 comments Read more at DEV Community