New npm tool anchors proof-of-work solves to Bitcoin for tamper-proof auditing

·1 views

A developer has released @powforge/solve-witness, an npm package that makes server-side proof-of-work solve events independently verifiable without relying on server logs. The tool batches accepted solves into a Merkle tree every 10 minutes, sealing them into a single 32-byte root hash that is then submitted to an OpenTimestamps calendar and anchored to the Bitcoin blockchain. Because all solves within a window share one Bitcoin timestamp, the on-chain cost remains constant regardless of how many solves occurred, making the approach economically efficient at scale. Anyone can later verify a specific solve by tracing a leaf hash through a Merkle inclusion path to the timestamped root, using standard SHA-256 and the reference OpenTimestamps tooling — no trust in the originating server required. The package is designed to integrate directly with the @powforge/ratelimit middleware via an onSolve hook.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Developer builds client-side JWT decoder to prevent token leaks via online tools

A developer has warned that many popular online JWT decoder tools forward tokens to remote servers, creating a potential security leak for production credentials. In response, they built a browser-only tool that decodes JWT headers, payloads, and signatures entirely on the client side with no outgoing network requests. The tool also supports Base64, Base64URL, URL encoding, and multiple hashing algorithms including MD5 and SHA variants. It includes live expiration checking and syntax highlighting, and is available at jwt-base64-inspector.vercel.app. The project is accompanied by a dedicated JWT security guide hosted on the same domain.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How GitHub Accounts Get Compromised Without GitHub Ever Being Hacked

Modern attacks on GitHub rarely involve breaking into GitHub's own systems directly; instead, attackers exploit trusted third-party integrations, stolen OAuth tokens, or phishing to gain legitimate-looking access. A 2022 campaign illustrated this clearly, when attackers used stolen OAuth tokens from Heroku and Travis CI integrations to access private GitHub repositories via the GitHub API. GitHub confirmed it did not believe its own systems were breached in that incident. Phishing attacks have also proven effective, with fake login pages capable of relaying credentials and one-time codes in real time, though hardware security keys were found resistant to that technique. These cases highlight how credential theft and trusted-permission abuse can make malicious activity appear indistinguishable from normal, authorized use.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Six Caching Patterns Explained: Trade-offs Every Developer Should Know

A software engineering explainer published on DEV Community outlines six distinct caching patterns, arguing that caching shifts complexity rather than simply improving performance. The core question behind every caching decision is who writes to the cache and when that write occurs, which determines which pattern applies. Cache-Aside, the most widely used pattern, lets the application manage cache reads and fallbacks directly, offering resilience if the cache fails but incurring extra round trips on misses. Read-Through simplifies application code by delegating database fetching to the cache layer itself, though this makes the cache a single point of failure. The article covers four additional patterns — Write-Through, Write-Behind, Write-Around, and Refresh-Ahead — each suited to specific consistency and performance requirements.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How AI Agents Use Accessibility Trees to Debug and Automate Desktop UIs

AI agents can now interact with desktop applications by reading accessibility trees rather than relying on screenshots or screen coordinates, making UI automation more precise. Tools like agent-desktop expose any app's accessibility tree as structured JSON, enabling agents to reference elements by name instead of pixel position, while reportedly cutting prompt token usage by 78–96% on complex apps. Open Interface takes a different approach, using multimodal LLMs like GPT-4o to read the screen, control the mouse and keyboard, and self-correct by re-capturing screenshots. Both approaches highlight a key insight: native apps that lack proper accessibility metadata give AI agents nothing to work with, just as they fail users relying on VoiceOver or Switch Control. Developers building custom UI components are encouraged to implement accessibility trees, as doing so simultaneously benefits disabled users and enables accurate AI-driven automation.

0 comments Read more at DEV Community