Nine Hard-Learned Lessons From Building a WebRTC SFU Server in Go

·26 views

A developer building a low-latency WebRTC selective forwarding unit (SFU) in Go documented nine non-obvious failures encountered beyond basic tutorial examples. Key issues included a breaking API change in Pion v4 that removed TrackRemote.WriteRTCP, requiring RTCP writes to be routed through the PeerConnection with corrected SSRCs. Other problems ranged from a silent UI bug where an empty event.streams array caused a black video element despite healthy network stats, to browser heuristic caching serving outdated JavaScript and masking applied fixes. Payload type mismatches between publisher and viewer PeerConnections caused Chrome to silently drop packets, since RTP payload type numbers are negotiated per-connection and cannot be forwarded blindly. The author notes that most of these failures superficially resemble media or network problems, making them especially time-consuming to diagnose without knowing their true causes.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

How to Retrofit Spring Security Into a Legacy Internal App When VPN Access Ends

A software developer has published a detailed guide on adding Spring Security to an existing Java Spring Boot application that previously relied solely on VPN-based network access for protection. The article addresses a common real-world scenario where internal business tools — such as accounting systems and admin panels — must handle authentication and authorization as remote and external access needs grow. Using a demonstration financial accounting system built on Java 21 and Spring Boot 3.5, the author walks through retrofitting security onto a live, publicly accessible app with a fabricated but structurally realistic dataset. The guide deliberately recreates actual bugs encountered during a parallel work project, allowing readers to trace each flaw from cause to fix using published code on GitHub. It is aimed at beginner and mid-level developers who have basic Spring Security experience but have not yet tackled row-level or role-based data authorization.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Why 'Supported' Linux Doesn't Always Mean 'Secure': The ELS Vulnerability Gap

Enterprise Linux servers under Extended or Maintenance Support are often flagged with dozens of vulnerabilities by scanners, sparking disputes between security and application teams. The core issue is that 'vendor support' does not guarantee uniform security updates across all packages, releases, or architectures. Many enterprise Linux vendors, including Red Hat and Canonical, backport security fixes into older package versions, meaning an outdated-looking version number does not automatically confirm a system is vulnerable. Vulnerability scanners that compare installed versions against upstream releases can therefore produce misleading results in these environments. Organizations running aging systems face compounding challenges — high application dependency, low change tolerance, and shrinking patch coverage — making risk-based vulnerability assessment essential rather than relying solely on scanner output.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Google's TPU Shortage Is a Resource Authority Problem, Not Just a Supply Gap

Alphabet CFO Anat Ashkenazi has acknowledged that Google is operating in a supply-constrained environment, with TPU shortages traced to a limited number of high-bandwidth memory manufacturers rather than internal mismanagement. DeepMind CEO Demis Hassabis confirmed the bottleneck is industry-wide and rooted in physical component availability. With demand from internal teams, Cloud customers, and frontier AI research all competing for finite compute, Google was forced to establish an explicit allocation hierarchy. CEO Sundar Pichai publicly stated that frontier AGI work takes priority, with Cloud, Search, and YouTube sharing the remainder. The situation highlights that when every demand signal is legitimate but supply still falls short, the critical question becomes who holds the authority to decide where compute goes.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

APC Spec Rule: Unknown .apc/ Files Must Not Be Treated as Agent Instructions

The APC folder structure specification requires that consumers ignore any .apc/ paths not formally defined by APC or an approved extension, preventing unrecognised files from being silently treated as agent instructions. This rule matters because different tools handle unknown files differently — one may ignore them while another feeds every Markdown file in the directory to its agent, causing inconsistent behaviour across the same codebase. A file's location inside .apc/ alone does not grant it semantic authority; a consumer must be able to identify what a path means before acting on it. Teams wanting to make instructions universally applicable should place them in AGENTS.md, or use defined paths such as .apc/rules/ or .apc/skills/ for scoped rules and callable procedures. Sensitive data like credentials or runtime caches should never be stored in .apc/, as the unknown-path ignore rule is a parsing convention, not a privacy safeguard.

0 comments Read more at DEV Community