OWASP M6: Privacy Failures Carry Severe Business Risk Despite Low Technical Impact

·11 views

The sixth entry in OWASP's Mobile Top 10 2024 list, Inadequate Privacy Controls, stands out as the only risk rated low in technical impact yet severe in business impact. Unlike other items on the list, M6 focuses not on broken code but on unnecessary or mishandled collection of Personally Identifiable Information such as names, payment data, health details, and device identifiers. Because apps continue functioning normally, engineering teams often deprioritize the issue, but regulatory fines, lawsuits, and reputational damage can follow. React Native apps face heightened exposure due to deep dependency chains, verbose logging habits, and evolving platform requirements like Apple's Privacy Manifest and Google Play's Data Safety form. Even apps that claim not to collect PII typically transmit IP addresses, device IDs, usage logs, and crash metadata — data that, when combined, can identify individual users.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Why VAT APIs Must Handle Rates, History, and Calculation Context

Adding VAT to ecommerce or SaaS products appears straightforward at first, but quickly becomes complex once edge cases like refunds, historical transactions, and product-specific rates emerge. EU member states apply standard, reduced, and zero rates differently depending on product categories such as books, food, or pharmaceuticals, making a simple country-to-rate lookup insufficient. APIs also need to account for the date of a transaction, since the rate in effect today may differ from the one used when an original sale was recorded. A further distinction exists between VAT-inclusive and VAT-exclusive pricing, as the VAT portion differs significantly depending on the price basis used. Storing calculation metadata — including country, product tax class, transaction date, and rate provenance — transforms a VAT result from a one-time response into an auditable, traceable record.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Developer Argues Modern Cloud Platforms Are Bloated, Pitches Simpler Alternative

A developer writing on DEV Community argues that mainstream cloud platforms have grown overly complex, prioritizing new features over improving the developer experience. The piece highlights trade-offs across common deployment approaches — plain VMs, serverless functions, and Kubernetes — noting each carries significant cost, maintenance, or usability drawbacks. The author contends that only large tech companies with dedicated DevOps budgets can comfortably navigate today's cloud infrastructure landscape. As a response to these frustrations, the developer has begun building a tool called Gagarin Cloud, designed to let developers deploy web apps and dependent services with just a few CLI commands. The article positions the project as an attempt to restore simplicity to cloud deployment without requiring Kubernetes configuration or complex CI pipelines.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

SketchProxy Uses Fixed-Memory Sketches to Block API Cardinality Attacks at the Edge

A new edge reverse proxy called SketchProxy tackles high-cardinality denial-of-service attacks that can overwhelm traditional rate-limiting systems. Conventional approaches rely on centralized Redis or Memcached clusters, which can crash or fail open when flooded with millions of ephemeral IP addresses. SketchProxy, built on Go's standard library, replaces external cache dependencies with fixed-size in-memory epoch sketch tables allocated once at startup, keeping memory consumption constant regardless of attacker scale. The design addresses three key weaknesses of distributed counter clusters: memory exhaustion, network round-trip latency of 2–10ms per request, and connection pool saturation. By maintaining strict memory bounds internally, SketchProxy aims to enforce rate limits on legitimate repeat clients while surviving IP-rotation floods without an external database.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Google Ads Data Shows 3-4 Word Searches Now Drive Nearly Half of Conversions

An analysis of Google Ads query trends from January 2025 to August 2026 shows a significant shift away from short searches toward longer, more descriptive queries. One-to-two word searches dropped from 42% to 24% of impressions, while three-to-four word searches rose from 33% to 48% over the same period. The conversion shift was even more pronounced, with 3-4 word queries jumping from 20% to 46% of conversions, nearly matching shorter terms. The findings, based on data examined by Further's Jason Tabeling and reported by Search Engine Land, are linked to the growing influence of Google's AI Mode and Gemini on search behavior. Advertisers are advised to segment their search-term reports by word count and treat longer queries as a distinct and measurable source of commercial intent rather than a secondary concern.

0 comments Read more at DEV Community