OWASP Releases Cornucopia Mobile App Edition v2.0 With 80 Security Threats

·1 views

The OWASP Foundation has announced the release of Cornucopia Mobile App Edition v2.0, a security card game designed to help developers identify mobile application threats. The new version is compatible with MASVS v2.1, MASTG v2.0, and MASWE v1.0, aligning it with the latest OWASP mobile security standards. The release covers 80 distinct threats that address requirements, tests, and weaknesses outlined by OWASP. The announcement was made on September 10 by Johan Sydseter on behalf of the OWASP Foundation.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Study: WebP at Quality 80–85 Beats High-JPEG Settings for Photos

A compression study tested 24 images from the standard Kodak reference suite, encoding each as JPEG and WebP across quality levels 20 to 95 and scoring results using the SSIM structural similarity metric. The findings show that most perceptible quality is gained early in the compression curve, with diminishing returns at higher settings — raising JPEG quality from 85 to 95 nearly doubles file size for an SSIM improvement of just 0.025. WebP consistently outperformed JPEG, delivering roughly 30% smaller files at equivalent perceived quality. Lossless formats cost approximately seven times the size of a quality-85 JPEG, making them impractical for most photographic use cases. Researchers recommend quality 80–85 in WebP as the practical sweet spot, while noting that the ideal setting varies by image content and is best determined through live preview rather than a fixed number.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

MCP Solves AI Tool Discovery But Leaves Security Gaps for Developers to Fill

The Model Context Protocol (MCP) has standardized how AI clients discover and invoke external tools, replacing fragmented, custom plugin systems with a common language. However, security experts warn that discoverability is not the same as authorization — a tool being listed does not mean it is safe or permitted to use. MCP does not natively enforce per-user permissions, least-privilege access, sandboxing, prompt-injection defenses, or approval workflows. Every tool description, schema, and result enters the AI model's context, making them potential attack surfaces for manipulation. Developers are advised to treat MCP servers as runtime plugins with real influence and to implement a dedicated policy gateway between agents and MCP servers.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

hls.js ESM builds skip the transmuxer worker by default, here is how to fix it

The ESM build of hls.js, introduced in version 1.4, does not bundle the transmuxer worker inline, meaning video transmuxing runs on the main thread unless a workerPath is explicitly configured. The default enableWorker: true setting is misleading, as it only signals intent to use a worker if available rather than confirming one is actually running. Developers can verify whether a worker is active by checking the browser's resource performance entries or the DevTools thread panel during playback. The fix involves passing a resolved URL for hls.worker.js via the workerPath option, with syntax varying slightly across bundlers such as Vite, webpack 5, and Next.js. Additionally, a PerformanceObserver tracking long tasks exceeding 50ms can help distinguish main-thread stalls from network-related buffering issues.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How to Build a React Native Video Upload That Survives App Backgrounding

A standard fetch() upload in React Native fails silently when the OS suspends or kills the app mid-transfer, leaving no error and no settled promise. To work around this, developers can persist upload state in a SQLite database and use a native background session — iOS Background URLSession and an Android foreground service — to handle the actual file transfer. The approach requires writing the file body to disk first, since iOS background sessions do not support in-memory data or stream bodies. On Android, targeting version 14 and above requires declaring a dataSync foreground service type, while Android 15 introduces a 6-hour daily cap on such services. The full implementation, written against Expo SDK 54 and SDK 55, runs to roughly 150 lines and reconciles upload state with the server when the app returns to the foreground.

0 comments Read more at DEV Community