Post-Quantum TLS Is Now a Platform Engineering Problem, Not a Research Topic

·30 views

Post-quantum TLS has quietly shifted from a cryptography research subject to a live infrastructure concern, arriving through default changes in cloud SDKs, CDN configurations, and browser handshake preferences rather than formal migration projects. The immediate engineering challenge centers on key agreement, where hybrid schemes combining classical X25519 with ML-KEM are already shipping — notably via Cloudflare's X25519MLKEM768 — while post-quantum certificate authentication remains a longer, more complex migration. AWS has set a 2026 deadline to remove older Kyber-based support across KMS, ACM, and Secrets Manager endpoints, giving platform teams a concrete deprecation date to plan around. Microsoft has shipped Windows support for ML-KEM hybrid TLS groups and is targeting critical product migrations by 2029, while mid-2026 measurement data across tens of thousands of domains shows readiness remains highly uneven. Engineers are advised to audit which services, SDKs, middleboxes, and certificate workflows can handle larger handshake sizes and hybrid key exchange before defaults shift further beneath them.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Excel Freelancer Dashboard Tracks Income, Expenses and Hours in One View

Freelancers often scatter invoices, expenses, hours and bank balances across separate files, making it hard to judge whether they can take on new work. The article proposes a single-page Excel dashboard that can be updated in about 15 minutes a week. It recommends showing four key figures at the top: monthly income, expenses, billable hours and unpaid invoice total. All other figures are drawn from one master table of jobs, so a single status change updates the whole sheet. A month-by-month summary and a list of outstanding invoices round out the layout.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

myOS Portfolio Platform Adds Reddit Posting and Unified Logo in v2.37 to v2.40

The myOS Portfolio Platform has released updates from version 2.37.0 through 2.40.0 as documented in a developer log. The latest version introduces Reddit posting via the free API using a user's own account. Social posting now runs only automatically, with networks connected through a picker, and Bluesky sign-in receives its own card. Secret fields are also now protected from browser autofill. Earlier releases in the series added a unified logo and admin style, README research with an approval step, a phone tab bar, and an AI provider setup guide with cost forecasting.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Validating URL Search Params in TanStack Start With Zod

Treating URL query parameters as trusted data causes pages to crash, show empty results, or send bad values to the API. TanStack Start addresses this by letting each route declare a validateSearch function that the router runs whenever the URL changes. Using a Zod schema with .catch() instead of .default() replaces invalid values such as a non-numeric page with safe defaults rather than raising errors. Components then read strongly typed search values through Route.useSearch(), without manual parsing or casting. Filters stored in the URL also survive page refreshes, can be shared as links, and respond to the back button.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Notifio's 38-page product site loads a single 550-byte image and has no screenshots

The developer of Notifio, a desktop app, found that its marketing website contains no screenshots despite the usual convention for selling such software. A count across 38 pages showed the only image loaded on each is a 550-byte SVG bell icon in the header, which the browser caches after the first visit. Instead of screenshots, the site uses inline SVG icons and animated product demos built from HTML elements, which avoids separate image assets and their associated loading and high-density display costs. The developer notes the demos carry trade-offs, including about 997 lines of hand-rolled timer code and an accessibility gap that was addressed. The 214 KB og-image.png used for social previews is never downloaded by ordinary visitors, but is fetched by platforms such as Slack and WhatsApp when links are shared.

0 comments Read more at DEV Community