Private media exports: fixing wrong filenames and browser-opened PDF and CSV files

·3 views

The article argues that private export downloads should rely on stored Content-Type and Content-Disposition metadata rather than making files public. A browser opening a PDF or CSV inline usually signals a missing or incorrect response header, not a reason to expose the object. The author separates the internal storage key, which marks an isolation boundary, from the customer-facing filename, which is presentation only. It recommends that the signing service check tenant ownership before creating a short-lived presigned link, since a valid signature alone does not establish business authorization. The piece also proposes deriving the media type from the generated file and building attachment headers with an ASCII fallback plus a UTF-8 encoded filename.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Running AI Agents in Production: A Worked Monthly Cost Model

A guide on production AI agent costs argues that model tokens typically dominate the bill at moderate scale, ahead of infrastructure like compute. Its worked example models 300,000 tasks a month with eight model calls each, totaling about $21,919, or $0.073 per task, at list prices. Prompt caching reduced the token bill by about 45 percent, with model routing, fewer calls, and shorter outputs as the next biggest levers. Infrastructure, including sandboxes, orchestration replicas, NAT gateways, and trace storage, came to roughly $799 a month. The author, who publishes on a platform called Control Plane, notes that all inputs are stated so readers can substitute their own figures.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Kubernetes Cluster Add-ons Configured From a Single Shared Kapitan Inventory

Before running its first application, a Kubernetes cluster typically needs a common set of add-on components installed. This project keeps the configuration for these components in one Kapitan inventory, where each shared value is defined only once. A platform-baseline check script deploys the setup to a fresh kind cluster on every change and once a week. Components such as cert-manager, Kyverno, Prometheus Operator, Grafana Operator, External Secrets, Velero and Argo CD are rendered from pinned, verified recipes sourced from the kadet-hub registry. Each recipe's digest and signed attestations are checked before the inventory is compiled.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Guide Compares Five Options for Deploying AI Model Inference

A deployment guide outlines five ways to serve AI models: managed model APIs, managed ML endpoints, serverless GPU services, self-hosted serving on containers or Kubernetes, and platform layers that run containers across clouds. It recommends choosing among them based on factors such as whether the model is proprietary or open-weight, traffic patterns, latency needs, required features, data residency, cost structure, and team skills. Managed options are faster to start with, while self-hosted serving offers greater control over cost, data location, and portability. The article also highlights common inference challenges, including GPU underutilization, cold starts, autoscaling, rate limits, and multi-region availability. The guide is published by Control Plane, which is also promoted as one of the platform options discussed.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Mixed 400-row adapter 'vaccine' preserves two behaviors in a 4-bit Qwen model

A researcher tested whether a small mixed training adapter, called a vaccine, could protect a model's sentiment behavior when it is merged with a topic-classification adapter. The prime was trained on 300 SST-2 and 100 AG News rows for one epoch, taking about 63 seconds on a 6 GB laptop. Evaluated on 400 rows per task, the merged vaccine raised sentiment accuracy from 50.0% to 74.0% and AG News accuracy from 45.8% to 71.2% at a 0.75 merge weight. The vaccine alone scored 82.2% on SST-2 and 72.0% on AG News, though a dedicated sentiment adapter still performed better on sentiment. The author stresses the single seed, single host, and lack of cross-validation, and notes this is not true prime-boost or pathogen-agnostic immunity.

0 comments Read more at DEV Community