SShortSingh.
TopTechnologyAI & MLStartupsProgrammingScienceBusinessFinanceCrypto & Web3World
Back to feed
Programming

Private Thumbnail Pipelines: Isolating Tenants Before Resizing and Signing URLs

0
·2 views

The article argues that a B2B SaaS serving private image thumbnails should treat tenant and source revision as part of each derivative's identity. It recommends generating thumbnails in a bounded worker and issuing short-lived signed URLs only after an application-level authorization check. The author contends that the real reliability concern is the isolation boundary rather than the resize library, since a readable thumbnail can still belong to the wrong tenant. To illustrate, the piece describes a stale-revision and retry scenario and suggests testing oversized requests, duplicate enqueues, and cross-tenant lookups. It proposes splitting responsibilities: the web request handles authentication and policy, while the worker handles byte processing and CPU-heavy transforms.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Log in to join the discussion and vote.

Log in

Related stories

0
ProgrammingDEV Community ·

Auditing AI C++ Patch Graders by Seeding Faulty Mutants

A hypothetical example describes an eval harness that reported PASS on AI-generated C++ patches for weeks while a signed modulo replacing a bounded comparison went undetected. The unit tests and sanitizer checks stayed green because no test case exercised the faulty branch, showing that a passing report does not prove the grader can still catch a given failure. The proposed remedy is a weekly self-audit that pushes known-faulty patches, called mutants, through the real harness and flags any grader that fails to reject them. Each mutant is declared in a manifest with the graders that must catch it, and a surviving mutant counts as a finding. The approach requires a clean git worktree and a harness that reports per-grader status in machine-readable form.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Declaring Degradation: A Fallback Contract for AI Agents That Lose Their Cloud Model

An illustrative scenario describes a nightly job that tags support tickets via a remote model, where a retry wrapper silently returns empty tags during timeouts and the failure goes unnoticed. The author argues this is a missing contract between a capability and its degraded form, not a model-quality issue. The proposed remedy is a three-tier declaration (local_only, cloud_preferred, cloud_required) that specifies whether each tool may leave the host and what it may return when the cloud path is unavailable. Declarations live alongside each tool as data, so reviewers can audit them and missing entries fail at startup rather than at runtime. A small outcome object reporting status (ok, degraded, refused) and payload source is recommended over resolvers that return inconsistent values.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

AetherScope V2.2.1 releases a Rust-based SAST tool with 3D code visualization and an MCP server for AI agents

AetherScope V2, a native Rust engine called aether-engine, merges four tools into a single fast binary aimed at checking code written by AI agents such as Claude, Cursor and Antigravity. It offers a WebGL 2 interactive 'galaxy' view of codebases or Obsidian vaults, plus a real-time static analysis linter that runs in under 50 ms on each save. The linter covers over 185 CWE and zero-day rules across several languages, along with taint tracking, SCA via OSV.dev and SARIF 2.1.0 export. A spec-driven governance feature seals per-folder rules with BLAKE3 hashes and blocks unsigned AI changes, while an MCP server lets agents verify patches in real time. The project is demonstrated through a live web demo and a GitHub release for version 2.2.1.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

10 ejercicios de hoisting y scope para practicar entrevistas frontend

Un nuevo artículo de DEV Community propone diez ejercicios para practicar preguntas de hoisting y scope que suelen aparecer en entrevistas frontend. Cada ejercicio muestra un fragmento de código que el lector debe predecir antes de revisar la solución. El texto explica cómo var, let, const, las declaraciones de función y las expresiones de función se comportan al elevarse. Las respuestas, según el autor, fueron verificadas en Node.js, y el material se presenta como continuación de un post previo sobre variables y tipos de dato.

0 comments Read more at DEV Community