Public Audit of OSS Release Exposes Documentation Errors the Developer Missed

·1 views

After shipping v0.2.1 of PlannerCritic, developer and author found their release documentation contained verifiable inaccuracies when a reader proposed a structured public audit. The reader froze five specific claims from the release before inspection and verified each solely against publicly available artifacts. Three of the five claims failed verification, including a test-count discrepancy, a self-contradicting field-test report stating both zero true failures and one true failure, and a mismatch in how many times a specific detector fired. Crucially, the underlying engine results were found to be sound — the errors were confined to how the release was documented and communicated. The developer concluded that a system can perform correctly while the written narrative around its release remains inaccurate, a distinction they argue most open-source maintainers overlook.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Web Share API brings native OS share sheet to browsers with minimal code

The Web Share API, accessed via navigator.share(), allows web pages to trigger the same native share sheet that mobile apps use, requiring just a few lines of JavaScript. A developer implemented the feature on Forgemage.net, a marketplace for the game Dofus, to let users easily share item requests with others. The API has two key requirements: the page must be served over HTTPS, and the share call must be triggered directly within a user gesture, with no intervening network requests or the browser will reject it. Developers must also ensure shared URLs are absolute rather than relative, as relative paths are meaningless outside the context of a specific host. Fallback handling covers browsers that lack support and cases where the user dismisses the share sheet, making the feature straightforward to implement progressively.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Blameless Postmortem Template Helps Web Agencies Learn From Incidents Without Blame

A blameless postmortem is a structured process that examines how systems, tools, processes, and context combined to cause an incident, rather than assigning personal fault. Published on DEV Community, the template is designed for small web agencies and is intended to be completed in a focused 45–60 minute meeting with a concise written document. The approach separates technical learning from HR, legal, or disciplinary processes, while still requiring clear ownership of corrective actions. Teams are guided to build timelines from evidence, review detection and response quality, and produce a small set of specific actions with assigned owners and due dates. The template also defines common postmortem triggers, such as customer-visible downtime, data loss, emergency rollbacks, and repeated or near-miss incidents.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

GPU Has Two Parts: Why VRAM, Not Cores, Determines If Your Model Loads

A GPU card consists of two distinct components: processing cores that perform calculations, and VRAM (video memory) that stores data — a distinction that confuses many engineers new to AI infrastructure. When a large language model is deployed, its weights are loaded into VRAM, not into the cores themselves. The cores continuously stream data from VRAM to perform each calculation, which is why language models generate text word by word rather than all at once. On AWS EC2 instances, the prominently listed system RAM figure is irrelevant to model loading — only the GPU's VRAM capacity determines whether a model fits. For example, a g6.4xlarge instance lists 64 GiB of system RAM but only 24 GB of VRAM on its NVIDIA L4 GPU, and AWS does not display VRAM directly on its EC2 pricing page, requiring a separate cross-reference.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Developer builds nightly AI agent attack system, finds gaps in Google's own tools

A developer created an automated security tool called Crucible that stress-tests AI agents for prompt injection and other vulnerabilities by running adversarial attacks every night at 3am UTC. The system plants detection tripwires in each agent's environment rather than relying on the AI itself to report whether it was compromised. Testing revealed that Google's Model Armor guardrail layer failed to block attacks that succeeded at baseline, including an injection hidden inside a scanned invoice image. Crucible was also pointed at Google's official sample customer-service agent, where a normal-sounding customer message bypassed a guarded discount-approval tool after an explicit rejection. The developer reported the finding to Google's Bug Hunters program, which escalated and closed it as 'Infeasible,' citing the sample-code scope of the repository.

0 comments Read more at DEV Community