PyTorch Dev Ditches Custom SSRF Code for Battle-Tested requests-hardened Library

·1 views

A developer contributing to pytorch/torchtitan initially built a custom SSRF protection system for the project's image decoder URL fetcher, handling DNS resolution, IP validation, and redirect tracking manually across up to 10 hops. A project maintainer recommended against the custom approach, advising the team to delegate such security-critical logic to a mature third-party library instead. The developer switched to requests-hardened, which intercepts connection attempts at the transport adapter level and validates IPs at connect time, eliminating a known TOCTOU vulnerability present in the original code. The change reduced the implementation from roughly 75 lines to around 15, while also improving protection against edge cases like DNS rebinding and cloud metadata endpoint exposure. The episode highlights a widely held open-source principle: for security-sensitive functionality, proven libraries are safer and more maintainable than custom solutions.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Hobbyist Developer Builds Multilayer Perceptron From Scratch Using Julia

A self-taught machine learning enthusiast has documented their journey learning ML concepts and implementing a Multilayer Perceptron (MLP) from scratch without professional guidance. After completing two Udacity Nanodegree programs in AI and Deep Learning, the author felt unsatisfied with their understanding of the underlying mathematics and decided to derive it independently. They manually worked out the calculus for both the feed-forward and back-propagation phases, then implemented the algorithms in Julia — a high-level programming language — on both CPU and GPU. The author chose to build an MLP rather than a more complex neural network because they limited themselves to implementing only what they could first prove mathematically. A follow-up post is planned covering data augmentation techniques and image processing functions such as rotations and distortions.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

AI Conversation Management Is Becoming a Hidden Productivity Drain

Many regular AI users are finding that preserving useful outputs from tools like ChatGPT and Claude creates a secondary workflow of copying, titling, tagging, and filing information into apps like Notion or Obsidian. The core problem is that valuable insights often emerge unexpectedly mid-conversation, making it awkward to save entire chats while also impractical to manually sift for the few worthwhile exchanges. Saving everything leads to cluttered knowledge bases that are rarely revisited, while saving nothing risks losing important reasoning or decisions. The challenge is less about storage and more about retrieval — knowing how to quickly return to a specific, useful moment across hundreds or thousands of past conversations. As AI becomes embedded in more daily workflows, this knowledge-management overhead is growing into a significant and largely unsolved burden.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Developer ships a zero-impact bug fix — and explains why it still belonged in the codebase

A developer building CauterRule, an open-source tool that converts repeated AI agent failures into reusable rules, shipped a code fix that ultimately dropped zero trajectories in testing. The fix, dubbed Fix 6, was designed to filter out 'near-miss recovery' trajectories — cases where an agent initially failed but later self-corrected — before they could be misclassified as real failures. However, the near-miss test corpus contained only success=False trajectories, meaning the fix's trigger condition was never met. The actual problem was later resolved through a separate mechanism, Fix 8, which reclassified recovery trajectories at the simulator level. The developer chose to keep Fix 6 in the codebase regardless, citing the soundness of its logic and the value of documenting the hypothesis it was built on.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Anthropic's claude.md requirement raises fragmentation fears among AI developers

Anthropic's CEO announced that its development systems will only support a proprietary markdown file called claude.md for AI skill instructions, diverging from the AGENTS.md convention used by other AI agents. Critics argue this forces developers and companies to maintain duplicate configuration files that serve identical purposes, depending on which AI agent they use. Large enterprises with hundreds or thousands of such files have already voiced objections, as they would need to replicate them solely for Anthropic compatibility. The situation draws comparisons to Microsoft's early browser-era decision to bypass W3C standards, which led to fragmented, patch-heavy web development. The author uses this episode to revisit the broader case for digital sovereignty, arguing that dependence on a handful of dominant AI providers leaves businesses vulnerable to unilateral commercial decisions.

0 comments Read more at DEV Community