Article URL: https://dl.acm.org/doi/full/10.1145/3706598.3713778 Comments URL: https://news.ycombinator.com/item?id=50318401 Points: 12 # Comments: 4
This is an AI-generated summary. ShortSingh links to the original source for the complete article.
A security write-up explains how analysts can reverse engineer a Web3 application's minified JavaScript bundles to locate hardcoded backend API URLs. The author argues that because blockchain transactions are slow and costly, many Web3 apps depend on centralized APIs for prices, fees, and user data. By mapping routes that the frontend calls, the researcher identified several endpoints, with some correctly rejecting unauthenticated requests. One endpoint listing all ecosystem tokens, however, responded with a large JSON payload to a request lacking any credentials. The piece warns that the exposed data, including internal testnet contract addresses and hidden tokens, could aid targeted attacks.
A developer who built MacroScout, a calorie tracker for iPhone and Android, found that the difficulty of launching the app lay in meeting App Store requirements rather than writing the code. The account describes App Store rules as external standards that must be read, interpreted for the specific app, and then applied through changes. Key figures cited include a $99 annual Apple Developer Program fee, a one-time $25 Google Play registration fee, and Apple's typical review of 90% of submissions within 48 hours. The developer also notes that new personal Google Play accounts must complete a closed test with at least 12 testers over 14 days. The developer advises keeping a running list of platform rules from the start of development and checking it throughout the build process.
A customer CRUD application can appear finished through the UI, yet two less visible behaviors need careful attention. The first concerns sorting, where records with equal sort values have no guaranteed order unless the unique ID is added as a secondary key. The second concerns duplicate email addresses, which an existence check alone cannot fully prevent when concurrent requests race, so a database unique index and translation of the resulting SQL Server error into a 409 response are also needed. The author's example clamps page parameters and warns that offset pagination still does not provide a consistent snapshot when records change between requests. The duplicate-email translation also assumes any uniqueness failure means a duplicate email, which must be revisited if more unique constraints are added. These observations come from a local demo and prior verification, not a production-readiness claim.
Dubai-based indie studio Mirza Games, which publishes on Google Play as Sezarr, has detailed how its PDF compression tool reduces files to a user-specified size entirely within the browser. The tool targets common needs such as government forms and job portals that impose strict file size limits. Processing relies on WebAssembly builds of qpdf, pdf-lib and pdf.js running in Web Workers, so files never leave the user's device. The engine applies lossless optimisation first, then progressively more aggressive steps, returning the first result that meets the target. Memory-based render caps on weaker devices mean very large files may be slower or rendered at lower resolution.
Discussion (0)
Log in to join the discussion and vote.
Log in