Two-Layer Hashing Design Counts Anonymous Posts Without Tracking Devices

·1 views

A developer has detailed a privacy-focused system designed to tally anonymous posts without identifying the devices that submitted them. The mechanism assigns each device a pseudonym using two rounds of hashing: the device applies SHA-256 to its locally stored UUID combined with a subject ID, while the server applies HMAC-SHA256 using a secret key it holds exclusively. This two-layer approach means the raw device identifier never leaves the device, and the server cannot reconstruct it even from the pseudonym it stores. The system uses pseudonyms solely to count distinct devices and determine whether a post threshold has been met for publication. The developer also documented an early bug where the threshold counted total posts instead of unique devices, along with the known limitations of the design.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

How MCP Workbench Helps Developers Debug Server Connection Issues Fast

Developers building MCP servers often face silent connection failures where no tools appear and no clear error is shown, making debugging frustrating. A structured workflow using MCP Workbench can isolate issues by first verifying the server process starts cleanly and surfaces any stderr output immediately. If the server launches successfully, Workbench automatically runs initialization and tool discovery requests, flagging exact JSON-RPC errors such as protocol mismatches or malformed schemas. Developers can then test individual tool calls using a form builder, with raw error responses revealing issues like invalid parameters, server-side exceptions, or timeouts. Experts recommend avoiding chat clients for debugging entirely, as they abstract protocol details, whereas a raw JSON-RPC inspector provides full visibility into what is sent and received.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How Sessions, Tokens and Authentication Work After You Log In

HTTP is stateless by design, meaning servers have no inherent memory of previous requests, which creates a challenge for maintaining authenticated user sessions. To solve this, session management uses a combination of short-lived access tokens (JWTs) and long-lived refresh tokens issued upon successful login. A session lifecycle involves three core operations: authentication to establish the session, token rotation to keep long-lived sessions secure, and revocation to invalidate sessions before they naturally expire. The project referenced demonstrates these concepts using a Node.js and Express backend built with TypeScript, PostgreSQL, and Prisma ORM. Token rotation replaces the refresh token after each use, reducing the risk of token theft in persistent sessions.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

AgentForge Team Shares Six Months of Lessons from Open-Source Multi-Agent AI Orchestration

The AgentForge team released an open-source multi-agent orchestration framework on GitHub after six months of production deployment, publishing key lessons learned along the way. The team found that designing for failure modes first — such as agent timeouts, malformed outputs, and race conditions — was critical to building reliable systems. They implemented per-agent structured execution traces, a sliding-window memory strategy, and a router-specialist model architecture to manage context and control costs. These optimizations, including response caching and routing cheaper models for initial decisions, reportedly reduced costs by 60% compared to a straightforward implementation. The framework is built on Python 3.11+, AsyncIO, Pydantic, and supports SQLite or Redis for state persistence, with a WebSocket-based monitoring interface.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

AI Scribe Lawsuit Exposes Consent Failures Across US Healthcare Systems

A California man named Saucedo discovered a false consent record in his patient portal after an AI transcription tool secretly recorded his medical appointment at a Sharp Rees-Stealy clinic in July 2025. The ambient AI scribe had transcribed the consultation in real time, routed audio to a third-party cloud vendor, and generated its own documentation falsely stating that consent had been obtained. By November 2025, Saucedo became the lead plaintiff in a class action alleging over 100,000 patients were recorded without consent. The case has drawn wider attention to the rapid, largely undisclosed adoption of AI scribing tools — including Abridge, Nuance DAX, and Suki — by clinicians across the US, Canada, the UK, and Australia. Regulatory bodies including NHS England and the American Hospital Association issued guidance on their use in April 2026, as legal and ethical questions mount over patient consent, data ownership, and professional accountability.

0 comments Read more at DEV Community