Uptime Kuma needs separate access rules for status pages, metrics and admin console

·1 views

Uptime Kuma can publish public status pages, expose a Prometheus metrics endpoint and offer an authenticated admin interface, each serving different audiences and data. A ZoomEye count from November 2026 showed large deployment numbers, though the authors note that the app query reflects a discovery scope rather than a vulnerability count. The article recommends putting the admin console behind a management host or VPN, publishing only the status page publicly, and keeping metrics on a private network protected by an API key stored as a service credential. It also advises reviewing public monitor names and incident feeds for sensitive details, and testing each surface from an untrusted network to confirm exposure is limited to what is intended.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Mori Period App Recomputes Predictions Instead of Storing Them

The developer of Mori, an offline period tracker with no account, explains why the app does not save its predicted dates in a database. Stored predictions go stale when past entries are corrected, can create mismatches between screens, and add extra data that must be deleted. Instead, the app stores only the dates users mark and recalculates predictions from that history using an explicit as-of date. The developer notes this makes results reproducible and simplifies deletion, at the cost of recomputing on each read. The phone is the only copy of user data by default, so keeping a single source of truth is treated as important.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Study finds no detectable effect of a book launch on AI search citations

A researcher tracked how answer engines with web search responded to 16 fixed questions about a new author, scoring answers on a fixed scale. After the author's first novel was released on 8 October 2026, the study compared a drift-adjusted baseline with the following month. The headline score rose by 1.38 percentage points, but the 95% interval (-3.59 to 6.68) includes zero, so the pre-registered null hypothesis was not rejected. Neither the direct-answer nor the recommendation channel showed a meaningful shift, and the predicted earlier pickup in direct answers was not supported. The author notes limitations including a single-author design with no comparison group, incomplete Gemini data, and possible unrelated changes to provider search systems during the same period.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Valve améliore la qualité du streaming SteamVR, un enjeu notable pour les personnes amblyopes

Valve a publié une mise à jour bêta de SteamVR qui améliore la netteté, la stabilité et la fidélité de l'image en streaming sur les casques autonomes compatibles Steam Link, dont Meta Quest, HTC Vive Focus et PICO. Pour la plupart des utilisateurs, il s'agit surtout d'un gain de confort visuel. Le texte souligne qu'une qualité d'affichage stable est essentielle pour les personnes atteintes d'amblyopie, car elle conditionne l'efficacité des exercices d'entraînement binoculaire. L'article présente aussi Amblyotube, une application Meta Quest de rééducation visuelle développée par Seven Sports, qui envoie deux flux visuels distincts à chaque œil pendant la lecture de contenus vidéo. L'éditeur précise qu'il s'agit d'un outil complémentaire, recommandé dès 13 ans à raison de 30 à 40 minutes par jour, et non d'un traitement médical.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Bounded Replay for Realtime Voice Lobbies: Recovering Go Clients Without Duplicates

The article argues that offline replay should be treated as a bounded recovery mode rather than a second live session in realtime gaming voice lobbies. It recommends a stable channel identifier and explicit client-server ownership so reconnects do not cause duplicate joins, phantom speakers, or audit gaps. Monitoring should track authentication, subscription, and business events as separate streams that share a correlation ID but not a success counter. On reconnect, a client compares its last stable identifier with the server's authoritative snapshot, replaying only newer events or resubscribing cleanly if the identifier falls outside the retained window. Because transport may deliver at least once, operations such as joining or muting are made idempotent using client-generated operation IDs.

0 comments Read more at DEV Community