VAST 4.4 Schema Bug Lets Empty Ad Wrappers Pass Validation, IAB Notified

·1 views

A flaw in the VAST 4.4 draft XML schema allows an empty ad wrapper — missing required fields like AdSystem, VASTAdTagURI, and Impression — to pass validation, a constraint that had been enforced in every version from 2.0 through 4.2. The issue stems from a single compositor change in the XSD file, where an xs:choice element with minOccurs set to zero effectively makes all child elements optional regardless of their individual declarations. This also breaks two additional guarantees: elements that should appear only once can now repeat, and the previously enforced element order is no longer required. The bug is believed to be an unintended side effect of the CTV Ad Portfolio restructure rather than a deliberate design decision. The issue has been reported to IAB Tech Lab, with concerns raised that ad servers and QA pipelines using the published schema as a validation gate may unknowingly accept wrapper responses that cannot deliver ads or record impressions.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

CNCF reframes Shadow AI as a non-human identity threat across software pipelines

The Cloud Native Computing Foundation (CNCF) has published a new threat model reframing Shadow AI — unapproved, unmonitored AI tools embedded in software development workflows — as a non-human identity risk rather than a simple chatbot concern. The model maps AI-related vulnerabilities across every stage of the delivery pipeline, from developer laptops and source control to CI/CD systems, artifact registries, and Kubernetes runtime environments. A key concern is prompt injection, where AI agents processing untrusted content such as issue descriptions or build logs can be manipulated into leaking data or taking unsafe actions. CNCF recommends that every AI agent be assigned a human owner, a unique identity, least-privilege access, and active monitoring, and maps specific projects like Falco, SPIFFE/SPIRE, and Kyverno to each pipeline stage as concrete controls. The framework also draws a firm boundary on autonomous deployments, stipulating that AI agents should propose changes while humans retain approval authority.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

BroadcastChannel API offers a cleaner native alternative to localStorage tab sync

Developers commonly sync browser tabs by writing sentinel values to localStorage and listening for storage events, but this approach repurposes a persistence API as a makeshift messaging system. The BroadcastChannel API provides a purpose-built alternative, allowing any tab, worker, or iframe on the same origin to send and receive messages simply by opening a named channel. Messages are delivered to all other subscribers on that channel using the structured clone algorithm, supporting objects, arrays, dates, and binary data without manual JSON serialization. Practical use cases include logging out all tabs simultaneously, keeping e-commerce cart counts consistent across windows, and pushing live config changes without a page reload. Unlike the localStorage workaround, BroadcastChannel requires no filtering, deduplication timestamps, or manual cleanup beyond calling channel.close() when finished.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

No-Code Tools Can Build Internal Admin Dashboards Fast, But Know Their Limits

No-code internal tool builders like Retool, Appsmith, and Budibase allow engineering teams to create functional admin dashboards in a single day by connecting databases and wiring UI components without custom code. These platforms work best for repetitive internal CRUD tasks such as searching users, issuing refunds, or editing config records used by a small number of staff. They eliminate the need to manually build a database connection layer, component library, and authentication system from scratch. However, the tools become costly or inadequate when complex custom logic, granular permissions at scale, or consumer-facing interfaces are required. A key security step often overlooked is scoping database credentials to a limited role, preventing the admin panel from having unintended access to critical data.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

LLM Poker Calculator Passes Math Check but Fails on Unconfirmed User Assumption

A developer tested a poker-analysis framework where a large language model acts as an input layer, interpreting natural-language questions and routing them to deterministic local calculators that handle all arithmetic. Across 25 hand-authored test cases, the system was evaluated on whether calculator results remained auditable and numerically verified after the LLM proposed typed inputs. In one key failure case, a Japanese-language query stated 'the pot is 150,' which was ambiguous about whether the figure included the opponent's bet or not. The LLM silently assumed the pre-bet pot was 150, logged the assumption internally, and the calculator correctly returned 20% required equity — but the user had never confirmed that interpretation, meaning a different reading would have yielded 25%. The experiment highlights a specific engineering gap: verified arithmetic does not guarantee a correct outcome when the LLM resolves input ambiguity without seeking user confirmation.

0 comments Read more at DEV Community