Visa, Mastercard Launch Agent Trust Protocols — But Key Verification Gaps Remain

·1 views

Visa has introduced its Trusted Agent Protocol (TAP), an open-spec framework where every agent request carries a cryptographic signature with a timestamp, session ID, and key identifier bound to a specific merchant domain and operation. Mastercard followed with Verifiable Intent (VI), enabling merchants to verify signed intent credentials in real time within the authorization flow before any funds move. Both initiatives are part of a broader industry convergence that also includes Coinbase's x402 protocol and the AP2 coalition involving Google, Visa, Mastercard, PayPal, and around 60 partners. However, critics note that neither protocol allows external parties to audit the verifier logic, reproduce credentials from public bytes, or access an immutable third-party log proving what was published and when. Proposed complementary approaches, such as offline-verifiable attestation using Ed25519 checks and Sigstore's Rekor transparency log, aim to fill these gaps without requiring network membership or API keys.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Developer Builds Fan-Made Interactive Daily Map Tool for PEAK Game

An independent developer has created Peak Map Today, a fan-made interactive map utility for the game PEAK, built around a design principle of immediate usability. Unlike typical game guide pages that lead with marketing content, the tool places a fully functional map at the top of the page so players can access the current biome, route, and markers without scrolling. The map draws on data from the open PeakMap project and supports multiple layers including Luggage, Belltowers, Animals, Amulets, and Tombs, each of which can be toggled or inspected individually. Both top-down and side-angle views are available where source data permits, helping players assess lateral distances and elevation changes from a single workspace. The implementation also handles touch and desktop zoom interactions carefully, using pointer events and browser gesture guards to keep map controls local and prevent unintended page-level zooming.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

AI Is Erasing the Grunt Work That Trained Junior Developers

A widely shared essay by developer Asael Shinder argues that AI tools are automating the repetitive, low-level tasks that historically taught junior engineers core problem-solving instincts. Tasks like debugging obscure errors, writing test suites, and fixing configurations by trial and error formed an informal apprenticeship that new developers no longer experience by default. Shinder warns that juniors today are instead handed AI-generated output to review — a skill that itself requires the instincts only hands-on struggle can build. He calls on senior engineers to deliberately assign challenging work, encourage independent debugging, and make clear that the difficulty is intentional and instructive. Without such intervention, he cautions, the industry risks producing a generation that can generate code at scale but lacks the judgment to verify it.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How VPNs Work: Encryption, DNS Leaks, and What They Cannot Do

A VPN routes your internet traffic through an encrypted tunnel via a VPN server, masking your public IP address from websites and making it harder for others on your network to read your data. The website you visit sees the VPN server's IP address rather than your own, while your device-to-server connection remains encrypted. However, a VPN does not make users fully anonymous, as websites can still track individuals through cookies, browser settings, and account information. DNS traffic must also be routed through the VPN to avoid DNS leaks, where name resolution requests bypass the encrypted tunnel entirely. Connection speeds can be affected by factors such as server distance, server load, and network routing quality, so switching servers may help improve performance.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How a Green Canary Deployment Missed a Bug That Corrupted Nine Hours of Data

A software team's automated canary deployment system approved a release that ultimately corrupted nine hours of nightly settlement processing, despite showing healthy metrics. The flaw stemmed from canary pods being excluded from the Kafka consumer group, meaning the asynchronous batch workload — which actually triggered the bug — was never tested. The faulty code path involved a nullable decimal handled by a shared serialiser, a route rarely touched by HTTP traffic but hit constantly by a batch job running at 1 a.m. The team also discovered that analysis relied solely on HTTP status codes and latency, so a service returning incorrect data with a 200 status would still pass. In response, they added consumer group participation for canary pods, a shadow batch replay mode, business-level metrics, and synthetic requests mimicking edge-case tenant payloads.

0 comments Read more at DEV Community