Why a Boolean 'Valid/Invalid' PDF Verifier Is the Wrong Design

·1 views

Developer Aman Singh, building Putmysign, a PDF signature collection app, discovered a critical flaw when Outlook re-saved a forwarded signed contract, altering its bytes and causing his verifier to flag a legitimate document as invalid. This revealed that 'byte mismatch' and 'forgery' are entirely different conditions that a simple true/false check cannot distinguish. To fix this, he designed a five-tier verification system using two independent checks: a SHA-256 hash lookup against stored records, and an HMAC-signed certificate embedded in the PDF's metadata. The tiered verdicts range from 'verified' (exact byte match) and 'certified' (authentic certificate, altered bytes) to 'tampered' and 'unknown', covering cases where files are modified by mail clients, records are deleted, or plans are downgraded. The embedded certificate ensures documents can prove their own authenticity even after the original database record is gone.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Study Examines Whether AI Is Ready to Design Circuit Boards

A new analysis published on EEBench explores the current capabilities of artificial intelligence in designing printed circuit boards (PCBs). The piece investigates how well AI tools can handle the complex technical demands of electronics design. It assesses both the strengths and limitations of existing AI systems when applied to real-world circuit board tasks. The findings aim to give engineers and hobbyists a clearer picture of where AI stands in this specialized field today.

0 comments Read more at Hacker News

ProgrammingDEV Community ·

Graphic Era University Launches AWS Student Builder Group to Boost Cloud Skills

Graphic Era Deemed to be University established the AWS Student Builder Group (SBG) in 2025 to give students practical exposure to cloud computing and emerging technologies. The community focuses on hands-on learning through real-world projects, workshops, hackathons, and certification drives rather than purely theoretical study. Members explore a broad technology stack including Amazon Web Services, Artificial Intelligence, Full-Stack Development, DevOps, and Open Source tools. The group aims to bridge the gap between academic learning and industry demands by connecting students with mentors and peer collaborators. Since its founding, SBG has grown into one of the fastest-expanding technical communities on campus, with a mission to develop confident, job-ready cloud professionals.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Piping a command's output to tail silently hides its real exit status

A developer discovered on September 4, 2026, that running a Node.js script through a pipe to tail caused the shell to report exit code 0, even though the script had actually failed with exit code 1. This happens because in bash, the $? variable after a pipeline reflects the exit status of the last command in the pipe — in this case, tail — not the original program. The issue was especially problematic in a control run, where accurately capturing failure is critical, since a masked exit code made a genuinely failed check appear successful. The developer recommends either running the command on its own line, using bash's PIPESTATUS[0] array immediately after the pipeline, or enabling set -o pipefail in scripts, each with its own caveats. The bug was found by accident rather than deliberate auditing, and the author acknowledges similar issues may exist elsewhere in their codebase.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Audit Reveals 47% of Lifetime Views Landed on Articles With No Repo Link

A content audit conducted on September 4, 2026, found that 24 of 63 published articles on a DEV Community account contained no link to any repository, yet those articles accumulated 1,076 of 2,310 total lifetime views — nearly half. The most-read article on the account, with 181 views, was among the unlinked pieces. The author discovered that while all 29 articles published from July 10 onward consistently included a repository link, this practice had never been formally documented in the 141-line style guide governing the writing process. The audit highlighted that an undocumented habit, sustained only by memory, is a fragile system that can fail without warning. Rather than publishing new content, the author concluded the more valuable action was to retrofit the existing 24 articles with links, since those pages continue to receive traffic with no outward path for readers to follow.

0 comments Read more at DEV Community