SShortSingh.
TopTechnologyAI & MLStartupsProgrammingScienceBusinessFinanceCrypto & Web3World
Back to feed
Programming

Why a correct SRI hash can still block your script: line endings explained

0
·1 views

A developer building a browser-based Subresource Integrity (SRI) hash tool discovered that line ending differences between Windows (CRLF) and Unix (LF) formats produce entirely different hash values for otherwise identical files. Because HTML textareas automatically normalize pasted content to LF line breaks, hashing text pasted into the tool yields a different digest than hashing the original CRLF file served from a CDN. The browser's SRI check compares the hash of the actual bytes received from the server, so even a technically "correct" hash generated from normalized text will cause the script to be blocked. The issue was reproduced using Node.js v24.11.1 and OpenSSL 3.2.3 on Windows, with both tools confirming that LF and CRLF versions of the same code produce completely different SHA-384 digests. A further complication arises from the spec's strongest-hash rule, which means that if multiple algorithms are listed in an integrity attribute, only the strongest one is verified — a passing SHA-256 hash is ignored if an incorrect SHA-512 hash is also present.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Log in to join the discussion and vote.

Log in

Related stories

0
ProgrammingDEV Community ·

27B LLM Squeezed Under 6GB via Ternary Quantization, But CPU Speed Disappoints

A developer tested Prism's Ternary-Bonsai-2-27B, a ternary-quantized large language model that compresses a 27-billion-parameter model into under 6GB, on a budget Hetzner VPS with no GPU. The model uses an aggressive PTQ1_0 format where each weight is reduced to one of three values, requiring Prism's custom llama.cpp fork since the format is not yet supported upstream. While Simon Willison had reported 20–44 tokens per second on Apple Silicon with Metal acceleration, the CPU-only test on the VPS yielded just 2–3 tokens per second. At that speed, the model is viable for background batch processing but impractical for real-time interactive use. The tester also noted an unexplained throughput variance of up to 40 percent between server restarts with no configuration changes.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Why AI Systems Need New Observability Metrics Beyond Latency and Uptime

Traditional software monitoring tools are inadequate for AI-native systems because they measure technical success rather than output quality, missing failures like hallucinations, biased responses, or unsafe content. A technically successful HTTP 200 response can mask serious problems such as fabricated information, ignored retrieval context, or policy violations. Large language models introduce non-deterministic behavior, meaning identical inputs can produce varied outputs and quality can degrade silently after model or prompt updates. Experts advocate for a dual observability strategy that combines conventional infrastructure metrics with AI-specific Service Level Indicators (SLIs) measuring trustworthiness, relevance, and safety. Without these specialized SLIs, organizations risk deploying AI systems that appear operationally healthy but are fundamentally unreliable or harmful in real-world use.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

URL Encoding Pitfalls: Why %20, +, and Special Characters Break APIs

URLs are composed of distinct parts — scheme, host, path, query string, and fragment — each with its own encoding rules, and treating them as uniform text is a common source of bugs. Characters like &, #, =, and ? carry structural meaning in URLs, so user-supplied data containing these must be properly encoded before being inserted into a URL component. A frequent source of confusion is that spaces can be represented as either %20 or + depending on context: standard percent-encoding uses %20, while HTML form encoding uses +, and a literal plus sign must be encoded as %2B to avoid being misread as a space. JavaScript developers often misuse encodeURI() and encodeURIComponent(), where the former preserves URL-structural characters and is unsafe for encoding individual values, while the latter correctly encodes characters like & and = within a single component. Using dedicated APIs such as URLSearchParams and the URL constructor is generally the safer and clearer approach for building URLs with dynamic query parameters.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Developer audits 2 months of Claude Code sessions, finds $1,675 in API costs and 117 risky deletes

A developer building an AI safety tool called Paveo replayed 59 days of their own Claude Code sessions to stress-test the product before releasing it publicly. Across 106 sessions and over 8,000 model calls, the usage would have cost $1,674.75 at standard API rates, with one single session reaching $452.92. A starter safety policy, when applied retroactively to all tool calls, would have blocked 670 actions, including 117 recursive force-delete commands and 3 forced git cleans. The developer notes that not every blocked command would have been a genuine mistake, but argues that a false refusal is preferable to an unrecoverable data loss. Paveo, which runs locally without any network access and supports multiple AI coding tools, is set to become publicly available this week.

0 comments Read more at DEV Community
Why a correct SRI hash can still block your script: line endings explained · ShortSingh