Xray REALITY gives identical errors for a wrong key and a wrong short ID

·3 views

A maintainer of VLESS and REALITY config templates ran fault-injection tests on Xray-core 26.10.31 on a single Linux machine using loopback only. Misconfigured clients with a wrong public key, a wrong short ID, or a wrong server name all failed with similar SSL errors, and the server logged nothing at warning level. A wrong key and a wrong short ID both caused the client to receive the genuine target certificate and trigger a possible-MITM message that points users toward their network instead of their configuration. The author advises checking the public key and short ID first when that message appears, and comparing the SNI character by character. The new release also warns that using www.microsoft.com as the target or non-443 ports may increase the chance of the server IP being blocked.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Developer weighs options for struggling X reply app Starling after weak early traction

A developer who built Starling, a tool that drafts X replies in the user's own voice, says the app has struggled to find users despite going live as a free beta on 31 October. After an unsuccessful Flippa auction that drew no bids, they are now considering selling the product, pivoting it toward professionals who reply online for work with a LinkedIn focus and a $19-29 monthly price, seeking an audience-holding partner, or shutting it down. Their estimate is that they may reach only 30-90 sign-ups and 0-2 paying users in the next two months, given the crowded market for AI writing tools. They have asked the developer community for advice and invited feedback on the free product at starlingwriter.com.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Confirmed Crypto Transactions Can Still Trigger AML Reviews

A blockchain transaction showing confirmation does not guarantee that the funds lack a suspicious history, a point often overlooked by users. Confirmation only shows the transfer was processed; it does not verify the origin of funds, sanctions exposure, or links to scams and stolen assets. Compliance screening instead examines the risk profile of a wallet address, which is a different question from whether a transaction occurred. Risk indicators can include sanctions connections, mixer activity, stolen funds, darknet exposure, and interactions with flagged counterparties. The concern is especially relevant for USDT on the TRON network, widely used by traders, exchanges, and businesses receiving stablecoin payments.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

DoorDash's AI-Assisted Coding Interview: A 60-Minute Practice Plan

DoorDash's March 2026 engineering interview announcement describes swapping traditional coding rounds for a 60-minute session where candidates use integrated AI tools on a supplied project. Evaluators reportedly weigh how candidates get oriented, verify AI output, debug, control scope, and explain tradeoffs, with finishing every task counting for less than good judgment. The article proposes a rehearsal built around a small support-ticket routing app, where a new refund rule must take priority over existing order and payment rules. The author stresses that the schedule is an original practice plan rather than DoorDash's official agenda, and advises candidates to confirm tool permissions with their recruiter.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

FBI Attributes $6.3B Binance Crypto Theft to North Korea's TraderTraitor Group

The FBI has attributed the theft of roughly $6.3 billion in cryptocurrency from Binance on October 29, 2026, to the North Korean threat group TraderTraitor. Binance says it has found no evidence of hot-wallet private key leakage but is probing a possibly compromised DevOps endpoint and other potential entry points. TRM Labs reports that the stolen funds were moved across ten blockchains in a short window, using pre-signed authorizations on Ethereum and standard signed transfers elsewhere, which suggests the signing infrastructure was compromised. Frozen assets total about $2.7 billion as of October 30, but attackers still hold ETH and BTC that issuers cannot freeze. Binance plans to phase in withdrawal resumption starting November 1.

0 comments Read more at DEV Community