0
ProgrammingHacker News ·
Is your Postgres migration safe or not safe?
Article URL: https://safenotsafe.dev/ Comments URL: https://news.ycombinator.com/item?id=49854161 Points: 5 # Comments: 0
Programming
0
ProgrammingDEV Community ·
WHMCS May Be Charging Outdated EU VAT Rates, Manual Check Advised
Billing platform WHMCS has been found to carry stale EU VAT rates, meaning invoices sent to consumers in affected countries may display incorrect tax figures without any visible error. Six EU member states have changed their standard VAT rates since January 2024, including Estonia, Finland, Luxembourg, Slovakia, Romania, and Estonia again, yet WHMCS's public changelogs show only one rate correction across versions 8.6 through 9.0.9. The platform's auto-update and Auto Configure features draw rates from an undisclosed source, making it impossible to verify their accuracy from release notes alone. Finnish hosting provider Pulsed Media discovered outdated rates in their own WHMCS setup and is urging other operators to manually cross-check their tax rules against the European Commission's TEDB database. Administrators can audit their rates via Configuration > System Settings > Tax Configuration > Tax Rules, or by querying the tbltax table directly on self-hosted installations.
0
ProgrammingDEV Community ·
Over 152,000 ownCloud Instances Flagged for Critical Auth Bypass CVE on ZoomEye
A critical authentication bypass vulnerability, CVE-2023-49105, affecting ownCloud versions before 10.13.1 was added to CISA's Known Exploited Vulnerabilities catalog in August 2026. On September 24, 2026, two separate ZoomEye queries — one filtering by the ownCloud product fingerprint and another by the CVE identifier — both returned exactly 152,655 matches. This identical result suggests that ZoomEye's CVE index and product fingerprint data resolve to the same set of assets, meaning the flagged vulnerable population overlaps entirely with the known ownCloud population. The flaw stems from a validation gap where pre-signed URLs were accepted without a configured signing key, allowing anyone with a valid username to read, modify, or delete other users' files. Administrators are advised to upgrade to ownCloud 10.13.1 or later, configure signing keys for all file owners, and review WebDAV access logs for suspicious pre-signed URL requests.
0
ProgrammingDEV Community ·
Apple Pay Token Decryption Docs Contain Key Derivation Error, Dev Warns
A developer has flagged that Apple's live reference page for decrypting Apple Pay tokens contains an error in the key derivation function table, listing the hash function where the shared secret should appear and omitting critical AES-256-GCM algorithm ID bytes. The mistake means anyone building a decryptor from the current documentation will generate a key that fails to decrypt the ciphertext, with no informative error to indicate why. The correct values remain visible in an archived version of the same page. A detailed technical guide has been published covering the actual decryption flows for Apple Pay's EC_v1 and RSA_v1 formats and Google Pay's ECv2, including signature verification steps and certificate rotation practices that are commonly skipped. The guide also addresses a broader question of whether merchants should be handling token decryption themselves, rather than delegating it to a payment service provider.
0
ProgrammingDEV Community ·
How ACME HTTP-01 and DNS-01 Challenges Verify Domain Control Internally
The ACME protocol automates TLS certificate issuance by requiring clients to prove domain control before a certificate authority will issue a certificate. Two widely used verification methods are HTTP-01, which places a challenge response in the web server's HTTP path, and DNS-01, which inserts a cryptographically derived value as a DNS TXT record. Crucially, the certificate authority performs the validation independently rather than trusting the client's claim. This distinction matters in complex environments such as Kubernetes clusters or systems behind load balancers, where the component requesting the certificate may not directly control the infrastructure needed to complete the proof. Understanding these mechanisms requires examining the full chain of infrastructure dependencies, not just the certificate request itself.
0
ProgrammingDEV Community ·
How to Decode a JWT in Your Browser Without Exposing It to Third Parties
A JSON Web Token (JWT) consists of three Base64URL-encoded segments — header, payload, and signature — joined by dots, and its contents can be read by anyone who holds the token without needing a secret key. Decoding can be done directly in a browser console using a one-line JavaScript command, avoiding the need to paste tokens into online tools that may transmit them to external servers. Security experts warn that decoding a token is not the same as verifying it; only server-side signature validation, combined with checks on expiry, issuer, and audience fields, confirms whether a token should be trusted. A common vulnerability arises when applications blindly accept the algorithm specified in the token header, including the insecure 'none' algorithm, which can be exploited by attackers. Users are advised to avoid pasting production tokens into untrusted decoders, use test tokens where possible, and revoke any credentials that may have been exposed.
0
ProgrammingDEV Community ·
How Cron Expressions Work: Syntax, Examples, and Common Pitfalls
Cron is a Unix-based job scheduler whose five-field syntax — covering minute, hour, day-of-month, month, and day-of-week — is now widely used in CI pipelines, cloud schedulers, and job queues. Each field supports special characters such as wildcards, ranges, lists, and steps, allowing expressions like '0 9 * * 1-5' to schedule a job at 9 AM on weekdays. A key pitfall is time zone handling: cron runs in the time zone of the host machine or service, which often defaults to UTC, potentially causing jobs to fire at unintended local times. In classic Vixie cron, restricting both the day-of-month and day-of-week fields triggers the job when either condition matches, not both — a behaviour that can catch developers off guard. Some schedulers such as Quartz and AWS EventBridge extend the standard five-field format with seconds or year fields, so users should always verify which dialect their tool expects before deploying.
0
ProgrammingDEV Community ·
Hidden EXIF Metadata in Photos Can Expose Your Location and Daily Routine
Every photo taken on a phone or camera contains embedded EXIF metadata that records details such as GPS coordinates, device model, capture time, and editing software. When images are shared via email, classified-ad sites, forums, or personal websites, this metadata often remains intact and visible to recipients. A photo taken at home or of an item for sale could inadvertently reveal a person's address or daily patterns, posing risks especially for journalists, activists, or anyone concerned about stalking. While major social platforms sometimes strip location data on upload, their policies vary and cannot be relied upon consistently. Users are advised to view and remove EXIF data locally using browser-based tools before sharing any image, and to disable GPS tagging in their camera app settings as a precaution.
0
ProgrammingDEV Community ·
JSON vs YAML: How to Choose the Right Format for Your Use Case
JSON and YAML can represent identical data structures, but the best choice depends on whether the file is read primarily by machines or by humans. JSON's strict, minimal syntax makes it ideal for APIs, data exchange, and machine-generated files, as every major programming language includes a fast built-in parser. YAML's readable, comment-supporting format suits configuration files that developers maintain regularly, such as Kubernetes manifests, Docker Compose files, and GitHub Actions workflows. However, YAML carries notable pitfalls: indentation errors can silently alter document meaning, and older parsers may misread unquoted values like 'no' or 'off' as booleans — the so-called 'Norway problem'. A practical rule of thumb is to use JSON when software communicates with software, and YAML when humans are the primary authors and editors of the file.
0
ProgrammingDEV Community ·
How to Properly Back Up a Self-Hosted Spliit Instance Using PostgreSQL and S3
Self-hosting the expense-splitting app Spliit requires backing up three distinct components: a compressed PostgreSQL database dump, a copy of the S3 or MinIO bucket storing receipt images, and the environment file holding credentials and configuration. The PostgreSQL database contains all groups, expenses, participants, and splits, making it the most critical backup element, while receipt image blobs stored in S3 cannot be recreated from memory. A lesser-known data loss risk is the browser's local storage, which holds group link indexes and is entirely separate from the database. Backup needs vary by use case — casual users may need only nightly database dumps, while heavy users scanning receipts should prioritize bucket backups with dated retention windows. Experts recommend logical pg_dump over Docker volume snapshots for portability across version upgrades, and stress that any backup plan must include a rehearsed restore procedure to be considered reliable.
0
ProgrammingDEV Community ·
Playwright's Built-In API Testing Tool Eliminates Need for Separate Frameworks
Playwright, primarily known as a browser automation framework, includes a built-in HTTP client called APIRequestContext that allows teams to run API tests without a separate testing tool. It supports standard HTTP methods, authentication, header configuration, and response assertions, all within the same test suite used for end-to-end browser testing. Teams benefit from shared authentication state, a unified test runner, and consistent debugging workflows through Playwright's HTML report and Trace Viewer. Setup requires installing Playwright via npm, configuring a base URL, and using the built-in request fixture — no additional libraries needed. This makes Playwright a practical all-in-one option for teams looking to consolidate their UI and API testing into a single CI pipeline.
0
ProgrammingDEV Community ·
Cloudways to Retire Legacy API Keys by October 2026, Urges Token Migration
Cloudways is phasing out its legacy API Key authentication in favour of API Access Tokens, with an end-of-life date set for October 15, 2026. Existing integrations can continue using API Keys during the transition period, but Cloudways recommends migrating to Access Tokens before the retirement deadline. Access Tokens offer improvements over the old system, including per-integration tokens, configurable permissions, expiration periods, and independent revocation. For teams using GitHub Actions to deploy Laravel applications on Cloudways, the migration involves replacing the email-and-API-key credential pair with a Bearer token passed directly to the Cloudways REST API. The core deployment architecture remains largely unchanged, with only the authentication method needing to be updated.
0
ProgrammingDEV Community ·
Go Pipeline Hits 4x Speedup Using Lock-Free and Cache-Line Optimization Techniques
A software engineering walkthrough published on DEV Community demonstrates how replacing a mutex-based Go pipeline with lock-free alternatives can dramatically improve throughput. The naive implementation, using a shared mutex queue, channel semaphore, and buffered file I/O, processed around 821,000 events per second on an 8-core machine. An optimized version employing sharded SPSC ring buffers, a Chase-Lev work-stealing deque, cache-line-padded atomic semaphores, and mmap zero-copy storage raised throughput to roughly 3.3 million events per second — a 4x improvement. A focused micro-benchmark further showed that simply padding struct fields to separate cache lines reduced execution time from 543ms to 157ms, a 3.46x gain from a single layout change. The author notes that all six techniques covered — cache-line padding, atomic semaphores, sharding, ring buffers, work stealing, and zero-copy I/O — apply equally to C++, Rust, Java, and other performance-critical environments.
0
ProgrammingDEV Community ·
How to Set Up H2 In-Memory Database in a Spring Boot CRUD App
A developer building a Spring Boot CRUD application switched from using a linked list to a database to enable persistent data storage. They chose the H2 in-memory database as a beginner-friendly option that requires no separate installation or configuration of heavier systems like MySQL or PostgreSQL. The setup involves configuring three key sections in the application.properties file: H2 database connection details, JPA settings, and the H2 web console. JPA, or Jakarta Persistence API, allows developers to interact with the database using Java code instead of writing raw SQL queries. The guide also notes that the Spring Data JPA dependency must be added to the project's pom.xml file for the integration to work.
0
ProgrammingDEV Community ·
AI Sysadmin Traces Four Days of Web Timeouts to Failing Switch Ports
Pulsed Media's autonomous AI sysadmin, Väinämöinen, spent four days diagnosing intermittent blog timeouts that initially pointed to software issues like PHP, Apache, and DNS. A structured ping sweep with varying packet sizes revealed frame-size-dependent packet loss, a key indicator of physical-layer bit errors rather than software or configuration faults. SNMP counter deltas on the network switch confirmed that a specific port was accumulating tens of thousands of input errors every five minutes. The culprit turned out to be an ageing Dell Force10 S60 access switch silently degrading its copper ports in groups. Moving the server's cable to a different switch port resolved the issue, and the post outlines repeatable diagnostic commands others can use to catch similar failures quickly.
0
ProgrammingHacker News ·
Rat discovered in Alberta, ending its decades-long status as rodent-free
Alberta, Canada, long celebrated as the world's only rat-free region, has had that distinction broken following the discovery of a rat. The find was reported on September 25, 2026, marking a significant moment in the province's history. Alberta has maintained aggressive rat-control programs since the 1950s to keep the province free of the rodents. The discovery raises questions about the future of those control efforts and whether the province can restore its unique pest-free status.
0
ProgrammingDEV Community ·
Why owning your digital presence matters more than renting reach
During busy periods like launch weeks, companies often neglect maintaining accurate information on their own digital accounts, which can cost them business when potential partners search and find nothing useful. A common workaround is purchasing one-off placements on third-party channels, but these offer only short-term visibility and cannot be edited later by the company. A more sustainable approach involves maintaining a consistent series of clear, updated notes on accounts the company itself controls. The key distinction is that owned assets remain editable and accessible long-term, unlike rented placements that fade once the campaign ends. Experts caution that visibility should not be confused with virality — the realistic goal is simply ensuring accurate, findable information exists when someone searches for the company.
0
ProgrammingDEV Community ·
Student from Lahore Gets 15 Bug Fixes Merged Into Google, Microsoft, Apache Projects
A developer based in Lahore has had 15 code contributions merged into major open-source projects, including those maintained by Google, Microsoft, Apache, the OpenJS Foundation, and Red Hat — repositories collectively holding over 890,000 GitHub stars. Among the most critical fixes was a silent data-loss bug in Microsoft's Entity Framework Core, where a database reported a successful write even though the data had been rolled back with no error or warning. Another fix addressed Apache Maven's concurrent build system, which could print a green 'BUILD SUCCESS' message even when a build step had silently failed and produced nothing. A Google Gson bug caused subclass fields to vanish from serialized data without any error, returning empty objects instead of the original content. The developer notes that the most dangerous bugs are those that report success while failing quietly, and that patiently questioning every success signal has proven more effective than any complex debugging technique.
0
ProgrammingDEV Community ·
Developer Releases Eger v0.1, an Open-Source Experimental Language Engine for Windows
A developer has launched Eger v0.1, an experimental open-source programming language engine built from scratch using Python and llvmlite, with LLVM handling low-level code generation. The project features a Python-inspired syntax and was developed with assistance from Google's Gemini AI. The release includes a standalone Windows installer, interactive REPL support, and automatic system PATH configuration for easy terminal access. During development, the creator encountered a packaging issue where bundling llvmlite into a single executable triggered Windows security errors, which was resolved by switching to a directory-based installer built with Inno Setup. Eger v0.1 is currently available for Windows 10 and 11 (64-bit) users, and the developer is actively seeking community feedback on syntax design and installation experience.
0
ProgrammingDEV Community ·
How Emmet in VS Code Helps Developers Write HTML and CSS Faster
Emmet is a shorthand toolkit built directly into Visual Studio Code that expands brief abbreviations into complete HTML and CSS code with a single keystroke, requiring no additional extensions. Developers can use shortcuts such as '!' to generate a full HTML boilerplate, or operators like '>' and '*' to create nested and repeated elements instantly. The tool also supports CSS shorthand, where abbreviations like 'df' expand to 'display: flex' and 'bgc' to 'background-color', speeding up stylesheet authoring. Emmet is available by default in VS Code and works across both HTML and CSS file types. Full documentation for additional shortcuts is available at docs.emmet.io.