> Markdown version of [/magazine/486-dev-digest-138-are-you-secure-about-this](https://www.wearedevelopers.com/magazine/486-dev-digest-138-are-you-secure-about-this). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md).

---

# Dev Digest 138 - Are you secure about this?

**By:** [Chris Heilmann](https://www.wearedevelopers.com/@chris-heilmann)

**Published:** October 21, 2024

Hello there! This is the 2nd "out of the can" edition of 3 as I am on vacation in Greece eating lovely things on the beach. So, fewer news, but lots of great resources. Many around the topic of security. Enjoy!

## News and Articles

**Google Pixel** phones take a [proactive approach to security](https://security.googleblog.com/2024/10/pixel-proactive-security-cellular-modems.html) whilst [the ad tracking of Firefox causes controversy](https://blog.zgp.org/why-turn-off-firefox-ad-tracking/). **Sir Tim Berners-Lee** [closes the World Wide Web foundation](https://www.theregister.com/2024/09/30/world_wide_web_foundation_closes/) to concentrate fully on **Solid**. The [Switch Emulator Ryujinx shuts down](https://arstechnica.com/gaming/2024/10/switch-emulator-ryujinx-shuts-down-development-after-contact-by-nintendo/) after being contacted by **Nintendo**. You can [learn to reason with LLMs](https://openai.com/index/learning-to-reason-with-llms/), [LLMS and search engines can co-exist](https://www.livemint.com/technology/llm-chatbots-chatgpt-seo-ai-search-engines-google-search-prabhakar-raghavan-ads-genai-slms-11725770982208.html) and you don't need AI to scrape the web but you can [use only your web brower](https://8chananon.github.io/tut/scraping1.html). The [sparkles icon has become synonymous with AI](https://css-tricks.com/the-proliferation-and-problem-of-the-sparkles-icon/) and that is becoming a problem. You can follow some great [Offline UX patterns](https://github.com/Expensify/App/blob/main/contributingGuides/OFFLINE_UX.md) to deliver resilient apps and there is a splendid reminder that the [goal is not to write less code](https://gomakethings.com/the-goal-isnt-to-write-less-code/).

Let's talk about some security topics. Some weeks ago **Kia** had a [security issue that allowed for remote control of cars](https://samcurry.net/hacking-kia) using a license plate and **Charlie Gerard** shows how you can [hack cars with JavaScript](https://charliegerard.dev/blog/replay-attacks-javascript-hackrf/). **Snyk** has great info on how to [prevent log injection vulnerabilities](https://charliegerard.dev/blog/replay-attacks-javascript-hackrf/). Someone spent $20 to achieve RCE and [accidently became the admin of the .MOBI domain](https://labs.watchtowr.com/we-spent-20-to-achieve-rce-and-accidentally-became-the-admins-of-mobi/). Sextortion scams telling people they have been filmed doing naughty things now also [include photos of their home](https://krebsonsecurity.com/2024/09/sextortion-scams-now-include-photos-of-your-home/) extracted from their IP location. There was a year long campaign of [malicious NPM packages](https://checkmarx.com/blog/year-long-campaign-of-malicious-npm-packages-targeting-roblox-users/) targeting **Roblox** users. Police officers are [using AI to write crime reports](https://apnews.com/article/ai-writes-police-reports-axon-body-cameras-chatgpt-a24d1502b53faae4be0dac069243f418) and [delivery robots offer promo codes](https://www.404media.co/delivery-robot-knocked-over-pedestrian-company-offered-promo-codes-to-apologize/) after running over pedestrians. **Frederik Braun** has a [prompt injection demo](https://frederikbraun.de/prompt-injections-and-a-demo.html) and there is a "complete guide" to [hacking misconfigured S3 buckets](https://blog.intigriti.com/hacking-tools/hacking-misconfigured-aws-s3-buckets-a-complete-guide). Passwords have a lot of problems, but [passkeys have more](https://world.hey.com/dhh/passwords-have-problems-but-passkeys-have-more-95285df9) and you can [secure your Node.js apps](https://www.nodejs-security.com/blog/securing-your-nodejs-apps-by-analyzing-real-world-command-injection-examples) by analysing real world command injection examples.

## Code and Tools

Structured Fields is a new RFC and there is already a [JavaScript package](https://evertpot.com/structured-fields-javascript-v2/) to work with them. **Bramus** has some insights on [benchmarking the performance of CSS @property](https://web.dev/blog/at-property-performance?hl=en), there are lots of [new things in Svelte in October](https://svelte.dev/blog/whats-new-in-svelte-october-2024) and [OneJS brings JavaScript to Unity](https://onejs.com/) without the need of a browser or web view. You can learn more in [this video](https://www.youtube.com/watch?v=dnoq9EV_YT4). If you like to do things the hard way, here are some [recipes for writing SVG by hand](https://www.smashingmagazine.com/2024/09/svg-coding-examples-recipes-writing-vectors-by-hand/) and instructions how to [submit an Electron App to the Mac App store](https://www.dolthub.com/blog/2024-10-02-how-to-submit-an-electron-app-to-mac-app-store/). C++ is having a comeback with the [Safe C++ blueprint](https://www.theregister.com/2024/09/16/safe_c_plusplus/), there are some [nifty CSS properties for trimming whitespace](https://css-tricks.com/two-css-properties-for-trimming-text-box-whitespace/) and a painful write-up on the [hardest bug investigation](https://www.reddit.com/r/ExperiencedDevs/comments/1fu0e5q/the_hardest_bug_investigation_of_my_career_and/) and the bonkers code that caused it.

**Some tools for you:**

- [Make music using the free-to-use audio and video](https://citizen-dj.labs.loc.gov/)
- [Confectionary](https://confectioneryapp.com/) - a minimalist browser
- [Ente](https://ente.io/) - is a Google Photo alternative
- [Mitata](https://github.com/evanwashere/mitata) - JS/C++ benchmark tooling on the CLI with ASCII charts
- [Syncthing](https://github.com/syncthing/syncthing) - continuous file synchronization
- [Automated and continuous pentesting for Conversational AI](https://splx.ai/)

## Cool code demos

[
 ![ball on plane](https://wearedevelopers.imgix.net/public/magazine/articles/486/images/670407350c059d5c02cda440_ball.gif)
](https://dev.shoya-kajita.com/061/)

[
 ![Typography Cube](https://wearedevelopers.imgix.net/public/magazine/articles/486/images/6704073667f6253fcad3ae5b_cube.gif)
](https://radicalsoftware.xyz/labs/en/typography-cube/)

## Talks and Videos

![Fireside Chat with Eric Demuth, CEO of Bitpanda](https://wearedevelopers.imgix.net/public/magazine/articles/486/images/67040735a106c200fae333c0_Demuth-Butcher.png?w=720&fit=max&dpr=2&auto=format)

[Check out](/videos/981-fireside-chat-with-eric-demuth-ceo-of-bitpanda) an interesting Fireside Chat with Eric Demuth, CEO of Bitpanda on the past, present and future of the digital currencies and trading space.

**Other videos and talk write-ups of note:**

- **Francesco Ciulla** - [Rust and Docker: Let's build an AI-powered app! (26m)](/videos/984-rust-and-docker-let-s-build-an-ai-powered-app)
- **Eli Holderness** - [A Brief History of Data Storage (27m)](/videos/974-a-brief-history-of-data-storage)
- **Panel** - [The Impact of Technology on Democracy (31m)](/videos/1108-the-impact-of-technology-on-democracy)

## Learn New Skills

![__wf_reserved_inherit](https://wearedevelopers.imgix.net/public/magazine/articles/486/images/6715ef7c8bfd8ebb0240da4f_6715ee511780db956c61c96b_gen-ai.png?w=720&fit=max&dpr=2&auto=format)

_Learn gen AI skills you actually need with Google Cloud_

**Get hands-on with generative AI learning:** [Dive into new gen AI learning paths from Google Cloud](https://cloud.google.com/blog/topics/training-certifications/four-new-gen-ai-learning-paths-on-offer?utm_campaign=FY24-Q4-cloud-genai-learning-launch&utm_content=cloud-blog-emea-we-are-developers&utm_term=-&utm_source=hs_email&utm_medium=email&_hsenc=p2ANqtz-8_irU4sGxIcbnTh-dZyUDhFZbHFW3wg4DtNF-3ROLndCpmOKehnY62manUa7QbcmmUEPTz). Learn how to build and modernise gen AI applications, bring gen AI into your data workflow, manage and deploy gen AI models, and generate smarter gen AI outputs.

# Work and Jobs

Return to office is still a discussion point and **Microsoft** told folks they can [work from home unless productivity drops](https://www.techspot.com/news/104972-microsoft-assures-employees-they-can-continue-working-home.html). Question now is that even if that happens, how could you pin it on home office alone? Open Source is still debated, with some calling it [not a business model](https://cra.mr/open-source-is-not-a-business-model/) and others pointing out that it [needs to financially symbiotic](https://www.zachleat.com/web/symbiotic-open-source/). It seems that [fewer people build in public](https://laike9m.com/blog/no-one-builds-in-public,160/), but if you are then there is a great [Open Source Project Maintainer's guide](https://liamwhite.dev/posts/0035-hostile-source-environment/).

## Events

![__wf_reserved_inherit](https://wearedevelopers.imgix.net/public/magazine/articles/486/images/6715ef7c8bfd8ebb0240da43_6715ef24b37a32f88f4c296a_call-for-speakers.png?w=720&fit=max&dpr=2&auto=format)

_Call for Speakers for World Congress 2025_

As we gear up for the [WeAreDevelopers World Congress 2025](https://worldcongress.dev/?utm_content=5&utm_campaign=WWC25&utm_source=hs_email&utm_medium=email&_hsenc=p2ANqtz-8_irU4sGxIcbnTh-dZyUDhFZbHFW3wg4DtNF-3ROLndCpmOKehnY62manUa7QbcmmUEPTz), we're thrilled to announce that our official **Call for Speakers is open!**  
Whether you want to share insights about programming, coding trends, emerging technologies, tools, or the challenges of tomorrow in software development, we want to hear from you! [Submit your talk now!](https://sessionize.com/wearedevelopers-world-congress-2025/?utm_source=hs_email&utm_medium=email&_hsenc=p2ANqtz-8_irU4sGxIcbnTh-dZyUDhFZbHFW3wg4DtNF-3ROLndCpmOKehnY62manUa7QbcmmUEPTz)

# Procrastination Corner / Wonderful Weird Web

- [Your name in Landsat](https://landsat.gsfc.nasa.gov/apps/YourNameInLandsat-main/)
- [Can you detect five star movie reviews?](https://www.monkeon.co.uk/reads-like-a-five/)
- [Markov chains are funnier than LLMs](https://emnudge.dev/blog/markov-chains-are-funny/)
- [Alien Romulus "Facehug yourself"](https://alien-facehugger.vercel.app/)



## Related Articles

- [Dev Digest 131 - AI'm not sure about OSS](https://www.wearedevelopers.com/magazine/472-dev-digest-131-ai-m-not-sure-about-oss)
- [Dev Digest 120 - Apple and peers](https://www.wearedevelopers.com/magazine/455-dev-digest-120-apple-and-peers)
- [Dev Digest 129 - Now that's what I call private data!](https://www.wearedevelopers.com/magazine/468-dev-digest-129-now-that-s-what-i-call-private-data)
- [WeAreDevelopers Dev Digest Issue 116 - The new search wars…](https://www.wearedevelopers.com/magazine/445-wearedevelopers-dev-digest-issue-116-the-new-search-wars)

## Related Videos

- [WeAreDevelopers LIVE - Dapr / Pixels and Generative Art / Open Source and Communities / and more](https://www.wearedevelopers.com/videos/1720-wearedevelopers-live-dapr-pixels-and-generative-art-open-source-and-communities-and-more)
- [WeAreDevelopers LIVE: Scammer Payback with Python, Grok Goes Unhinged, The Future of Chromium and mo](https://www.wearedevelopers.com/videos/1288-wearedevelopers-live-scammer-payback-with-python-grok-goes-unhinged-the-future-of-chromium-and-mo)
- [WeAreDevelopers Live: Browser Extensions, Honey Scam, Jailbreaking LLMs and more](https://www.wearedevelopers.com/videos/1286-wearedevelopers-live-browser-extensions-honey-scam-jailbreaking-llms-and-more)
- [New Browser APIs, End of React Create App, Smuggling Data in Emoji and more with Rowdy Rabouw](https://www.wearedevelopers.com/videos/1299-new-browser-apis-end-of-react-create-app-smuggling-data-in-emoji-and-more-with-rowdy-rabouw)

## Related Jobs

- [Staff Developer Advocate, GitHub Security Lab](https://www.wearedevelopers.com/jobs/ext/1921051-staff-developer-advocate-github-security-lab) at **GitHub**
- [Senior Software Engineer](https://www.wearedevelopers.com/jobs/ext/15942-senior-software-engineer) at **GitHub**
- [Remote Senior Full-Stack Engineer](https://www.wearedevelopers.com/jobs/ext/679408-remote-senior-full-stack-engineer) at **Edge Impulse**
- [AI Software Engineer (Germany)](https://www.wearedevelopers.com/jobs/48317-ai-software-engineer-germany) at **Sunhat**
- [Remote Senior Full-Stack Engineer](https://www.wearedevelopers.com/jobs/ext/643147-remote-senior-full-stack-engineer) at **Edge Impulse**
- [Remote Senior Full-Stack Engineer](https://www.wearedevelopers.com/jobs/ext/683045-remote-senior-full-stack-engineer) at **Edge Impulse**