TLDR DEV 2025-11-21

Schedule a demo to learn more

BRUTE-FORCEABLE AIRLINE RESERVATION API LEFT MILLIONS OF PASSENGER RECORDS VULNERABLE

A security researcher discovered a vulnerability in Avelo Airline's reservation API that allowed unauthorized access to passenger data through a brute-force attack due to the lack of last name verification and rate limiting. By exploiting this flaw, an attacker could have potentially accessed millions of passenger records, including PII, government ID numbers, and partial payment data, within a few hours. The researcher responsibly disclosed the vulnerability to Avelo on October 15, who quickly responded and patched the issues by November 13.

OPTIMIZING RUBY PERFORMANCE: OBSERVATIONS FROM THOUSANDS OF REAL-WORLD SERVICES

Based on analysis of over 3,000 real-world Ruby services, Datadog found that Ruby applications spend 82% of their CPU time in library code, making careful library selection necessary for performance optimization. Upgrading from Ruby 2 to Ruby 3 (with YJIT enabled) reduces CPU usage, while some popular libraries like mysql2 can be replaced with more efficient alternatives like trilogy for performance gains.

CODE EXECUTION WITH MCP: BUILDING MORE EFFICIENT AI AGENTS

MCP allows AI agents to connect to external systems, but as agents scale to use hundreds or thousands of tools, loading all tool definitions upfront and passing intermediate results through the context window creates inefficiencies and increased costs. By using code execution environments where agents write code to interact with MCP servers as APIs rather than making direct tool calls, agents can load only needed tools on-demand, process data locally before returning results to the model, and reduce token usage by up to 98.7%.

WE ARE REPLACING OOP WITH SOMETHING WORSE

OOP is not disappearing but shifting into new domains like microservices and distributed systems. The core principle of OOP, information attenuation and separation of concerns, is now being applied at the process and network level. This shift replaces OOP with a more cumbersome and complex system characterized by microservices, Docker, and Kubernetes.

WHY TOP FIRMS PARADOXICALLY FIRE GOOD WORKERS

Elite firms often hire top talent, train them extensively, and then let many go after a few years. This "up-or-out" system isn't a flaw but a strategic way for firms to signal talent and boost profits by creating a reputation for excellence. By periodically churning employees, firms maintain a perceived higher quality, allowing them to underpay those who remain while benefiting from their association with the prestigious firm.

PropelAuth. Read it now

INTRODUCING NANO BANANA PRO

Google DeepMind has launched Nano Banana Pro (Gemini 3 Pro Image), a state-of-the-art image generation and editing model built on Gemini 3 Pro. This new model improves image creation through improved reasoning, world knowledge, and real-time information integration. Nano Banana Pro allows users to generate accurate visuals with legible text, maintain consistency across multiple elements in complex compositions, and apply studio-quality creative controls like adjusting lighting and focus.

CC SWITCH

CC-Switch is a cross-platform desktop application for managing and switching between Claude Code, Codex, and Gemini API configurations. It supports MCP integration, API speed testing, config import/export, and multiple languages.

AI SLOP SECURITY ENGINEERING: OKTA'S NEXTJS-0AUTH TROUBLES

Joshua Rogers reported a security vulnerability in Okta's auth0/nextjs-auth0 project and submitted a patch. However, the maintainer used AI to rebase the commit, resulting in incorrect attribution and the removal of Rogers' contribution history. The maintainer then used AI to apologize for the error and refused to correct the commit, despite Rogers' request.

READONLY CHARACTERS ARE A BIG DEAL

Read-only characters in text editors help create interactive applications. Emacs allows marking specific substrings as read-only, enabling bidirectional interaction where both the user and the editor can modify different parts of the text. This contrasts with VS Code, where the lack of this feature hurts the creation of similar interactive tools.

ANDROID AND IPHONE USERS CAN NOW SHARE FILES, STARTING WITH THE PIXEL 10 FAMILY.

Quick Share on Android will now work with AirDrop, making file sharing easier between Android (starting with the Pixel 10 family) and iPhone devices.

SIX THINGS I BET YOU DIDN'T KNOW YOU COULD DO WITH CHROME'S DEVTOOLS

Some lesser-known Chrome Devtools features include `console.time()` functions, DOM element change monitoring, and being able to attach listeners to any function with `monitor`.

PARETO PRINCIPLE: THE SIGNIFICANT 20%

20% of bugs often result in 80% of the total failures.

PRESERVING CODE THAT SHAPED GENERATIONS: ZORK I, II, AND III GO OPEN SOURCE

Microsoft, in collaboration with Team Xbox and Activision, is open-sourcing the code for Zork I, II, and III under the MIT License to preserve gaming history and provide a valuable resource for education and exploration.