Skip to content
360SOFTY
HomeInsights

Insights

Ideas for building
better software.

Engineering perspectives on architecture, product development, AI, and the everyday decisions behind useful software.

From the engineering desk

Browse practical articles or follow the latest technology updates.

Subscribe via RSS →

Curated links from external sources — not 360Softy original articles.

ExternalSoftware Engineering
DEV Community

Same tokens. Different DNA. Why a Texas notebook must not become a parlor.

Most agent "redesigns" are mood boards. Navy glass. A fake dashboard. The dates and proper nouns already in the file never make it onto the page. /reimagine-it is the opposite contract: extract this source's nouns, dates, and colors, then ship a real artifact (webpage, infographic poster, SVG, Three.js, simulation). Two sources with the same command tokens must not share layout chrome. If a redesign skill is allowed to keep a gold layout and swap nouns, clients get the same poster with different

agentsdesignsoftware
DEV CommunityRead original
ExternalSoftware Engineering
DEV Community

Running the AWS CLI Against Your Own Hardware

The AWS CLI is on almost every developer's machine. Once you've built habits around commands like aws ec2 describe-instances, aws s3 cp, and eksctl create cluster, the idea of switching to different tooling for on-prem or edge deployments is genuinely painful. Most engineers assume there's no alternative, but with Spinifex there is. The CLI keeps working, and you just change the endpoint. The AWS CLI, every AWS SDK, and any Terraform provider wrapping them assume connectivity to amazonaws.com. I

awsdevopsselfhosted
DEV CommunityRead original
ExternalSoftware Engineering
DEV Community

How we run five coding agents side by side in one window

I build NestMux, a desktop app that runs Claude Code, Codex, Gemini CLI, Copilot and OpenCode in a grid of real terminals, each with its own account and its own git worktree. This is how it works inside, including the parts that are heuristics wearing a confident UI and the parts that do not survive a restart. If you are building something similar, most of this transfers. If you are deciding whether to use it, this is the honest version of what it does. Thirty-five seconds of it running, so the

electronaidevtools
DEV CommunityRead original
ExternalSoftware Engineering
DEV Community

I pushed the badBANANA Threat Observatory public

This was one of those projects I had wanted to make for a long time, even before I had a very clear reason for it. Over the years, if you spend enough time around security, you keep seeing threat maps. A lot of them are visually impressive. They pull you in immediately. Lines moving across a globe, attacks firing in real time, counters climbing, everything looking active. But once I started learning more about how threat data actually works, I kept coming back to the same problem: a lot of those

securitycybersecurityopensource
DEV CommunityRead original
ExternalSoftware Engineering
DEV Community

Trusted AI Agent Transactions, Part 5: End-to-End Proof

Building and proving the complete request path The previous articles covered the identity model, PingFederate token exchange, SPIRE workload identity, and PingAuthorize policy. This final part connects them into one testable application path. The browser workbench signs the user in through PingFederate with OAuth 2.0 Authorization Code and PKCE. The application never collects the user's PingFederate password. After sign-in: the demo agent receives the user access token the agent obtains a JWT-

gopingidentitymcp
DEV CommunityRead original
ExternalSoftware Engineering
DEV Community

Trusted AI Agent Transactions, Part 4: PingAuthorize Policy Decisions

Making policy decisions with PingAuthorize Part 3 established the transaction context and immediate caller identity. Authorization still needs to answer a separate question: may this verified combination invoke this target and tool for this purpose? PingAuthorize is integrated as a remote policy decision point at the MCP gateway. It does not verify the transaction JWT or the mTLS connection. Those checks happen before policy evaluation. The gateway constructs a typed policy request from values

pingauthorizesecurityauthorization
DEV CommunityRead original
ExternalSoftware Engineering
DEV Community

Trusted AI Agent Transactions, Part 3: SPIRE Workload Identity

Binding a logical agent to a real workload with SPIRE Part 2 used a SPIRE JWT-SVID as the actor token in PingFederate token exchange. That proves more than a caller-supplied agent name, but it helps to understand exactly what it proves. A logical agent describes an approved application role. A SPIFFE ID identifies an attested running workload. They are related, but they are not interchangeable. AgentID: urn:agent:customer-support SPIFFEID: spiffe://example.org/agent/customer-support The firs

spiffespiresecurity
DEV CommunityRead original

Let’s start with a conversation

Tell us what you’re working on.

An idea, a challenge, or a system that needs to work better. We’ll help you understand the next step.

Discuss your project

Prefer email? [email protected]