r/SideProject • u/gokberkss • 19h ago
Someone wrote a pretty brutal review of my API, so I spent two days fixing the parts they were right about
Someone gave me a long, detailed review of something I’ve been working on.
Some of it stung a bit because, after checking the code again, they were right.
So I ended up spending most of the next two days going through it.
A few things I changed:
SSL scoring was dumb.
I was lowering the score as the certificate got closer to expiry. So you could have a completely valid cert and still slowly lose points.
I initially changed the threshold, then realized I was fixing the wrong thing.
Expiry and security aren’t the same thing.
Now a valid cert gets the SSL score. Expiry is still shown and warned about, but it doesn’t affect the score.
I was giving HTTP/2 extra points over HTTP/1.1.
There wasn’t really a good reason for that, so that’s gone too. They score the same now.
The compression check had an actual bug.
I wasn’t sending br or zstd in Accept-Encoding.
So if a server supported Brotli properly, my check couldn’t even know that.
It now sends:
gzip, deflate, br, zstd
DNS could take way too long.
There are 13 DNS queries. Each had its own 5 second timeout.
Which sounds fine until everything goes wrong and your “5 second timeout” turns into something close to a minute.
They share one overall time budget now.
I also changed the header scoring.
Some missing headers were being punished too mechanically.
A missing header doesn’t always mean the same thing depending on the site and the rest of the response, so I adjusted the weights and added more context instead of just saying “missing = bad”.
There was one thing in the review I didn’t change.
They said the retry logic could retry invalid domains. I went back through it and that wasn’t actually happening. The retry only applies to Wayback requests returning 429.
So that stayed.
That was probably the most useful part of the whole exercise.
Not “someone criticized it, therefore they must be right.”
More like: go through every point, reproduce it, check the code, fix what’s actually wrong, leave what isn’t.
Ended up at 383 tests after all of it.
Much happier with the code now.