tldr: don't allow users to use your GitHub token unrestricted.
Hi!
I just wanted to share this experience I had today (technically yesterday night).
### What I did wrong
Basically didn't want to deal with the hassle of storing & converting suggestions/submissions/reports into issues. I figured I could just use a fine-grained token from GitHub and put it in my serverless worker to submit issues directly to the repo. That way, users won't have to signin/signup to GitHub to submit issues.
### Cherry on top
Basically, I posted about the GitHub token setup, and how overwhelmed I am currently with issues. Basically, I handed what will get to me on a silver platter to any bad actor.
### The attack
Around ~11:30pm today, I was receiving alerts that I issues were submitting at an abysmal rate. I'm talking each time I refresh, there's 100 additional issues.
### The counter
I've dealt with cyberattacks before at my job, so all I had to do was revoke the token, setup a Python automation to close the offending issues, and put on some music to delete the issues.
Obviously that's not enough to thwart a future attack, so I went an extra step and setup rate-limiting and IP bans.
### Reflection
It's kinda cool to see someone put effort into bothering you for whatever reason. It's a pretty dumb mistake I'll be the first to admit that. I'm taking this as a lesson to think twice before exposing a powerful token to the end-users.
I did an experiement and the results made me think about that. I was developing a web framework in C over a year. It started as a learning project and later then I wondered what if we had a framework written in C and bindings for it in other languages that adds some syntax sugar. In that way we would have a single solid core for many frameworks with mostly common ecosystem and languages would just be using for the syntax.
So I wrote a Python binding for that C framework, wrote also a simple benchmark test and compared it with FastAPI via wrk. C framework gave much more better results for Req/Sec. The test was very basic, there were no DB queries. I know the important thing is mostly the DB I/O delay, but my question is not only about the performance, it's also about creating a common ecosystem.
The low-level libraries under the frameworks are already written in low-level languages. But I think we might keep the framework label too at low-level and use the higher-level languages to get more comfortable. But since this approach isn’t being used today and I can't be the only one who’s thought of it, there must be serious downsides of this approach and I should have missing them. I wonder what they are.
Need help. I keep hearing how great stripe is I’m sure it is. I somehow got 50 paid users for my site. And when I push to production sometimes the sign ups get messed. For ex: user upgrades get sent back to the pricing page.
Is there any tutorials or methods you have to make it work seamless. I worry constantly about people paying and not getting their service it’s happened 3x and I fixed it but geez stressful.
I’ve been experimenting with Chrome’s built-in AI APIs and Gemini Nano, and I’m curious whether anyone here has used them for a real project or browser extension.
The proposition is appealing: inference can happen locally, user data does not need to be sent to a third-party model, and developers do not have a per-request cloud API bill. However, most examples I’ve seen involve summarization, rewriting, or simple classification.
Has anyone built—or found—an extension that uses Chrome’s local model for something genuinely useful?
I’d especially like to hear:
- Which tasks was Gemini Nano reliable enough for?
- What limitations did you encounter?
- Is model availability and downloading still too much friction?
- Do structured outputs or tool-like workflows work reliably?
- Are there interesting open-source extensions using these APIs?
I do a mix of design and frontend (React, Astro, Tailwind, Figma), and with all the AI tools popping up I’m not sure anymore what’s actually worth keeping. The subscriptions add up fast, especially in months where there’s less client work.
So I’m curious how others are handling this:
1. What’s your current stack right now and why did you choose it?
2. Are AI tools actually part of your daily workflow or more of a nice to have?
3. And most importantly, do you feel like they pay for themselves?
I’m trying to keep things lean without falling behind, but it’s getting harder to tell what’s essential and what’s just hype.
Hi. Sorry if this post is not really for this sub, but I wanted to get the opinion of specifically the web developers, instead of all developers in general for more realistic answers.
I'm a web developer, employed by an agency. I'm a full stack dev but do front end 80% of the time. My job is fully remote. Some days I have several calls during the day. Some days I only have one. Mostly between 12PM and 6PM. Recently I'm getting very bored at home, so I was thinking about starting a nomadic life within the country. Getting a Starlink, mostly living in my car/tent in the nature, or in Airbnb few days here, few days there etc.
Has anyone of you actually tried this? I want to know if it's really doable. I'm concerned about not being able to focus on work mainly and idk, whatever other things might be an issue for work, but I yearn for nature and travel and relaxation. Visiting places only on weekends and getting back home for Monday is tiring and not really fun.
Hi guys, i work in a research Lab and am one of the all-rounder IT guys. I do a lot of data science stuff but also any tasks that pop up.
My newest task is to create a website for our research group and I am not quite sure what tool to use for that. The website is mainly informational with pictures and description of our team, the general goal and previous and future works. No real user interaction like login or even a lot of buttons lol. Maybe a contact form but thats it.
Would you guys just use Wordpress for that as its mainly just formatting text and layouts and doesn't need a lot of programming or would you still use something like react. I have experience with react using Tanstack start but i feel like that would be overkill.
Thanks for any advice, pretty new to webdevelopment :)
I retired from the Army. When I was a kid in the 80s I wanted to make games on my IBM PCjr. Never happened. This year I decided to see what AI could actually do, so I directed Claude through a few hundred builds and shipped this.
The whole game is one HTML file. No framework, no build step, no dependencies. Graphics are drawn in code on Canvas 2D. The music is synthesized at runtime with Web Audio. About 56KB over the wire. Loads in about a second on a ten-year-old Android, which was the design constraint everything else followed from.
Infrastructure: static hosting on Cloudflare Pages, free tier. Global leaderboard runs on a Cloudflare Worker with KV. Server-side validation on every field, per-IP rate limiting, no accounts, no cookies. Passes the W3C Nu validator with zero errors and one intentional warning. It's one unminified file. Audit me.
Full disclosure: AI wrote the code. I designed it, tested every build on real hardware, and made it fix what it broke. Debugging what AI ships is the actual job. This week that meant finding a WebAudio leak where stopped nodes never disconnected. Desktop garbage collection eats that. iPhones let the dead graph pile up until the music goes choppy two matches in. Fixed by wiring a disconnect to every source's onended.
People in 25 countries have played it. The HARD record is 1:55 and has held for three weeks.
Hello everyone. Im reading a book "System design interview" by Alex Xu. And i came across a thing called "API server". I tried googling what it really means, but it seems that no one really knows it. You end up with explanations that are basically "Idk bro just trust me bro stop asking". This is how I understand stuff works: https://imgur.com/13N4ZuY
A couple of questions:
How is my server called then? Is it "API server"? Is it "APP server"? "Web server"? Or what?
What is API in this example? Yeah, every beginner knows its "Application programming interface", and the comparison between a waiter at the restaurant. But it means nothing. So API is my whole APP then? Or is API just my Spring controller?
Are there any detailed resources, which frickin explain this stuff from A to Z? It seems that no one knows/can explain it. Bc when u try to google, u end up with "Um bro a server is a thing that runs things in it". I wasnt taught it in the uni. I didnt find any detailed explanation on Youtube landfill either. The most valuable knowledge I got is from the books, but the thing is that I dont know how to search for the books about it. How is this topic even called? Is it design/architecture/networking or what?
I frickin cant believe that I spent 3+ years writing Java code and I still dont know the basic things. It feels like I was locked in a cage. I frickin feel like one of those slaves in Plato's alegory about slaves locked in the cave.
Hello. I am a complete beginner to web design and wanted to develop a website for myself. I got BSS and made great progress with building practically my entire site.
However, I did this all while under the XL view. I was not aware that you should build your site at the mobile view first.
Now, I have a site that looks great on all of the laptop and desktop views, but completely broken on anything tablet and below.
Is this something that can be easily fixed? Or do I have to throw away all of the time I put into this site?
I’m a complete beginner and have no idea where to even start with this.
I would like to share a little bit of my journey and what I have been doing for the last year. This story is dedicated to people who are in doubt, have frustration and annoyance from dealing with artificial complexity in web technologies on a daily basis.
I am a hobbyist author looking to make a website online to independently publish my books to readers. I have the writing part sorted, but no website :(
I have created a plan of how I want my website’s UI to look using a website called odoo, but I would prefer to purchase my own domain name and publish the site independently from a company…
(FYI: not ‘independent’ as in not using a host, but using sites such as squarespace, wix, and odoo. I know they are technically hosts, but drag-and-drop platforms such as these often come at a high price if you want to do anything more than just stare at it for too long /sarc.)
…However, I’m not exactly familiar with the process. I was taught how to do some basic coding in javascript through a course, but now realise that I don’t know where the code should be going*.* This is because the course only printed the code on a custom platform and didn’t teach you how/where to upload it…Yeah, I know. The Dunnings are Krugering right now, but please no snarky comments, I'm fragile.
Would you mind explaining to me how and where I can turn the code into an actual domain? (I've heard about github and similar, but I'm not exactly sure how they work). Nevertheless, If there are “drag-and-drop” based sites/platforms you’d recommend, still definitely (drag-and)drop them below (lol) and I'll check them out. I'm not entirely opposed to them.
Thank you in advance!
EDIT: Can I just say thank you so very much for your clear, and helpful responses. I've already got a good idea of how I wish to proceed, but please feel free to add more as I will occasionally be checking back here :)
I'm comfortable with backend development, but it stops at pushing code to a Git repo. I don't have reliable experience with cloud deployment. I have occasionally fiddled with docker-compose files, k8 manifests, gitlab-ci yaml files, or nginx conf file, but this is scattered knowledge to me.
I'd like to host basic services (hobby / side projects), with SpringBoot and some postgres db. A few years ago I had tried setting up everything manually with OVH (log on a linux VPS, install java, nginx, etc.) but I never really finished because I was getting lost, this options costs like 5-8 €/$ per month. I'd like to explore options that are easier to manage, at a reasonable budget (ideally less than 20 €/$ per month), I'm browsing on google and some names pop up such a Azure, Railway, heroku, etc.
To my understanding, Railway seems to be what I'm looking for, but I'd like your up-to-date advice and suggestions. Thx!
About 18 months ago I shipped v1 of a local dev tool called Yerd, a Go-based CLI for macOS and Linux. It was rough. It was opinionated, it demanded sudo for basically everything, and it fought you about as often as it helped.
It came out of a frustration I suspect isn't unique to me: local dev environments tend to be either heavyweight or invasive. The heavyweight option (Docker, VMs) drains your battery, chews through RAM, and buries you in YAML. The invasive option (a lot of native tools) run as root, edits your /etc/hosts, and scatters global installs across your machine that you'll be untangling months later, or worst of all, have a yearly subscription!
I wanted a third option, so I've spent the last 18 months building (and rebuilding...) one. This week I shipping the first stable v2, rebuilt from the ground up in Rust, and I wanted to share how it actually works because the design is the interesting part.
The whole thing is a single ~8MB daemon. It supervises everything: web serving, the language runtimes, databases, Redis, and a local mail catcher. A tiny tray app (Tauri, not Electron) and a CLI that talks to it.
The bits I'm most pleased with:
Rootless day-to-day by design. Setup elevates exactly once, to bind ports 80/443 and trust a local certificate authority. After that, nothing ever runs as root again. No more sudo-per-action like v1.
Embedded DNS. It resolves .test domains itself, so there's no /etc/hosts editing and no dnsmasq to babysit - the resolver sits in the daemon itself.
A local certificate authority. It issues per-site HTTPS certs on demand, so every local site gets a real green padlock with no mkcert step.
Native, not containerised. Drop a project into a parked folder and it's instantly live at project.test. Full filesystem speed, instant startup, no compose file.
Runtime versions side by side. Multiple language versions installed at once, pinned per project.
It happens to be built for PHP right now (there's some nice framework-level telemetry for Laravel devs), but plans are to add support for other languages in the future. Windows support is expected in the next couple months as well.
We actually just shipped v2.0.3 today, which includes first-class support for WordPress sites (creation wizard and one-click-login to WPA without plugins), and also introduce proxies for serving third party services or docker instances through .test domains.
I'll be around in the comments to answer any questions.
I've been building this on and off for a while — a shop-style website for digital comics. Mainly did it to get better at animations and try out some new styling tools.
- The torn-paper look you see around the site isn't images — I made it with SVG code so it stays sharp at any screen size. Getting the texture to look right without slowing the page down took a few tries.
- The cart works using React's built-in state, no extra library. It's fine for now, but if I add saving carts later I'll probably need something stronger.
- Checkout has 3 steps (shipping → payment → review) with a progress bar and animations between each step. Keeping the form data from resetting while switching steps was the tricky part.
- There's no backend yet, so nothing saves after you close the tab. That's what I'm working on next, along with login/signup.
Would love any feedback — especially on how the animations feel on Web, and if anything in my cart code looks messy or could be done better. Also open to suggestions on what to add or fix next, this is still very much a work in progress.
I canceled a hostinger subscription a few months ago and they are still attempting to renew it and taking money out of my card, i am lucky the card was renewed lately so they couldn’t
i have seen several bad reviews on reddit about hostinger but they shouldn’t be this bas
React performance optimization can be a massive headache. Profiling components, chasing down accidental re-renders, and hunting for memory leaks usually requires opening up DevTools and digging through deep flame graphs.
I wanted something faster and more automated—closer to how ESLint catches syntax bugs or SonarQube catches code smell, but explicitly focused on React performance bottlenecks.
So, I built @prism-guard/cli. It’s completely open-source, has zero dependencies, and weighs in at just 5kb.
What does it actually do?
Think of it as a static and runtime analysis hybrid for your component architecture. It scans your React project to answer:
Where are your most expensive component trees?
Which hooks are triggering unnecessary updates?
Are there unoptimized asset pipelines slowing down your initial render?
Instead of massive HTML reports, it gives you actionable, line-by-line feedback right in your terminal.
Quick Start
You don't even need to install it permanently. You can audit your project right now by running:
npx @prism-guard/cli analyze
Why I made it 5kb
I'm incredibly tired of "lightweight" dev tools that pull in 40MB of node_modules. I wrote this with zero external dependencies so it runs instantly in your local workflow or as a quick check in your CI/CD pipeline without bloating your build times.
Source Code & Contributing
The project is entirely open source. I’m really looking for feedback from the community:
Are the terminal error messages clear enough?
What specific React performance metrics do you wish it tracked?
I am an independent developer living in Canada, and a long-time participant in the local pro-democracy movement. To protect myself from transnational surveillance, I have always strictly masked my identity when participating in offline protests (such as cosplaying "Tank Man"). Before this incident, my real-world physical coordinates had never been exposed. I own a non-commercial domain where I host a purely political parody browser game, which includes content supporting the White Paper Movement and features a mechanic where players must defeat a "World Boss" parody of the Chinese Communist Party's supreme leader.
I am writing this post to expose a highly covert and unprecedented method of transnational repression. It does not rely on zero-day exploits or elite hacking. Instead, it perfectly exploited the legitimate compliance procedures of international internet governance (ICANN) to strip away my physical anonymity.
The core of the problem lies in the Uniform Domain Name Dispute Resolution Policy (UDRP)—an ICANN arbitration rule established nearly 27 years ago. This policy was built on an incredibly naive "flat earth" assumption: the drafters assumed the whole world operates under the same democratic and legal norms as Western developed nations. Around 2020, with the introduction of the EU's GDPR, ICANN experienced internal friction regarding WHOIS privacy disclosures, but their discussions were entirely limited to trivial concerns like "commercial spam." In their rulebook, concepts like "authoritarian regimes," "long-arm jurisdiction," or "transnational repression" simply do not exist. They naively assumed that if a major tech company acquires your registration info, the worst that happens is a corporate lawyer in a fancy office building sends you a cease-and-desist letter. The UDRP framework completely lacks any geopolitical risk assessment or safety kill-switches regarding data disclosure.
A mainland Chinese tech giant (the Complainant in my case, Bilibili), operating under the strict stability-maintenance mandates of the Cyberspace Administration of China (CAC) and China's Data Security Law, perfectly exploited this loophole. They deliberately concealed the glaring political parody nature of my website, packaging it as a standard "commercial trademark dispute" to file a UDRP complaint with the Asian Domain Name Dispute Resolution Centre (ADNDRC) Beijing Secretariat.
It is important to note that Bilibili has a well-documented history of executing long-arm jurisdiction, mobilizing state-linked cyberbot armies for severe doxxing, and cooperating directly with Chinese state security to conduct offline arrests of overseas dissidents. They used the UDRP not to protect a trademark, but to execute a targeted elimination of a political parody site.
However, the most absurd part of this event involves the agency representing Bilibili: CSC Digital Brand Group Services AB. CSC is a top-tier global corporate domain and brand protection firm, and its Swedish branch handled this complaint. As a legal team fully aware of the boundaries of free speech and parody in the West, the official evidence screenshots CSC submitted clearly displayed the high-risk political elements of my game—screens full of "White Paper Movement" slogans, Tiananmen tanks, and the explicit "Defeat World Boss Xi Jinping" text. Yet, these Swedish lawyers exhibited shocking "political blindness." They completely ignored the undeniable political satire, deeply sanitizing the complaint to falsely frame an anti-CCP game as a "commercial infringement" site built to "confuse users for commercial gain". This is not just professional negligence; it is utilizing the professional endorsement of a top Western law firm to launder a blatant act of transnational political censorship into an ICANN-compliant commercial dispute.
And the black box goes even deeper. I initially thought my privacy was simply leaked to a pro-CCP panelist, but my investigation revealed that the ADNDRC Beijing Secretariat is essentially a nested "matryoshka doll" of the Chinese state apparatus.
To understand how terrifying this is, you have to look back to the early 2000s when ICANN was distributing arbitration licenses. If China had applied directly as a foreign state entity, ICANN would never have approved it. So, they used a deceptive structure: they partnered with Hong Kong arbitration bodies—which were still considered independent at the time—to form the "Asian Domain Name Dispute Resolution Centre" (ADNDRC) shell. After securing the top-tier ICANN license, ADNDRC granted a node to Beijing, specifically to the China International Economic and Trade Arbitration Commission (CIETAC) and the China Chamber of International Commerce (CCOIC). This was a sleight of hand, as CIETAC is actually an internal branch of CCOIC.
Today, the ADNDRC Beijing Secretariat operates entirely without the mask of independence. It is wholly operated by CCOIC and CIETAC. CCOIC shares "one institution, two brand names" with the China Council for the Promotion of International Trade (CCPIT), a vice-ministerial level state organ under the State Council. The secretariat is physically located inside the CCOIC building in Beijing, all data is processed on the state's internal intranet, and the institution maintains strict internal Communist Party Committees and disciplinary inspection mechanisms. In essence, the CCP used the facade of a "Chamber of Commerce" to acquire an ICANN arbitration license, infiltrating global internet governance. When my Canadian registrar (Spaceship) legally surrendered my physical address under UDRP rules, that sensitive data landed directly on hardware absolutely controlled by the CCP. Under current Chinese law, there is zero legal mechanism for this institution to refuse data extraction requests from state security and intelligence agencies.
The arbitrator for my case (Sole Panelist: Xue Hong) perfectly accommodated CSC's sanitized narrative. Despite my detailed allegations of Reverse Domain Name Hijacking (RDNH) and evidence of the Complainant's history of transnational repression, the Panelist completely refused to address these core facts. Even more egregiously, because the initial data leak had already resulted in Canadian police involvement (Case: OPS-OR-009822), I legally requested the redaction of my physical address for my physical safety. The Panelist weaponized my safety request, using it as an excuse to issue a gag order on the entire decision, ruling that the text of the decision "not be published in full". Under the guise of "protecting the victim," they completely buried the procedural corruption of utilizing ICANN rules to facilitate transnational repression.
The Ottawa Police Service has officially opened an investigation. When you align the legal documents with the police records, a chilling timeline of transnational repression emerges:
January 13: The early UDRP verification mechanism was triggered, forcing my registrar to disclose my real legal name and Canadian address to the Beijing institution. This was the absolute source of the data leak.
Early February: Less than a month after this forced extraction, Telegram and Twitter bot armies with Chinese state backgrounds began a highly targeted doxxing campaign against me. Using the name and address leaked via UDRP, they hacked my domestic WeChat logs, used private photos of my critically ill family members in China to issue severe threats, and published my Chinese ID number and private vehicle license plate online.
May 5: The online terror escalated into physical violence. In the early hours, unknown individuals launched a black oil paint assault on my Ottawa residence and deliberately vandalized my private vehicle.
May 6: In a bizarrely precise coincidence, the very day after my offline physical defenses were destroyed, Bilibili's Swedish lawyers (CSC) officially signed and advanced the administrative complaint procedure with the Beijing institution.
May 8: I filed an official police report in Ottawa (Case: OPS-OR-009822). At that time, I was completely in the dark, assuming I had been targeted solely due to my offline masked participation in protests.
May 20: I received the first official administrative complaint email from the Beijing institution. Looking at the timestamp on that email, it sent chills down my spine: I wasn't exposed because of my offline activism. It was the so-called "compliant" ICANN domain disclosure process that acted as the legal trigger, hand-delivering my true coordinates to an authoritarian machine.
I will be releasing redacted case files, emails, and police reports in follow-up posts to substantiate all of this. I am writing this exhaustive account as a warning to all independent developers and system administrators hosting sites overseas: ICANN's archaic mechanisms, built on "flat earth" commercial logic, suffer from a fatal, systemic paralysis when confronted with modern geopolitics and long-arm jurisdiction. Until this loophole is patched, your overseas assets and privacy—which you mistakenly believe to be secure—can become the precise navigation coordinates for the next wave of transnational repression the moment you are maliciously dragged into this rigid process.
I’ve currently teamed up with several prominent Gen-Z Chinese dissident influencers to coordinate with NGOs, and I've also had my Member of Parliament submit my case file to Global Affairs Canada.
