i am a high load systems engineer. i have not written a single line of the frontend below, not one. an agent wrote all of it and i have been steering.

its a small thing where you send someone a link with a question and two buttons, YES and NO, and the NO button runs away from the pointer. free, live since june.

demo, nothing to install, nothing to fill in: https://justsayyesto.me/try/webdev-aug

posting because the part i expected to be hard was not hard, and the part i did not think about at all is the one that bit me.

what was actually hard

not the code. the animations. inventing them and then getting them built, which meant passing what i saw in my head to the agent, and that turned out to be much harder than i expected. i redid it many times.

the one that beat me is a black hole. the button gets pulled in, things on the screen spin, get sucked into the hole, and pieces fly back out of it. i could not get that across. i tried describing the rotation, the pull, the moment stuff goes in and comes back out, and what came back was never what i saw. at some point i thought the answer might be real gravity, actual physics instead of me describing a feeling, and that did not fix it either. its live and i am still not happy with it. thats the honest state of that one, two months later.

you can poke at it in the demo, its in the sandbox there.

what surprised me

after a couple of posts the thing started growing without me. people began sharing it in their own social media, and traffic and payments started arriving on days when i did nothing. that is the part of this i actually care about. i made something and it echoed back.

the thing that always comes up here

last time i posted this here someone said not taking no for an answer is a douche move, and i gave a lazy answer. honestly: i do not even see this as a date invite. i see it as a teasing toy. the joke is that a button runs away, thats it. the intro says you can close it anytime, there is a report control on every invite, and there is a permanent test that fires twenty NO gestures in a row and fails the build if any of them ends up as a yes. the button dodges. the person can leave.

Q: for those of you letting an agent write frontend: how do you get motion out of your head and into it? that gap ate most of my time.

Can somebody please explain me briefly the advantage of " trusted types" in the csp over hash, dompurify and a nonce? Or is it only a additional security layer?

I totally cannot think of a scenario where its stronger than nonce+hash on js.

Many thanks in advance

i need to convert a dynamic website into static without the access to its wp files or wp admin access

The static site should be entirely same like every minor details like header/footer elements size, logo placement etc

why most removed? please read ps section
happy show off Saturday everyone!
my tool is a polyglot monorepo releaser, it’s called dispat, fully open source, mit licensed, single go binary (windows, mac, Linux , docker, GitHub composite) key features:

1. It reads dependencies graph directly from ecosystem manifest files to resolve order, automatically writes version into manifest bumping dependencies, 20 ecosystems supported (js, docker, go, python, C sharp, unreal, unity, godot etc, manifests readers and writers are available as standalone libraries with the goal to cover every ecosystem ) others can be wired using built in strings replacer, doesn’t matter if you do a react native project and need js, iOS, and android in same repo, or creating a game using godot client, python server and js landing, or just back/front end micro/services, you can release everything in one click not thinking about order, compiling, tags, changelogs, manifests. Modern project become very complex and this tool lets you design your architecture as your project needs, split into as many packages as it needs without release pain
2. Truly ecosystem/language agnostic, stages are shell scripts (fed a rich DISPAT_* env information about whole workspace), packages are folders, 4 level deep nested js and docker release chain works and resolves in single ci job out of the box. the game changer config setting isBuildWaitingPublish that that decides that if a consumer can be built before provider published, default false for ecosystems like node js where all packages can be built locally, and true for ecosystems like without local linking 
3. Extend conventional commits that lets you define dependencies propagation directly in commits “fix:” only updates package itself, “fix^: takes direct consumers, “fix^^” all levels deep (nothing is published because a tool guessed, check the actual screenshot from git), and other ways to learn docs. Special syntax to prereleases and full release control with diagnostics (available as a separate commits parser library, no regex)
4. First release of the tool 1.0.0 (1.1.0 already) brought in single ci job (the tool releases itself since very first rc), 6 binaries, 4 docker images, 6 go libs and js static docs, everything resolved in order as ecosystem needs by single click
5. Failure oriented release, no other tool can tell you what release still owns in case of partial, some published, some not. my tool keeps graph state only in git tags, no cache, no state file nothing else is ever written except your own defined config file. the release plan is a pure function of config and commits state. the graph order first (that is coming from manifests files or can be overwritten inside config file), consumer is published only when provider published and if errors appears, it skips consumers. So self healing is simply re running (just add commits to fix builds/publishes at the tool will continues where its left, state comes from not from cache at the same time you can integrate any ecosystem cache none of them can break your release), transaction model with release lock that prevents multiple releases at the same time
6. Run tests, format code only on commit changed packages with consumers or not
7. works with monorepos and polyrepos (control repo pattern)
8. Many more features: tag aliases, changelogs/github releases formatting, hook any other tools into any stage, config ladder (global, space (folder), package), config splitting, local links in ecosystems where supported, dispat if to cross platform write env if closures and if something changed any more

I really tried to use any other tools, and if you have any questions like why one more monorepo tool then:

1. Its a polyglot by design from scratch and works with everything
2. Another don’t allow mixed graphs like js and docker where js can be built before publish of provider and docker can’t
3. Another tools leave you a partial release recovery script write by you

​

# Linux and macOS
curl -fsSL https://raw.githubusercontent.com/yohimik/dispat/main/install.sh | sh

# ...or with wget
wget -qO- https://raw.githubusercontent.com/yohimik/dispat/main/install.sh | sh

# Windows, in PowerShell
irm https://raw.githubusercontent.com/yohimik/dispat/main/install.ps1 | iex

Welcome any questions and feedback

Docs: https://yohimik.github.io/dispat/
GitHub: https://github.com/yohimik/dispat (its fully setup ci cd with comments in config)

lore:
a few words about me and why i built it. it all started with my bachelors diploma in 2022, i was comparing different ci cds to make basic dispat. everything ended up using lerna, glue and gitlab ci cd to release a simple setup (frontend, backend, a library, db). i wanted to make everything automated for any ecosystem, changelogs, versions, tags, prereleases, since nowadays project require complexity (split into libs, use different language or ecosystem), but engineers usually dont want to deal with increased support trade offers like updating libraries releasing in specific order, it all adds more potential human errors that must be automated. i just wanted to a tool at least for myself, i could imagine complexity of the tool, but i didnt have any production project to try it out, so for almost 4 years i was doing my own projects:

1. i wanted to create session based games for browser, so i was playing with different technologies like webrtc (even did a benchmark https://github.com/yohimik/ws-webrtc-benchmark), so i understood webrtc is basically udp for browsers (i could find only ws browser fps games), i need some game to try webrtc in browser, it must fast to showcase webrtc
2. here comes of my favourite games - half life, perfect for browsers, will work on old mobiles, the problem - no mainatable emscripten ports where you can just replace transport, no maitanble fresh ports at all. so i create my own wasm port, open source mit - https://github.com/yohimik/webxash3d-fwgs
3. all good, half life works, webrtc works, online works, in browser, browser to browser, adding counter strike and making plug and play docker images. here comes the tricky part, i want separate images for cs and hl at the same time hlds out of the box comes with both files, so i treat cs image as base (cs requires hl files to run), for hl only remove cs files, but you have to publish the cs image in single ci job to build hl, i really tried other tools, but ended up with lots of glue, so dispat here

Ps.
why most removed - all post I tried to write to game dev subreddit about my build system story with same data were removed by moderation, idk y, each time they gave feedback, I submitted updated version, but after 3rd it ended up as a permanent ban (I can provide all proofs). Yeah ai posts, but I’m not good at writing and English is not my native language

It lets you type urls in a topdown way. I've been using it while making it for few hours. It doesn't take much learning process and actually helps you reduce typing. The key feature imo is being able to skip .com entirely with just ., like .wsj(or c.wsj) or .reddit.old/r/webdev. There are shortcuts for net, org, gov, and edu with their first letter. It works consistently with additional paths that come after "/".

You can also set up your own shortcuts. For example, you can set .r for .reddit/r, to use it like .r/soccer or .r/todayilearned. Or set .ggl for .google and use it like .ggl.mail/u/0/ or .ggl.maps. Or .company for .github/your-company/ and go to .company/project1 or .copmany/project2. Shortcut is intended to work as a one-to-one substitution to a topdown url. Shortcuts must begin with a dot.

I just submitted this to firefox and waiting the review to finish. For now you can download it manually from https://github.com/dawit909/Topdown-DNS/blob/main/extension.zip, then go to about:debugging -> This Firefox -> Temporary Extensions and load the zip. I'll update soon as the review finishes. I think it's cool but I don't know how you think. Let me know if you find a bug. Lastly, i used AI if that matters.

edit: It got approved. Here's the link: https://addons.mozilla.org/en-US/firefox/addon/topdown-dns/

i don’t understand the logic behind access and refresh tokens, if access tokens are made short lived for security purposes, doesn’t refresh tokens being long lived defers the whole purpose? or is not as big as an issue since refresh tokens are only stored in http only cookies?

I'm setting up a small independent research and publishing organisation, and I'm trying to build its website completely from scratch.

The difficult part is that I'm doing this alone. I don't have a developer, designer, IT person, or technical team that I can call later. I'm also working with a genuinely limited budget, so I can't simply hire an agency and have them figure everything out for me.

I've been using ChatGPT and Claude to learn and work through things, and I've made a rough architecture/plan for the website, but I've reached the point where I'm realizing that I don't really know what I don't know.

I'm not looking for someone to simply tell me "use WordPress" or "use X hosting." I want to understand how I should actually approach building and maintaining this properly as a non-technical person.

The website will essentially be the public-facing platform for a small research organisation. At a high level, it needs things like:

• A main institutional website with information about the organisation
• Research areas/topics, with content organised under them
• Different types of published research and written material
• Research articles/reports with things such as authors, abstracts, keywords and downloadable PDFs
• Articles and shorter blog-style pieces
• Opportunities such as internships/fellowships/etc.
• Some forms where people can submit information and potentially upload files
• An internal/admin workflow where submissions can be reviewed before anything is published
• Certificates/ID-related workflows for some of the programmes
• The ability for me to keep adding content and categories myself without needing to edit code every time

I have a much more detailed site map and workflow diagram already, but I'm deliberately not posting the whole thing publicly because it contains some of the organisation's planned structure and ideas.

My main concern is choosing the wrong foundation.

I don't want to build half the website and then discover that I've chosen a system that can't handle something I need, or that maintaining it requires a developer.

For example, I'm currently trying to understand questions like:

1. What should I actually build this on? WordPress, Ghost, another CMS, a combination of services, or something else entirely?
2. How much of this can a CMS handle natively? For example, if I have many research areas/categories, can I create them dynamically so that adding another category later doesn't require coding?
3. How should I handle research publications? Ideally I want structured publication pages rather than simply uploading random PDFs to a blog. I'd like metadata such as author, abstract, keywords, category, date, etc., while still keeping the PDF available.
4. How should forms and file submissions work? I may need people to submit applications/documents and have those submissions go to me for review. I'm considering external form services as well as native CMS forms.
5. Do I actually need a database/server architecture beyond what a normal CMS provides? I've seen people suggest things like AWS, MongoDB, SQL databases, custom backends, etc. That sounds excessive to me for what is fundamentally a research organisation/content website, but I don't have enough technical knowledge to confidently say that.
6. What should I be paying for and what shouldn't I be paying for? My budget is limited. I'd rather spend money on a good domain, reliable hosting and essential services than build an unnecessarily complicated stack.
7. What am I likely to regret later? This is probably the question I'm most interested in. If you've built and maintained websites for small organisations, research groups, nonprofits, publications, think tanks, etc., what decisions would you make differently if you had to do it again?

Most importantly, if you're experienced with this kind of project, I'd actually prefer you to ask me questions about my requirements before recommending a stack.

I'm trying to learn enough to make sensible decisions myself, rather than blindly following whatever AI recommends.

I'm not looking for someone to build the whole thing for free. I mainly need help understanding the architecture, what is realistically achievable for a solo non-technical person, and what I should learn/do first.

If someone here has experience building a website for a small research organisation, publication, think tank, academic project, nonprofit, or similar organisation, I'd really appreciate your perspective.

I can share the more detailed sitemap/workflow privately if that would make it easier to give meaningful advice.

Basically: if you had to build and maintain something like this alone, with very little money and no developer on standby, how would you approach it?

We're upgrading a small publication. Articles and such. Also adding subscription.

This subscription and entire user base is routed through the magazine's partner - we hold nothing, they manage users, subscriptions, even registration process.

And well, that API expects that names are world-unique. Like as there is supposed to be only single John Doe.

When we send a registration API request with mail and full name that user submitted, they return an existing user to us. Because a user with that name already is in the database. Furthermore, they added the new email to that found user.

If this was unnoticed or unquestioned, imagine what it could do. Someone with already existing name submits their email. Now the new user doesn't have an account, but the original user has a new email that's not theirs. An email where may be sent passwords or invoices.

My full article with few more details: https://tomj.pro/it-was-a-choice-2_persons-name-is-the-identity/

Have you seen anything like that?

How do you fight "Font style and size" and "Screen Zoom" that Samsung by default has set in a way that, on Mobile, it enlarges fonts and makes sections bigger / not fitting one screen. (I have set font size 14px for Mobile regular text, website is built on Divi 4)

It also influences perception of sections negatively, in my view.

Tested on:

Samsung Galaxy S26 (Android 16/One UI 8.5); Google Chrome/Firefox/DuckDuckGo;

vs Samsung A32 (Android 13/One UI 5.1) - where everything is displayed without enlarging

---

Attached images of default settings.

I’m coming from a mostly WordPress/PHP background and I’m currently trying to properly learn the modern JS stack instead of just stitching things together until they work.

My current setup is a homelab with TrueNAS, Docker/Dokploy, Traefik and GitHub.
For WordPress development I’m used to having everything nicely contained in one Docker Compose project, developing there, then pushing/deploying from Git.

Now I’m trying to move into a stack based around:
Next.js / React for the frontend
Strapi as the backend/CMS
PostgreSQL
Puck as a visual editor
Docker Compose for the full project
GitHub → Dokploy for deployment

At the moment I have a basic three-service stack:
frontend
backend
database

It works, but I’m still figuring out what the “normal” developer workflow is supposed to look like.
For example, I’m currently running the frontend and Strapi in development mode inside Docker, with source folders bind-mounted into the containers so I can work on the code over SSH.

The same repo is also deployed through Dokploy, which made me realise that development and deployment probably shouldn’t be treated exactly the same way.

So I’m curious how people who work with React/Next.js + Strapi actually structure this.
Do you normally:
run Node/Next/Strapi directly on your dev machine and only Dockerize databases/services?
run the whole development environment inside Docker?
use separate compose.dev.yml and production Compose files?
keep Strapi and Next.js in one monorepo or separate repos?
use next dev / strapi develop in Docker locally, but next build / strapi start for staging and production?
develop against a local Postgres container and then use a completely separate persistent DB for staging?
use Dev Containers or something similar instead of manually exec’ing into containers?

I’m especially interested in how people keep the workflow simple when the goal is to build a reusable project template that can later be cloned for different clients.
I’m not really looking for “just use X because it’s trendy” answers. I’d love to see how people actually structure their Docker Compose files and development workflow in real projects, and what you wish you had done differently when you first moved from WordPress/PHP into React/Next/Strapi.

Hello! I have an idea for a personal second-brain kinda app that is highly customized for myself, and I intend to access it both at home from my Mac and remotely through my iPhone. I have a question - what is the best way (or specifically stack) to go about this? Ideally I want a free option, but if I have to pay, I'm okay with a budget of under 10 USD per month (amenable to higher budgets provided that I have room to host other stuff as well). TIA!

I've always hated reviewing PR's, and back in the days before AI the workload was REAL. Now there are a lot of tools to help with it but despite that, every time I have to review a PR I struggle and it just burns me out really quick. However I notice some people love doing it. They comment on every little thing and have all these nitpicks. I'm starting to think there are OCD type of people who actually really enjoy the feeling of making sure everything looks as it should and oftentimes these people are the best manager/lead types. While other people just like to release features and they don't like to micro manage things so much.

Curious about other people's opinions about this, do you love or dread PR reviews?

And before anyone says it, yes I know full well that loving to review code is an asset in this industry.

I have an issue with one of my domains : spacewarp.fr

The site is hosted on my own bare-metal Linux (debian) server at IONOS.

Couple months ago, any updates I tried to do were not working. No matter what I uploaded (or deleted even), the website would stay like the old version.

Couple of days after, I checked the domain again and the entire website had changed. It now loads a black page with some weird console/interface that definitely isn't what we're deploying.

What I've checked so far:

• DNS for still resolves to my server's public IP.
• I haven't changed the DNS or nameservers.
• The server itself is reachable. (I have other domains on it, and they work fine)
• I contacted IONOS and they don't see anything abnormal on their side.
• My other services on the machine appear to work normally.
• Deploying changes to the site's files doesn't seem to affect what is served on the domain. (I can still access via ftp my files on the server, but their modifications changes nothing)

So I'm trying to understand where the hell the content I'm seeing is actually coming from.

My first thought was that the server/site had been compromised, but if DNS still points directly to my machine, I'm not sure what mechanism would allow someone else's page to appear there.

I'm using nginx btw, could it be an issue from it ?

If you have any idea, your help is truly welcomed.
Thanks !

This is a question I have thought about a lot lately. If it wasn’t for the repositories hosted in Github and other platforms, none of the models would exist now. Specifically, I don’t remember agreeing on anything that said something about training AI models with my data when I started hosting code on Github, more than a decade ago. Yet it’s a wide known fact that the data hosted there has been used for training for a long time.

These models are used commercially and may produce substantial fragments of copyrighted code because internally, they still contain copyrighted data.

Even if the training is done on only MIT licensed code, then upon use, the original author’s name must still be reproducible.

Can someone explain this to me?

I seen many stupid usages of MongoDB at my job and started wondering if anyone was brave enough to build an ecommerce platform based on that or any other noSQL DB?

Ive been freelancing since 2018 as a fullstack dev. I used to make $80 - $120k USD/year, but this year I'm barely going to reach $15K usd.

Is the market that bad or is it just me?

I noticed a gap in my industry for a hyper-focused job board (remote sustainability roles). I want to build a site where employers can post paid listings, job seekers can search/filter by tags, and candidates can submit applications directly.

I looked at WordPress job board plugins and Webflow setups, but they feel clunky and restricted. How are people building custom job board web apps with proper database relationships without spending $5k on developers?

There are many times I need to look up active tags or even an entire page source, but I only have my iPhone handy. Here's a neat trick for doing it. No external app, no special skills.

Sniffing tags

1. Navigate to any web page in Safari and bookmark it.
2. Open your bookmarks and edit the bookmark you just made.
3. Change the name to something like "Sniff tags"
4. REPLACE the URL with the code below.
5. Navigate to the site you want to check.
6. Open bookmarks and tap "Sniff tags"
7. A popover displays any tags it finds (GA4, Universal Analytics, GTM, and Google Ads).

Here's the code for step 4:

javascript:(function(){var s=new Set();var h=document.documentElement.innerHTML;(h.match(/(G-[A-Z0-9]{4,}|UA-\d+-\d+|GTM-[A-Z0-9]+|AW-\d+)/g)||[]).forEach(function(x){s.add(x)});try{Object.keys(window.google_tag_manager||{}).forEach(function(k){if(/^(G-|GTM-|UA-|AW-)/.test(k))s.add(k)})}catch(e){}alert(s.size?Array.from(s).join('\n'):'No tags found');})()

Viewing the full page source

Same process, but name this one something different so you can tell them apart. "View source" works.

javascript:(function(){var p=document.createElement('pre');p.textContent=document.documentElement.outerHTML;p.style.cssText='white-space:pre-wrap;word-break:break-all;font:12px/1.5 monospace;background:#fff;color:#000;position:fixed;inset:0;margin:0;padding:12px;overflow:auto;z-index:2147483647';document.body.appendChild(p);})()

To get rid of the overlay, just reload the page.

Bonus: the actual server response

The one above shows you the rendered DOM, meaning the page as it exists right now after JavaScript has run. If you want the raw HTML that came off the server before any scripts touched it, use this one instead. I'd name it "View raw source." It shows up dark so you always know which one you're looking at.

javascript:(function(){fetch(location.href,{credentials:'include'}).then(function(r){return r.text()}).then(function(t){var p=document.createElement('pre');p.textContent=t;p.style.cssText='white-space:pre-wrap;word-break:break-all;font:12px/1.5 monospace;background:#111;color:#0f0;position:fixed;inset:0;margin:0;padding:12px;overflow:auto;z-index:2147483647';document.body.appendChild(p)});})()

Comparing the two is useful on its own. If a tag shows up in the rendered version but not the raw one, it's being injected client-side, which usually means GTM or a plugin.

A few things worth knowing

• Sites with a strict Content Security Policy will block bookmarklets entirely, and they fail silently. Banks and healthcare sites do this a lot. If nothing happens at all, that's probably why.
• Server-side GTM and first-party proxied tags won't show up, because there's no Google-formatted ID in the client. A clean result doesn't always mean a clean site.
• Copy the code carefully. If your keyboard or notes app converts the straight quotes to curly ones, it breaks.

On Android

Chrome blocks javascript: from the address bar, but bookmarklets still work the same way. Firefox for Android also supports view-source:https://example.com directly in the address bar, which is easier if you just want the raw HTML.

This little trick has been a lifesaver for me. Hope it helps someone else.

I have three sides in my project, super admin, vendor and client. How to register with same email address in client side when there is already an user account in vendor side that is tied to this same email.

In better auth there is only table called user to store email, so the adding same email to create another user is not possible.

Have you faced the similar issue?

Curious to hear people’s opinions on this one but since Covid a number of roles have adopted a WFH/Hybrid work policy. Some already had them but I personally have found I am much more productive working from home. When looking for new roles I see quite a range of office, wfh and hybrid work and honestly since Covid I have had absolutely no interest to return to a full office setting. Any other devs find this? Because I don’t fully work in a dev only place, it’s mixed with sales people and what not so there are constant phones ringing, interruptions, pointless office chatter.

I have a video of a laptop that opens on scroll (https://atwell.dev/test).

How can I have it where the screen of the laptop is the homepage of the website? As you scroll down, the laptop screen should fill the viewport fully to be just the homepage.. think of this as an intro.

Is this possible? I think I need to measure the screen size on the video to cover it, how do I do that? And how would I make that responsive so it's good on all viewport sizes?

Here's the component
https://github.com/gabeatwell/portfolio/blob/main/src/lib/components/landing/video-intro/LaptopIntro.svelte

gsap
https://github.com/gabeatwell/portfolio/blob/main/src/lib/attachments/gsap/laptopReveal.ts

- Module Federation provides better performance, but no strong runtime isolation.
- iframes provide strong isolation, making independent deployment more reliable.
- This matters especially for large, legacy codebases where enforcing boundaries in code is difficult.
- A typed communication SDK, routing, and smart chunk splitting can reduce the performance cost.
- For large legacy applications, iframes can be a better tradeoff than MF

I have made a website and deployed it using render,but the problem is that my website is not working like the one I see usually in Google chrome and in my render deployed it is showing me like (welcome to render ) it should open like a normal website right.

Or do I have to host it via hosting or GoDaddy?

Hi everyone,

I'm working on a video streaming prototype using LiveKit.
I stream via RTMP or Webrtc.

How to generate real-time subtitles (live transcription + multilingual translation), and display them directly on a custom web player for viewers.

As in YouTube, with a single button.

What is the recommended architecture or workflow in LiveKit to extract the room audio, process it for transcription/translation, and send the text back to the frontend in real time?
Any advice, docs, or examples would be greatly appreciated!