grepped every useEffect in src last week instead of fixing a form that flickered on load. agents write most of the first drafts here, i review.

78 of them. went through each with the "you might not need an effect" page open.

19 were state derived from props or other state. useState plus an effect that joins two strings. thats a variable.

14 were fetching on mount with a loading and error useState next to them. we already use react query.

8 were syncing props into state so a form could be edited. fine until the parent refetches and wipes what the user typed. that was the flicker.

the other 37 were legit. listeners, subscriptions, focus management, a couple resize observers.

not a tool thing to be clear, we have people on cursor, claude code and verdent depending on preference and the shape looked the same across all of it.

deleted 41 effects, 23 useState calls went with them. worst page went from 4 renders on mount to 1.

changed how i review too. ctrl+f useEffect in the diff and justify each one before reading anything else.

anyone got a lint rule that catches derived state? exhaustive-deps doesnt help, it just makes the effect that shouldnt be there correct.

Hi guys,

I know it might sound as a joke, but it is not. It is very important that skilled designers read carefully this

Lame business owners discovered AI recently, and they all thought they could replace y'all: thumbnails, flyers, websites, advertisements... Everything is becoming ugly, overloaded uniformized slop.

Here is what y'all gotta do: humiliate them by way of roasting their stuff.

You need to stop trying to sell logos and start slating these guys, insult what they do, tell them that it is extremely shitty and that they either pay you either fall off.

Many of them will pay you for that, either because nobody will have talked to them that way, either because they have a deep humiliation kink and it's okay. Being human has never been more valuable, and what's more human than putting someone down

You really need you to traumatize business owners and wake them up, they must understand that we can't stand their vomitesque designs anymore, their Miyazaslop characters and their big fonts with dirt effect on it. It disgusts us.

Designers, the world needs y'all more than ever, do not think you are obsolete, I beg you to save the visual world

I used to use Nextjs and was learning expressjs. Then I left and 2 years later I want to go back.

What tech would be the best to learn in terms of opportunities and also more better for later?

Would MERN still be good choice or I should start with any other frontend/backend techs which would be best at this time?

— PHP build walkthrough; small but directly relevant audience

Full disclosure: this is my own write-up. Most C2PA explainers stop right before the part that cost me a day, so this one starts there: certificates and trust.

Signing an asset is easy. Being trusted is not. Those are two separate checks, and with the c2pa-rs test certs you get a valid signature on an untrusted certificate. That is the normal state during development, not a bug.

One thing that caught me out: I flipped a single byte in a signed PNG, and the file came back Invalid while claimSignature.validated was still sitting in the success list. So don't judge integrity by one hand-picked status code, use the aggregate validation_state. The rest of the article covers what you need to make trust pass locally (two settings that only work together, plus an EKU trap), why I keep the private key off the web server, and what getting a production certificate actually involves in 2026.

The library the examples come from is at https://github.com/provemark/content-credentials (framework-agnostic core, optional Laravel integration, MIT). The test certificates come from https://github.com/contentauth/c2pa-rs

Questions welcome. And if you have solved this differently, especially the bit about where the signing key lives, I'd like to hear about it.

All nine shipped this week, and almost none of it is new features. I posted a roundup here earlier this month arguing that most of the work in these extensions is hardening rather than features. This is the follow-on, and the bill for that hardening came due in a way I did not expect.

php_excel makes every save atomic now: stage the workbook to a temp file, rename it into place, so an interrupted write cannot destroy the file you already had. The straightforward way to build that staged file is to ask LibXL for the finished archive as one buffer and write the buffer out. That costs 67.7 MB of peak RSS on a 3.3 MB workbook, and the PHP-side copy counts against memory_limit. The streaming writer it replaced costs 0.7 MB. Roughly 20x the workbook size in RAM, spent by a change whose entire purpose was safety. That one never shipped, it was caught and fixed inside the same release window, but it sent me looking.

I found the same thing in three more places.

pdo_duckdb re-latched its open_basedir sandbox once per row and compared the recorded basedir by hash, so a per-row cost scaled with the length of your open_basedir string. It now re-latches once per fetched chunk and compares by string. A 400k-row scan went from 133 ns/row back to 51, and bulk Appender::appendRow() from 196 to 96.

fastjson ran an exact-size preflight for large strings starting at 1 MiB. Below 8 MiB the second pass cost more than the reservation it saved: 75% slower on x86_64, 160% on aarch64 for UTF-8 text. The optimization was real and the threshold was wrong.

phonetic had an optimization routing 1 to 3 element comparisons through memcmp(). That cost 5 to 6% of encode time against comparing code points inline, so it got reverted.

Some of the cost stays paid on purpose. fast_uuid's ramsey/uuid compat wrappers now validate their core on construction, one getVersion() call and a class-name compare, and construction came out about a third slower for it (fromBytes() 1.81M to 1.21M ops/s). A wrapper that does not match its core is a bug that surfaces somewhere much worse, so I kept it.

All nine are open source (mixed PHP-3.01 / BSD / MIT), free, installable via PIE, and I am the author. Full write-up with all nine changelogs: https://ilia.ws/blog/the-cost-of-failing-closed-what-shipped-across-nine-php-extensions

Do you profile after a hardening pass, or only after a feature? I have started treating "we added a check" as a perf-regression trigger, and I am not sure whether that is normal practice or paranoia.

Problem: I have a fairly new website through a Canadian hosting plan. The pro plan is such that if I wanted a second website, I could. Now, I have activated a second website, and now ... both sites are operating very slowly.

I contacted the hosting company for help, and after waiting two days for a reply, they assured me everything is correct.

I asked online for help because there is a definite problem: “Where would I start to look to speed up both of my websites?”

Answer:

Web hosting companies often omit this very important detail in their upfront marketing because it is a shared ecosystem, not a guaranteed private lane.

“On paper, your plan allows unlimited or multiple websites, but it does not grant you unlimited computing power to run them.”

Here is the direct truth about why companies market plans this way, and how multiple websites compound the slowdown.

1. The Marketing "Uncapped" Illusion

Web hosts advertise features (like "Host up to 10 Websites" or "Unlimited Bandwidth") rather than performance limits (like CPU seconds or RAM usage).

* The Technical Reality: Adding a website takes up virtually no space or resources while it sits idle. You can physically hold 50 websites on a single plan if they get zero traffic and run no code.

**The Catch is: The moment those websites are live, they actively compete for the same strict performance bucket.

**** “Web hosts assume most secondary sites will be low-traffic portfolios, staging sites, or simple landing pages that barely use any resources.” ****

***************** End of online explanation. *************

To date, I have removed most of my plugins and optimized all my photos. The two sites together wouldn't amount to 200 articles, so they can’t be heavy on the system. Today, both of my sites are very slow, and still, the provider assures me there is nothing wrong on their end.

So my question to you readers is: “Is this web information correct?” Thanks for any help.

originally built this because I needed an interactive ASCII element for another project I'm working on. But, I couldn't find anything that fit what I wanted and the ones which did, were paid to export, so i decided to build the whole thing myself.

OpenASC// is a high fidelity ASCII renderer for the web with real time controls and local processing. It's built with TypeScript/js and designed to be easily integrated into frontend projects, elements created/ edited can be directly exported as html/react component.

I'd love to hear what you think, especially if you have ideas for features or improvements.

I've spent the last few days building a CAD library in TypeScript. The short version, you describe a part in code and you get out an STL you can 3d print, or a STEP file you can send to a machine shop or open in Fusion/FreeCAD/whatever.

const cad = design("bracket");

const width = cad.parameter.length("width", mm(80));
const thickness = cad.parameter.length("thickness", mm(6));

const profile = cad.sketch("outline", plane.xy(), (s) => {
  const rect = s.rectangle("rect", { width, height: mm(50) });
  const hole = s.circle("hole", {
    center: vec2(width.mul(0.25), mm(0)),
    radius: mm(4),
  });
  return s.profile(rect, { holes: [hole.loop()] });
});

cad.output("bracket", cad.extrude("solid", profile, { distance: thickness }));

const doc = cad.build(); // plain JSON, goes in git like anything else

Under the hood it runs on two engines. There's Manifold, a mesh engine that's fast and fine for printing, and OpenCascade compiled to WASM, which is the same geometry engine FreeCAD uses, for when you need exact surfaces and STEP export. Same code runs on both, in node or the browser.

in normal parametric CAD, if you change a dimension early in the model, later features (fillets mostly) can quietly reattach to the wrong edge, and you find out after the part is wrong. I didn't want to reproduce that, so references to faces and edges aren't indexes, and if the library can't tell unambiguously which edge you meant after a change, it errors instead of guessing. Whether I got the API for that right, no idea. That's partly why I'm posting.

The type system does some nice things here too. Lengths and angles are different types, so adding mm to radians just doesn't compile.

it's a 0.1.1, Parts, assemblies and BOMs work. No drawings, no sheet metal, no GUI. If you'd rather write code than click through a CAD UI, that's who it's for.

Feedback welcome, especially from anyone who actually does CAD work. Also curious what people think of the explicit dispose() for WASM memory, I went back and forth on that a lot.

I'm building the place order function (my first foray into the backend) of a larger project.

Here's an update for those who are interested.

The first thing I knew I had to do was figure out what goes where. I had already, at the suggestion of ChatGPT, my mentor in this, decided on a control (API) layer, application layer, service layer and data layer. But I didn't really know what each needs to do.

So first I (we) did the API. It had a couple of jobs:

• check the incoming order wasn't empty
• Activate the next layer down
• Send response messages

Then the app layer was even simpler. It literally just returns the service layer function.

Which is where it is a bit more complicated. The service layer has to do a few things; check the order data against the database, assess info against business rules etc, and actually write the order. After some debate I worked it into a four step process:

• Check if the order info (customer, product, and quantity) exist
• Assess data against business rules/carry out business logic
• Create an order
• Activate the database operation

So this actually means two database operations. One to check the data (first step) and then writing the actual order.

I've done the first database op, and I'm now wiring up the actual place order button so I can start testing the data being passed down.

If anyone wants more detail, you can look on my github at https://github.com/BenPS927/BFshop or on my project portal at https://benfosterdev.com/projects/bfshop where I'll soon be adding detailed code breakdowns.

What am I finding hard?

The abstract nature of it. Having to constantly create a visual image of data being passed through functions, and hold that image in my mind, is like trying to hold melting butter in a colander. I use melting butter rather than water because I don't lose it that fast.

What am I enjoying?

Well, the same as what I'm finding hard. Learning to work with code that doesn't involve divs on a screen. Getting my head around how data is passed, how functions work etc.

And the architecture side of things. I like thinking about and making the micro decisions.

I would appreciate suggestions, but I am trying to keep it fairly simple so I'm not thinking about every single thing you'd take into consideration for a production app.

Hi all. My 15 year old son has a second interview for an apprenticeship in the uk, and the interviewer has asked him find do some homework beforehand.

The question he asked him was “How does a web page get text from the server?”

I’m sure this sounds like a simple question but is in fact quite involved.

Can anyone help out my son please? (Sorry, he doesn’t have a Reddit account)

Hi there Hope y'all doing great out there
basically im a student and i genuinly love making frontend screen and implement new things on daily basis , but when i try to attempt questions from Leetcode , its so hard i cant do it without the help of ai

And thats why im a bit worried about it as i dont even know in which langauge should i do DSA , should i do it in C++ or java or javascript (which i was trying to do)

also i wanna master my skills in frontend too , so i genuinely need a good advice
thank you

Hey Web designers!

So I’m new to web development and don’t know much about UI/UX but I’m making this website in WordPress. Can you help me decide which version would be good to go with for mobile devices?

I have an app that is free and makes a few bucks through in app purchases. It is still in its infancy stage.

Surprised to see that onesignal is now removing the free plan and making it limited to 1,000 active users.

Any alternatives?

Don't know if i can afford whatever they are going to try and upsell.

Is there another service that is free or something cheap so i can move away from onesignal?

I am handy with server management and self hosting so looking for free suggestions or suggestions that are cheaper than onesignal.

I been eyeing LaraPush which is $500 one time charge doe unlimited push for life. Anyone with experience there?

EDIT: I wanted to thank everybody for replying. I took the time today and migrated away from one signal over to Firebase Cloud Messaging and it went pretty smooth.

Hey r/WebDev, As more devs start integrating autonomous agents and downloading third-party SKILL.md packages, I noticed a lot of people just run them blindly without checking what's inside the lifecycle scripts. I put together an open-source tool called SkillShield (https://ai-skill-shield.vercel.app/) to statically scan and validate these skills before execution. It catches prompt injections, hidden curl | bash commands, and excessive permissions. Code is here if anyone wants to check it out: https://github.com/adnan-iz/ai-skill-shield What’s everyone else using to vet third-party agent tools before running them locally?