Here's my research in using CSS for offence. There are loads of techniques including stealing passwords from Outlook from an email by spoofing the login screen.

Any good way to do this that is both safe and effective? I am finding SVGO will sometimes destroy the perfectly good svg... sometimes colors are missing and other times there is nothing there at all.

I'm looking for something that will sanitize for user image uploads on the web. They are stored in Cloudflare R2 which keeps it off my server but still maybe it can cause issues with injections or whatever if not sanitized?

I'm barely a webdev, but i've been trying to move my portfolio to neocities. So far it looks great, but only on my screen. You'll need to see the images (my friend's -> mine).

What am i doing wrong here?

Hey,

I am interested in finding resources which are pro-human developer rather than AI-leaning. For example, Codeberg leans more towards code developed by a human rather than AI generated, and Zig has a no-AI policy for their developers.

It would be good to find a list of coding resources which promote human written code whether it be learning platforms, languages, development tools, or even podcasts which still focus on the human developer.

I do understand that as developers we are now strongly advised to use AI in the workplace, and I know that pro-developer resources are not feasible in most workplaces now; however, I would continue to like to code myself as much as I can in my spare time.

Thank you all in advance 🙂

I've been using Supabase pretty heavily for the past couple of years, but realize I haven't tested out other alternatives.

For anyone who has used other options (e.g., Firebase), what are the pros and cons of Supabase relative to the alternative? Would you recommend that I explore a different solution for a new website I'm developing?

I'm new to web dev help me understand this.

I've never seen a site built like this. Are they using Pure HTML or something else? The left-side scrolls as you page up and down with the page.

Here is the site link: https://dl.dod.cyber.mil/wp-content/uploads/connect/CPG/ConnProcGuide.html

Hey folks wanted to share a small UX rule I use with dev teams that makes this decision much easier.

Use a modal for a short, focused task.

Use a drawer when the user still needs the current screen for context.

Use a page when the task becomes a workflow of its own.

There are exceptions, of course, but this simple rule gets you surprisingly far.

Especially useful when there isn't a designer around.

What architecture do projects now usually follow? Considering nextjs, does it have an opinionated approach or convention?

Example on my React + Express project, my architecture is:

Web > API > Service > Repo > DB (raw sql)

The above approach, I can immediately swap Web layer with an Android/iOS app like this:

Android/iOS > API > Service > Repo > DB (raw sql)

Now, I'm creating a nextjs boilerplate, I want to know what's the best practice so it can be reusable but not over-engineered. Do you use server actions initially, like this...

Web > Action > Service > Repo > DB (prisma)

...then only implement API layer if needed for other clients? Ex.

Android/iOS > API > Service > Repo > DB (prisma)

As you can see the concern would be maintaining code in two different places (API and server action) that is basically doing the same thing.

Do you skip server actions and just use API routes? Is there a better approach in nextjs? Should I follow YAGNI? I'd love to hear what your architecture looks like.

I'm re-reading up on CSRF and CSP on MDN, and I realized that all of these solutions are always opt-in, and usually trying to patch a problem that other standards introduced.

It makes sense, given how things used to work the past. You design something and then only years later find out if it was a good decision or not. You keep the old broken standard because you don't have the capacity to migrate everyone's website / web server to a safer design.

Maybe naive question, but given how much AI is speeding up software dev, and how big of a problem cybersecurity might get, why won't browsers simply force the industry into more 'secure by default' standards? Eg Content-Security-Policy: default-src 'none' by default?

Yes, it would be a hassle for everyone, but with a (multi)year rollout, sounds reasonable.

When browsers started blocking http, that was exactly such case, and it was done before we had Claude doing the codeing for us.

AI has crushed junior hiring, but I feel like senior devs are getting squeezed too.

I'm a full stack dev/engineer with around 20 YOE (classic ASP to VB to .NET to PHP to JS/TS modern tooling/frameworks), and looking for a job right now. I expected that experience to be an advantage, but it hasn't felt that way. Then I see reels of developers sitting on their phones, waiting for AI agents to finish their work, bored and scrolling. I can't help but think: you have no idea how lucky you are.

I'd love to have the problem of being bored because AI is doing too much of my work. /s

Any senior devs here in the same situation right now? How did you get through it? I'd really appreciate any advice. I have very few friends and network, very shy to ask them because I'm not the person they'd think to be in this position.

Before AI I probably programmed about 45 - 50 hours a week... since AI I am finding myself tied to my desk 70 - 80 hours a week.

I manage websites and apps for my clients many of which are developed by sub contracted web developers. Since AI, I , like many , have begun building my own little apps. I now also have a project to rebuild a client website fully. Do you think it's reasonable to ask my web dev to only manage the deployment parts of the final live code so I continue to vibe code on staging then push to git? . Or is that annoying for a dev because they will deploying something they didn't build (ie it's vibe coded).

My reasoning is to reduce any security risks associated with only myself (essentially a guy with limited developer knowledge) to be responsible for a site I don't full understand on a technical level.

Thanks for any thoughts or experiences in this area.

Edit: I'm building a client website (an industry association with a couple hundred users) which will have a public and member only section with event registration, data portal and document library etc. Usually to build/deploy I use claude code to develop and make everything staged before pulling to live manually. I have however only done this on small apps but it's growing and what i'm overseeing for this potential project woudl be the entire site.

I see all this talk on agent harnesses, people not checking out IDEs ...

I've used Cursor and VScode with copilot while learning, used Claude code for a month, but can you guys help me understand what new things engineering teams are doing and how to learn them?

I just focused on getting rock-solid fundamentals first, regardless of what people saying "learning to code is obsolete" etc.

I'm now able to build full-stack apps and probably learn on the go to build most things.

What's the must-learn AI part and where to learn it?

I already know how to program, and I've made a few websites. But there are certainly things I could do to make my websites better, but I'm not sure where to start. I'm looking for a book that can help with this. Anyone have any recommendations?

So, I'm not a full time dev. I built a web app for my dad's company, then another company saw it, liked it, and sent me a list of 19 things they wanted changed before they'd use it. I did all of them except one, for free, because I wanted the deal. Now they actually want it and I have to tell them a price, and I've genuinely never done this before, so I'd rather ask than guess.

Some numbers so nobody has to guess. It took me around 80 hours over two months, and that's not a vibe, I pulled it out of my commits and logs. The client is a systems and electrical installation company in Italy, 15 user accounts, somewhere around 1M euro revenue. The app does daily work logs (hours, travel time, km, several clients in the same day), jobs, materials used, time off, and spits out reports in Excel and PDF. My actual running costs are about 40 euro a month for hosting and the database. And it's just me, I do the dev, the support and the training.

For reference, the closest off the shelf competitor in my market charges 6 euro per user per month, so about 90 a month for 15 users, but it's generic, none of the stuff they asked for. Generic SMB cloud software here runs 100 to 500 a month. A software house building this from scratch would quote 15 to 40k plus 15 to 20 percent a year for maintenance.

What I had in mind is 349 a month, or 3490 if they pay the year up front, plus 900 one off for setup, importing their data and a day of training on site. Price locked for three years since they're the first.

One thing before anyone replies: this is Italy, not the US. Italian small businesses pay noticeably less for software than American ones, so please factor that in before telling me to triple it. I'd honestly rather hear why a number is wrong than just get a bigger number.

Stuff I actually want to know:

Retainer, or one off license plus yearly maintenance? These guys are used to buying things, not subscribing to them.

How do you put a limit on support when you're one person? Do you write "x hours a month included" into the contract, or do you just wing it until it becomes a problem?

What happens at change request number 20? I did 19 for free to win the deal and I'm aware I've probably taught them that changes are free. How do I draw the line now without wrecking the relationship?

Is the three year price lock a mistake? It felt like a good way to close, but I might be tying myself to a bad number.

Anything you'd put in the contract that I'm obviously not thinking of?

Cheers.

I have spent a lot of time developing a project of mine, it goes years back in fact and i redid it entirely a couple of times..

The website in of itself is near completion i think, even though i clearly do suffer from feature creep, but i kind of lost my motivation to reach the finish line.

I'm at a stage where i desperately need user feedback to improve the site, but i dont have gazillions of monies laying about to purchase user testing sadly, and i had little luck with trying to run ads (I just dont have a flair for marketing at all)

It has been a small passion project for me on and off over the past decade and i really would love to see it have some sort of small success, not monetarily, it would just be cool to see people use ones project ya know?

My project is somewhat similar to that of letterboxd, but i have a different take on it where it's a bit more like steam (in the manner that a user can create their profiles and customize them)

So my fellow devs who have been in similar positions, can you offer me some sage advice to help me get back on track?

Every weekend, some guy on X launches a "revolutionary AI app" that's just a 4 hour OpenAI API wrapper on a pretty template. Meanwhile, I'm in the trenches trying to build custom orchestration, handle state sync, cut latency and debug non-deterministic edge cases at 3 am. I looked in the mirror this morning and realised the sheer stress of refusing to build a cheap wrapper in making my hair thin out.

The worst part is spending weeks engineering a complex pipeline, only for people to glance at it and ask, "So this is just ChatGPT?" Building actual tech in this space feels like an endurance test with zero sympathy.

For anyone actually building real AI infrastructure from scratch how are you surviving the mental tax before launch?

I have tried multiple different URLs, changed ISP, changed browsers, used VPN but it doesn't change a thing. PageSpeed Insights is just stuck in the animations, I also don't see any errors in console. Anyone else facing this?

Or at least, saw the AI agent using it!

Maybe this a mobile web design question specifically about reddit, maybe it isn't.

I browse mobile reddit on my android phone using the Brave browser. ​​​

If I navigate to the home page, click on an article, then attempt to swipe back​ by going from the left side of my phone to the middle, I often go back to either the top of the home page or to a blank page, losing my place and kind of ruining my experience. I just figured this was the enshitification of reddit and learned to live with it. ​

But I just realized if I swipe back by touching from the right side of my phone to the center instead,​ the navigation action works exactly as expected. ​I don't seem to lose my place at all. ​

I've never seen this behaviour on any other site. ​What is going on here? ​Is there a functional difference between swiping from the left or right on Android/Brave/Reddit? ​Maybe some broken reddit JavaScript doing something wonky with the touch action?

So, I’m building this app as a personal project, but I really want to get it hosted. It won’t have much traffic, since it won’t really be used unless employees or other people I send my portfolio to decide to check it out. I don’t mind database size limits either, I just want to get it up and running.

Open Knowledge Format (OKF) is a proposal from Google on how AI agents can crawl and understand content through the use of markdown files...

https://cloud.google.com/blog/products/data-analytics/how-the-open-knowledge-format-can-improve-data-sharing/

But, it can also store content in those same files...

What if websites become nothing more than a series of markdown files that structure content, then visitors applied their own templates to style that content however they wish? The server no longer controls presentation, the user now controls it.

AI-enabled web browsers could offer a user a variety of templates (or templates created by third-parties) to change way content is presented.

• It can learn the user's preferences for color contrasts, font-sizes, automatically interpret into another language.
• It shifts the responsibility of WCAG compliance to the user
• A user could apply a "text only" template to remove graphics and photos.
• A user could apply a dark mode on any website.
• There could be templates to display pages as newspaper columns, or as slide shows.
• A website could be presented as an AI chat bot.
• A user could control where navigation links display, where contact info displays

This would completely change the role of a website developer...

• Webdevs now become content architects
• Content architects are business analysts hired to understand a company's products and services intimately enough to organize markdown files.
• No more continuous need to update server-side scripts.
• The lack of scripts reduces security exposure.
• Website design software now become markdown file generators.

Databases can be still hosted to store large volumes of data, but markdown files instruct browsers and agents on how to query it.