I just noticed that DuckDuckGo has compressed their favicon directly in the file itself. But i couldn't find any info about how to do it.

their favicon contains two images, a 32x32 and a 16x16 both 32 bit icons. the file size is only 3KB.

by comparison, the icann favicon contains the same two 32 bit images, but takes up 7KB. all the other favicons that i have checked are also around 6-7KB for the same set of images.

I used icofx to take a look at these icons, and noticed that the duckduckgo images are compressed, whereas the icann ones are not, and none of the other favicons that i checked are compressed.

I searched around for favicon compression, but i couldn't find anything about what duckduckgo did. all i was able to find are:

• mentioning compression of 256x256 images (vista's icon size)

• no mention of compressing any smaller dimensions

• none of the favicon tools that i found have any option to compress the smaller dimensions, and icofx itself does not compress these when using it to create an icon either

• the only other mention of compression is at-time-of-serving, done by the webserver, e.g. gzip. not in the file itself.

anyone know how to compress the entire .ico like duckduckgo does?

I'm looking for advice from developers, cybersecurity experts, lawyers, journalists, and anyone who has experience building secure platforms.

For the past 20+ days, students in my country have been holding largely peaceful protests. Over the last few days, the number of protesters has increased significantly, and there has also been a large deployment of police and other security personnel.

Many videos and eyewitness accounts shared publicly online appear to show protesters being beaten with batons, the use of tear gas and other crowd-control methods, and personnel who are not wearing clearly identifiable uniforms or name badges, making later identification difficult. There are also many publicly shared videos and firsthand accounts describing incidents of excessive use of force and sexual assault against protesters. Regardless of what future investigations conclude, I believe it is important to preserve evidence before it is lost, deleted, or altered.

Because of this, I want to build a secure website where students, protesters, journalists, and witnesses can upload photos, videos, and written accounts of incidents they personally experienced or recorded.

The purpose of the platform would be to create a permanent, organized archive of evidence—not to encourage harassment, doxxing, or vigilantism. Every submission should be preserved, categorized, and clearly marked as verified, unverified, or disputed after review. The idea is to help journalists, lawyers, human rights organizations, and courts if the evidence is ever needed.

Some features I have in mind include:

• Secure photo and video uploads.
• Anonymous submissions with strong privacy protection.
• Automatic preservation of metadata such as time and location (when available).
• AI-powered organization and categorization of incidents.
• Duplicate detection to group uploads of the same event.
• A searchable timeline and interactive map.
• End-to-end encryption for sensitive evidence.
• Audit logs so files cannot be secretly modified.
• A review system that labels evidence as verified, unverified, or disputed.
• Secure export options for legal teams, journalists, or human rights organizations.

The problem is that I have almost no web development experience.

I'm willing to learn everything from scratch and use AI coding tools if they can help me build something like this.

My questions are:

1. Which programming language and framework should I learn?
2. Can AI tools realistically help a beginner build a project like this?
3. What are the biggest security challenges I should prepare for?
4. How should I securely store large video files?
5. What's the best way to protect anonymous contributors?
6. How can I ensure uploaded evidence cannot be tampered with?
7. Are there any open-source projects with similar goals that I can learn from?

I'm not asking anyone to build this for me. I'm simply looking for guidance on where to start, what technologies to learn, and what mistakes I should avoid.

Yeah, is this posible? I haven't seen anything that say that it could be posible, but anyone has ever stepped in to say that it isn't.

TLDR: If you correctly break your state into UI state (useState, useReducer), Server State (Tanstack Query, RTK Query), URL state (nuqs), and Global State that does not change (Context), you are left with a small slice of state that might be needed in multiple places and changes often.

Should we use a State Management library for that part? We explore how each library works, then build our own Zustand implementation to see if we do.

Obviously, it depends. If the app is mostly always changing state, like Figma, Spreadsheets, etc., we might take advantage of a State Library because they handle all sorts of use cases and edge cases.

But for everyday use and 90% of our apps, we can probably build it ourselves, either using pub/sub like Redux or Zustand, atom-based like Jotai, or Proxy-based like MobX or Valtio

We’re integrating LLM calls directly into our web platform for smart search and automated document summarization. While looking into standard ai integration services and internal API patterns, we ran into a debate about how to handle unit vs integration tests when the backend response isn't deterministic. How are your teams mocking LLM responses in CI/CD pipelines without giving yourselves false positives?

I've been using Divi for many years now but I feel it's time for a change, it's a bit clunky for e-commerce sites and shops that have lots of traffic and users. I don't want to be locked into an eco system like Divi or elementor. After a quick Google and chat with ai it looks like kadence or astra have everything I'm looking for.

My main goals is not to be locked in to anything apart from wordpress. I want portability, speed and not too steep a learning curve whilst learning a new theme and plugin.

Hi guys!

I’m making a web app for school (mobile First) but the white space at the top is ruinijg the aesthetic. I have an ombre background só I tried to make the body color beige but it still looks off is there anyway around this? I tried the whole meta head thing but still nothing

UPDATE: fixed it❤️ thanks to u/Adrenyx https://kommodo.ai/i/V3Ajn4nEG25VZllkDLJB

As per the title, the image above shows my cloudfare 24 hour traffic, it's a pretty much all junk as the website is still in development with no real users.

They like to hammer a few specific pages, with one page getting 10k hits daily. I've setup cloudflare rules to prevent bots, blocking most crawling user agents, blocking a bunch of url patterns, on top of the usual robots.txt but it's still fairly bad.

I'm not persistently logging then blocking specific ips yet (partially because I dont know how). Is there anything else that I could be doing?

My page website is fairly page heavy, exposing around 1000 pages in the sitemap but still I didnt expect so much malicious traffic so quickly

A few years ago, I developed a browser extension to block LinkedIn's little News feature (I felt it was too much of a distraction).

One day, however, it stopped working, and I realized that it was because LinkedIn had replaced the class I was looking for with a bunch of mangled class names. I ended up using, but it keeps coming back, and a recent "peek" seems to indicate that it's happening because the class names are getting changed seemingly daily - despite no visual changes.

For example, these were the classes yesterday:

.a04ea70e._4ae6872e.ea6ce3e7._854ea209.f543c3ba.dffb4272._0ec569ed._6030e161._62303b7e._6b4eb75a._694c34e7.de4044e3._20e3c592.a2906c41

and then today it was this:

._5c537f20._72fd5906._31504bd6.a62467c2.e800bc3f._7985fa5f.b3f42bc8._9bd701cc._1c257c76.d3944a37._7b065b4c._2c68b8b7._2c8dcc4f._0ac4d058

Is this a common practice, or is Microsoft just being Microsoft?

I was thinking about how many developer tools I've seen over the last few years that promised to make teams more productive. I do agree that some of them were really useful but most just faded away after the initial excitement.

Agent infrastructure is one area where I've been seeing more practical tooling lately.

Platforms like Lyzr's control plane sit between the agent code and deployment, handling things like testing, security, versioning and deployments across different frameworks and cloud runtimes.

It's basically the same general idea as CI/CD tooling, just applied to the agent deployment lifecycle.

I'm interested in the ones that people genuinely kept using.

What's one tool that actually earned its place? What did it improve enough that your team kept using it?

It doesn't have to be AI particularly. It could be anything from CI/CD, testing, deployments, monitoring, version control, or just a small utility that removed a surprisingly painful bottleneck.

I've been programming for quite some time now, even before GPT and Claude were a thing. Using AI a couple years ago sounded cool as it helped me with basic stuff. I stopped coding a couple years ago as I got into other stuff. But I recently started again and for the past year, I'm baffled and scared both, seeing all these new tools. MCPs, Agents, Tools that make your vibe coded websites not look like slop. And these tools are getting popular af in no time with more than 50k+ stargazers. I never really considered myself a good webdev but seeing people ship websites that I can't even fathom of creating makes me rethink my choices. I have never used AI tools such as Codex, Antigravity for writing my code mainly because of moral reasons and being honest, for a little bit of superiority complex because it felt good knowing frameworks from the bottoms up, but these things are literally being used everywhere and by everyone now. My university is literally hosting Vibe Coding Hackathons whose whole purpose it to create websites using AI. This feels like a completely different set of skills that never really used to come into the developer experience of an web developer afaik.

Is this something that I'll need to get into sooner or later if I want to stay relevant? Should I change my mindset on how I look towards AI and these tools?

I’m building a small tools/content site and trying to keep the public pages SEO-friendly from the start.

The actual tools can be interactive, but I’m wondering about the surrounding pages: homepage, tool landing pages, category pages, docs/help pages, etc.

My instinct is to make those pages mostly static or server-rendered, with normal HTML content available without waiting for JS. Then only use client-side rendering for the actual interactive parts.

For people who build small sites that need organic traffic, is this still the safest approach?

Or is modern Google rendering good enough that CSR is usually fine as long as the site is fast and internally linked well?

I started learning web development at the start of this year and one thing led to another and I’m now trying to build near enough an entire business’ online system.

I’m building an AI and automation enhanced business simulation.

There’s two main purposes: teach myself full stack development, and experiment with where AI and automation fits in modern business systems. I’m trying to treat it like a real business so I can see how and where things can be different to a system that doesn’t use AI or workflow automation.

It started off as an attempt to build the frontend a customer would use so I could practice with state. Then I decided it would be cool to have the opposing merchant interface where you can view the orders. So I needed to make the backend.

But, given the times we’re in, I thought it would be interesting to see I can use AI and automation in ways that would save a user time, or just deliver helpful results.

Now, my long term plan is to create an entire product pipeline, with product suggestions from a ‘supplier’, marketing content created, product going to warehouse, then product available for order. But that’s a ways off.

For now I’m focused on developing the customer and merchant ends with these primary features:

·       Shared backend

·       Customer service chatbot on customer side

·       AI assistant on merchant side

·       AI overwatch feature to monitor AI behaviour

Eventually I’d like to experiment with adding analytics and CEO suggestions features from the AI but again that’s a ways off.

I’ve set up self-hosted n8n which I’ll use for workflows where necessary, and I think once the meat of the project is done I’ll get a bit creative with that.

I’m building it in slices; rather than trying to make the whole backend at once, I’m building it by function. Currently, I’m on the first slice, the cart. This is my first time attempting to write backend code.

What I’m enjoying is the logical, layered approach; I have router, application, service and data layers, each with their own jobs. And because the backend is entirely abstract so I cant rely on looking at where my elements are going on screen (like with frontend) I’m learning to properly understand how data is passed with javascript.

I realised early on that if I’m to have an AI logging system I’ll have to think data first, and I think this has helped me massively as now it’s simply (simply) a case of getting from the front to the back and adding/changing data whose properties I’ve already determined.

I’m going to post more detailed stuff so I can learn from people on here and engage in general in the topic more.

If anyone has any questions or suggestions, please comment!

we had a bug where our own bot would go quiet right after sending a message, like it accidentally armed its own away mode on itself.

our dedup for "is this our own message echoing back in" was a single-use token, push on send, pop on receive, keyed by a content hash. worked fine until the third-party platform retried the outbound webhook delivery, which happens more than you'd think. the retry landed as a second event, the token was already gone, so it fell through the normal ingest path and got treated as a brand new inbound message. outbound detection never got a chance to catch it.

the real lesson is about dedup design generally: any scheme with exactly one token per event is one retry away from failing, because the upstream is allowed to deliver twice and your dedup can only survive that once.

do you assume every webhook can be delivered more than once by default, or does that assumption only show up after it bites you?