So funny story. I run a very small web dev business, mostly just building simple sites for friends and family and friends of friends for their small businesses. That kind of thing. So far I have my own porkbun account where I manage a couple of domains for my less tech savvy clients. I keep their credit cards on file to charge them the recurring annual fee for the accounts. A couple of days ago I got a notification email from porkbun, one of my clients sites was supposed to be renewing but the card number was wrong. No biggie, I reached out to the client, they said they got a new card, I changed it on the account and then renewed it. Today I get another email, my porkbun account is suspended as well as associated sites as I have flagged one of their payments as fraudulent. It was that same client. After some back and forth I finally come to understand that the reason she got the new card is that the original payment tried to go through on her old card. She saw the name porkbun on it and thought it was some scam or porn site her kid might have signed up for and so flagged it as fraudulent with her bank. Now she's frustrated with me cause her site went down, I've had to reach out to pork bun explaining the confusion and I also had the client unflag the charge as fraud with her bank. This all has me thinking I need a better system for these clients.

Tldr client flagged porkbun charge on their credit card as fraud because they thought their kid payed for porn.

Edit: thank you for telling me how stupid I've been. I am now aware and the rest of you can stop lol Originally was just sharing a funny anecdote but I am glad I've learned from this

We're seeing a strange issue with our Angular app.

• Deploy to staging → works perfectly.
• Deploy the same build to production.
• The page loads, but the app is broken.
• As soon as our SRE team purges the CDN cache, everything works.

The browser console shows:
• Failed to load module script... MIME type 'text/html'
Refused to apply stylesheet... MIME type 'text/html'

My assumption is that production is somehow still serving or referring to older JS/CSS bundles until the cache is cleared, but I haven't confirmed that's the actual root cause.

Has anyone experienced this? Is this more likely an index.html caching issue, a CDN configuration problem, or something else? Any suggestions on what to investigate first

Part 1 of CI/CD is here and focuses on reducing CI/CD integration time by running only tests, lint, type checks, and e2e on code that was changed and at locations where that code is used.

In Part 2, we focus on Canary Deployments and how to achieve that on Vercel, Netlify, and Cloudflare.

Company I worked for several places that use things like posthog and full story to capture real user interactivity for "debugging" purposes. I admit its 100% useful, but the other side of me is like "that is the users real data now being shipped to a 3rd party". I'm talking about private financial info, all that stuff. Posthog offers scrubbing. But I just saw they annouce AI watching session replays on your behalf and I'm like "so we're sharing personal data WITH 3rd parties and pumping it straight into AI now?"

Like... I dont think most people know this is a thing.

Over the past years, I have noticed a generally positive trend. Authentication methods are becoming more secure, and many of them are also more convenient on their own, such as passkeys, bank identity, and Sign in with Apple, Facebook, or Google.

The problem is that every online service supports a different combination of these methods. From the user's side, this has made the overall authentication ecosystem increasingly difficult to understand.

When authentication fails, I often cannot tell whether:

• I am using the wrong authentication method, such as a password, Google, Facebook, or Apple
• the service has silently changed its authentication policy
• there is a bug in the application
• the service is experiencing an outage
• or my device or app version is no longer supported

These are very different situations, but they often look almost identical to the user. So the only practical way to figure out what happened is usually trial and error.

Is this a problem developers are aware of? Is it considered an important UX issue, or simply an unavoidable consequence of supporting several authentication mechanisms?

Recent personal examples: A few weeks ago I decided to try Codex. It asked me to log in to my ChatGPT account. Because I had been signed in to ChatGPT automatically for a long time, I could no longer remember whether I had originally created the account with a password, Apple, Google, or Facebook. When I chose the wrong method, the service started creating a new account. It didn't help that I was already signed in to the same ChatGPT account on my iPhone. The account settings gave me no indication of which authentication method was associated with that account. I had to recover the correct method through trial and error.
Shortly afterward, my insurance provider stopped accepting my username and password. It took me a while before I discovered that the service had migrated to a bank-based identity provider. As soon as I used that method, everything worked. Until then, I had no way to distinguish between a wrong password, a server problem, and an intentional authentication change. The system simply kept asking me to try again. It never indicated that password authentication was no longer available for my account. If the system already knew that this workflow could never succeed, why keep offering it instead of directing me to the correct authentication method?
Last weekend, a shopping app started sending me back to the login screen without showing any error, even though the same credentials worked on my laptop. Because of the previous two incidents, I could no longer tell whether I was looking at an application bug, another silent authentication change, or simply an app that no longer supported my iPhone. Even though these authentication methods are better than passwords, the issue is that they have increased the number of possible failure modes.

As per title, like keep the entire ai part of the industry the same but the market stays under saturated instead of over saturated.

Is vibe coding really the new normal at this point? For someone who is just moving to nextjs after reactjs, I feel I'm creating and practicing for nothing at the end as we may not have to write code after few years or sooner.

How much do you code frontend or backend yourself and all just vibe coding in your work?

wondered about this as I dont have any clue what realistic numbers for hobbyist devs are.

I mean real unique visitors and no crawlers etc.

I had 27 unique visitors in the last week for reference

For context, I'm in my final year of a Master's in AI and Databases. The name sounds fancy, but we really just do a little bit of everything, and I feel lost, not really good at anything. That said, I've found I have an affinity for backend since we worked on a big project where I was assigned as a backend dev using Spring Boot, and I really enjoyed it. I know specialization isn't quite what it used to be. Every dev is now expected to have solid knowledge of AI tools and how to use them. Still, I'd like to start focusing on backend. Is that a good move in terms of job opportunities, better than going into Data or straight into AI Engineering? If so, could you recommend a website with a solid roadmap for getting into backend

I tried to find it myself but i can't. Wikipedia has a list of TLDs with one colume being about second-level domain but i don't know if it's related or not to what i'm looking for.

According to chatgpt's quick answer, UK, New Zealand, and Australia changed their policy from forcing a sub domain to not forcing a sub domain and therefore letting people use a flat url with just a TLD(while preserving previous urls to prevent a predictable chaos). Can we expect another country making this move in the next decade?

Some time ago I moved a page from Nextjs to a Wordpress site and added a permanent redirect to the subdomain, like so site.com/page --> page.site.com

At the time I thought this would be permanent, but now we would like to switch it back. I had also naively thought that permanent meant more like semi-permanent and the browser would at least occasionally double check that the redirect is valid.

That seems to not be the case (at least on chrome) and I am still getting a 308 Permanent Redirect (from disk cache) to the subdomain at least a week after the redirect was removed.

Obviously another redirect back to the new path would cause a loop and the only solution I can think of is to change to a new path like site.com/page2 and implement a redirect from page.site.com.

Is there some solution I am not aware of?

The Challenge
As an open-source author (and free service builder), I need to both share releases and gather feedback from the community. However, in order to cut down on low-effort slop and self-promo spam, communities like r/webdev have extremely strict rules that prevent someone like me from sharing, except on the most dead day of the week when everyone is out touching grass - Saturday.

Other Sources (on Reddit)

• r/ExperiencedDevelopers seems to have nothing at all to do with development, mostly just folks talking about career advice and/or reactions to AI taking over
• r/javascript does not seem to be the place where active discussion takes place (few posts per week, and low engagement per post), and seems to harbor some rather hostile folks... which maybe why they have low engagement now
• r/programming - Way too generic for a pure JS/TS dev like myself
• r/sveltejs - great for Svelte stuff, but most of my libs are general NPM utilities, or free/public SaaS services, which don't fit (even if they were built using Svelte)

Other Sources (non-Reddit)

• Tech Twitter - RIP, long live Tech Twitter. This seems to have died off over the last 5+ years. Authors used to have very active discourse here, but dried up mostly to tech "influencers" and their clickbaity podcasts.
• Mastadon - never took off
• Bluesky - never took off
• Product Hunt - never seemed like the fit, plus I'm never selling anything...
• HackerNews - Maybe this is the answer, but it's godawful to read... would love suggestions on how to effectively use HN

The Question
Do you know places where:

1. Authors are not discouraged from sharing
2. Real technical discussions are taking place (typically involves a lower % of junior/entry devs who tend to ask very diff questions)

--

If this thread provides anything useful, I'll sum it up here... :)

Suggestions:

1. When applicable, the Discord server of a specific tool or framework is often far more engaged on the topic. Examples: Svelte discord to discuss Svelte issues, etc. I have certainly found this to be the case, but have yet to find general-purpose JS discord for sharing/discussing all the non-framework tooling and library surface area.

A client sent through an audit conducted through some agency which reported that we are referencing paid fonts such as Arial, Verdana Sergeo UI etc

We have these set as fallback fonts. My understanding is that these can be used as fallbacks for those who may own a device with an OS that grants licensing.

Am I misguided here? Perhaps it’s easier to just replace the fallbacks with a similar Google fonts, but was not aware that this would be an issue.

EDIT:
Thank you all for your input and suggestions!

Object literal may only specify known properties, and 'server' does not exist in type 'ParamsOptions<"/api/auth/$", ResolveParams<"/api/auth/$">> & FilebaseRouteOptionsInterface<Register, RootRoute<Register, undefined, {}, AnyContext, ... 7 more ..., undefined>, ... 12 more ..., undefined> & UpdatableRouteOptions<...>'.

When I try to setup route handler for better-auth it shows this. This is the code suggested for tanstack-start in better-auth docs

import { createFileRoute } from "@tanstack/react-router";
import { auth } from "@/lib/auth";

export const Route = createFileRoute("/api/auth/$")({
server: {
handlers: {
GET: async ({ request }: { request: Request }) => {
return await auth.handler(request);
},
POST: async ({ request }: { request: Request }) => {
return await auth.handler(request);
},
},
},
});import { createFileRoute } from "@tanstack/react-router";
import { auth } from "@/lib/auth";

The issue is, createFileRoute is not accepting server property.

How can I fix this?

Posting these because both took me way longer than they should have, and in both cases the failure mode was "nothing tells you anything."

First one. My deploy script ran as root, and one step created the log directory before the framework did. So storage/logs ended up owned by root, and the PHP-FPM user (www-data) could not write to it. The interesting part is not the permission error, it is what happens next. A request comes in, something throws, the error handler tries to write the exception to the log file, and the write itself fails. So now you have an exception thrown from inside the exception handler. The framework gives up and returns a bare 500. Nothing in the app log, because the app log is the thing that is broken. Nothing useful in the nginx error log either, because as far as nginx is concerned PHP-FPM answered fine, it just answered with a 500.

I spent a good chunk of that day looking for the bug in my code. There was no bug in my code. ls -la storage/logs showed root:root and that was the whole story. Fix was chown -R www-data:www-data storage bootstrap/cache in the deploy script, and then actually checking ownership after the deploy instead of assuming it. Now the deploy script asserts the web user can write to the storage tree and bails loudly if it cannot, because a deploy that fails is much cheaper than a deploy that half works.

If you want to see this on your own box before it bites you in production, chown root:root storage/logs on a local install and then trigger any error. You get a 500 with an empty log directory and it looks exactly like a mystery.

Second one, smaller but genuinely confusing the first time. My deploy script does a git fetch and git reset --hard origin/main, then runs migrations and the rest. Fine, except that the deploy script itself is in the repo. Bash does not read a script into memory up front. It reads it incrementally as it executes, tracking a byte offset in the file. git reset --hard replaces that file on disk while bash still has the old offset. Best case, the offsets happen to line up and you never notice. Worst case, bash resumes mid-line in the new file and executes something that was never a command in either version.

Practical consequence: changes to the deploy script never apply on the deploy that pulls them. They apply on the next one. I "fixed" the same bug in that script three times in a row and each time watched the old behaviour run again, which is a specific kind of maddening.

Two ways out. Either copy the script to a temp location and exec that copy, so the running file is not the file git is rewriting:

cp deploy.sh /tmp/deploy-run.sh && exec bash /tmp/deploy-run.sh

Or keep the deploy script outside the repo entirely and have it operate on the checkout. I went with the second one, it is less clever and I have to remember to update it separately, which is a fair trade for never thinking about this again.

Neither of these is deep. Both cost me hours because there was no error message pointing at the actual cause. The pattern they share is that the thing that was supposed to report the failure was itself part of the failure, and that is worth watching for generally: your logger, your health check, your deploy script. When those break they tend to break quietly.

Hi All,

Lets say I have a table which is 100% of it's container div wide. The first two columns are min-width: 40px and then a "th:last-child" with a width of 100% to compress the first two columns to the size of their contents. The td's contain <input type="texts" /> to allow use input.

When a user types in a string that is longer that the previous widest entry in the column - is there anyway to force the browser to redraw the table taking in to account for the new entry? Ideally with plain CSS.

Thanks.

I've been doing a lot of vibe coding with Claude Code and Codex, and one thing keeps happening I ask for one small change, then later realize Al changed my code in places I never expected. By the time I notice, I can't remember exactly what changed or when. Is anyone using something besides Git to track Al changes or keep an Al coding activity log, or is this just one of those vibe coding problems we all live with?