The Daily Index — Monday, March 3, 2025 · TLDR Index

ARTICLES & TUTORIALS

TLDR Web Dev

TLDR Web Dev

ABUSING C TO IMPLEMENT JSON PARSING WITH STRUCT METHODS

A memory-safe JSON parser can be made in C using struct methods for a more ergonomic API. The parser represents JSON values using a `json_value` struct with unions for different data types and includes functions for freeing memory and printing the parsed structure. The parsing process combines lexing and parsing into a single pass, handling atoms (numbers, null, true, false), strings, arrays, and objects with helper functions for whitespace skipping and error handling.

xnacly.me · 14 min

TLDR Web Dev

CROSS-SITE REQUESTS

By default, browsers allow cross-site write requests but restrict cross-site reads, a behavior governed by the Same-Origin Policy. CORS is a mechanism to selectively allow cross-origin requests, while CSRF protection uses tokens to verify the legitimacy of requests. CSRF protection is especially important for simple POST requests allowed cross-site.

smagin.fyi · 6 min

TLDR Web Dev

API DESIGN NOTE: BEWARE OF ADDING AN "OTHER" ENUM VALUE

Including an "Other" enum value can create too much ambiguity as new enum values are added later. Returning new values contradicts the meaning of "Other" as "not mentioned elsewhere." Instead, document the enum as open-ended, letting each application define its own "Other" category for unrecognized values.

devblogs.microsoft.com · 2 min

TLDR Web Dev

SPEEDRUNNERS ARE VULNERABILITY RESEARCHERS

Video game speedrunners use reverse engineering, static/dynamic analysis, and custom tooling to discover and exploit game glitches, which is similar to techniques used by cybersecurity professionals. Their skills translate directly to valuable security roles and should be used more often for testing security in software in general.

zetier.com · 8 min

TLDR Web Dev

WHY WE DITCHED NEXT.JS AND NEVER LOOKED BACK

Northflank ditched Next.js because they found it had negative SEO impacts for them, poor performance at scale, and also was a "black box" during debugging. They replaced it with a custom React SSR solution using Express.

northflank.com · 8 min

TLDR Web Dev

MAESTRO

Maestro is a UI testing framework for mobile and web apps. It addresses flakiness and delays inherent in mobile testing with built-in tolerance and fast iteration. The framework uses a declarative YAML syntax, has a simple setup with a single binary, and is open-source.

github.com · 4 min

TLDR Web Dev

I STRUGGLED WITH GIT, SO I'M MAKING A GAME TO SPARE OTHERS THE PAIN

After struggling with Git, this developer created Git-Sim to visualize Git commands, but realized it only helped those already familiar with Git. To make Git more accessible, they created Devlands, a voxel-world game where users can explore Git concepts and codebases in an immersive, tangible way. Devlands has a Git tutorial and a freeform mode to interact with files, commits, and branches within the game world.

initialcommit.com · 13 min

TLDR Web Dev

HOW TO GAIN CODE EXECUTION ON MILLIONS OF PEOPLE AND HUNDREDS OF POPULAR APPS

A security researcher discovered a vulnerability in todesktop, an Electron app bundler service, that could allow remote code execution on millions of users of popular applications like ClickUp, Cursor, and Linear. The researcher found hardcoded Firebase credentials and secrets within todesktop's deployment pipeline, letting them push malicious auto-updates to any application using the service. They promptly reported the issue to todesktop, who quickly implemented a fix involving a privileged sidecar for signing and uploading.

kibty.town · 5 min

TLDR Web Dev

XCODE CONSTANTLY PHONES HOME

Slow Xcode builds can often be due to unnecessary connections to developerservices2.apple.com during the "Gather provisioning inputs" phase. This developer blocked these connections with Little Snitch, which sped up builds. He also found that Xcode connects to devimages-cdn.apple.com on launch and appstoreconnect.apple.com whenever an Xcode project is opened, likely to send data to Apple.

lapcatsoftware.com · 3 min

TLDR Web Dev

MY EXPERIMENTS WITH WASM AND OPENGL

This developer, with no prior OpenGL experience, rendered 1 million dynamic, lit, and textured spheres at 60 FPS by porting a C++ OpenGL implementation to WASM/WebGL after encountering performance issues on their local machine.

uds5501.github.io · 8 min

TLDR Web Dev

RE: VSCODE EXTENSION DRAMA

VSCode has a lack of transparency and inconsistently applies security measures in remotely uninstalling an extension based on a potentially flawed threat analysis.

andrews.substack.com · 4 min

TLDR Web Dev

MAKING O1, O3, AND SONNET 3.7 HALLUCINATE FOR EVERYONE

A developer discovered that LLMs like ChatGPT sometimes suggest a non-existent syntax for dynamically preloading associations in Rails, which ironically originated from a flawed idea they themselves posted on a Rails forum years ago.

bengarcia.dev · 3 min