The Daily Index — Monday, March 31, 2025 · TLDR Index

ARTICLES & TUTORIALS

TLDR Web Dev

TLDR Web Dev

COMPONENTS ARE JUST SPARKLING HOOKS

Components and hooks are closely related in React. Components are a subtype of hooks since they inherit the Rules of Hooks and must return a ReactNode. By converting a component into a hook, there is more flexibility in managing state and behaviors separately from UI rendering, allowing for patterns like headless components.

bbss.dev · 6 min

TLDR Web Dev

POSTMORTEM ON NEXT.JS MIDDLEWARE BYPASS

Vercel has published a postmortem on CVE-2025-29927, a critical vulnerability in Next.js related to Middleware bypass. The timeline outlines the vulnerability's disclosure, investigation, patching, and public announcement. The vulnerability involved an internal `x-middleware-subrequest` header and impacted self-hosted Next.js applications, but not Vercel, Netlify, or Cloudflare Workers.

vercel.com · 6 min

TLDR Web Dev

KARPATHY'S ‘VIBE CODING' MOVEMENT CONSIDERED HARMFUL

Andrej Karpathy's "vibe coding" advocates relying on AI tools without fully understanding the generated code. However, this approach leads to technical debt, security vulnerabilities, and a loss of intellectual ownership over systems. It's better to have a balanced approach of using AI assistance while maintaining engineering quality through architectural vision, focused code generation, thorough review, and comprehensive testing.

nmn.gl · 5 min

TLDR Web Dev

THE WAY WE'RE THINKING ABOUT BREAKING CHANGES IS REALLY SILLY

Compilers currently lack the concept of time, treating code as if it always existed in its current state, which leads to unnecessary breaking changes when dependencies are updated. Instead, we should focus on preserving the behavior of existing code rather than strictly following the old syntax during updates. This means having automatic code migrations, similar to database migrations, that apply transformations to call sites when dependencies are updated.

welltypedwitch.bearblog.dev · 6 min

TLDR Web Dev

HOW TO WRITE BLOG POSTS THAT DEVELOPERS READ

Good blog posts for devs get straight to the point, expand the target audience, strategically plan how readers will discover the post, use visuals, and accommodate skimmers to maximize engagement.

refactoringenglish.com · 13 min

TLDR Web Dev

WHY APPLE'S SEVERANCE GETS EDITED OVER REMOTE DESKTOP SOFTWARE

Apple's promotional video for "Severance" inadvertently revealed a flawed workflow for professional video editors. The video showed editors using Macs for remote editing via Jump Desktop, a screen-sharing tool. This means that the Mac's local horsepower is not as important as a fast internet connection and a powerful remote server.

tedium.co · 11 min

TLDR Web Dev

THE STATE OF THE FRONT-END AND FULL-STACK JOB MARKET

React and Next.js are highly sought after, along with Javascript and Typescript. AWS is the dominant cloud provider and PostgreSQL remains a popular database. Despite some technologies correlating with higher compensation, there are minimal salary increases with experience. Education beyond a bachelor's degree is rarely required.

tsev.dev · 11 min

TLDR Web Dev

EVERYONE KNOWS ALL THE APPS ON YOUR PHONE

Indian Android apps have privacy issues as many apps circumvent Google's privacy policies to collect data on installed apps. Swiggy and Zepto were found to have extensive lists of apps they query, while personal loan apps like KreditBee and Moneyview query an excessive number of apps. A significant privacy loophole exists through the "ACTION_MAIN" filter, allowing apps to see all installed apps with a user interface. Zepto's READ_SMS permission request shows how apps access personal data, potentially sharing it with brokers and affecting user pricing.

peabee.substack.com · 12 min

TLDR Web Dev

WHAT TO DO

Creating valuable and original things is necessary, as it's uniquely human to be able to think deeply and clearly, which results in the best products, ideas, companies, and art made.

paulgraham.com · 8 min

TLDR Web Dev

MALWARE IN LISP? NOW YOU'RE JUST BEING CRUEL

Malware authors are increasingly using less common programming languages like Delphi, Haskell, and Rust, along with less popular compilers, to evade detection by traditional static analysis methods.

theregister.com · 5 min

TLDR Web Dev

IT'S FIVE GRAND A DAY TO MISS OUR S3 EXIT

37signals' upcoming exit from AWS S3 to its own Pure Storage hardware will save millions over five years, but it will have to pay $5,000 per day if the data migration isn't completed by June 30.

world.hey.com · 3 min

TLDR Web Dev

WHY IS THIS SITE BUILT WITH C

This developer built their website with C to have fast, dependency-free, and long-lasting static site generation using the md4c markdown parser after being frustrated with the complexity and maintenance burden of previous attempts using Django and Nuxt.js.

marcelofern.com · 9 min