TLDR WEB DEV 2025-01-15

Schedule a demo to learn more

MILLIONS OF ACCOUNTS VULNERABLE DUE TO GOOGLE'S OAUTH FLAW

A flaw in Google's "Sign in with Google" OAuth allows attackers to access accounts of former employees at defunct startups by purchasing the company's domain. This vulnerability affects millions of Americans, granting access to sensitive data across various SaaS platforms like Slack, Notion, and HR systems containing social security numbers. Google is currently working on a fix.

HOW RQLITE IS TESTED

rqlite is a distributed relational database that uses a testing strategy based on the testing pyramid. This strategy prioritizes comprehensive unit testing of individual components, followed by integration tests focusing on the interaction between Raft consensus and SQLite. A minimal set of end-to-end tests verify basic functionality, while performance testing pushes the database to its limits under heavy load.

UNDERSTANDING REACT SERVER COMPONENTS

React Server Components (RSCs) come with the "double data problem," where the same data is sent as both HTML and a "payload" (serialized React Element tree), potentially increasing bandwidth usage. RSCs use techniques like streaming and React's `Suspense` to optimize performance, but careful consideration of component placement (client vs. server) is necessary to avoid issues.

REWRITING MY WEBSITE IN PLAIN HTML AND CSS

This developer rewrote their simple website from SvelteKit to plain HTML and CSS due to frustration with the Javascript bundler and build process, available free time, and a desire to migrate to Cloudflare Pages. The rewrite involved using Pandoc to convert Markdown blog posts to HTML, Python with the `uv` library for scripting, and the `http.server` module for serving the site. The result was a significantly smaller website (~88kb vs ~356kb).

HOW NOT TO LEARN RUST

This post goes over common mistakes new Rust programmers make. These mistakes include neglecting dedicated study time, diving into complex algorithms without sufficient foundational knowledge, and misinterpreting compiler errors and warnings. Best practices from other languages don't always apply directly to Rust, especially due to Rust's unique ownership and borrowing system.

MAYBE DON'T NAVIGATE(-1) IN REMIX/REACT ROUTER

Using `navigate(-1)` in Remix/React Router for creating "Back" links can be problematic as it accesses the browser's history, potentially navigating outside the application. A better approach is to use the `Link` component's `state` property to pass a `back` URL, allowing controlled navigation within the app.

PYPER

Pyper is a pure Python framework for concurrent and parallel data processing that simplifies building data pipelines using a functional paradigm. It has an intuitive API to unify threaded, multiprocessed, and asynchronous operations safely.

MIRAI

Mirai is a Server-Driven UI framework for Flutter that allows developers to build dynamic, cross-platform apps using JSON configurations. It simplifies UI delivery, allowing for real-time updates without redeployment, and supports mobile, web, and desktop platforms.

PNPM 10.0

pnpm 10.0 released with improved security by no longer running lifestyle scripts of dependencies by default, improved hashing, and other performance & feature improvements.

WHAT'S INVOLVED IN GETTING A "MODERN" TERMINAL SETUP?

Achieving a "modern" terminal setup can be frustrating. Key aspects of a modern experience include multiline paste support, infinite shell history, and 24-bit color. Popular shells like bash and zsh often lack essential features out-of-the-box.

DON'T USE COSINE SIMILARITY CARELESSLY

Using cosine similarity carelessly when comparing vectors generated from text embeddings can be problematic. While seemingly simple and widely used, cosine similarity often fails to capture true semantic similarity, instead focusing on superficial aspects like writing style or matching questions to questions rather than questions to answers. More effective approaches include directly querying LLMs for similarity comparisons, training task-specific embeddings, and pre-processing text to remove irrelevant information before embedding.

THE SHIFT IN METRICS: HOW PRODUCT ENGINEERS MEASURE SUCCESS

Traditional engineering metrics like features shipped or lines of code focus on outputs, which often fail to capture the true impact of engineering efforts. Outcome-oriented metrics, such as customer retention, feature adoption, and revenue growth, better align with business goals by measuring value delivered.

SHALLOW CLONES VERSUS STRUCTURED CLONES

When creating deep copies of nested JavaScript objects, using `structuredClone` instead of shallow cloning methods like the spread operator (`...`) prevents unexpected state mutations by verifying that all nested objects and arrays are duplicated, not just referenced.

FFMPEG BY EXAMPLE

This website provides a collection of examples that demonstrate various FFmpeg functionalities, like extracting multiple video clips with one input.

EPOCH SEMANTIC VERSIONING

"Epoch Semantic Versioning” is a new versioning scheme that extends Semantic Versioning by adding an "Epoch" number to better communicate the significance of changes, addressing the limitations of zero-major versioning and the logarithmic human perception of version numbers.

A NEW CHAPTER FOR EXPRESS.JS: TRIUMPHS OF 2024 AND AN AMBITIOUS 2025

In 2024, Express.js released version 5.0, improved governance, enhanced security measures, and increased community engagement.