TLDR Index
TLDR Web Dev

TLDR WEB DEV 2025-03-31

5 sections15 entrieslinks blockcomplete parse

Parse notes

  • Subscription/account footer truncated before parsefooter_truncated

01ARTICLES & TUTORIALS

WE HACKED GOOGLE'S AI, GEMINI AND LEAKED ITS SOURCE CODE (AT LEAST SOME PART)

In March, Roni Carta (Lupin) and team disclosed they hacked Google's AI, Gemini, during the 2024 LLM bugSWAT event, winning the Most Valuable Hacker award. They discovered a vulnerability within Gemini's Python sandbox that allowed them to rewrite Python code and map the filesystem, enabling them to extract a 579MB binary file. Analyzing this binary revealed internal source code, including sensitive Google proto files containing metadata descriptions used to classify user data and internal security proto definitions.

links.tldrnewsletter.com21 min read

COMPONENTS ARE JUST SPARKLING HOOKS

Components and hooks are closely related in React. Components are a subtype of hooks since they inherit the Rules of Hooks and must return a ReactNode. By converting a component into a hook, there is more flexibility in managing state and behaviors separately from UI rendering, allowing for patterns like headless components.

bbss.dev6 min read

POSTMORTEM ON NEXT.JS MIDDLEWARE BYPASS

Vercel has published a postmortem on CVE-2025-29927, a critical vulnerability in Next.js related to Middleware bypass. The timeline outlines the vulnerability's disclosure, investigation, patching, and public announcement. The vulnerability involved an internal `x-middleware-subrequest` header and impacted self-hosted Next.js applications, but not Vercel, Netlify, or Cloudflare Workers.

vercel.com6 min read

02OPINIONS & ADVICE

KARPATHY'S ‘VIBE CODING' MOVEMENT CONSIDERED HARMFUL

Andrej Karpathy's "vibe coding" advocates relying on AI tools without fully understanding the generated code. However, this approach leads to technical debt, security vulnerabilities, and a loss of intellectual ownership over systems. It's better to have a balanced approach of using AI assistance while maintaining engineering quality through architectural vision, focused code generation, thorough review, and comprehensive testing.

nmn.gl5 min read

THE WAY WE'RE THINKING ABOUT BREAKING CHANGES IS REALLY SILLY

Compilers currently lack the concept of time, treating code as if it always existed in its current state, which leads to unnecessary breaking changes when dependencies are updated. Instead, we should focus on preserving the behavior of existing code rather than strictly following the old syntax during updates. This means having automatic code migrations, similar to database migrations, that apply transformations to call sites when dependencies are updated.

welltypedwitch.bearblog.dev6 min read

HOW TO WRITE BLOG POSTS THAT DEVELOPERS READ

Good blog posts for devs get straight to the point, expand the target audience, strategically plan how readers will discover the post, use visuals, and accommodate skimmers to maximize engagement.

refactoringenglish.com13 min read

03LAUNCHES & TOOLS

JSON-EDIT-REACT

Json-edit-react is a highly configurable React component for editing and viewing JSON/object data, with features like inline editing, granular control over edits, JSON Schema validation, customizable UI, and search/filtering. The component is self-contained with no external UI library dependencies and supports custom components, localization, drag-n-drop reordering, and keyboard customization.

github.comGitHub repository

PG-MCP

PG-MCP is a PostgreSQL Model Context Protocol server for better AI agent interaction with databases. It extends the reference Postgres MCP implementation with features like multi-database support, rich catalog information, extension context, and query explanation. The server has connection management and query tools, along with schema discovery and data access resources.

github.comGitHub repository

04MISCELLANEOUS

WHY APPLE'S SEVERANCE GETS EDITED OVER REMOTE DESKTOP SOFTWARE

Apple's promotional video for "Severance" inadvertently revealed a flawed workflow for professional video editors. The video showed editors using Macs for remote editing via Jump Desktop, a screen-sharing tool. This means that the Mac's local horsepower is not as important as a fast internet connection and a powerful remote server.

tedium.co11 min read

THE STATE OF THE FRONT-END AND FULL-STACK JOB MARKET

React and Next.js are highly sought after, along with Javascript and Typescript. AWS is the dominant cloud provider and PostgreSQL remains a popular database. Despite some technologies correlating with higher compensation, there are minimal salary increases with experience. Education beyond a bachelor's degree is rarely required.

tsev.dev11 min read

EVERYONE KNOWS ALL THE APPS ON YOUR PHONE

Indian Android apps have privacy issues as many apps circumvent Google's privacy policies to collect data on installed apps. Swiggy and Zepto were found to have extensive lists of apps they query, while personal loan apps like KreditBee and Moneyview query an excessive number of apps. A significant privacy loophole exists through the "ACTION_MAIN" filter, allowing apps to see all installed apps with a user interface. Zepto's READ_SMS permission request shows how apps access personal data, potentially sharing it with brokers and affecting user pricing.

peabee.substack.com12 min read