TLDR WEB DEV 2025-07-09

THINK BEFORE YOU CACHE

There are four key questions to consider when caching: whether caching is the right solution, what should be cached, where to store it, and how/when it should expire. This article discusses various caching approaches in Rails (view/fragment, page, controller/action, object/model, and low-level caching) and different storage options, from in-memory stores like Redis to the new Rails 8 default Solid Cache, which uses database-backed storage optimized for modern SSDs.

TAKING OVER 60K SPYWARE USER ACCOUNTS WITH SQL INJECTION

This developer discovered a SQL injection vulnerability in the Catwatchful stalkerware service that allowed him to access its database. He successfully dumped the 'user' table, gaining access to over 60,000 plaintext usernames and passwords.

WE REACHED $1M ARR WITH ZERO FUNDING

ProjectionLab is a financial planning tool that was bootstrapped to $1 million in annual recurring revenue in four years. It started as a side project inspired by the financial independence movement. It wasn't an easy journey, due to the emotional rollercoaster of entrepreneurship and the transition from solo development to building a team.

STOP FORCING AI TOOLS ON YOUR ENGINEERS

Managers should stop forcing AI tools on engineers and instead focus on outcomes rather than tool adoption. Mandating specific AI tools, creating AI-usage metrics for performance reviews, and eliminating traditional coding methods lead to slower development and messy codebases.

YOU SHOULD DELETE TESTS

While automated tests are necessary for maintaining confidence when making code changes, they should be deleted when they are flaky. Tests that are flaky, too strict, too slow to run regularly, or outdated due to changed business requirements all harm developer productivity.

—> Start free

INSTANTDB

Instant is a modern Firebase alternative that provides a real-time database for frontend apps. It makes development easier by handling data fetching, permission checking, and offline caching, allowing developers to focus on building user interfaces. Instant supports relational queries, optimistic updates, and multiplayer functionality by default.

BRUT RB

Brut is a Ruby-based framework for building web apps with HTML, JavaScript, CSS, and database interactions. It's structured around concepts like pages, forms, handlers, and components for the front-end, and database models and domain logic for the back-end.

SUPABASE MCP CAN LEAK YOUR ENTIRE SQL DATABASE

Supabase's MCP integration can lead to the leakage of sensitive SQL database information. The attack involves a malicious user crafting a support ticket message that instructs an LLM, operating with elevated privileges (service_role), to extract data from sensitive tables and insert it into a user-accessible support thread. The main issue is the LLM's inability to distinguish between legitimate data and malicious instructions embedded within user-provided text.

REACT ROUTER OPEN GOVERNANCE

React Router is adopting an open governance model with a Steering Committee to guide the project's future development, moving away from founder-led decision-making to a more community-driven approach. The team will simplify React Router by reducing API surface area, focusing on core routing functionality, and deprecating APIs that overlap with new React features like built-in `title`, `meta`, and `link` components.

STEVE BLANK BLIND TO DISRUPTION – THE CEOS WHO MISSED THE FUTURE

Over 4,000 carriage companies failed to adapt to the disruptive technology of automobiles in the early 20th century.

SVGS THAT FEEL LIKE GIFS

High-resolution, animated SVGs can be created using asciinema and svg-term-cli, which can be embedded in GitHub READMEs and work by animating SVG attributes using `animate`, `animateTransform`, and `animateMotion` tags.

AI EXTERNAL COMMENTS

Using external AI conversation links in code comments is a code smell, and instead, code should be self-contained and explainable through executable tests, descriptive inline examples, and constants.

HOW JSDOC SAVED MY DEV WORKFLOW

Using JSDoc, along with TypeScript compiler support in VS Code and ESLint, provides a valuable type-checking and development workflow for JavaScript projects where TypeScript is not a viable option.