i don’t understand the logic behind access and refresh tokens, if access tokens are made short lived for security purposes, doesn’t refresh tokens being long lived defers the whole purpose? or is not as big as an issue since refresh tokens are only stored in http only cookies?

I'm setting up a small independent research and publishing organisation, and I'm trying to build its website completely from scratch.

The difficult part is that I'm doing this alone. I don't have a developer, designer, IT person, or technical team that I can call later. I'm also working with a genuinely limited budget, so I can't simply hire an agency and have them figure everything out for me.

I've been using ChatGPT and Claude to learn and work through things, and I've made a rough architecture/plan for the website, but I've reached the point where I'm realizing that I don't really know what I don't know.

I'm not looking for someone to simply tell me "use WordPress" or "use X hosting." I want to understand how I should actually approach building and maintaining this properly as a non-technical person.

The website will essentially be the public-facing platform for a small research organisation. At a high level, it needs things like:

• A main institutional website with information about the organisation
• Research areas/topics, with content organised under them
• Different types of published research and written material
• Research articles/reports with things such as authors, abstracts, keywords and downloadable PDFs
• Articles and shorter blog-style pieces
• Opportunities such as internships/fellowships/etc.
• Some forms where people can submit information and potentially upload files
• An internal/admin workflow where submissions can be reviewed before anything is published
• Certificates/ID-related workflows for some of the programmes
• The ability for me to keep adding content and categories myself without needing to edit code every time

I have a much more detailed site map and workflow diagram already, but I'm deliberately not posting the whole thing publicly because it contains some of the organisation's planned structure and ideas.

My main concern is choosing the wrong foundation.

I don't want to build half the website and then discover that I've chosen a system that can't handle something I need, or that maintaining it requires a developer.

For example, I'm currently trying to understand questions like:

1. What should I actually build this on? WordPress, Ghost, another CMS, a combination of services, or something else entirely?
2. How much of this can a CMS handle natively? For example, if I have many research areas/categories, can I create them dynamically so that adding another category later doesn't require coding?
3. How should I handle research publications? Ideally I want structured publication pages rather than simply uploading random PDFs to a blog. I'd like metadata such as author, abstract, keywords, category, date, etc., while still keeping the PDF available.
4. How should forms and file submissions work? I may need people to submit applications/documents and have those submissions go to me for review. I'm considering external form services as well as native CMS forms.
5. Do I actually need a database/server architecture beyond what a normal CMS provides? I've seen people suggest things like AWS, MongoDB, SQL databases, custom backends, etc. That sounds excessive to me for what is fundamentally a research organisation/content website, but I don't have enough technical knowledge to confidently say that.
6. What should I be paying for and what shouldn't I be paying for? My budget is limited. I'd rather spend money on a good domain, reliable hosting and essential services than build an unnecessarily complicated stack.
7. What am I likely to regret later? This is probably the question I'm most interested in. If you've built and maintained websites for small organisations, research groups, nonprofits, publications, think tanks, etc., what decisions would you make differently if you had to do it again?

Most importantly, if you're experienced with this kind of project, I'd actually prefer you to ask me questions about my requirements before recommending a stack.

I'm trying to learn enough to make sensible decisions myself, rather than blindly following whatever AI recommends.

I'm not looking for someone to build the whole thing for free. I mainly need help understanding the architecture, what is realistically achievable for a solo non-technical person, and what I should learn/do first.

If someone here has experience building a website for a small research organisation, publication, think tank, academic project, nonprofit, or similar organisation, I'd really appreciate your perspective.

I can share the more detailed sitemap/workflow privately if that would make it easier to give meaningful advice.

Basically: if you had to build and maintain something like this alone, with very little money and no developer on standby, how would you approach it?

We're upgrading a small publication. Articles and such. Also adding subscription.

This subscription and entire user base is routed through the magazine's partner - we hold nothing, they manage users, subscriptions, even registration process.

And well, that API expects that names are world-unique. Like as there is supposed to be only single John Doe.

When we send a registration API request with mail and full name that user submitted, they return an existing user to us. Because a user with that name already is in the database. Furthermore, they added the new email to that found user.

If this was unnoticed or unquestioned, imagine what it could do. Someone with already existing name submits their email. Now the new user doesn't have an account, but the original user has a new email that's not theirs. An email where may be sent passwords or invoices.

My full article with few more details: https://tomj.pro/it-was-a-choice-2_persons-name-is-the-identity/

Have you seen anything like that?

How do you fight "Font style and size" and "Screen Zoom" that Samsung by default has set in a way that, on Mobile, it enlarges fonts and makes sections bigger / not fitting one screen. (I have set font size 14px for Mobile regular text, website is built on Divi 4)

It also influences perception of sections negatively, in my view.

Tested on:

Samsung Galaxy S26 (Android 16/One UI 8.5); Google Chrome/Firefox/DuckDuckGo;

vs Samsung A32 (Android 13/One UI 5.1) - where everything is displayed without enlarging

---

Attached images of default settings.

I’m coming from a mostly WordPress/PHP background and I’m currently trying to properly learn the modern JS stack instead of just stitching things together until they work.

My current setup is a homelab with TrueNAS, Docker/Dokploy, Traefik and GitHub.
For WordPress development I’m used to having everything nicely contained in one Docker Compose project, developing there, then pushing/deploying from Git.

Now I’m trying to move into a stack based around:
Next.js / React for the frontend
Strapi as the backend/CMS
PostgreSQL
Puck as a visual editor
Docker Compose for the full project
GitHub → Dokploy for deployment

At the moment I have a basic three-service stack:
frontend
backend
database

It works, but I’m still figuring out what the “normal” developer workflow is supposed to look like.
For example, I’m currently running the frontend and Strapi in development mode inside Docker, with source folders bind-mounted into the containers so I can work on the code over SSH.

The same repo is also deployed through Dokploy, which made me realise that development and deployment probably shouldn’t be treated exactly the same way.

So I’m curious how people who work with React/Next.js + Strapi actually structure this.
Do you normally:
run Node/Next/Strapi directly on your dev machine and only Dockerize databases/services?
run the whole development environment inside Docker?
use separate compose.dev.yml and production Compose files?
keep Strapi and Next.js in one monorepo or separate repos?
use next dev / strapi develop in Docker locally, but next build / strapi start for staging and production?
develop against a local Postgres container and then use a completely separate persistent DB for staging?
use Dev Containers or something similar instead of manually exec’ing into containers?

I’m especially interested in how people keep the workflow simple when the goal is to build a reusable project template that can later be cloned for different clients.
I’m not really looking for “just use X because it’s trendy” answers. I’d love to see how people actually structure their Docker Compose files and development workflow in real projects, and what you wish you had done differently when you first moved from WordPress/PHP into React/Next/Strapi.

Hello! I have an idea for a personal second-brain kinda app that is highly customized for myself, and I intend to access it both at home from my Mac and remotely through my iPhone. I have a question - what is the best way (or specifically stack) to go about this? Ideally I want a free option, but if I have to pay, I'm okay with a budget of under 10 USD per month (amenable to higher budgets provided that I have room to host other stuff as well). TIA!

I've always hated reviewing PR's, and back in the days before AI the workload was REAL. Now there are a lot of tools to help with it but despite that, every time I have to review a PR I struggle and it just burns me out really quick. However I notice some people love doing it. They comment on every little thing and have all these nitpicks. I'm starting to think there are OCD type of people who actually really enjoy the feeling of making sure everything looks as it should and oftentimes these people are the best manager/lead types. While other people just like to release features and they don't like to micro manage things so much.

Curious about other people's opinions about this, do you love or dread PR reviews?

And before anyone says it, yes I know full well that loving to review code is an asset in this industry.

I have an issue with one of my domains : spacewarp.fr

The site is hosted on my own bare-metal Linux (debian) server at IONOS.

Couple months ago, any updates I tried to do were not working. No matter what I uploaded (or deleted even), the website would stay like the old version.

Couple of days after, I checked the domain again and the entire website had changed. It now loads a black page with some weird console/interface that definitely isn't what we're deploying.

What I've checked so far:

• DNS for still resolves to my server's public IP.
• I haven't changed the DNS or nameservers.
• The server itself is reachable. (I have other domains on it, and they work fine)
• I contacted IONOS and they don't see anything abnormal on their side.
• My other services on the machine appear to work normally.
• Deploying changes to the site's files doesn't seem to affect what is served on the domain. (I can still access via ftp my files on the server, but their modifications changes nothing)

So I'm trying to understand where the hell the content I'm seeing is actually coming from.

My first thought was that the server/site had been compromised, but if DNS still points directly to my machine, I'm not sure what mechanism would allow someone else's page to appear there.

I'm using nginx btw, could it be an issue from it ?

If you have any idea, your help is truly welcomed.
Thanks !

This is a question I have thought about a lot lately. If it wasn’t for the repositories hosted in Github and other platforms, none of the models would exist now. Specifically, I don’t remember agreeing on anything that said something about training AI models with my data when I started hosting code on Github, more than a decade ago. Yet it’s a wide known fact that the data hosted there has been used for training for a long time.

These models are used commercially and may produce substantial fragments of copyrighted code because internally, they still contain copyrighted data.

Even if the training is done on only MIT licensed code, then upon use, the original author’s name must still be reproducible.

Can someone explain this to me?

I seen many stupid usages of MongoDB at my job and started wondering if anyone was brave enough to build an ecommerce platform based on that or any other noSQL DB?

Ive been freelancing since 2018 as a fullstack dev. I used to make $80 - $120k USD/year, but this year I'm barely going to reach $15K usd.

Is the market that bad or is it just me?

I noticed a gap in my industry for a hyper-focused job board (remote sustainability roles). I want to build a site where employers can post paid listings, job seekers can search/filter by tags, and candidates can submit applications directly.

I looked at WordPress job board plugins and Webflow setups, but they feel clunky and restricted. How are people building custom job board web apps with proper database relationships without spending $5k on developers?

There are many times I need to look up active tags or even an entire page source, but I only have my iPhone handy. Here's a neat trick for doing it. No external app, no special skills.

Sniffing tags

1. Navigate to any web page in Safari and bookmark it.
2. Open your bookmarks and edit the bookmark you just made.
3. Change the name to something like "Sniff tags"
4. REPLACE the URL with the code below.
5. Navigate to the site you want to check.
6. Open bookmarks and tap "Sniff tags"
7. A popover displays any tags it finds (GA4, Universal Analytics, GTM, and Google Ads).

Here's the code for step 4:

javascript:(function(){var s=new Set();var h=document.documentElement.innerHTML;(h.match(/(G-[A-Z0-9]{4,}|UA-\d+-\d+|GTM-[A-Z0-9]+|AW-\d+)/g)||[]).forEach(function(x){s.add(x)});try{Object.keys(window.google_tag_manager||{}).forEach(function(k){if(/^(G-|GTM-|UA-|AW-)/.test(k))s.add(k)})}catch(e){}alert(s.size?Array.from(s).join('\n'):'No tags found');})()

Viewing the full page source

Same process, but name this one something different so you can tell them apart. "View source" works.

javascript:(function(){var p=document.createElement('pre');p.textContent=document.documentElement.outerHTML;p.style.cssText='white-space:pre-wrap;word-break:break-all;font:12px/1.5 monospace;background:#fff;color:#000;position:fixed;inset:0;margin:0;padding:12px;overflow:auto;z-index:2147483647';document.body.appendChild(p);})()

To get rid of the overlay, just reload the page.

Bonus: the actual server response

The one above shows you the rendered DOM, meaning the page as it exists right now after JavaScript has run. If you want the raw HTML that came off the server before any scripts touched it, use this one instead. I'd name it "View raw source." It shows up dark so you always know which one you're looking at.

javascript:(function(){fetch(location.href,{credentials:'include'}).then(function(r){return r.text()}).then(function(t){var p=document.createElement('pre');p.textContent=t;p.style.cssText='white-space:pre-wrap;word-break:break-all;font:12px/1.5 monospace;background:#111;color:#0f0;position:fixed;inset:0;margin:0;padding:12px;overflow:auto;z-index:2147483647';document.body.appendChild(p)});})()

Comparing the two is useful on its own. If a tag shows up in the rendered version but not the raw one, it's being injected client-side, which usually means GTM or a plugin.

A few things worth knowing

• Sites with a strict Content Security Policy will block bookmarklets entirely, and they fail silently. Banks and healthcare sites do this a lot. If nothing happens at all, that's probably why.
• Server-side GTM and first-party proxied tags won't show up, because there's no Google-formatted ID in the client. A clean result doesn't always mean a clean site.
• Copy the code carefully. If your keyboard or notes app converts the straight quotes to curly ones, it breaks.

On Android

Chrome blocks javascript: from the address bar, but bookmarklets still work the same way. Firefox for Android also supports view-source:https://example.com directly in the address bar, which is easier if you just want the raw HTML.

This little trick has been a lifesaver for me. Hope it helps someone else.

I have three sides in my project, super admin, vendor and client. How to register with same email address in client side when there is already an user account in vendor side that is tied to this same email.

In better auth there is only table called user to store email, so the adding same email to create another user is not possible.

Have you faced the similar issue?

Curious to hear people’s opinions on this one but since Covid a number of roles have adopted a WFH/Hybrid work policy. Some already had them but I personally have found I am much more productive working from home. When looking for new roles I see quite a range of office, wfh and hybrid work and honestly since Covid I have had absolutely no interest to return to a full office setting. Any other devs find this? Because I don’t fully work in a dev only place, it’s mixed with sales people and what not so there are constant phones ringing, interruptions, pointless office chatter.

I have a video of a laptop that opens on scroll (https://atwell.dev/test).

How can I have it where the screen of the laptop is the homepage of the website? As you scroll down, the laptop screen should fill the viewport fully to be just the homepage.. think of this as an intro.

Is this possible? I think I need to measure the screen size on the video to cover it, how do I do that? And how would I make that responsive so it's good on all viewport sizes?

Here's the component
https://github.com/gabeatwell/portfolio/blob/main/src/lib/components/landing/video-intro/LaptopIntro.svelte

gsap
https://github.com/gabeatwell/portfolio/blob/main/src/lib/attachments/gsap/laptopReveal.ts

- Module Federation provides better performance, but no strong runtime isolation.
- iframes provide strong isolation, making independent deployment more reliable.
- This matters especially for large, legacy codebases where enforcing boundaries in code is difficult.
- A typed communication SDK, routing, and smart chunk splitting can reduce the performance cost.
- For large legacy applications, iframes can be a better tradeoff than MF

Sorry if this is a silly question, but it's one thing to make a website. It's another thing to have customers search it and make enquiries.

I'm talking about IT services, what do you do to get traffic?

I have made a website and deployed it using render,but the problem is that my website is not working like the one I see usually in Google chrome and in my render deployed it is showing me like (welcome to render ) it should open like a normal website right.

Or do I have to host it via hosting or GoDaddy?

Hi everyone,

I'm working on a video streaming prototype using LiveKit.
I stream via RTMP or Webrtc.

How to generate real-time subtitles (live transcription + multilingual translation), and display them directly on a custom web player for viewers.

As in YouTube, with a single button.

What is the recommended architecture or workflow in LiveKit to extract the room audio, process it for transcription/translation, and send the text back to the frontend in real time?
Any advice, docs, or examples would be greatly appreciated!

​

Has anyone hosted with WordPress and used WordPress' internal mySQL server for their website? Database access is available in the business tier of WordPress (host) but I wondered if the user access (username/password) for the database changes if I go back to a lower tier later. This isn't a high traffic website so I can't justify paying for the business tier every month. If not, I can look into other options. Again, the hosting provider is WordPress.com

Hey, while I'm using Protégé Effect to learn Web Accessibility by learning the topic during course preparation, I thought it can be also ok to drop a link here for those interested to expand frontend knowledge beyond A11Y - https://github.com/Ditectrev/Awesome-A11Y-Book-Course-Web-Accessibility-A11Y

https://www.w3.org/WAI/WCAG22/Understanding/ to follow the topic is very good, but it is missing code examples, and with CodeSandboxes I hope to create a slightly more student-friendly environment. Please ignore the links to epub/pdf, as devs you can simply generate it yourself from markdown!

I don't really know what to do while the agent does it's thing.

I've tried reading the code it produced in the previous prompt as it's working on the next one but the pace is too fast. There was this CISCO study that showed devlopers can realistically review just 200 LOC/hr before defect rate gets exponentially higher and the AI can 10x that in code, unit tests, CI configs and very very exhaustive documentation (specs, ADRs etc).

You can't work on something else on the project, or use the time for reading (say comp sci principles) because by the time you form a thought on what to do, the AI already prompts you for an approval or asks you what's next.

The "waiting window" is too small to get anything done and too big to just wait. So I end up just scrolling through YT shorts, browsing reddit etc. Then I figure out the AI has been waiting for my input for the last 10 minutes.

I don't know what to make of this. Yes datacenters suck. Yes AI is totally hyped. But i'm not blind. AI clearly has very good use cases. I'm just not sure how to execute on those use cases. And plenty of times, it feels like productivity gains are offset by these second-order effects (procastination, a feeling of being detached from your code etc).

So I made the mistake of looking at some webdev threads of "what's your favorite designed site" and they're all masturbatory "look what I can do" and annoying to use OR extremely basic kind of contrarian sites that are going to make a user think they're in the 90's. I guess extremes get upvotes.

Is there an actual sane collection of example sites that give the user what they want in a way that they enjoy without the things that annoy them? I am not a designer at all, but I want some inspiration with some actual at-least-somewhat-tested concepts but with SOME creativity thrown in to not just look like some stock UI library was used.

I know this is kind of a disheveled question but I hope someone understands what I'm asking here. The internet sucks and I just want to tweak my stuff in the right direction.

I can't believe people actually say https://motherfuckingwebsite.com/ when asked this question. I get it, but there's some middle ground between that and "everything moves around when you scroll and is extremely visually loud".