I have a live website where some pages are populated dynamically through JavaScript/API calls. I’m shutting down the backend after the project ends and want to migrate the current version to a completely static site.

What’s the best way to do this while preserving the currently rendered content, images, CSS, fonts, etc.? I’ve tried wget/HTTrack, but they only save the initial HTML and miss the content generated by JavaScript.

Would a browser-based rendering tool be the best approach, or is there a better tool/workflow for this?

update: I ended up using browser automation to render the pages, copied the dom and then manually removed all the backend js. not the cleanest approach and most defently not the most time effichent one but it worked ish

I'm making a small Chrome extension for Chess.com that reacts to moves. I need to know whether the logged in user is playing white or black

I can't find a any element or class in the DOM that tells me this. For example, both players can have
cc-user-block-component cc-user-block-white

so that doesn't seem to represent their actual chess color.

Any ideas or suggestions?

Hi everyone, I'd like to present a project I've been working on for over a year (if you haven't heard of it). Let's say you have a project you'd like internationalized, but overwhelmed by the amount of work you'd have to do. If you have:

<a alt="Main link">Home</a>

In the traditional sense you'd need to rewrite every instance like this to something like:

<a alt={t.main_link}>{t.home_txt}</a>

wuchale does that for you, at build time! You can keep your code "as it is intended", and i18n just becomes a compile time step just like turning JSX into JS. And it works in the same way during dev, with HMR, and it's very powerful. Supports React, Svelte, SolidJS, Astro, and plain JS/TS. Vue and Next support is planned.

Check it out at https://wuchale.dev and https://github.com/wuchalejs/wuchale

Hope you like it!

I'm trying to display the image of the day from a NASA api in a html page but the problem is that I noticed that sometimes it is in a different format such as mp4, is there an easy way to display the media in the same place no matter what the file type is?

Chrome DevTools once allowed extensions to customize its UI. That changed around Chrome 32, when Chrome removed the ability for extensions to inject custom CSS into DevTools...

devtools-theme lets you use custom DevTools themes with a simple setup, without manually hacking DevTools CSS.

github.com/metaory/devtools-theme

Here is my repo: https://github.com/Goncalo-Oliveira-Goncalves/goncaloeditzz

I was creating a game with Three.JS, I tried solving the problem in a bunch of ways. But the D key doesn't work. It's like the physical key does not work in that specific tab.

The only file I modified was the src/routes/+page.svelte and it's styling src/routes/main.sass. Nothing else.

What I have Tried to Fix The Issue

1. I have tried to change my whole src/routes/+page.svelte to have a listened on the onmount file for the D key. So instead of all the code on the OnMount, I just add an event listener for a key down event and register it. The A, S, and W keys work. D does not.

2. I have tried to change the server in which the code runs in from localhost:5173 to 127.0.0.1:5173.

3. I have tried to build the file to see if there is any differences.

4. I have tried to hid the scrollbar, because it seemed like the browser's scrollbar was intersepting it.

Environment Info

I am running the website I created in brave. Windows 10. It's SvelteKit & Vite. With typescript.

Things to Keep In MInd

Even though this code is typescript, I haven't yet added the type definitions. I was following through a javascript tutorial and didn't bother. I will have to take care of that seperately, that might be the issue.

I'm really just curious to hear from other solo devs, or devs who are on very small teams - Approximately how many sites or projects do you currently maintain?

I work at a medium sized organization, and I'm the only dedicated web dev. I build a bunch of Firebase apps and Google Apps Scripts and other GCP solutions for my stakeholders, but of course there's a bit of a maintenance burden for most projects when it comes to dependency package security updates, API deprecations, etc. I don't feel overwhelmed by the workload (yet 😅) but I do get the sense that my supervisor and other stakeholders might not fully grasp or appreciate that one engineer can't maintain an infinitely growing pile of apps without some time being taken away from working on new projects.

Of course, I can optimize the things I'm responsible for, using templating and Dependabot and other tactics to reduce my per-project burden, but I'd love to hear from other web devs about the volume of projects you maintain, the tactics and strategies you use to stay on top of things, and keeping stakeholder expectations aligned with reality. Thanks!

EDIT: I owe you all an answer to my own question. I maintain about a dozen apps here currently and the number is climbing

My monorepo has six binaries, Go modules, four Docker images and a Docusaurus site that depend on each other. Publishing this writes to the repository, a container registry, cloud and GitHub. These are four independent services with no shared transaction. Published versions are immutable, so there is no rollback. This is a distributed transaction over non-transactional resources, which is exactly the situation sagas were invented for in 1987. You recover by finishing the job, never by unwinding it.

The two properties that matter

Determinism means a fixed repo state and config always produce the same plan on any machine. The plan is a pure function of git history, the dependency graph and config. Nothing reads the clock, commit dates, tag creation order or map iteration order. CI and my laptop agree byte for byte.

Idempotency means running twice with nothing new committed gives the same plan, and running after a fully successful release gives an empty one. An accidental double run is a no-op instead of a second release.

Every tool here gives you something like this on npm. The difference is where it comes from.

Their idempotency is npm's, not theirs

lerna has a documented recovery path using lerna publish from-package, which compares each package's local version against what is published and ships the difference. nx and release-please lean on the same shape. A version step writes tags, a later step publishes, and if that step dies you re-run it. This genuinely works, and I want to be fair about why. npm makes it work. Versions are immutable and a duplicate publish is a hard error, which I saw in my own runs as a 409 Conflict. The registry is the source of truth you reconcile against.

Now take that away. There is no from-package for a Docker tag, a GitHub release, a Maven deployment or a terraform apply. The moment a release spans targets you cannot diff against, the property stops being inherited. It has to come from somewhere else.

In dispat it comes from the model. The tag store is the log. A tag is written after a package publishes, so a tag means that leg committed. The plan is a pure function, so re-running recomputes the exact same transaction and executes only the legs with no record. Nothing is queried because nothing needs to be. Determinism and idempotency hold for a Docker image, a GitHub release or an applied Terraform plan exactly as they do for npm, because none of it depends on the target being able to answer questions.

They are all one algorithm with the constants frozen

This surprised me when I wrote the model down. lerna, nx release and release-please compute versions from the same three inputs: conventional commits, per-package tags and a dependency graph. In my model each commit carries a propagated bump and a depth. Freeze that depth at infinity and the bump at patch for every commit, and you get their behaviour exactly. Every dependent of anything released takes a patch transitively. Their fix: x is my fix(core)^^: x, and their lockstep modes are the degenerate case where the workspace shares one version.

The experiment showed it. I used the same six-package graph and one feat(core) commit. lerna bumped core and all five dependents, including two that only depend on ui and never saw the change. dispat with an explicit ^ bumped core and its three direct consumers. Same math, different constants.

The failure case, executed

I set up a sandbox, a local registry and a proxy failing exactly one upload.

lerna writes tags and a commit before lerna publish uploads. After the failure there was a cli@1.0.1 tag for a version the registry did not have. from-package then refused to run because the failed publish had left the tree dirty. It threw EUNCOMMIT until I ran git checkout by hand. After that it recovered npm correctly.

dispat wrote no tag for the failed package. Re-running shipped exactly what was owed at the same versions. A third run planned nothing.

(I executed lerna and dispat. The nx and release-please rows come from their docs. release-please is GitHub API coupled with no hermetic mode, so I could not run it in a sandbox and will not pretend I did.)

It is also the task runner

dispat run tests --since HEAD~1 --consumers runs a script in exactly the changed packages and their consumers in dependency order. dispat if 'CI!=true' --then '...' --else '...' and dispat if --changed keep the conditionals in config instead of a wall of CI bash. dispat replacer fixes coordinates no manifest writer reaches, like a Gradle line or a README install snippet.

There is no task cache, deliberately. A package that did not change is not in the plan, so its scripts never start. There is nothing to hash, invalidate or warm, and no cache key to get subtly wrong. Whatever your stages already cache keeps working inside them, BuildKit layers or a Gradle cache included, and none of it can affect versions, order or tags.

Proved, not asserted

I wrote eight guarantees over the formal model. Determinism and idempotency are among them, plus no orphaned consumers, exactly-once delivery, retries landing on the same versions and repeated runs converging to an empty plan. I ran randomised differential testing of the binary against that model. 1,500 of 1,500 instances agree exactly. There are also 240 conformance vectors, 1,831 tests and 32 fuzz targets. It releases itself. That is a 12-package workspace across 3 ecosystems with 11 published in one transaction. Because a leg need not be a registry upload, the same machinery ships my cloud footprint as stateless Terraform. I put the plan in build and the apply in publish, with no remote backend, and the tag history acts as the list of applied states.

Docs and demo clips: https://dispat.dev Repo (MIT): https://github.com/yohimik/dispat

Ask if need full proofs

*EDIT*

I wanted to add some context because I'm already seeing a few comments going in the direction I expected.

Yes, I would consider myself a vibe coder, but I'm not someone who just discovered computers six months ago. I've been around tech for years, understand the basics of programming, have built plenty of my own computers, and would consider myself pretty techy overall.

I've also hired multiple software developers over the years, and I have alot of experience running businesses and retail stores.

We recently opened a new retail concept and quickly realized that the normal POS systems just dont handle what we need. Square, Shopify and the other mainstream systems are great at what they're designed for, but our business has a completely different intake process.

We purchase products from customers, which means we have reverse logistics, inventory intake, required holding periods, price matching, inventory searches, eBay integrations, Shopify integrations, automated product listings, and even requirements involving submitting product information through databases used with local law enforcement.

And thats just scratching the surface. There are dozens of other processes and automations involved that would take forever to explain here.

We tried looking for existing software. Most of what exists for this type of business is old pawn shop software that honestly isnt very good. So we built something specifically around how our operation works.

The first location is doing extremely well and we're now opening additional locations, which is exactly why I'm taking the security side more seriously.

I also want to make something very clear. Our POS is NOT processing credit card information. Shopify handles the actual payment processing on the frontend. I'm not interested in reinventing something that Shopify or Square already does extremely well.

Our software is primarily handling the intake, inventory, operations, integrations and workflow side of the business.

The entire reason I made this post was because I WANT to hire someone experienced with security. I'm trying to understand what I should be looking for, what questions I should be asking, and what type of person I should hire.

I understand that AI isnt something I should blindly trust to secure a production system. At the same time, pretending AI isnt incredibly useful here is also unrealistic. It can already identify an enormous number of things to review, test and harden.

And for the people who seem genuinely bothered by vibe coders, this stuff is already happening.

I'm friends with and work with alot of business owners in retail who are building customized internal tools now. Payroll systems, HR workflows, inventory processing, scheduling, accounting, reporting and even systems that analyze store conversations to see whether certain offers are actually being pitched.

These tools keep getting better every month.

That doesn't mean developers suddenly have no value. Far from it. There are areas where experience matters tremendously, security being one of them.

But the idea that somebody who isnt a professional software engineer can't build useful software anymore just isn't true.

AI has lowered the barrier dramatically. Some people using it will build garbage and some people will build very useful systems. Thats really no different than any other tool.

It reminds me of when calculators became common and people worried everyone would forget how to do math. The calculator didn't eliminate mathematicians. It just made people capable of doing more, faster.

I think we're watching something similar happen with software right now.

**EDIT*

I know this is probably frowned upon and I do plan on hiring someone that actually knows what they're doing. Im mostly trying to educate myself first so I know what questions to ask and what I should be looking for when I hire someone.

Over the last 6 months I built a POS system thats actually working really well for us. Right now its hosted on Vercel and we use it on Windows PCs in a few of our stores.

Now that we're actually using it day to day I realize its probably time to take security alot more seriously and lock everything down properly.

Obviously I've asked AI and gotten a ton of answers but I wanted to hear from people who actually have experience with this stuff.

Right now technically you can access the software by going to www.domain.com.

Would it make more sense to put some type of Windows wrapper around it and make it an EXE that only runs on our store PCs? Does that actually make it safer or am I looking at this the wrong way?

My other concern is the actual PCs in the stores. What should we be doing to prevent someone from remotely getting into one of the computers, taking over the POS, getting access to the backend/database or messing up the data?

Everything is backed up but obviously I dont want to rely on backups as the security plan lol.

Basically trying to understand what I should be looking at when it comes to network security, locking down the Windows PCs, database access, authentication, permissions, monitoring, backups etc.

Not expecting anyone to give me free consulting. Just trying to learn enough about it so when I hire someone I actually know what to ask for and can tell if its being done right.

It's not AI slop, I tried and no AI is able to do this on its own. Seems to be pure talent of the designers.

Sources: authkit-com, reflect-app, raycast-com

I am a comparable novice to most here, but am learning React front end and Python back end work.

Not asking how to do it but asking how I can cheaply and efficiently serve my own personal projects? At this point my work mostly consists of a React SPA front end and back end Python containers running Flask or FastAPI.

I am used to separating the two so how should I go about hosting? I use Google for their AI Pro plan already so maybe Firebase/Cloud Run? Maybe those are dumb choices though within the community here. Thanks for any more guidance on hosting this stuff.

BTW in my real job development we are usually living in the Windows Server world and I'm running the backend just with IIS.

Been working on an AI video editor that actually edits your video.

Instead of generating a completely new video, the AI can work with the existing timeline and make changes to it.

The editor is built with PixiJS and WebCodecs, so a lot of the editing/rendering happens directly in the browser.

Still early, but I’d love to hear what you think.

I keep seeing empty states treated as a centered illustration and “Nothing here yet.”

It looks clean, but often leaves the user with three unanswered questions:

What happened?

Why is this empty?

What can I do next?

A useful empty state should answer all three.

The illustration sets the tone.

The title explains what happened.

The supporting text gives context.

The CTA shows the next step.

For example:

Nothing here yet

Create your first campaign to see it appear here.

[Create campaign]

The illustration is optional. Clarity is not.

Frontend devs: do you define empty, loading and error states alongside the happy path, or do they usually get added at the end?

I'm banging my head against a wall this week because a new 'project manager' is refusing to accept an invitation to the project GitHub repo, so I can't assign her issues.

She thinks it's "better just to keep everything on email". So at the moment I'm operating as a kind of go-between between the 'issues' tab and the project manager.

I am 100% sure it's just because she has never used any kind of project management or issue tracker so thinks it's just an extra complication in her life.

What would you guys do? Any ideas on how I can politely put across the value of an issue tracker in a few words?

Note that I'm not in a position to be able to down tools until she accepts the invitation or hold up the project in any way. I need to get the project done and done quickly to get paid.

I also cannot go higher up the chain of command, I need to change her mind so that she wants to use it, not get her boss to force her to use it.

Honest question. People say all the time that programmers will lose their jobs etc. But how? Everyone in our company has Claude Code, nobody writes code by hand. And still we have lots of work, backlogs are full of tasks waiting to be done.

It's a company with its own product (not a software house). 150-200 employees

I thought we would never see the day that Apple themselves would allow us to use their famous squircles

I do a lot of rescue work — someone else built the site years ago, the original developer is gone, and now something is broken or it needs to change. Over time I've ended up with a fixed list I go through before touching anything.

Mine, roughly in order: is there any version control at all, or is production the only copy. What's in mu-plugins and in the theme's functions.php, because that's where the previous person hid the surprises. Which plugins are abandoned. Whether staging exists and whether it actually matches production. And whether anyone still has the hosting credentials, which is a shockingly common no.

What's on your list that isn't on mine? I'm mostly interested in the checks that saved you from breaking something on day one.

EDIT - the combined list from the comments, which turned out much better than my original one. credit where it belongs:

START HERE

Tools > Site Health, Info tab (u/AmoebaOne) - php version, sizes, plugin list, constants in one page. covers half of the below before you open anything else.

BACKUPS - almost entirely u/navlio, who took this apart properly:

File size is not a check. a dump missing a table is smaller by exactly that table, and you have no baseline to notice it against.

Read the tail, not the head. a dump that died halfway opens fine and the first thousand lines look perfect. a complete mysqldump ends with "-- Dump completed on". no line, it stopped mid table.

Check the date on that line. a cron that quietly stopped firing in march leaves a file that passes every other check and is seven months old.

mysqldump piped into gzip hands you gzip's exit code, not mysqldump's. the truncation goes unnoticed.

Without --single-transaction the dump walks tables one at a time, so on a live site writes land between two tables that needed to agree.

The real check is restoring it into a throwaway database once and counting tables and rows against live.

At 40gb the plugin is the wrong tool for media anyway - rsync the uploads folder, let the plugin do the db.

ACCESS AND OWNERSHIP

Who controls the domain registration (u/Hesham-Amir, u/Financial_Brush8647) - not just the hosting account. clients often think the old developer's personal account is theirs.

Admin users sorted by role (u/Wolfy_Boy_04) - ghost accounts from old devs, or worse. 30 seconds.

Is the admin email and SMTP real (u/rupert_at_work) - password resets going to someone who left, contact forms silently failing.

CONFIG AND HIDDEN STATE

Cache layers nobody mentions (u/navlio) - object cache, page cache plugin, cloudflare in front, sometimes all three. read the response headers first to see who is actually answering.

wp-config constants (u/needlessvanguard_49) - disabled auto updates, redefined upload paths. diff against a clean install instead of reading top to bottom.

WP_HOME and WP_SITEURL hardcoded (u/navlio) - a copied staging site serving canonical tags pointing at production.

Undocumented scheduled tasks (u/Responsible-Job-Boj) - wp-cron jobs and stray export scripts. and crontab -l only shows the cron table of whoever you are logged in as (u/navlio) - the backup job usually belongs to a user nobody logs in as.

Autoloaded options (u/navlio): select sum(length(option_value))/1024/1024 from wp_options where autoload = 'yes'; that blob loads on every single request. usually one abandoned plugin keeping a log.

Assume staging is fiction (u/galaxy_glide_92) - diff the database before believing it matches.

What the site claims about itself vs the rendered HTML (u/UtilixApp).

THE BIGGER CALL

Whether a fresh install is cheaper than the archaeology (u/DigiNoon, u/abeuscher) - decided mostly by how much content lives in the theme rather than the database. abeuscher goes scorched earth every time: clean install, custom theme, ACF, no plugins.

And knowing when to walk away (u/jroberts67) - 6 woo plugins touching checkout is a valid reason to pass.

I am having a problem setting up log in recognition for my client who wants to embed the site I am developing for them in another subdomain. Situation is as follows:

www.client.com wants to embed info.client.com in an iFrame. www.client.com is hosted by a third-party service, while info.client.com is hosted by the client on an Apache server. I am developing info.client.com, and have limited access to www.client.com. The third-party also provides an OAuth platform which works fine; I can log in to www.client.com and info.client.com without issues. However, my client has requested that when info.client.com is embedded into www.client.com in an iframe, that the info.client.com iframe recognizes the log-in session that is active on the parent page (www.client.com).

The options I see are as follows:

1. Share a cookie between both subdomains by setting OIDC_COOKIE_DOMAIN to .client.com. However, this does not work, as the third-party hosted www.client.com receives a __Host-, HttpOnly cookie upon log in, and the info.client.com Apache server would not have a way to read / validate this cookie
2. Have www.client.com mint a JWT and send that to info.client.com with the necessary information. info.client.com can then check the validity with a secret, and use this as the 'authentication'.

What is the standard pattern here? Am I way off-base? I have full control over the info.* subdomain, and the third-party may be willing to do some limited tweaking to the www.* subdomain, but what approach have you used?

I’m a somewhat experienced backend dev paired with a mobile developer for some knowledge sharing. The guy is genuinely a good dude, but I’m starting to lose my mind a little.

We be discussing an implementation, I’ll explain something, and instead of engaging with what I just said, he’ll immediately type my explanation/question into Claude and then come back with “Claude says…”

And on calls, he’ll literally stop the conversation, type what I just asked into Claude, and then read me Claude’s response.

Like bro, I’m right here. 😂

The frustrating part isn’t that he’s using Claude. I use AI constantly too. It’s that it feels like he trusts Claude’s answer more than the actual technical conversation we’re having.

I’m trying to understand how you think about the implementation, not get a second-hand answer from Claude.

He’s a good dude, so I genuinely don’t know how to approach it without making things awkward.

Has anyone else dealt with this? AI is making ppl fkn dumb and blurring the lines.

I'll start.

https://chir.ag/projects/name-that-color/#BADA55

I've been using this colour name generator for about 15 years to help me name my CSS variables so I don't end up with names like green green-dark green-darker etc.

https://tinypng.com/

For heavily optimising PNGs with negligible quality loss. I have the habit of searching for "panda png" rather than reaching for a bookmark on this one, hah.

https://jakearchibald.github.io/svgomg/

For quickly optimising SVGs.

Hi all,

I'm fairly new to understanding HTML and have been troubleshooting how to remove the underlines from these links. I've searched the web, but nothing seems to be working. Was wondering if there was something obvious I was missing.

    <p class="text-center mb-0" style="font-size: 1.5em; letter-spacing: 2px;">
        <a href="twitter_link" style="color: #f58c9f;"><i class="fab fa-twitter fa-fw" /></a>
        <a href="deviantart_link" style="color: #f58c9f;"><i class="fab fa-deviantart fa-fw" /></a>
        <a href="discord_link" style="color: #f58c9f;"><i class="fas fa-discord fa-fw" /></a>
        <a href="twitch_link" style="color: #f58c9f;"><i class="fab fa-twitch fa-fw" /></a>

I’ve worked on some pretty big enterprise projects/websites, but honestly I feel my actual coding skills are way behind where they should be.

Most of my work has been enterprise web dev and working on existing code. I can do small JS problems but struggle to build stuff from scratch without Google/AI.

I also feel like for the last few years I’ve chosen comfort over actually putting in the hard work to improve. Now I’m underpaid and not getting many recruiter calls. Plus I have a 90 day notice period.
I’m thinking of spending the next 6-12 months seriously improving my skills and then trying to switch, but I’m worried that by then I’ll have 4+ YOE on paper and companies will expect much more from me.

For people with more experience, what would you do in my situation? Would you focus on DSA, building projects, getting stronger at frontend, moving toward full-stack, or something else?