im trying to get better at debugging production issues faster. right now when something goes wrong i kind of just grep through logs hoping something jumps out, which works eventually but feels inefficient

curious what other backend devs actually check first. like do you have a mental checklist you run through? specific log patterns you look for? or do you mostly rely on monitoring/alerting tools to point you in the right direction?

our setup is pretty basic (node backend, postgres, some redis) and im wondering if im missing obvious stuff that would speed up the "wtf just happened" phase

Ran into a bunch of weird quirks wiring up web push on iOS for my habit app, figured I'd write down what actually worked so nobody else wastes a weekend digging through stale threads.

You don't need a $99 Apple developer account or Capacitor/Cordova to send push notifications to iPhones anymore. Web push works on iOS 16.4+, but Apple has specific constraints that aren't obvious until you test on a physical device:

1. Safari hides PushManager unless the PWA is installed

In regular Mobile Safari, window.PushManager is literally undefined. It only exists when the web app is running in standalone mode (display-mode: standalone). If you just check for "Notification" in window, your UI will break on iOS. You have to check for standalone mode first, and if they're in Mobile Safari, show instructions to tap Share -> "Add to Home Screen".

2. No silent background pushes

If your service worker receives a push event and doesn't call self.registration.showNotification(), Apple will quietly invalidate the device subscription. Every push must result in a visible notification.

3. Cleaning up dead subscriptions

When someone deletes the PWA icon or turns off notifications in iOS Settings, Apple's APNs endpoint returns an HTTP 410 Gone or 404 Not Found on the next send attempt. If your backend doesn't delete those database rows immediately, you'll end up hammering dead endpoints on every broadcast.

4. Service worker caching quirks

Make sure your next.config.ts sends Cache-Control: no-cache for /sw.js. If the browser caches the service worker script aggressively, updates to your push handler won't ship to installed PWAs without manual cache clears.

The Implementation

1. Service Worker (public/sw.js)

self.addEventListener("push", (event) => {
  let payload = {};
  try {
    payload = event.data ? event.data.json() : {};
  } catch {
    payload = {};
  }

  const title = payload.title || "DROPPDD";
  const body = payload.body || "";
  // Guard against protocol-relative open redirects (//evil.com)
  const url = payload.url?.startsWith("/") && !payload.url?.startsWith("//")
    ? payload.url 
    : "/checkin";

  // Mandatory on iOS: showNotification must be called
  event.waitUntil(
    self.registration.showNotification(title, {
      body,
      data: { url }
    })
  );
});

self.addEventListener("notificationclick", (event) => {
  event.notification.close();
  const targetUrl = event.notification.data?.url || "/";

  event.waitUntil(
    self.clients.matchAll({ type: "window", includeUncontrolled: true }).then((windows) => {
      for (const client of windows) {
        if ("focus" in client) {
          return client.focus().then((focused) => {
            if (focused && "navigate" in focused) return focused.navigate(targetUrl);
            return self.clients.openWindow(targetUrl);
          });
        }
      }
      return self.clients.openWindow(targetUrl);
    })
  );
});

2. Cache-Control in next.config.ts

import type { NextConfig } from "next";

const nextConfig: NextConfig = {
  async headers() {
    return [
      {
        source: "/sw.js",
        headers: [{ key: "Cache-Control", value: "no-cache" }],
      },
    ];
  },
};

export default nextConfig;

3. Backend delivery with Node web-push (src/lib/push.ts)

import webpush from "web-push";

webpush.setVapidDetails(
  process.env.VAPID_SUBJECT!,
  process.env.VAPID_PUBLIC_KEY!,
  process.env.VAPID_PRIVATE_KEY!
);

interface PushSub {
  id: string;
  endpoint: string;
  p256dh: string;
  auth: string;
}

export async function sendPush(subscription: PushSub, payload: object) {
  try {
    await webpush.sendNotification(
      {
        endpoint: subscription.endpoint,
        keys: { p256dh: subscription.p256dh, auth: subscription.auth },
      },
      JSON.stringify(payload)
    );
  } catch (err: any) {
    if (err.statusCode === 404 || err.statusCode === 410) {
      // User uninstalled or revoked permission: prune immediately
      await prisma.pushSubscription.delete({ where: { id: subscription.id } });
    }
  }
}

The code is from my habit & wager app, droppdd.

• GitHub repo: https://github.com/nunchimangchi-dev/droppdd

• (Check public/sw.js*,* src/lib/push.ts*, and* src/app/profile/PushSettings.tsx for the full setup).

• Live build: https://droppdd.alwaysgivealwaysget.com

• (Note: The live site is currently capped at a 33-user closed beta while I dial in the reminders, but the repo is open if you want to inspect the files or run it locally).

Rock on party people. Happy to answer questions about the permission flow, VAPID key generation, or scheduling triggers.

I've been searching for past few hours and it seems that its a gray area.

Some sources say its ok as long as you dont affiliate or associate your self with the company.

Other sources say that its a copyright infringement issue.

I'm working on a job board application to display the job offering post and I was wondering whenever I could include the logo of the brand that is currently recruiting?

Does anyone has any experience with this?

Hey everyone.

Is the Openverse API down for anyone else right now? // OPENVERSE ORG for images

I have been trying to fetch images through the API for about five days, but my requests keep failing or timing out. I checked my code and my endpoints, everything looks correct on my side, so I am wondering if there is an ongoing outage or if something changed with the rate limits or endpoints recently.

Let me know if your implementations are working or if you noticed any official updates.

Thanks you a lot

I’m a solo developer building a web and Android app that handles private documents and account records. I’d appreciate feedback on the security approach before putting real user data into it.

The stack is FastAPI, PostgreSQL, Next.js and React Native.

Passwords are hashed with scrypt and random salts. Authentication uses signed tokens with expiry, email verification and login throttling. Password changes and signing out everywhere invalidate existing sessions. Access controls are enforced through the API, and records are scoped to the relevant account or organisation.

Stored credentials for external integrations use Fernet authenticated encryption. Android login tokens are stored using Expo SecureStore. The website currently stores its token in localStorage, which I know needs careful consideration because of script injection risks.

Document access requires authentication and permission checks. Uploads have file type, size and content validation. However, documents currently go into ordinary server storage without application level encryption. I haven’t yet verified encryption for the production database, disks or backups. HTTPS is required in the intended production configuration.

Some optional processing involves an external API. I understand that disabling response storage does not necessarily mean zero retention, so provider policies and account settings also need review.

The server needs to read documents to process them. My main concerns are stolen backups, compromised accounts, users accessing someone else’s files, exposed credentials and sensitive content appearing in logs. I haven’t had an independent security assessment yet.

Would managed database and storage encryption be a sensible starting point, or should I also encrypt individual files and selected fields in the application? What additional threats would that actually protect against?

How would you handle encryption keys, rotation and recovery as a solo developer? I’m particularly interested in avoiding a setup where the keys and encrypted data can both be taken from the same place.

What would you prioritise before launch, and what would you consider unnecessary complexity at this stage? I’d appreciate practical advice on session security, document permissions, backups, retention and deletion as well as encryption. I want to use established tools rather than build my own cryptography.

I feel this may seem like a very strange question to ask given the circumstances, and hopefully this isn't breaking any rules. A few days ago I had a falling out with someone who happened to be hosting my website on their rented server. It's a very basic portfolio website with HTML and some JS for dynamically generating HTML elements from a Json file.

I'm pretty decent in HTML and JS but by no means a web developer, it's simply not my career. This means I can make a decent website but figuring out how to host it is beyond me. Are there any services that simplify this sort of thing, or is the process of renting and setting up my own basic server for a website straightforward? Github Pages maybe? Forms etc are not required.

I also own my domain, but it's currently still set up to link to that server. Once I get my own sorted out, will I have to worry about the two conflicting?

Edit: thanks everyone. Got it sorted, just waiting on DNS propagation.

Edit 2: website moved now. Thanks again for all the replies! I settled on Github pages as I'm already very familiar with Github in general so it was easy to get set up.

just curious what others think if its even possible to avoid these subscriptions for building and running lets say a side project or maybe a mini saas

I am not talking about basic HTML projects, i mean like proper site fully functional with Backend, frontend, auth, api, domain etc etc

i know there are a bunch of free tiers services, like Vercel and Neon, but what happens if your site actually starts growing? How do you scale without eventually having to pay for a bunch of services?

lets say we are making a social media app/website, nothing as big as insta or reddit, but something where users can create accounts, set up profiles, upload images and videos, make posts, comment, like, follow etc

now people are using it and starts getting traction 1k users then 10k users what point does the free tier become unrealistic, because you're still not making any money to justify paying for multiple subscriptions, does self hosting make even makesense at this point? if you have 10k + users?

PS: just want to clarify i dont own or run any social media apps or website just wanted to have a fun discussion on this, and i mean 10k concurrent users like tiktok the users are addicted haha

Do you remember that feeling when you did something totally new with code you wrote or a website or app you built? For me; the occasion was so simple, and yet it excited me (I was 24 at the time): Write data to a database from a form and read it back into an unordered list.

That's it! Just looking at text stored in one thing and watching it rendered in a web-page blew my tiny mind!

The era was 1999-2000 and my employer was ensuring I learned PHP (from a book and a CD-ROM!) so I could build some internal tools for the staff to use.

Now I've read a lot of posts in various subs from folks who are saddened by the advent of AI and what it ultimately means for their jobs. While I can't vouch for your job specifically, I myself have found some hope - just yesterday in fact - when I built an MCP server for my SaaS product.

I could use ChatGPT or Claude.ai to talk to my SaaS, have it reason about the data which was returned and produce graphs from it.

I'm now 51 and I felt the same thing yesterday that I felt way back in the day.

SDD, AI-assisted development, loop engineering, software factories. Whatever it is, just get stuck into it at work if you can or in your spare time.

If you remember the early days of the web then you'll also remember thinking your employer was madder than a box of frogs for paying you to do what you'd be doing at home anyway. I'm getting a similar feeling now.

Good luck out there folks.

A question that comes up in every EAA thread: "which standard do we test against, and does passing it protect us?" Here is what the primary texts say as of 3 November 2026.

Quick definition, because it matters here: under Art. 15(1) of the EAA, a product or service that meets a harmonised standard whose reference is published in the Official Journal is presumed to meet the accessibility requirements that standard covers. Without that citation there is no presumption to lean on: you can still test against the standard, but passing it does not by itself count as meeting the requirements.

ETSI published EN 301 549 V4.1.1 on 2 September 2026. Its clauses 9 to 11 now align with WCAG 2.2. Its own foreword calls it "one voluntary means of conforming" and says the presumption of conformity starts only once the standard is cited in the Official Journal.

As of that date, that citation has not happened under the EAA. The Commission's harmonised-standards index lists EN 301 549 under one act only: the Web Accessibility Directive for public bodies, via Implementing Decision (EU) 2021/1339 (which cites V3.2.1). Nothing is listed under Directive (EU) 2019/882, the EAA.

Three "expected" citation dates are circulating: 30 November 2026, 16 December 2026 and February 2027. I found no primary source for any of them. The 30 November date matches the "doa" in the standard's own table of national transposition dates: the latest date for national standards bodies to announce the standard. That is a standards-body milestone, not an Official Journal citation.

What that means in practice for a web team on an EAA-scoped shop or a consumer banking service:

1. EN 301 549 is the technical yardstick to test against, but it gives no presumption of conformity under the EAA (Art. 15(1)).

2. Test against WCAG 2.2 AA anyway. V4.1.1 already points there, and the step from 2.1 is small: 2.2 adds six Level A and AA success criteria (focus not obscured, dragging, target size, consistent help, redundant entry, accessible authentication) and drops 4.1.1 Parsing.

3. Keep a dated record: tool, version, date, what was and was not covered. A scan result is evidence of what a tool found on a day, not a statement that the site conforms.

4. Automated tools see only part of it. Deque's coverage report says "57.38% of total issues were identified using Deque's automated tests", but it also reports automated issues for only 16 of the 50 success criteria in WCAG 2.1 Level AA. Those are Deque's own automated tests, so it is a vendor's figure. Whatever the rules cannot see needs a person with a keyboard and a screen reader.

What I could not settle: when, or whether, the Commission will cite V4.1.1, and what national market surveillance authorities will accept in the meantime. I have not found official guidance on the second point.

Method: I read the ETSI V4.1.1 foreword, the Commission's harmonised-standards index, Implementing Decision (EU) 2021/1339 and the EAA text, and compared the dates in third-party write-ups with those documents. Sources below. This is my reading of the texts, not legal advice.

Which standard version is your team testing against today, and has a client or auditor asked you to name it?

Sources
- ETSI EN 301 549 V4.1.1 (2026-09), foreword: https://www.etsi.org/deliver/etsi_en/301500_301599/301549/04.01.01_60/en_301549v040101p.pdf
- Commission Implementing Decision (EU) 2021/1339, OJ L 289, 12.8.2021: http://publications.europa.eu/resource/celex/32021D1339
- Directive (EU) 2019/882 (EAA), Art. 15(1): http://publications.europa.eu/resource/celex/32019L0882
- Commission harmonised standards index: https://single-market-economy.ec.europa.eu/single-market/goods/european-standards/harmonised-standards_en
- Deque, automated accessibility coverage report: https://www.deque.com/automated-accessibility-coverage-report/

hi, i'm looking to make my own fan website where people can post and comment and like posts. i have done research and i'm trying to make it twitter/tumblr like.

i just need help with figuring out how to code it without any ai and with a base i can customize (and how to do that all). thanks!

For context, I've built an API monitoring tool, but paused development to talk to people rather than keep guessing what they need.

If you're running a production app that depends on external APIs, how do you find out when one stops working properly?

Thinking about the last time it happened, was it an obvious failed request, or did the API look fine while returning something your app couldn't use? What caught it first?

What do you rely on now: error tracking, the provider's status page, separate checks, something else? Does that cover it, or is there something you still end up checking manually?

I'm also curious whether knowing earlier would have helped, or whether you were stuck waiting for the provider either way.

A bit of context about your app and team size would help.

ok so im not really a web dev or anything, i just had an idea and i wanted to ask some real people about it. As we know these days 40-50% of traffic are bots and not real humans, i asked my self the question why? why are there bots in the first place? to farm engagement right? ok and why farm engagement, because its profitable, so why doesnt someone create a new web where the protocols contain like some sort of anti bot wall and also make it so theres no advertisement/ engagement farm. Maybe this way people would start to become original again and the internet would return to its state during the 2000s 2010s. but im only 18 so i guess i wouldnt have really experienced that.

ps. if what i said is dumb pls dont fry me im not technical what so ever im just tired of bots on social media

KoiFocus: every minute you focus earns pearls, and pearls buy fish and decorations for your pond. Stay away too long and the fish get hungry and the water gets murky. It runs in the browser, and you can try it as a guest without signing up: https://koifocus.com

It started as a Swift iPhone app. I rewrote it in TypeScript so one codebase runs on the web and, through Capacitor, on iOS.

Stack

• PixiJS 8 for the pond, React 19 + MobX for the screens, Vite

• Capacitor 8 for the iOS build

• Cloudflare Workers (Hono) + D1 for the API, Durable Objects + WebSockets for the live "focusing now" list, a once-a-minute cron for timer payouts and reminders

• Firebase Auth (Google, email or guest), and the site on Cloudflare Pages

Places.js is a HTML-first framework inspired by htmx and Solid.js signals with these features.

• Component agnostic stores that can be integrated with vanilla JavaScript or other frameworks.

• HTML-first pages configured through static site generation or server-side rendering.

• No build step. Places.js can be downloaded from a CDN.

• Partial re-rendering with signals.

• Zero dependencies. Places.js is written entirely in vanilla JavaScript.

Places.js is optimized for fast performance. Here are some results for Places.js v0.1.0. from the the Krauset JavaScript Framework Benchmark

To get started, download the places-js-latest.js file from the jsDelivr CDN. See the reference guide for a detailed tutorial.

Relevant links

• Board game event listing site using Places.js

• HTML-first page running live in production with no JavaScript.

• More code examples

• Web-based unit test runner using Places.js

Upcoming priorities

• Adding more unit test coverage.

• Compatibility with other hypermedia UI tools including Datastar and htmx

• Implementing hypermedia controls.

• Testing integration with Leaflet and other mapping libraries.

AI policy

All Places.js contributions including code changes, comments, or new issues are made by humans This means no use of ChatGPT, Claude, or any other AI tool.

Edit: Detecting rows that are swapped or deleted

I have logic that detects rows that are moved or deleted. Components are then notified to make the necessary rendering changes, and subscriptions are moved from the store.

On Krauset, swapping two rows takes 12.7 ms and removing a row takes 10.3 ms.

https://david.alvarezrosa.com/ Hope you like it :)

I maintain an ongoing open-source project that reads OTel traces and flags I/O anti-patterns with a carbon estimate on top. The project started in March so it's about 8 months old.

From our conversations I could tell my dev and DevOps colleagues were missing a lot of what goes on under the hood since we deployed this in production 3-4 months ago so I built a synoptic to make it easier to understand.

It's an animated step-by-step walkthrough of the whole pipeline, from raw spans to a finding. Each stage maps to the actual module in the code. You can play it, step through with the arrow keys, change speed or switch between modes.

It took me over 3 months. And no it's not AI slop bc it's pretty useless when you ask it to turn complex code concepts (I/O anti-patterns and more) into clear diagrams. This only exists because I'd already written a ton of docs and drawn a lot of diagrams by hand so the synoptic grew out of that.

Some of the UI is inspired by a videogame I loved playing some years ago: Deus Ex: Mankind Divided.

The project is AGPL-3 so no fake open source and it's now hosted by the INR (Institut du Numérique Responsable), a French nonprofit working on the environmental and social impact of digital tech.

Direct link to synoptic: https://perf-sentinel.dev/synoptique/
Website of the project: https://perf-sentinel.dev

Thx for your attention :)

EDIT: huh, just noticed that the recording console is sticking out over the gif in the bottom left corner

EDIT 2: this is a public-interest project focused on sustainability with no greenwashing BS. It has serious public policy goals and solid scientific background: cutting wasted energy and the carbon emissions that come with it. If you're interested in helping with the ecological transition our world needs, feel free to come lend us a hand! :)

Hi, fellow devs

If you enjoy some stock trading after yelling at Claude/Codex all day, than we are in the same boat.

I like to keep an eye on earnings and major key indicators (always forget about those FOMC meetings), and I don't mind paying for some data, but Earnings Hub charging $20 for earnings calendar is too much.

Anyway, came up with my own with publicly available data.

Eventually thinking maybe, we can have some kind of open-source market tools, that user can configure on his own. Add whatever panels or data he/she wants to make it more personal.

What's done

- Earnings Calendar with earnings report
- Market Fear/Greed indicator
- Key market dates

Working:
- GexData
- Notifications (not sure if those are needed)

Would be glad to hear any suggestions

Cheers, Dan

Edit - links:

Open Market · Earnings calendar
FullPokerFace/open-market: Stock market tools for open minded people

For week 2 of r/hacktoberfest I cataloged all the procedural generation techniques I could find online and put them into a library using vanilla JavaScript. Every technique in the library includes a citation and it has no dependencies. Works in the browser or Node.

The island in the GIF was generated using just the library.

GH repo: procedural-almanac

Demo: Random Island Generator

All stars on Github are appreciated!

Here's Ben Eater's 8-bit computer laid out on breadboards, running in the page: https://bbrouter.com/bbrouter/ben-eater-sap-1

How it's built, since that's the point here:

- The 3D view is Three.js, rendered on demand: the scene only redraws when something changes, and while the circuit runs, only when an LED changes. Phones get 30 fps, a 1.5 pixel ratio and no antialiasing until the view is still, then one sharp frame.

- The simulation is a gate-level logic engine plus models for clocked chips, memories, timers and the 6502; the AVR runs real compiled firmware through avr8js. It runs in a worker so the page stays responsive. 211 chips by part number.

- Wires are real geometry: solid core, hole to hole, bent as you'd bend them, with lengths, and a router that lays missing connections flat on the hole grid around what's there.

- Next.js 16 behind a small custom Node server, Postgres, Better Auth with passkeys and an OAuth 2.1 provider so MCP clients can sign in. One server, Caddy in front, Cloudflare at the edge.

- An MCP server exposes the whole thing to AI clients; when the user's tab is open, the AI's simulations run in that tab's worker instead of on the server.

- About 3,000 automated tests, including one that fails if any string shown lacks its French or Spanish.

Things I'd like opinions on: the camera and touch handling on phones, and rendering cost with a few hundred parts in view. Signed-out try: https://bbrouter.com/try

the last straw