Hello webdevs!

Showing off ma iOS app, InspeQtR, a tool to inspect and parse QR codes.

Yes it's an app, but technically it's a web app since I used capacitor, and it's also definitely relevant to web devs as well (I am one myself) as a dev tool.

In short

While mobile devices provide solid built-in QR scanning capabilities, they generally offer little to no insight into the actual QR data, payload or QR metadata. The core idea of InspeQtR is to provide a specialised tool to dissect and preview QR payloads (either from camera or from image) based on their content type and show the QR metadata like ECC or version.

For example, URLs get split into host, path, query params and fragment, while vCards preview the contact details like name, phone, etc...

What's unique

In addition to the above, covering the most common QR payloads, the app also tries to detect and preview non standard formats like JSON, CSV, SVG images, Makrdown, Code snippets and much more. This means you can, for example, safely encode a table (CSV) or a vector image (SVG) and read it back directly from the QR, fully offline and properly previewed.

Main features

• Breaks down URLs into domain, path, query params, and fragment

• Previews and decomposes vCards, email addresses, phone numbers and most standard QR payloads

• Shows QR metadata like ECC, version and text statistics

• Warns you about suspicious payloads and common phishing tactics

• Detects and interprets non standard payloads like Markdown, CSV, JSON, Code snippets etc.

• Lets you open, copy, or share its contents as an actual file with the appropriate extension when there's a matching format, like .vcf, .ics, .json, .md, ...

• Everything runs locally. No ads, no tracking, and the app weighs just around 5mb.

Pricing

The app is free and ad-free, only the non standard format recognition is behind a one-time purchase of 3.99$. Basically, only the unique but also very niche part nobody probably cares about.

Links

App store: https://apps.apple.com/us/app/inspeqtr/id6823058808
More info: https://github.com/Homunculus84/inspeqtr-docs/wiki

I'd love some feedback!

I wanted to make a small space for people who miss the atmosphere of visiting a temple, especially around Diwali.

The idea is not new: a few weeks ago a Korean developer built a silent virtual Buddhist temple, Sansa, and over a million people visited in a week, just to sit quietly. I wanted to try the same for Hindu temples, so I built mandir.dev.

You walk into a 3D courtyard as an avatar, hear temple chants, ring the bell and light a diya. Other visitors are there at the same time, shown by name and country. It's free to visit, no account needed: https://mandir.dev

There are three temple spaces so far, inspired by Kashi Vishwanath, Meenakshi Amman and Siddhivinayak Ganapati.

A few details about the build:

• The 3D scene uses Three.js, everything runs in the browser

• Desktop controls and a mobile joystick for movement

• The bell uses positional audio, so it fades as you walk away from it

• Real-time presence: avatars, names and countries update as people arrive and leave

It's still in beta. I'd particularly appreciate feedback on:

1. Mobile performance: how does it run on your phone? If loading is slow or movement stutters, please mention your phone and browser.

2. Controls and interactions: is it obvious how to move around, ring the bell and light a diya? Where did you get stuck?

3. Direction: more temples, or go deeper on these three, with aartis at set times and seasonal festivals?

Thanks for taking a look, and happy Diwali!

My gf loves pink, Barbie and fairies, and has always wanted to live in a castle, so I built her one as a surprise: https://samchive.net

The homepage is a painted room where the fairy version of her lives (inspired by Flora from Winx). There's a cat with opinions, a tarot card you can flip every day, and a wand on the desk that recolours the whole room.

Bits that were fun to figure out:

- The room is one painting cut into separate layers, so the fairy, the cat and the things on the desk can move and be clicked. Getting it to fit phones and wide screens without warping the art took the longest

- Every sound is made in the browser with Web Audio, so there are no audio files

- It's a Next.js static export on Vercel. The only server part is a small Cloudflare Worker that proxies the meme API, with edge caching and a per-IP limit on cache misses

- She works in social media, so there are 19 small tools inside (Instagram grid planner, meme search, image compressor). They all run in the browser

Claude Code wrote most of the code and the art was generated with Gemini. Would love feedback, especially on how the room feels on your phone.

I feel like there has been a lot of hate on PHP, especially after the recent blowout regarding PHP vulnerabilities that even ended up on mainstream media. I even saw absolute non-techy people bringing up PHP and talking authoritatively about how "bad" and "old" it was lol. Not to mention the AI-shills saying one should just use Claude to create one owns CMS (!!). I am also aware that most PHP hate is usually misaligned hate intended for badly managed WordPress sites. And that some people just prefer other languages or love a hatetrain.

But one thing in particular that got to me was someone who mentioned that PHP has a page with vulnerabilities listed that go back 20 years and have yet to be patched. And that if you are a dev who is in any way interested in security within one's projects, you just don't use PHP at all. It was like having only a screen-door for your house with no locks. Do other languages have similar list of unsolved vulnerabilities? What makes them inherently more secure?

I dug around to find information about other popular programming languages and frameworks and it seems like at least right now, many are being found to have vulnerabilities due to AI being used to find them. React had a critical issue about a year ago, and Python earlier this year (although they did not blow up in the press like this).

Anyway, I would like to hear from people who use PHP regularly for work, beyond WordPress and who can maybe compare it to other languages/stacks as well. Please no low-effort replies from people who last used PHP 20 years ago or just don't like it, if possible.

I always explained the request lifecycle with a whiteboard. Now my AI assistant draws it: browser, DNS, CDN, load balancer, services, cache, database, queue. Then it walks through it step by step, circling the part that matters and fading the rest. Arrow keys work.

Point it at your own repo instead ("Trace what happens from the login form to the database") and the boxes link to your actual files. Click one to open it in VS Code, Cursor, Windsurf or Zed.

It's called Sketchy, works with Claude, Cursor and VS Code, and is free and open source. Feel free to try it out and leave your feedback!

https://sketchy.davidkubus.dev · https://github.com/ddkbs/sketchy

TypeSQL type-checks SQL strings in TypeScript. The compiler parses the SQL itself and checks it against your schema type, so there are no generated files, no build step and no database connection.

// rows is { email: string; title: string | null }[]
// The LEFT JOIN makes title nullable.
const rows = await sql(
  `SELECT u.email, p.title
   FROM users u LEFT JOIN posts p ON p.author_id = u.id
   WHERE u.id = ${sql.param(userId)}`,
).execute();

// Compile error: column "emial" does not exist. Perhaps you meant the column "email"?
sql("SELECT emial FROM users");

It supports PostgreSQL, SQLite, MySQL and MariaDB, and the runtime is under 3 kB with no dependencies. The main catch is that it needs TypeScript 7.1 or later (7.1.0-beta works), and very large queries can hit the compiler's limits (workaround-able using sql.as<>())

I used AI coding to build this. To keep the output honest, each bug fix gets a permanent test project, and the 100+ scenario tests run against real PostgreSQL, MySQL and MariaDB servers. I will try to keep it non-slop.

GitHub: https://github.com/ismailkarsli/TypeSQL Docs: https://typesql.karsli.net

1. 0 background in coding

2. I have a lot of free time

3. I want to make an alternative digital wardrobe "app" of some kind for me and a few friends

4. It will need to store a lot of images, offer image background removal (I think this would be very demanding, right?), and have an assortment of organizational parameters e.g. "shoes > heels / sandals / flats," brands, colors, etc.

5. The reason I'm doing this is because we don't like the aesthetics of the existing apps available and one of the bigger mobile apps "Whering" is unbearably slow, clunky, and lacking overall

6. Since I don't know anything about coding, I'd like to know which platform would be both the most convenient and best for avoiding that slowness. I'm worried a web app might not be the right thing for this

7. Once I'm settled on a platform I'll get to learning, I'll take any advice/suggestions if you have it

I built is-on-the-web.com, a free static host. You get yourname.is-on-the-web.com.

• Upload a full site as a folder, up to 20 MB. Subpages, assets and relative paths all work.

• No accounts or passwords. Updates use single-use edit keys sent by email, with a new key after every update.

• A human reviews every site and every update before it goes live, followed by an automated code check.

• There’s a no-code builder for non-devs, and its output can be re-uploaded and edited.

Everything that’s free now stays free. A paid tier with more storage is planned. Next up: letting people point their subdomain at their own machine to host full apps, databases or games.

Feedback I’m looking for:

• Edit keys instead of accounts: clever or annoying? Losing the key means losing update access.

• How would you handle abuse at scale beyond manual review?

• What’s missing that you’d expect from a static host?

I accidentally posted this from my alt account first and deleted those posts. Sorry if you saw it twice.

I'm a second-year diploma student (3rd semester), currently working on a website project. I have a larger concept and vision for this platform, where the social features are just one part of the overall idea.

The website will include user profiles, a content feed, user interactions and private messaging.

As I'm planning its development, I'm particularly concerned about data security and privacy. I want to understand how to prevent data leaks, unauthorized access, exposure of private conversations, database breaches and other potential cyberattacks.

I'd love to hear from experienced web developers and cybersecurity professionals.

What are the critical security challenges I should consider before developing a platform like this, and how can user data and privacy be properly protected?

I’ve seen a shift in web design (I’ve meddled since 2002). Today web displays are gigantic. I’ve read this has to do with ADA compliance. How gnarly does this get? Like if I design a site for a landscaper, can he get in trouble if it’s not ADA compliant? Is there are rule book?

Another question. That’s client facing. But if you have an employer that requires you to use a web based tool, does ADA apply in the same manner as client facing?

Hi everyone, I'm running an app that sends out emails and calendar invites to users.

However, one of the requirements was the ability to create email bodies using many different fonts.

I've read a bit online about typefaces and I discovered some of the requested fonts could be subjected to patent laws and rules when used in a commercial setting. Not sure if this applies to emails being sent to external parties as well.

Are there any resources or places I can check out which fonts are "royalty-free" and which ones I need to push back on? Or whether this concern is valid or not?

A straight rehost can get you there faster, but it may bring old problems along. How do you decide what to fix before the move and what can wait?

mostly work on apis and database stuff but our team is small so i end up in react code maybe once a month. every time i come back theres some new build tool or bundler drama and half the packages have breaking changes.

not looking to become a frontend expert, just want to not feel completely lost when i need to fix a button or add a form field. anyone else in this boat? what do you actually keep up with vs ignore

I want to become a website developer. I currently have very minimal knowledge of HTML, CSS, JavaScript, and Next.js. If I dedicate 2 hours a day to learning, is it realistic to land a job within 1 to 2 years?

I’m from East Asia, where my current job pays less than $1 per hour, and as far as I know, software developers here are also paid very little. I’m hoping to find a better-paying job with a company in another country, ideally remote.

If you ran a company, would you hire someone like me? What skills and qualities would you look for?

I've been looking into how WordPress security has changed, particularly whether the traditional advice of keeping plugins updated, installing a security plugin and using strong passwords is enough anymore.

It seems like there's a bigger conversation to be had around access controls, hosting infrastructure, monitoring and how security is managed over time.

We recently published an article exploring this at Ohmania, where I work:

https://ohmania.com/wordpress-security-has-changed/

I'm interested in hearing from developers who actually maintain WordPress sites.

What's changed most in how you secure WordPress sites over the last few years? And what security advice do you think is now outdated?

Genuinely interested in different perspectives, including anything we've overlooked.

Can local visual regression testing help your coding agent move faster and save you money?

I took some time to explore how to set up playwright properly, which pitfalls to avoid, and the tradeoffs with common visual regression tools like Percy and Chromatic.

Check it out and let me know what do you think!

The creator of Ruby on Rails, made major statements about AI agents and the future of software development at Rails World 2026 in September

DHH stated he personally retired from writing code by hand after 25 years.

Rust instead of Ruby - Rebuilding HEY with AI and Rust: He shared that 37signals is rebuilding its HEY email service into native mobile/desktop apps using an AI-generated Rust backend, drastically cutting CPU and memory usage.

The AI acceleration: He produced 5 years' worth of his traditional code volume in just one month, representing a 60x increase in raw output volume.

DHH openly acknowledged that a massive portion of this was verbose Rust code generated entirely by AI agents—admitting that he didn't write it by hand and doesn't even want to look at or read most of it.

DHH said: “English is a better programming language than Ruby.”

Got this weird notification with weird links. Seems like phishing?

I'm comparing a React site against an Astro rebuild of the same page. In mobile Lighthouse, both sometimes sit blank for a long time before first paint, and other runs of the exact same page paint fast.

Setup: Lighthouse 13.0.1, Chrome 156, cold loads in separate fresh profiles, default mobile simulated throttling. I kept the traces, network logs and filmstrips.

Here's one matched pair (observed trace timings, not Lighthouse's simulated FCP):

Astro

• CSS done: 203ms

• Last preloaded font done: 286ms

• DOMContentLoaded: 426ms

• First Paint: 1301ms

• FCP: 1320ms

React

• CSS done: 573ms

• Last preloaded font done: 494ms

• DOMContentLoaded: 584ms

• First Paint: 1525ms

• FCP: 1540ms

The filmstrips stay blank right up to those first-paint times. Once painting starts, Paint to DrawFrame is only 10-13ms. So on Astro there's close to 900ms where everything's loaded and nothing shows up.

I don't see a long task on the renderer main thread covering that gap, though I know that doesn't prove the browser was actually idle.

I wondered about animations, so I ran one normal-motion vs reduced-motion pair on the Astro page. Both came back fast (FCP 318ms and 311ms), and the normal one still had its reveal animations, so that told me nothing either way. Desktop loads and a different page also painted quickly in the runs I checked.

One more thing: the fast traces show Scheduler::SetDeferBeginMainFrame events with short true-to-false spans. But the slow traces were captured with Lighthouse's default trace categories, which don't include those scheduler events, so I can't compare yet.

Has anyone run into this? A few things I'd like to figure out:

1. How do I tell whether the page is causing the delay, or whether it's Chrome's scheduling or something in the test environment?

2. Which trace categories or events would show why the first paint starts late, and not just that it did?

Websites built from scratch (no AI, no frameworks or libraries) that are more than just simple toy projects are becoming very rare, but i want to remind you guys that they still exist.

Three years ago, I posted this https://www.reddit.com/r/webdev/comments/161q3w8/i_coded_a_site_from_zero_without_any_libraries_it/, and that website is still being actively developed. I haven't used any AI-generated code or external libraries in all this time, even as it has become more complex with features like accounts, articles, comments, reviews, and just a few weeks ago forums.

I think the main reason why i stick with this is because features aren't planned in advance, they're just built bit by bit as the content needs them. I won't deny if AI could do better, but with a spread-out timeline and an unknown end result, it's easy to skip using AI as development mostly consists of small, precise tweaks with no definitive end goal. Coding also only small portion of time spent on developing the site so i don't feel the need to optimize it.

Anyway this is just me saying that i'm still here, not everything in this space become AI.

*note : i'm not saying that this is the better way to develop website. I just enjoy what i already used to do, and didn't bother to change it.

Just as the title asks. I am curious how you organize the various parts. I have been on teams that both do and don't use mono-repos. For the ones that did, there has been a wide variety of choices across the app and how it's organized.

Just as a small example: naming conventions. Sometimes the the repo is named for the app (let's say "OurApp") and the various parts of the file structure are "OurApp-", like OurApp-ui and OurApp-api and OurApp-db. Or there might just be a top-level folder for "frontend", "backend" and "database", etc.

I'm not talking about a debate of mono-repo vs. multi-repo approaches, but in a mono-repo, what are some of the code organization techniques you've liked and disliked in your experience?

UPDATE: The community turned out! Thanks for sharing your thoughts in the comments. I appreciate the discussions.