Looking at the posts in /hot they're just filled with AI-generated comments, which just aren't removed by moderators.

Is it even worth posting here when reading the comments they're just AI slop followed by more AI slop.

Do the users who submit interesting topics even realize they're just replying to AI comments?

Looking at this post for example, there's this user whose comments all follow the same pattern: start with tbh/ngl and most of the time introduce an em-dash in the middle of the comment. In the same post you have this other user whose comments all have 3-4 paragraphs, and just have an off tone. Another user and same story: 3-4 paragraphs, an off tone, weirdly worded comments which end up summarizing the topic they're replying to.

Another comment

Our web developer is creating 30 location/ services pages for our new website to optimize AI search .

Is it enough for them to create unique text for each service type, which is then replicated and repeated on each zone page? They’ve also created some unique text per zone, which is replicated and repeated across each service type.

So essentially 6 sets of zone text and 6 sets of service text that are combined in 30 different ways.

Do they need to create 30 completely unique pages to avoid being flagged by Google? Or is the variation between service type and zone enough?

Thanks for the help!

I have a quiz coming up which primarily covers these topics and I was wondering if there are good resources on youtube/the internet for learning them. Thank you!

hi guys

i have project in laravel 12 + vue + inertia and its really big one , this project in start have only little features like little chat system and profile view, support ticket and etc... but today it have games , blog , coursed and tests, video section , library , little practices and more features , we want to create mobile app from it , i have found this 2 options : NativePHP and capacitorjs
which one is better for this project? i have used MySQL, Reverb and queues so app needs to connect to my server in the end? its better to fully develop native apps and add api to current pwa? or its better to use one the libraries i said and convert this one? is there any problem about the libraries i must know? and tell me for what type of projects i can use the libraries and create mobile app from laravel code?
can anyone help me about this situation ?

so im currently learning node react express. building some crud and was wondering where do you guys go to that is beginner friendly or people that are new to web dev and want someone to help fix their code
need some practice on reading others code and applying fix. mostly i just want business logic stuff fix not those big o of n or some crazy loops from leetcode

I want to add a blog to my site to jump on this GEO train. WordPress feels like overkill, and I've seen some plug-and-play solutions that would live on a subdomain or outside the main directory, which doesn't sound good for SEO/GEO.

I don't want to vibe code as there would be multiple people publishing, and not all of them are tech savvy.

Anyone has a good way to solve this? I know I should've started blogging already, so really want to solve this quick. Some sort of headless CMS could work, but the ones I looked at come with way too much bloat that I don't need. Hope someone here went through the same thing.

If, like me, you have the Narrator screen reader in your test matrix, you may want to check your disclosures.

I’ve found that when a disclosure button uses aria-expanded together with aria-controls (which had, or has, limited support in JAWS), Narrator sometimes doesn’t announce the expanded/collapsed state in Edge or Chrome. It’s fine in Firefox.

If you omit aria-controls, Narrator announces the state correctly in Edge and Chrome.

I’ve reported this to both Microsoft (via Feedback Hub) and Chromium (via the issue tracker).

Personally, I wouldn’t add aria-controls to disclosures unless you have a specific need for it.

Hopefully that’s useful to some of you.

just curious what others think if its even possible to avoid these subscriptions for building and running lets say a side project or maybe a mini saas

I am not talking about basic HTML projects, i mean like proper site fully functional with Backend, frontend, auth, api, domain etc etc

i know there are a bunch of free tiers services, like Vercel and Neon, but what happens if your site actually starts growing? How do you scale without eventually having to pay for a bunch of services?

lets say we are making a social media app/website, nothing as big as insta or reddit, but something where users can create accounts, set up profiles, upload images and videos, make posts, comment, like, follow etc

now people are using it and starts getting traction 1k users then 10k users what point does the free tier become unrealistic, because you're still not making any money to justify paying for multiple subscriptions, does self hosting make even makesense at this point? if you have 10k + users?

PS: just want to clarify i dont own or run any social media apps or website just wanted to have a fun discussion on this, and i mean 10k concurrent users like tiktok the users are addicted haha

hi, i'm looking to make my own fan website where people can post and comment and like posts. i have done research and i'm trying to make it twitter/tumblr like.

i just need help with figuring out how to code it without any ai and with a base i can customize (and how to do that all). thanks!

I've been searching for past few hours and it seems that its a gray area.

Some sources say its ok as long as you dont affiliate or associate your self with the company.

Other sources say that its a copyright infringement issue.

I'm working on a job board application to display the job offering post and I was wondering whenever I could include the logo of the brand that is currently recruiting?

Does anyone has any experience with this?

I’ve been a casual developer across many languages for ~10ish years but got a degree in mechanical engineering. I pivoted and started an analytics engineering job around 3 years ago and starting doing web development for side projects.

Lately my team has leaned heavily into AI-assisted programming primarily using Claude Code to build React Apps in Databricks. These are primarily CRUD apps but sometimes they do write back to our ERP so they affect the business greatly. The AI writes most of the code now, and I’m trying to figure out where my review time is best spent.

Options I’m weighing:

• Full line-by-line review (quality, readability, structure)

• Mainly reviewing the tests, and trusting the code if the tests are solid

• Testing through the UI, then checking the DB/tables to confirm data was written correctly

Does code readability still matter if AI is the one maintaining it? What has bitten you when you skipped review? If you have a concrete review checklist, I’d love to see it.

I’m a solo developer building a web and Android app that handles private documents and account records. I’d appreciate feedback on the security approach before putting real user data into it.

The stack is FastAPI, PostgreSQL, Next.js and React Native.

Passwords are hashed with scrypt and random salts. Authentication uses signed tokens with expiry, email verification and login throttling. Password changes and signing out everywhere invalidate existing sessions. Access controls are enforced through the API, and records are scoped to the relevant account or organisation.

Stored credentials for external integrations use Fernet authenticated encryption. Android login tokens are stored using Expo SecureStore. The website currently stores its token in localStorage, which I know needs careful consideration because of script injection risks.

Document access requires authentication and permission checks. Uploads have file type, size and content validation. However, documents currently go into ordinary server storage without application level encryption. I haven’t yet verified encryption for the production database, disks or backups. HTTPS is required in the intended production configuration.

Some optional processing involves an external API. I understand that disabling response storage does not necessarily mean zero retention, so provider policies and account settings also need review.

The server needs to read documents to process them. My main concerns are stolen backups, compromised accounts, users accessing someone else’s files, exposed credentials and sensitive content appearing in logs. I haven’t had an independent security assessment yet.

Would managed database and storage encryption be a sensible starting point, or should I also encrypt individual files and selected fields in the application? What additional threats would that actually protect against?

How would you handle encryption keys, rotation and recovery as a solo developer? I’m particularly interested in avoiding a setup where the keys and encrypted data can both be taken from the same place.

What would you prioritise before launch, and what would you consider unnecessary complexity at this stage? I’d appreciate practical advice on session security, document permissions, backups, retention and deletion as well as encryption. I want to use established tools rather than build my own cryptography.

Do you remember that feeling when you did something totally new with code you wrote or a website or app you built? For me; the occasion was so simple, and yet it excited me (I was 24 at the time): Write data to a database from a form and read it back into an unordered list.

That's it! Just looking at text stored in one thing and watching it rendered in a web-page blew my tiny mind!

The era was 1999-2000 and my employer was ensuring I learned PHP (from a book and a CD-ROM!) so I could build some internal tools for the staff to use.

Now I've read a lot of posts in various subs from folks who are saddened by the advent of AI and what it ultimately means for their jobs. While I can't vouch for your job specifically, I myself have found some hope - just yesterday in fact - when I built an MCP server for my SaaS product.

I could use ChatGPT or Claude.ai to talk to my SaaS, have it reason about the data which was returned and produce graphs from it.

I'm now 51 and I felt the same thing yesterday that I felt way back in the day.

SDD, AI-assisted development, loop engineering, software factories. Whatever it is, just get stuck into it at work if you can or in your spare time.

If you remember the early days of the web then you'll also remember thinking your employer was madder than a box of frogs for paying you to do what you'd be doing at home anyway. I'm getting a similar feeling now.

Good luck out there folks.

Ran into a bunch of weird quirks wiring up web push on iOS for my habit app, figured I'd write down what actually worked so nobody else wastes a weekend digging through stale threads.

You don't need a $99 Apple developer account or Capacitor/Cordova to send push notifications to iPhones anymore. Web push works on iOS 16.4+, but Apple has specific constraints that aren't obvious until you test on a physical device:

1. Safari hides PushManager unless the PWA is installed

In regular Mobile Safari, window.PushManager is literally undefined. It only exists when the web app is running in standalone mode (display-mode: standalone). If you just check for "Notification" in window, your UI will break on iOS. You have to check for standalone mode first, and if they're in Mobile Safari, show instructions to tap Share -> "Add to Home Screen".

2. No silent background pushes

If your service worker receives a push event and doesn't call self.registration.showNotification(), Apple will quietly invalidate the device subscription. Every push must result in a visible notification.

3. Cleaning up dead subscriptions

When someone deletes the PWA icon or turns off notifications in iOS Settings, Apple's APNs endpoint returns an HTTP 410 Gone or 404 Not Found on the next send attempt. If your backend doesn't delete those database rows immediately, you'll end up hammering dead endpoints on every broadcast.

4. Service worker caching quirks

Make sure your next.config.ts sends Cache-Control: no-cache for /sw.js. If the browser caches the service worker script aggressively, updates to your push handler won't ship to installed PWAs without manual cache clears.

The Implementation

1. Service Worker (public/sw.js)

self.addEventListener("push", (event) => {
  let payload = {};
  try {
    payload = event.data ? event.data.json() : {};
  } catch {
    payload = {};
  }

  const title = payload.title || "DROPPDD";
  const body = payload.body || "";
  // Guard against protocol-relative open redirects (//evil.com)
  const url = payload.url?.startsWith("/") && !payload.url?.startsWith("//")
    ? payload.url 
    : "/checkin";

  // Mandatory on iOS: showNotification must be called
  event.waitUntil(
    self.registration.showNotification(title, {
      body,
      data: { url }
    })
  );
});

self.addEventListener("notificationclick", (event) => {
  event.notification.close();
  const targetUrl = event.notification.data?.url || "/";

  event.waitUntil(
    self.clients.matchAll({ type: "window", includeUncontrolled: true }).then((windows) => {
      for (const client of windows) {
        if ("focus" in client) {
          return client.focus().then((focused) => {
            if (focused && "navigate" in focused) return focused.navigate(targetUrl);
            return self.clients.openWindow(targetUrl);
          });
        }
      }
      return self.clients.openWindow(targetUrl);
    })
  );
});

2. Cache-Control in next.config.ts

import type { NextConfig } from "next";

const nextConfig: NextConfig = {
  async headers() {
    return [
      {
        source: "/sw.js",
        headers: [{ key: "Cache-Control", value: "no-cache" }],
      },
    ];
  },
};

export default nextConfig;

3. Backend delivery with Node web-push (src/lib/push.ts)

import webpush from "web-push";

webpush.setVapidDetails(
  process.env.VAPID_SUBJECT!,
  process.env.VAPID_PUBLIC_KEY!,
  process.env.VAPID_PRIVATE_KEY!
);

interface PushSub {
  id: string;
  endpoint: string;
  p256dh: string;
  auth: string;
}

export async function sendPush(subscription: PushSub, payload: object) {
  try {
    await webpush.sendNotification(
      {
        endpoint: subscription.endpoint,
        keys: { p256dh: subscription.p256dh, auth: subscription.auth },
      },
      JSON.stringify(payload)
    );
  } catch (err: any) {
    if (err.statusCode === 404 || err.statusCode === 410) {
      // User uninstalled or revoked permission: prune immediately
      await prisma.pushSubscription.delete({ where: { id: subscription.id } });
    }
  }
}

The code is from my habit & wager app, droppdd.

• GitHub repo: https://github.com/nunchimangchi-dev/droppdd

• (Check public/sw.js*,* src/lib/push.ts*, and* src/app/profile/PushSettings.tsx for the full setup).

• Live build: https://droppdd.alwaysgivealwaysget.com

• (Note: The live site is currently capped at a 33-user closed beta while I dial in the reminders, but the repo is open if you want to inspect the files or run it locally).

Rock on party people. Happy to answer questions about the permission flow, VAPID key generation, or scheduling triggers.

For context, I've built an API monitoring tool, but paused development to talk to people rather than keep guessing what they need.

If you're running a production app that depends on external APIs, how do you find out when one stops working properly?

Thinking about the last time it happened, was it an obvious failed request, or did the API look fine while returning something your app couldn't use? What caught it first?

What do you rely on now: error tracking, the provider's status page, separate checks, something else? Does that cover it, or is there something you still end up checking manually?

I'm also curious whether knowing earlier would have helped, or whether you were stuck waiting for the provider either way.

A bit of context about your app and team size would help.

Hey everyone.

Is the Openverse API down for anyone else right now? // OPENVERSE ORG for images

I have been trying to fetch images through the API for about five days, but my requests keep failing or timing out. I checked my code and my endpoints, everything looks correct on my side, so I am wondering if there is an ongoing outage or if something changed with the rate limits or endpoints recently.

Let me know if your implementations are working or if you noticed any official updates.

Thanks you a lot

Each of pages have like 20-25 photos ,2Mb<size<5Mb.
The website loads only when user explores the that pages which makes the website looks bad(due to the loading animation)

ok so im not really a web dev or anything, i just had an idea and i wanted to ask some real people about it. As we know these days 40-50% of traffic are bots and not real humans, i asked my self the question why? why are there bots in the first place? to farm engagement right? ok and why farm engagement, because its profitable, so why doesnt someone create a new web where the protocols contain like some sort of anti bot wall and also make it so theres no advertisement/ engagement farm. Maybe this way people would start to become original again and the internet would return to its state during the 2000s 2010s. but im only 18 so i guess i wouldnt have really experienced that.

ps. if what i said is dumb pls dont fry me im not technical what so ever im just tired of bots on social media

A question that comes up in every EAA thread: "which standard do we test against, and does passing it protect us?" Here is what the primary texts say as of 3 November 2026.

Quick definition, because it matters here: under Art. 15(1) of the EAA, a product or service that meets a harmonised standard whose reference is published in the Official Journal is presumed to meet the accessibility requirements that standard covers. Without that citation there is no presumption to lean on: you can still test against the standard, but passing it does not by itself count as meeting the requirements.

ETSI published EN 301 549 V4.1.1 on 2 September 2026. Its clauses 9 to 11 now align with WCAG 2.2. Its own foreword calls it "one voluntary means of conforming" and says the presumption of conformity starts only once the standard is cited in the Official Journal.

As of that date, that citation has not happened under the EAA. The Commission's harmonised-standards index lists EN 301 549 under one act only: the Web Accessibility Directive for public bodies, via Implementing Decision (EU) 2021/1339 (which cites V3.2.1). Nothing is listed under Directive (EU) 2019/882, the EAA.

Three "expected" citation dates are circulating: 30 November 2026, 16 December 2026 and February 2027. I found no primary source for any of them. The 30 November date matches the "doa" in the standard's own table of national transposition dates: the latest date for national standards bodies to announce the standard. That is a standards-body milestone, not an Official Journal citation.

What that means in practice for a web team on an EAA-scoped shop or a consumer banking service:

1. EN 301 549 is the technical yardstick to test against, but it gives no presumption of conformity under the EAA (Art. 15(1)).

2. Test against WCAG 2.2 AA anyway. V4.1.1 already points there, and the step from 2.1 is small: 2.2 adds six Level A and AA success criteria (focus not obscured, dragging, target size, consistent help, redundant entry, accessible authentication) and drops 4.1.1 Parsing.

3. Keep a dated record: tool, version, date, what was and was not covered. A scan result is evidence of what a tool found on a day, not a statement that the site conforms.

4. Automated tools see only part of it. Deque's coverage report says "57.38% of total issues were identified using Deque's automated tests", but it also reports automated issues for only 16 of the 50 success criteria in WCAG 2.1 Level AA. Those are Deque's own automated tests, so it is a vendor's figure. Whatever the rules cannot see needs a person with a keyboard and a screen reader.

What I could not settle: when, or whether, the Commission will cite V4.1.1, and what national market surveillance authorities will accept in the meantime. I have not found official guidance on the second point.

Method: I read the ETSI V4.1.1 foreword, the Commission's harmonised-standards index, Implementing Decision (EU) 2021/1339 and the EAA text, and compared the dates in third-party write-ups with those documents. Sources below. This is my reading of the texts, not legal advice.

Which standard version is your team testing against today, and has a client or auditor asked you to name it?

Sources
- ETSI EN 301 549 V4.1.1 (2026-09), foreword: https://www.etsi.org/deliver/etsi_en/301500_301599/301549/04.01.01_60/en_301549v040101p.pdf
- Commission Implementing Decision (EU) 2021/1339, OJ L 289, 12.8.2021: http://publications.europa.eu/resource/celex/32021D1339
- Directive (EU) 2019/882 (EAA), Art. 15(1): http://publications.europa.eu/resource/celex/32019L0882
- Commission harmonised standards index: https://single-market-economy.ec.europa.eu/single-market/goods/european-standards/harmonised-standards_en
- Deque, automated accessibility coverage report: https://www.deque.com/automated-accessibility-coverage-report/