Phouvanh KCSV

Programmer at Banque pour le Commerce Exterieur Lao Public.

[NOVA @Its_Nova1012]

Two frontend engineers built authentication.

Developer A 👇

Store JWT in localStorage

Developer B 👇

Store JWT in HttpOnly Cookies

Which design passes your security review?

[Tom Dörr @tom_doerr]

Generates pixel-perfect skeleton loading screens from existing UI

https://t.co/rGarHJutyn

[Aiden Bai @aidenybai]

Introducing cnfast

A 3x faster drop-in replacement for `cn`

npx cnfast migrate

[Ashok Sahoo @ashoKumar89]

This code looks clean today.

What becomes painful 2 years later?

[Dhanian 🗯️ @e_opore]

How Kubernetes orchestrates pods
(clearly explained in under 1 min):

Kubernetes is a container orchestration platform that automatically deploys, manages, scales, and heals containerized applications.

Instead of manually managing containers, Kubernetes handles everything for you.

Here’s a simple mental model to understand it:

𝟭) 𝗬𝗼𝘂 𝗱𝗲𝗳𝗶𝗻𝗲 𝘁𝗵𝗲 𝗱𝗲𝘀𝗶𝗿𝗲𝗱 𝘀𝘁𝗮𝘁𝗲
↳ You create a Deployment manifest
↳ Specify how many pod replicas should run

𝟮) 𝗧𝗵𝗲 𝗦𝗰𝗵𝗲𝗱𝘂𝗹𝗲𝗿 𝗽𝗹𝗮𝗰𝗲𝘀 𝗽𝗼𝗱𝘀
↳ Kubernetes chooses the best worker node
↳ Pods are distributed across available resources

𝟯) 𝗣𝗼𝗱𝘀 𝗮𝗿𝗲 𝗰𝗿𝗲𝗮𝘁𝗲𝗱
↳ The kubelet on each node starts containers
↳ Containers run inside pods

𝟰) 𝗦𝗲𝗿𝘃𝗶𝗰𝗲𝘀 𝗲𝘅𝗽𝗼𝘀𝗲 𝗽𝗼𝗱𝘀
↳ Pods can be reached through Services
↳ Traffic is load-balanced across replicas

𝟱) 𝗞𝘂𝗯𝗲𝗿𝗻𝗲𝘁𝗲𝘀 𝗰𝗼𝗻𝘀𝘁𝗮𝗻𝘁𝗹𝘆 𝗺𝗼𝗻𝗶𝘁𝗼𝗿𝘀 𝘁𝗵𝗲𝗺
↳ Health checks detect failures
↳ Crashed pods are automatically recreated

𝟲) 𝗦𝗰𝗮𝗹𝗶𝗻𝗴 𝗶𝘀 𝗮𝘂𝘁𝗼𝗺𝗮𝘁𝗲𝗱
↳ More traffic → more pod replicas
↳ Less traffic → fewer replicas

𝟳) 𝗨𝗽𝗱𝗮𝘁𝗲𝘀 𝗮𝗿𝗲 𝗿𝗼𝗹𝗹𝗲𝗱 𝗼𝘂𝘁 𝘀𝗮𝗳𝗲𝗹𝘆
↳ New pods are created gradually
↳ Old pods are removed with minimal downtime

That's the core idea behind Kubernetes orchestration.

You tell Kubernetes what you want.
Kubernetes continuously works to make reality match that desired state.

If you want hands-on Kubernetes projects, deployments, scaling strategies, and production-grade examples, check out this ebook:
https://t.co/vyboCdLTx0

What else would you add?

——

♻️ Repost to help others learn DevOps.
🙏 Remember to bookmark.
➕ Follow me ( @e_opore ) to improve at software engineering.

[Povilas Korop | Laravel Courses Creator & Youtuber @PovilasKorop]

Reminder: bots/scanners are CONSTANTLY scanning your websites.

Looking for vulnerabilities.

Including "useless" requests like "fake" Livewire POST update.

You may, of course, silence these, or... pay attention to crawling patterns and think how to secure your apps better.

[LocalCan @LocalCanApp]

🆓 LocalCan 3.0 beta 2 is here with a Free mode!

Local domains (.local), and traffic inspection now work with no license - free for local-only dev. Enjoy!

Release notes in comments 👇

[chan is on vacay ✌️ @chantastic]

fuck logitech

[Manu Arora @mannupaaji]

you can create a sticky navbar that morphs when you scroll with pure CSS, no JS or animation libraries required

𝚑𝚎𝚊𝚍𝚎𝚛 {
𝚌𝚘𝚗𝚝𝚊𝚒𝚗𝚎𝚛-𝚝𝚢𝚙𝚎: 𝚜𝚌𝚛𝚘𝚕𝚕-𝚜𝚝𝚊𝚝𝚎;
𝚙𝚘𝚜𝚒𝚝𝚒𝚘𝚗: 𝚜𝚝𝚒𝚌𝚔𝚢;
𝚝𝚘𝚙: 𝟶;
}
@𝚌𝚘𝚗𝚝𝚊𝚒𝚗𝚎𝚛 𝚜𝚌𝚛𝚘𝚕𝚕-𝚜𝚝𝚊𝚝𝚎(𝚜𝚝𝚞𝚌𝚔: 𝚝𝚘𝚙) {
.𝚗𝚊𝚟-𝚋𝚊𝚛 {
𝚖𝚊𝚡-𝚠𝚒𝚍𝚝𝚑: 𝟻𝟼𝚛𝚎𝚖;
𝚋𝚘𝚛𝚍𝚎𝚛-𝚛𝚊𝚍𝚒𝚞𝚜: 𝟶.𝟽𝟻𝚛𝚎𝚖;
𝚋𝚊𝚌𝚔𝚐𝚛𝚘𝚞𝚗𝚍: 𝚛𝚐𝚋(𝟸𝟻𝟻 𝟸𝟻𝟻 𝟸𝟻𝟻 / 𝟶.𝟿𝟸);
}
}

the browser now knows when a sticky element is stuck, all triggered by one container query

available only in chromium browsers only, no firefox or safari which is a shame

[Marko Denic @denicmarko]

Snippet Editor is on Uneed today!

Create beautiful, shareable screenshots of your code.

Check it out: https://t.co/vxTfYpDDmT

[Ritesh Roushan @devXritesh]

System Design Question:

User uploads a 500MB video.

Your API processes it synchronously.

Request times out after 30 seconds.

User retries.
Same file processes twice.

What are the two mistakes here?

[Edgex @SahilExec]

A startup builds their
image upload system like this:

One endpoint handles everything:

1. Receive image upload
2. Resize to 3 different sizes synchronously
3. Save all 3 to local disk
4. Return response

Works fine for 10 uploads/day.

At 100,000 uploads/day

→ Image processing blocks the event loop
→ API times out for all other requests
→ Local disk fills up within weeks
→ No CDN images served from app server
→ Single server = single point of failure
→ Server restart wipes all uploaded images

What are the architectural mistakes here
and how would you redesign this
to handle millions of uploads
reliably and at scale?

[Edgex @SahilExec]

A junior dev built a search feature
with pagination:

Works perfectly at page 1, 2, 3.

User jumps to page 50,000.
Server takes 45 seconds to respond.
Database CPU hits 100%.

What's the fundamental problem
with OFFSET pagination at scale
and what do you replace it with?

[Edgex @SahilExec]

Your team is building a job queue system.

Requirements:
→ Process 50,000 jobs per day
→ Each job must run exactly once
→ Failed jobs must retry 3 times
→ Team of 4 developers
→ Already using PostgreSQL and Redis

You have 3 options:

A) BullMQ with Redis
— battle tested, great UI dashboard
— adds Redis dependency you already have

B) PostgreSQL-based queue (pg-boss)
— no new infrastructure
— uses DB you already have
— slightly slower

C) AWS SQS
— fully managed, no maintenance
— costs money, adds cloud dependency

Which do you pick
and what's the one requirement
that makes your choice obvious?

[Vlad Sazonau @vladsazonau]

🚨Must Have🚨

- disable auto-updates for extensions in VS Code/Cursor + other forks (MacOS: Cmd + Shift + P -> "Disable Auto Updating Extensions")
- use static analysis (https://t.co/0re0oLjgCO) for GHA to catch security issues
- use https://t.co/64cwF4XjxI to update GHA to latest versions with SHA pinning
- add Socket Free Firewall (https://t.co/qldhK1yhDt) or safe-chain (https://t.co/IFB7976pwr) when installing npm packages

[Edgex @SahilExec]

A startup builds their URL shortener like this:

One function handles everything:

1. Generate random short code
2. Insert into database
3. On redirect - query database
4. Update click count
5. Redirect user

Works perfectly at 1,000 URLs.

At 100 million URLs and
500,000 redirects per second

→ Random short codes start colliding
→ Every redirect hits the database
→ Click counter updates block redirects
→ Single database is the bottleneck
→ p99 latency goes from 10ms to 8 seconds

What are the architectural mistakes here
and how would you redesign this
to handle billions of URLs
and millions of redirects per second?

[Piyush Garg @piyushgarg_dev]

The vulnerability is an Algorithm Confusion / Key Confusion attack.

The server verifies JWTs like this:

jwt.verify(token, KEY)

But it never restricts allowed algorithms.

That means an attacker can:
- Change alg from RS256 → HS256
- Use the PUBLIC key as the HMAC secret
- Forge arbitrary tokens like:
{ "role": "admin" }

Impact:
- Full auth bypass
- Privilege escalation
- Account takeover
- Admin access without private key compromise

Fix:
jwt.verify(token, KEY, { algorithms: ["RS256"] })

[Martti Malmi @marttimalmi]

New version of Nostr VPN is out. Like tailscale, but no email addresses or 3rd party accounts, just public keys. New:
* native multiplatform user interfaces
* Nostr-based multihop routing (FIPS protocol) — very useful when NAT holepunching fails
* improved network management UX

[IP @ipwanciu]

That's a simple reminder to use `structuredClone` instead of the `JSON.parse/stringify` solution.

Widely available since March 2022.