Ray

Engineer @hireroger YC S24

[Ray @_raynirola]

Do you remember when you joined X? I do! #MyXAnniversary

[TANSTACK @tan_stack]

TanStack Virtual now has first-class chat support: end anchoring, append-follow, stable prepends, and streaming messages that stay pinned when they should.

The modern web is now a lot of streaming UI on top of lists, so this needed to feel boring 😉

https://t.co/qX9sbphpJJ

[Ben Dicken @BenjDicken]

@tomhaerter

[Yegor @yegormethod]

I add a fake "onboarding fee" of $500 to every proposal then "waive" it on the call

"Normally there's a $500 onboarding fee for new clients but honestly if you're in by friday i'll waive it since we already did the strategy session"

They just received a $500 discount on something that was never going to cost them $500

People don't evaluate price in a vacuum. They evaluate price relative to what they almost paid. $8K feels different when 30 seconds ago it was $8,500

I've been doing this for 7 months and not a single person has questioned it. They just feel like they won something

Many lessons

[Ayaan 🐧 @twtayaan]

i finally understand why it’s called linux porn 😭

[Roberto @robertocommit]

@github [Link text Here](https://t.co/qpbT5SSLsK)
OR
(Link text Here)[https://t.co/qpbT5SSLsK]

[@mikko @mikko]

-----BEGIN PRIVATE KEY-----

[0xDesigner @0xDesigner]

this is so accurate 😂

[Yusuke Wada @yusukebe]

hono/inertia is out!

Just write Hono app / it will be SPA / No need API layer
React/Vue/Svelte support
Powerful TypeScript types

https://t.co/YYeYtknzL2

[v @iavins]

Here is an insane piece of lore inside SQLite's source code

I am researching VACUUM and I was studying their code. In VACUUM, SQLite creates a temp file prefixed with `etilqs_`

Here is why:

[Ray @_raynirola]

If you need a mental debugger just to understand a function, it’s not sophisticated — it’s fragile.

[shubs @infosec_au]

For the Next.js/RSC RCE, it's possible to bypass both Vercel and Cloudflare, and most WAFs really. Don't trust your provider's WAFs, patch your systems ASAP. We added these new WAF aware checks to @assetnote earlier this morning.

[shubs @infosec_au]

Vercel is questioning whether or not a WAF bypass is possible... Pushed an update that uses a payload from @SLCyberSec research team (specifically @hash_kitten). Payload has been running for @assetnote customers for last 18h. https://t.co/9CqANckHK0 use --vercel-waf-bypass flag

[Ayush Agarwal @ayushagarwal]

Here’s the full story.

When the attacker reached out, I expected chaos. Instead, I met someone absurdly skilled, weirdly honest, and surprisingly open about why he did it.

He’s from Russia.
And his “job” is running a full stresser service - hundreds of servers across data centers, custom built browsers with Rust, distributed load generators, all built and managed by him.
At one point he even had 479 attacks running in parallel for different customers.

He walked me through how he bypassed multiple layers of protection at @dodopayments.
He showed me the tooling he built.
He explained how he tests hundreds of sites at once.

No ransom. No extortion.
Just….. “I don’t like weak security and I wanted to push you.”

And honestly, he did push us. Hard.
We spent 48 hours fixing gaps we didn’t know existed.
He pointed out where we were strong and where we weren’t.
He even shared suggestions on how to harden the stack further.

The wildest part?
What started as an attack turned into a conversation about infra, security, and resilience.

Internet is a strange place.
But sometimes the people trying to break you end up making you stronger.

[Bruno @use_bruno]

When a component is truly mission-critical to your product, ignore the rules and reinvent the wheel. You might end up creating the fastest JSON stringify alternative that handles bigints, decimals, and malformed JSON.

Github: https://t.co/d6hAy6jtkv

[AHU @ahlimanhuseynov]

@prisma's documentation is one of the worst developer experiences. Every time I start a new project, I waste hours…

The docs are never fully up to date,anything related to specific frameworks is a total mess. I’m seriously considering switching to @DrizzleORM

[FFmpeg @FFmpeg]

@GregKara6 Google Engineers are not very good at optimisation.
A bunch of basement dwellers beat them:

https://t.co/32TibCrfS3

[__Ola__.js 🔥 @1FineBreed]

I dunno how else to put this

But if I login to your website, copy my jwt auth token, click sign out then paste the auth token in postman and fire a request and it goes through

You simply don’t know how to do auth!

[Sam Altman @sama]

Small-but-happy win:

If you tell ChatGPT not to use em-dashes in your custom instructions, it finally does what it's supposed to do!

[Arnav Gupta @championswimmer]

Indian visa appointments use client side date to check for available slots? Lol.