Hamid Shoja

Software Engineer | Fullstack | Frontend | Typescript | AI

[Hamid Shoja @hashcode01]

@NetworkChuck Password auth

ssh-keygen -t rsa -b 4096
ssh-copy-id username@remote_host

connect without password
ssh username@remote_host

[Hamid Shoja @hashcode01]

3 important harding a VPS (linux machine)

1- block brute force
2- enable firewall
3- password auth

from @NetworkChuck

[Hamid Shoja @hashcode01]

@NetworkChuck Enable firewall

sudo ufw allow 22
sudo ufw enable
sudo ufw status

[Hamid Shoja @hashcode01]

Block brute force automatically

`Sudo apt install fail2ban -y`

`Systemctl status fail2ban`

[Addy Osmani @addyosmani]

Chrome DevTools now supports *individual* network request throttling!

Folks have been asking for this for years! DevTools now allows developers to simulate slow network conditions for specific requests rather than the entire page.

This helps in testing how a web application performs and handles issues when specific resources (like images, scripts, or API calls) are slow to load.

[Hamid Shoja @hashcode01]

@asidorenko_ @rauchg IMO go with whatever feels right to you, there’s not much of a diff between them these days.

[Hamid Shoja @hashcode01]

For large values like JSONB, PostgreSQL uses the The Oversized Attribute Storage Technique (TOAST) mechanism

The original table only stores a small TOAST pointer to the external data.

PostgreSQL moves large data as chunks to a separate TOAST table

[Hamid Shoja @hashcode01]

Learnt today: JSONB has hard limit of about 256MB in #Postgres !

[Hamid Shoja @hashcode01]

JSON type as raw text without decomposition has limit of 1GB, but you lose the indexing and efficient querying

[Hamid Shoja @hashcode01]

#React 19.2’s useEffectEvent vs our Custom useEventCallback https://t.co/dnWdCaJiO3

#javascript #frontend

[Hamid Shoja @hashcode01]

✅ Best practice:

Access Token → keep in memory only.

Refresh Token → in HttpOnly + Secure + SameSite cookie.

[Hamid Shoja @hashcode01]

❌ Don’t store tokens in Local/Session Storage

⚠️ Problem: any XSS = account takeover.

#frontend #backend #authentication

[Hamid Shoja @hashcode01]

✔️ Mitigation (not perfect):

CSP, short-lived access token, refresh token.

[Hamid Shoja @hashcode01]

It's accessible by JS so if XSS happens, attacker can steal it.

There is No HttpOnly support there and you can’t block script access.

Some still use it because backend has no session system and SPA needs to attach token in headers easily.

Any Mitigations?

[Hamid Shoja @hashcode01]

@tan_stack Query instances by default consider cached data as stale (staleTime=0).

So if a transition happens, the query's gonna fetch again. But if you don't want it to keep re-fetching, you can just set a longer staleTime. That way, it stays fresh longer and won’t pull every time

[Hamid Shoja @hashcode01]

If `gcTime=0` and `staleTime=0`, values are stale.

Stale values aren’t removed immediately they must first transition to an `inactive/unused` state.

This transition happens when a component or hook unmounts, or the query key changes.

#react #reactquery @tan_stack

[Hamid Shoja @hashcode01]

Arrow functions have no “this”
If `this` is accessed, it is taken from the outside.

#javascript #javascript_tips

[Hamid Shoja @hashcode01]

@iam_chonchol By default it's enabled by 5 second

[Hamid Shoja @hashcode01]

@elonmusk Still useful as a link to the topic 🔗

[Hamid Shoja @hashcode01]

#Docker Tip:
Need your container to access a specific :port on the host? If you're not using --network host, use the host's IP or host.docker.internal (OS-dependent). 🚀