标签：#web

When people talk about hackathons, they talk about the demo. The pitch, the UI, the "aha" moment on stage. Nobody really talks about the person who spent the whole weekend making sure the data didn't fall apart. That was me on AidStream, a blockchain-based aid distribution platform we built in a weekend and trust me it wasnt that easy as it seems. At a normal project, you can revisit your data model whenever.But during a hackathon you cant since when teamamtes start working on top of your tables it means both codes may start breaking . Serverless Postgres was the right choice for a hackathon: no local DB setup, no "wait, whose laptop has Postgres installed" problem. Everyone could connect to the same instance immediately. The gotcha was connection limits — with multiple people hitting the same database while testing features simultaneously, we ran into connection issues at the worst possible time (an hour before demo). So next time you watch a hackathon demo go off without a hitch, remember — someone probably spent the whole weekend quietly making sure the database didn't have a say in it. If you're the one holding the schema together at 2am, know this — it's not the flashy role, but it's the one that decides whether anyone else's code even runs.

Node.js 26 has been released, featuring the Temporal API enabled by default, an updated V8 engine to version 14.6, and the Undici HTTP client upgraded to 8.0. The release also removes deprecated legacy APIs. Developers should note migration points related to NODE_MODULE_VERSION changes. Node.js 26 is current for six months before entering long-term support. By Daniel Curtis

I was implementing a feature where the session container would track a lastActivity timestamp, updated on every authenticated request. Standard stuff. I wrote it, tested it locally with curl, and noticed something odd: I kept getting a new Set-Cookie header value on every response. Not occasionally. On every single one. A week later I was sending a pull request to mezzio/mezzio-session-cache . The Setup: Two Backends, One Session Our system had a constraint: two backend applications, written in different languages, sharing a single user session. One was the main PHP/Mezzio app. The other was a service in a different stack that needed to read from, and update the lastActivity timestamp on, the same session container. There are a few ways to make polyglot session sharing work. We landed on a shared cache backend (Redis) with a well-defined session structure. Both apps could read and write through their own libraries, as long as they agreed on the storage format and the cookie name. The session ID was the contract. That contract is the part that quietly broke. A Missing Escape Hatch My first instinct was the usual list of suspects. Was something calling regenerateId() in a middleware I didn't know about? Was there a logout being triggered somehow? Was a misconfigured cache layer evicting and recreating sessions? After a bit of digging through the call stack, I ended up in the library itself. And there it was: CacheSessionPersistence was regenerating the session ID whenever the session data changed . Not on login. Not on privilege escalation. On every write . That's when the real question hit me: why on earth would a library do that by default? Reading Code Before Changing It When you find behavior that surprises you in someone else's code, the wrong move is to immediately label it broken. The right move is to assume the maintainers had a reason, and find out what it was. The reason, in this case, is session fixation . Session fixation is a class of attack where an atta

"Cheapest residential proxy" is a search query with a hidden trap: the lowest price per GB and the lowest cost per successful request are not the same number. This post breaks down ten budget-to-mid-tier residential proxy providers from a cost-and-reliability angle, plus a script for measuring the metric that actually matters before you commit real traffic. The trap: price per GB vs. cost per success A proxy at $0.50/GB that fails half your requests is more expensive than one at $1.40/GB with a 98% success rate, because you're paying for retries, wasted bandwidth, and engineering time spent debugging "random" failures. Before comparing sticker prices, calculate: real_cost = traffic_price + failed_request_overhead + retries + setup_time + support_delays Concretely, here's a quick way to model it: def cost_per_success ( price_per_gb , success_rate , avg_response_kb = 50 , retry_overhead = 1.3 ): """ price_per_gb: advertised price success_rate: 0.0-1.0, measured against YOUR target site, not the vendor ' s claim retry_overhead: multiplier for bandwidth wasted on failed/retried requests """ effective_price = price_per_gb * retry_overhead gb_per_request = avg_response_kb / ( 1024 * 1024 ) cost_per_request = gb_per_request * effective_price return cost_per_request / success_rate # Example: cheap provider, mediocre success rate print ( cost_per_success ( 0.50 , 0.75 )) # looks cheap, isn't once failures are priced in # Example: pricier provider, high success rate print ( cost_per_success ( 1.40 , 0.98 )) # often cheaper in practice Run this with your own measured success rate (see the test harness further down), not the vendor's advertised uptime number. What to actually compare Before looking at price, check whether the provider covers: IP pool size and quality (pool size alone tells you nothing about freshness or block rate) Country vs. city-level targeting Sticky session support (for anything stateful) Rotation controls (for scraping/data collection) HTTP(S) and SOCKS5

For years, developers have faced the same dilemma when implementing complex search APIs: GET is the correct semantic choice for read-only operations, but query parameters can become extremely long and difficult to manage. POST allows sending a request body, but it's intended for operations that may change server state, making it a poor semantic fit for searches. To bridge this gap, the IETF has introduced a new HTTP method: QUERY (RFC 10008). Why was QUERY introduced? Modern APIs often require complex filtering: nested JSON filters GraphQL-like requests advanced search criteria large lists of IDs geospatial or analytical queries Encoding all of this into a URL is cumbersome and can exceed practical URI length limits. Developers have traditionally worked around this by using "POST" for read-only searches. The problem is that "POST" doesn't express the intent of the request very well. The new QUERY method solves this by allowing clients to send a request body while keeping the operation explicitly safe and idempotent. Key benefits ✅ Request body support Unlike "GET", "QUERY" allows sending structured request data in the message body, making complex searches much easier to model. ✅ Safe by design Like "GET", a "QUERY" request must not modify server state. It clearly communicates that the request is read-only. ✅ Idempotent Repeating the same "QUERY" request produces the same result without additional side effects, allowing clients and intermediaries to safely retry requests after transient failures. ✅ Cache-friendly Unlike the common "POST"-for-search pattern, "QUERY" is designed to work with HTTP caching, enabling better performance and more efficient network usage. ✅ Better API semantics Instead of overloading "POST" for read operations, APIs can now express their intent more accurately: "GET" → simple resource retrieval "QUERY" → complex read operations with a request body "POST" → operations that create or modify state Example Instead of forcing everything into a lo

Python's Memory Model Is Not What You Think It Is Ask most Python developers how Python stores a variable and they will say "it stores the value." This is imprecise in a way that causes real bugs and real confusion in interviews. A precise mental model of how Python stores and retrieves data changes how you read and write code. Python does not store values in variables. Python binds names to objects. The distinction sounds philosophical until you trace code that involves mutation, function arguments, or aliasing. Then it becomes the most practically useful concept in the language. Names Are Not Boxes The box metaphor, which says a variable is a box that holds a value, is how most introductory programming courses explain variables. In many languages this metaphor is close enough to accurate that it does not cause problems. In Python it is wrong in ways that matter. A more accurate metaphor: a Python name is a label attached to an object. The object exists independently in memory. Multiple labels can be attached to the same object. Attaching a new label does not move or copy the object. x = [ 1 , 2 , 3 ] y = x print ( id ( x ) == id ( y )) # True (same object, two labels) When you write y = x , you are not copying the list. You are creating a second label that points to the exact same list object. The Four Operations You Must Distinguish 1. Assignment creates a new binding x = [ 1 , 2 , 3 ] x = [ 4 , 5 , 6 ] # x now labels a completely different object The first list still exists in memory until garbage collected. The name x simply stops pointing to it and now points to the second list. 2. Mutation modifies an existing object x = [ 1 , 2 , 3 ] x . append ( 4 ) # the object x labels is modified in place Any other name pointing to the same object will instantly reflect this change because they look at the same memory location. 3. Augmented assignment on mutable types mutates x = [ 1 , 2 , 3 ] y = x x += [ 4 , 5 ] print ( y ) # [1, 2, 3, 4, 5] (same object, mutated) The

This is part of my work with 01MVP on OpenNomos — a project that helps founders validate ideas before building. The $0 Launch I once spent three months building a product. It had everything: authentication, payments, a polished UI, dark mode. I was proud of it. Launch day: 27 visitors. Zero signups. I had spent 90 days building and precisely zero days asking anyone if they wanted what I was building. I was solving a problem that existed only in my head. The Hardest Lesson The product wasn't bad. The code was fine. The UI was clean. The problem was that I never validated the core assumption: does anyone actually have this problem, and would they pay to solve it? This is the most common failure mode in indie hacking. You build something you think is cool, polish it to perfection, and launch to silence. The code was never the bottleneck. The validation was. What I Do Differently Now Talk to 10 people before writing code. Not surveys. Not landing page analytics. Actual conversations. "Would you use this? Would you pay for it? Why or why not?" Build a mockup, not a product. A Figma prototype or even a Google Form that simulates the core workflow is enough to test willingness to engage. Charge from day one. Free users will tell you nice things. Paying users will tell you the truth. If nobody will pay, the idea isn't ready. Kill fast. Most ideas fail. The goal isn't to make every idea succeed — it's to fail the bad ones quickly so you can find the good ones. Why This Matters More in 2026 In 2016, building a product was hard. You needed to know how to code, set up servers, handle deployments. The barrier to building kept bad ideas from being built. In 2026, Cursor writes your code, v0 generates your UI, and Replit deploys it. The barrier to building has collapsed to near zero. But here's the problem: AI can help you build anything. It cannot help you figure out what's worth building. The result is a flood of well-built products that nobody wants. The bottleneck shifted from

Disclosure: I write about projects in the OpenNomos ecosystem, including Swipe Cleaner. The Problem With Photo Cleaners Most photo cleaning apps have a dirty secret: your photos leave your device. They get uploaded to some server for "AI processing," "cloud analysis," or just because the developer didn't think about it. Swipe Cleaner takes the opposite approach. Everything happens on your iPhone. Not a single pixel leaves your device. Let me break down why that matters, and how it actually works under the hood. The Architecture Swipe Cleaner is built on three principles: 1. On-device processing, always. Image analysis, duplicate detection, and similarity matching all run locally using Apple's Core ML and Vision frameworks. No cloud roundtrips, no server costs, no privacy policy loopholes. 2. Tinder-style UX for decisions. You don't manage a grid of thumbnails and checkboxes. You swipe. Right to keep, left to delete. This isn't just a UI gimmick — it's a deliberate choice to reduce decision fatigue. When you have 3,000 photos to clean, you need flow, not friction. 3. Sandboxed storage access. The app requests permission for exactly what it needs. It doesn't ask for your entire photo library if you only want to clean screenshots. This is iOS privacy-by-design done right. Why On-Device Matters Now We're in a weird moment. AI capabilities are exploding, which means the temptation to "send it to the cloud for better results" is stronger than ever. But at the same time, Apple is pushing hard in the opposite direction — Private Cloud Compute, on-device ML, differential privacy. Swipe Cleaner aligns with where the platform is going, not where the industry has been. The Technical Trade-offs Local-first isn't free. Here's what you give up: Model size constraints. You can't run a 70B parameter vision model on an iPhone. The models need to be small, optimized, and ruthlessly efficient. No cross-device sync. Your cleaning decisions stay on one device. No cloud means no sync. For

Every developer has been there: you need to format a JSON blob, decode some Base64, or convert a timestamp. You open your terminal, look for the right npm package, or — worse — write a quick script. I used to do this too. Then I discovered a better pattern. The Problem with Local CLI Tools Local tools have real drawbacks: Installation overhead : npm install -g some-tool for a one-time task Version rot : tool stops working after OS update No sharing : you format JSON but cant send the result to a colleague Environment drift : works on your machine, not on staging Online Tools as a Pattern Opennomos Json (reachable via opennomos.com/en/project/01KJ850Z7PNGXHXESBM68HE12Y) represents a shift: developer tools as a platform , not as utilities you install. What makes this different: Zero install — browser tab, done Cross-device — phone, laptop, any OS Shareable results — formatted output has a URL you can send to teammates Timestamp converter built in — ms, seconds, ISO 8601, bidirectional Base64 codec — no need for a separate site The Bigger Trend We are seeing the same pattern across the dev ecosystem: GitHub Codespaces (IDE in browser), Replit (runtime in browser), Vercel (deployment in browser). The next frontier is utility tools in browser . Why run jq locally when a well-designed online tool does it faster and gives you a share link? Try It Head to opennomos.com/en/project/01KJ850Z7PNGXHXESBM68HE12Y — the JSON tools are free, fast, and part of a broader contributor rewards system that makes open-source tooling sustainable. Built as part of the Nomos Build-in-Public series.

DeepSeek vs Qwen vs Kimi vs GLM: Which AI API Actually Wins in 2025? I've spent the last decade designing systems that need to stay up no matter what. 99.9% uptime isn't a marketing slogan for me — it's the difference between a happy customer and a 3am incident call. So when the Chinese model ecosystem exploded with options like DeepSeek, Qwen, Kimi, and GLM, I didn't just glance at the benchmarks. I pulled the levers, watched the dashboards, and stress-tested every endpoint I could get my hands on. Here's what I found after weeks of running these models behind load balancers, instrumenting them with p99 latency tracking, and watching how they behave when you throw production traffic at them. The Multi-Region Reality Nobody Talks About Most comparison articles treat AI APIs like they're interchangeable endpoints you curl against. That's fine for a weekend hackathon. It's dangerous for production. When I'm architecting a service that depends on an LLM, I care about three things before I care about quality: p99 latency under sustained load Failover behavior when a region gets congested Cost per million tokens at the rate I'm actually consuming I ran each of these four providers through a series of synthetic workloads — bursts of 200 concurrent requests, sustained 50 RPS for an hour, and cold-start recovery tests. The numbers told a story that the marketing pages don't. The Data at a Glance Here's the TL;DR before I dive in. DeepSeek gives you the best price-to-performance ratio, full stop. Qwen has the widest catalog of model sizes I've ever seen from a single provider. Kimi costs a premium but earns it on reasoning-heavy workloads. GLM punches above its weight on Chinese-language tasks and offers multimodal support that the others don't. Dimension DeepSeek Qwen Kimi GLM Provider DeepSeek (幻方) Alibaba (阿里) Moonshot AI (月之暗面) Zhipu AI (智谱) Output price range $0.25–$2.50/M $0.01–$3.20/M $3.00–$3.50/M $0.01–$1.92/M Budget pick V4 Flash @ $0.25/M Qwen3-8B @ $0.01/M N/A GL

If you've ever built a scraper that worked perfectly in dev and then got blocked or CAPTCHA'd the moment it hit production traffic volume, you already know why proxy choice matters. This post breaks down residential proxies from a practical, implementation-focused angle: what they are, when to use them vs. alternatives, how to wire them into common tools, and how the major providers stack up. TL;DR Residential proxies route requests through real ISP-assigned IPs, so they're harder for anti-bot systems to fingerprint than datacenter IPs. Rotating residential proxies are for scraping/data collection. Sticky sessions (or static ISP proxies) are for anything stateful — logins, checkout flows, long-lived account sessions. Nstproxy is a good default pick if you want residential, static ISP, and mobile proxies under one API/dashboard instead of juggling multiple vendors for different parts of your stack. For large-scale enterprise scraping, Oxylabs and Bright Data have the most mature tooling. For budget/prototype work, IPRoyal, DataImpulse, and Webshare are worth testing. Proxy types, quickly Type Use for Pros Watch out for Residential Scraping, SERP checks, ad verification Looks like real user traffic Usually billed per GB Static ISP Long-lived sessions, account workflows Fast + stable IP Less useful for high-volume rotation Datacenter Speed-sensitive, low-stakes tasks Cheap, fast Easiest to fingerprint/block Mobile Mobile-first platforms/apps Strongest trust signal Most expensive per GB A production-grade scraping/automation stack often uses more than one of these at once — e.g., rotating residential IPs for crawling, and static IPs pinned to specific browser profiles for anything that requires a login. Wiring a residential proxy into your code Most providers give you a host:port endpoint plus username:password auth, and let you control rotation/session stickiness through the username string. A typical setup looks like this: Python ( requests ): import requests proxy_ho

Hi folks! This is Mark Tony , a fresher to this field of technology from the UG Physics background. In a way, I'm pursuing my desire which I missed during my college days. My new venture begins along with @payilagam_135383b867ea296 Where I'm doing my Full stack developer course right now. I'm excited and enthusiastic about learning and becoming a developer. Dev community kick starts my journey 😉😊

The capability phase is over For the past two years, the AI conversation has been about...

Multiplayer bugs in Unity rarely look like networking bugs. They look like "the game froze," "the player teleported," or "it worked in the Editor and broke in the WebGL build." By the time you've traced it back to the actual cause, you've usually burned an afternoon. Here are 10 issues that show up constantly in Unity networking code — WebSocket-based, Socket.IO, or otherwise — with the actual root cause and the fix. A few of these come straight out of real regression tests and commit history in socketio-unity , an MIT-licensed Socket.IO v4 client for Unity. The rest are patterns you'll recognize if you've shipped a multiplayer game. 1. Reconnect wipes your room/namespace state Symptom: Connection drops for two seconds, comes back, and the player is no longer in their room/lobby/channel — even though the server never removed them. Cause: A common (bad) reconnect implementation tears down the whole client and rebuilds it from scratch — including the list of channels/namespaces the player had joined. The reconnect "succeeds" at the transport level but silently drops application-level state. Fix: Reconnect logic should preserve subscriptions across the transport reset and only re-emit join / connect for namespaces the client already had open. If you're rebuilding the socket object on every reconnect attempt, stop — reconnect the transport, keep the namespace map. // Wrong: rebuilds everything, loses namespace state void OnReconnect () => CreateFreshEngine (); // Right: reuses the existing namespace map void OnReconnect () => ReconnectEngine (); // _namespaces untouched 2. "get_gameObject can only be called from the main thread" Symptom: Random UnityException thrown from inside a network event handler, but only sometimes — usually right when the server sends something. Cause: Your WebSocket/network library delivers callbacks on its own I/O thread. Any Unity API call ( transform.position = , Instantiate , even some Debug.Log paths) from that thread throws. Fix: Never tou

Software spends a surprising amount of its life just moving structured data around: an API returns JSON, a config file is written in YAML or TOML, a report is exported as CSV, a spreadsheet wants tabular rows. These formats are not interchangeable — each was designed for a particular job, and using the wrong one creates friction. Knowing the strengths of each makes you faster and saves you from a category of frustrating bugs. JSON: the lingua franca of APIs JSON (JavaScript Object Notation) is the default for data exchange between systems, especially web APIs. It represents nested objects and arrays cleanly, every programming language can parse it, and its rules are strict enough to be unambiguous. That strictness is also its main friction for humans: no comments are allowed, every string needs double quotes, and a single trailing comma makes the whole document invalid. JSON is excellent for machine-to-machine communication and data storage; it is merely tolerable for files humans have to edit by hand. YAML: configuration humans edit YAML was designed to be readable and writable by people. It uses indentation instead of braces, supports comments, and drops most of the punctuation that makes JSON noisy. This makes it popular for configuration in tools like CI pipelines and container orchestration. Its strength is also its danger: because structure is defined by indentation, a single misplaced space can silently change the meaning of your file or break it entirely. YAML also has surprising type-coercion quirks (the classic example: the word "no" being read as the boolean false ). Use YAML for human-edited configuration, but validate it. TOML: configuration that stays unambiguous TOML (Tom's Obvious Minimal Language) aims for YAML's readability without YAML's ambiguity. It uses explicit, INI-like sections and clear key-value pairs, supports comments, and has unambiguous typing. It is less prone to the silent indentation mistakes that plague YAML, which is why a number

In JavaScript and TypeScript, object references are often treated as disposable. An object is created, assigned to a variable, passed around, replaced, copied, spread, cloned, and eventually discarded. That is normal language behavior, but in larger mutable systems it creates a specific class of bugs: stale aliases. A stale alias appears when one part of the program still holds a reference to an old object while another part has already replaced that object with a new one. The old reference is still valid JavaScript, but it no longer points to current data. Hard Object References is a discipline for avoiding that class of bugs. The idea is simple: Object and array references should be stable. Do not replace them as a normal update mechanism. Copy data into existing objects instead. This rule is useful for application state, but it is not limited to global stores. It applies to ordinary variables, local component state, nested fields, arrays, drafts, snapshots, runtime models, and temporary objects. The broader principle is: Replace primitive values. Do not replace object and array references. The First Rule: const for Objects and Arrays The first level is variable bindings. If a variable holds an object or array, it should normally be declared with const : const user = { /* ... */ }; const items = [ /* ... */ ]; not: let user = { /* ... */ }; let items = [ /* ... */ ]; The point is not that the object becomes immutable. It does not. This is still possible: user . name = ' Alex ' ; items . push ( nextItem ); The point is that the variable should not be rebound to a different object: user = nextUser ; items = nextItems ; That replacement changes which object the variable points to. Any other code that still holds the old reference now points to obsolete data. So the first rule is: Use const for object and array references. Mutate or copy data into the object. Do not rebind the reference. This rule also applies to temporary objects. A temporary object may be short-live

Four years of optimizing React and Next.js projects taught me one thing: unoptimized images are everywhere, and nobody wants to fix them. Every project has the same pattern. Heavy PNG and JPG files are sitting inside /public , there is no consistent image pipeline, and some of those files have no business being that large in a production codebase. This is especially common in small and mid-sized projects. There is no CDN transformation layer or dedicated asset pipeline. Images get added while the product is moving quickly, and the cleanup becomes a task for “later.” Later, of course, never comes. Then, at 1am, while refactoring an extremely vibe-coded Next.js project, I found myself doing the cleanup manually again. Find an image. Upload it to an online compressor. Hit the free limit. Open another tool. Convert a few more. Download everything. Replace the original files. Hunt through the codebase for every import and src path. Hope I did not miss one. And I finally thought: I am a developer. Why am I doing this by hand? So I built pixcrush . npx pixcrush . One command to convert the images, compress them, and update their matching code references automatically. “But doesn’t Next.js already optimize images?” Yes, and if your application uses next/image consistently, you should absolutely take advantage of it. The Next.js <Image> component can resize images for different devices, lazy-load them, and serve modern formats such as WebP. Files inside /public can be referenced from the root URL, while statically imported images also give Next.js access to their intrinsic dimensions. The official Next.js image documentation explains these runtime optimizations in detail. But that solves a different layer of the problem. I wanted to clean up the source assets themselves: Replace heavy PNG and JPG files with smaller WebP files when conversion is worthwhile. Update existing imports and string-based image paths across the repository. Identify images that are no longer reference

Documentation is often the first product a developer experiences. Before they see your architecture, your engineering culture, or your code quality, they interact with your documentation. If that experience is confusing, incomplete, or frustrating, many developers won't make it to their first successful API request. Over the past few weeks, I've been reviewing documentation from AI startups to understand what makes onboarding smooth—and where teams unintentionally create friction. While every company is different, the same patterns kept appearing. 1. Quickstarts assume too much Many Quickstarts jump straight into code without explaining prerequisites. Developers are expected to know: Where to get an API key Which SDK to install Required environment variables Authentication steps A Quickstart should help someone go from zero to a successful request with as little guesswork as possible. 2. Error messages aren't documented Developers don't judge documentation by how it works when everything goes right. They judge it by how quickly it helps them recover when something goes wrong. Instead of only listing error codes, explain: Why the error happens Common causes How to fix it What to try next Good troubleshooting documentation builds confidence. 3. Examples are incomplete Too many examples leave out important details. Developers shouldn't have to infer: Authentication headers Environment variables Request payloads Expected responses Examples should be copy, paste, run, and understand. 4. There's no clear learning path Documentation often feels like a collection of pages instead of a guided journey. A better structure might look like this: Quickstart Core Concepts Tutorials API Reference Advanced Guides Troubleshooting When developers always know what to read next, they make progress faster. 5. Documentation isn't written for AI-assisted development Today, developers increasingly rely on AI coding assistants. That means documentation should also be easy for AI tools to int

Let's be honest, you can't scroll through your feed, listen to a podcast, or even make coffee without someone, somewhere, mentioning the impending AI apocalypse. It is usually framed as: "AI is coming for your job, your keyboard, and your favorite coffee mug." But isn't that incredibly ironic? We are the software developers. We are literally the architects building the AI, writing the code, and then using that AI to build even more tools. Are we truly creating our own replacements, or are we just very efficiently automating the boring parts of our day? It feels a bit like a baker building a robot to knead the dough, only to worry the robot will eventually want to run the whole bakery. I've always wanted to weigh in on this discussion and share my perspective, but I was always hesitant because I am not an "AI expert" and didn't want to get ratioed by researchers. However, I read something truly interesting recently that gave me a new perspective, and I had to share it. The Computer Era Paradigm We have all heard the stories of how we moved from papers to digital, and how computers were coming into the picture and they will take the job of the workers who were writing them everything in the registers. The wave that we are experiencing right now is kind of similar to that wave. At that time, people who were doing everything on the papers would have felt terrified and didn't wanna lose to a computer. But as the computers were new, they were quite fast and were efficient in doing the jobs and storing each and everything in the memory to be kept for later use. This tension is perfectly depicted in a movie I watched (Hidden Figures, if you're looking for it). Initially, teams of human "computers" did complex space research calculations and re-evaluated all the answers so the spacecraft wouldn't deviate from its path. Then, electronic computers were introduced, creating the same panic that we experience these days: "All these people doing calculations will be let off!" But

We are two friends building Pageonaut , a collection of 126 free browser tools (converters, calculators, PDF and image utilities, dev helpers). Early on we committed to one constraint: everything runs client-side . No file uploads, no accounts, no server-side processing. That one decision shaped the whole architecture, and it broke things in ways I did not expect. Here are the lessons, including the one where our server filled up with 419 GB of cache and took the site down twice. Why client-side only Every time I needed a quick converter, the top search results wanted me to upload my file to their server, create an account, or pay to remove a watermark. For work that a browser can trivially do locally. So the rule became: drop a file into one of our converters and it never leaves your device. You can watch the network tab while using it. This is great for privacy and trust, and it has a nice side effect: our server does almost nothing per user, so hosting stays cheap even if a tool gets popular. The cost: some tools are genuinely harder to build. PDF manipulation in the browser (we use client-side libraries instead of a server queue), image processing on the main thread without freezing the UI, and no "just call an API" escape hatch. When a tool truly needs the network (say, fetching a URL you give it), the page says so explicitly. Lesson 1: Unbounded URL params + ISR = a full disk This is the expensive one. We built shareable challenge pages: beat my score, try this color, that kind of thing. The URLs look like /tools/<slug>/challenge/<value> , where <value> is user-generated. With Next.js ISR, every unique URL that renders gets persisted to the filesystem cache. You can see where this is going. The value space is infinite. Bots found the pattern and started enumerating it. .next/server/app grew to 419 GB . The disk filled up, the site went down, and because we did not understand the root cause immediately, it happened a second time a few days later. The fix was tw