标签：#webdev

In web development, every millisecond on the critical path matters. Typography is part of your visual identity, yet a single self-hosted family can add hundreds of kilobytes before the browser paints the hero line clients actually see. That cost often shows up as slower First Contentful Paint (FCP) and a worse Largest Contentful Paint (LCP) when the LCP element is a headline set in a custom face. Font subsetting is the practical fix: ship only the characters (glyphs) each page or component needs instead of entire typefaces built for every language and symbol you will never render. What font subsetting is A typical desktop font file contains thousands of glyphs: Latin extended, Cyrillic, ligatures, numerals, punctuation, and symbols you may never use on a marketing site. When you @font-face that file or pull it from a CDN, the browser still has to download and parse the whole package unless you split it. Subsetting creates a smaller font file that includes a defined subset of Unicode code points. Examples: A display font used only on one H1 might need fewer than 40 characters. A Latin-only blog body font does not need CJK tables on every article. UI labels in English can omit unused weights and scripts. The browser downloads less data, spends less time decoding, and can apply the face sooner. You keep the look; you drop the dead weight. When font subsetting improves web font performance and LCP Subsetting pays off fastest in these cases: Situation Why subsetting helps Display or hero typography Few unique characters, high visual impact, often on the LCP text node Single-language sites Remove unused scripts and diacritic ranges you do not publish Icon or logo fonts misused as full fonts Replace with SVG where possible; subset if you must keep a font icon set Multiple weights loaded globally Subset per weight, or load weights only on routes that need them It is lower priority when you already use a system font stack for body copy and only load one small variable font w

An account manager forwarded us a Search Console screenshot at 4:47 p.m. on a Friday. LCP on the homepage had been in the red for eleven days. Engineering had not been in the thread because nobody was assigned to watch the numbers until a sponsor noticed. That is reactive performance monitoring in practice: fast tools, slow humans, and a calendar that only opens when someone else raises the alarm. Proactive monitoring is the opposite shape. Scheduled lab tests run whether or not anyone remembered to open PageSpeed Insights. Performance budgets turn history into rules. Alerts fire when those rules break, with enough context to triage and enough restraint that people still read them. The word “smart” in product copy usually means the second part: alerts that match how teams actually work, not a louder siren. This post is for agency leads who already automate some tests but still learn about regressions from client inboxes. We walk through what reactive looks like, what proactive requires, and how to wire alerts so they change behaviour instead of training everyone to mute the integration. What reactive performance monitoring looks like on agency teams Reactive does not mean “no tools.” Most agencies we speak with have PageSpeed Insights bookmarks, a monthly spreadsheet, and a standing item on the retainer review slide. Reactive means the signal arrives after the business event you wanted to prevent. Common patterns: Spot checks after deploy. Someone runs PSI on staging, ships, and assumes production matches until a complaint arrives. Quarterly or monthly report pulls. CrUX and Lighthouse exports go into a deck. Useful for storytelling; too slow to catch a plugin update that moved INP on Tuesday. Client-led discovery. The sponsor pastes a screenshot, asks “is this new?”, and the team scrambles to reproduce on a laptop that may not match the lab conditions you use in production monitoring. Alerting without policy. Webhooks fire on every metric twitch. By week three the

Most developers paste production JWTs into online decoders without thinking. Here's a 10-second DevTools check to see if your token is actually leaving your machine. A coworker was debugging an auth bug last month. Standard workflow: copy the JWT from the failing request, paste it into an online decoder, read the payload. I've done it a thousand times. You probably have too. Except the token he pasted belonged to a real customer. And the decoder he used is owned by an identity company that's had its share of security incidents. Nothing bad happened. Probably. But it made me think about something I'd never actually checked: when you paste a JWT into an online decoder, where does that token go? What a JWT actually contains Quick reminder of why this matters. A JWT isn't encrypted — it's just Base64URL-encoded. Anyone who has the token can read everything in it: header.payload.signature The payload routinely contains: User ID, email, and role Session identifiers Token expiry ( exp ) and issue time ( iat ) Sometimes — against best practice — far more And here's the part people forget: a valid, unexpired JWT is a live credential. If it hasn't expired, whoever holds it can often impersonate the user. Pasting it into a random website is functionally similar to pasting a password. The 10-second check Most online JWT decoders claim to be "secure" and "client-side." Some are. Some aren't. You don't have to trust the claim — you can verify it yourself in 10 seconds: Open the decoder in your browser Open DevTools → Network tab Clear the network log Paste a JWT and decode it Watch the Network tab If any request fires when you decode — your token left your machine. A truly client-side decoder fires zero network requests during decoding. The JavaScript does everything locally; nothing is sent anywhere. Try this on whatever decoder you currently use. You might be surprised. Why most "online" tools send data It's usually not malicious. Building decoding logic on the server is someti

I have been receiving pretty good offers for B2B contracts. I've been employed for the 7+ years here and, wasn't fired, had np joining whichever company, always got a raise hoping or within the company. The issue is that in some of those , mgmt and leadership people keep changing in less than 6-12 months. Goals, focus, performance, even structure keep changing out of nowhere, regardless of me being consistent or better in whatever made up metric they have always get some stupid ass feedback of something I should be doing outside my job or expertise. Am I being naive? every f..ing company is like that right? I've been wondering if maybe it is not for me being a full-time employee. Are contractor roles less focused on that? What is your exp from what I said above? don't care about goals, being on call or career paths. Just want to do the job, deliver and move on to the next project. I've been promoted many times, had leader roles, don't recommend, don't like, no added value for me and promotions don't give more money or improved my contract. What about agencies that provide dev services and you get allocated for short times? Also got those positions but no idea how it works and how stable it is. I always have been fulltime employee my entire working life. If you have resource about opening a company for B2B contracts, please link it to me, I would be mostly interested in something around Austria/Hungary area. I am specialized in FE hence posting here. EDIT: clarity on the second paragraph submitted by /u/Raziel_LOK [link] [留言]

I'm hoping to get some info on sizing for the Herman Miller Aerons.. I'm 5'7", 220lbs, and in my mid 40s. I'm built with a fairly long torso and shorter, but more muscular legs, which seems to be the opposite of what a lot of ergo chairs are built for. I've had mild, but consistent back pain for the last 10-15 years, primarily from being a programmer and sitting at a desk with cheap chairs and not the best posture for about 25 of the last 30 years.. My current chair (Office Max mesh back with a padded seat and headrest) was decent at the beginning, but the seat padding is basically gone and the last week or so, anytime I sit in it for longer than about an hour, my lower back pain is significantly worse for the rest of the day, so it's time to replace it. I've seen other reddit threads ([this reddit thread, for example]( https://www.reddit.com/r/hermanmiller/comments/j4y3tl/proper\_herman\_miller\_aeron\_sizing\_chart\_corrected/ ) that seem to indicate that the person won't help me with my height/weight and will make my lower back/thigh pain worse.. Is there anyone with a similar build to me that currently has or has had an Aeron that can give feedback as to whether it has actually helped with back pain or made it worse? Or, if anyone with a similar build to me has any suggestions on other chairs that have been good for them, I'd love that info. My budget tops out at about 600-650, and I don't have a problem with used/refurbished if it comes from a decent place with a reliable warranty or 30-90 day return policy. My back thanks you in advance! (In case it matters, this will probably be cross posted in a few other subs.. hopefully that's not an issue, as I need all the help I can get with this back pain at this point. submitted by /u/melophat [link] [留言]

Hello, I'm Shrijith Venkatramana. I'm building git-lrc, an AI code reviewer that runs on every commit. Star Us to help devs discover the project. Do give it a try and share your feedback for improving the product. A straightforward engineering question: what happens when you feed a long book to an on-device language model in Chrome and start adjusting the parameters? To explore this, I built a small experiment called Gemini Nano Book Lab : a Chrome extension sidepanel that uses Chrome’s built-in Prompt API to answer questions about Richard Wagner’s My Life , while also exposing some of the underlying mechanics. The response is only part of it. The experiment also captures: Model download behavior Retrieval cost Time to first token Context window pressure Effects of different chunking strategies Places where the API works well, and where its limits become obvious If you’re an engineer interested in systems that have rough edges—and therefore teach you something—this is a useful area to explore. What the Prompt API Is Chrome’s Prompt API is part of the browser’s built-in AI features. Instead of sending prompts to a cloud endpoint, a web app or extension can request an on-device language model session and prompt it locally. Resources: The Prompt API Session management best practices Structured output for the Prompt API Built-in model management in Chrome Debug Gemini Nano Core capabilities: Local inference Streaming results Availability check before session creation Context usage measurement Events like contextoverflow (In some environments) sampling parameters like temperature and top-k This makes it more than a simple text box—it becomes an environment for experimentation. Why a Long Book? Long inputs expose the interesting problems. Short prompts hide a lot; a paragraph‑long demo can make any model look magical. A long corpus forces concrete decisions: What chunk size works well? Should chunks overlap? How many chunks should you retrieve? What latency comes from ret

zero errors on the first try means i am basically a senior principal engineer for the next five minutes until the database connection breaks submitted by /u/Alternative-Tax-6470 [link] [留言]

Hello, I have been working for the last couple of years in the Nuxt/Vue environment, and Laravel before that. Recently, one of our clients asked us to rebuild their website in Wordpress. I have hacked my way through some small wordpress projects before, but it always feels miserable and inefficient. Are there any tools or techniques that you use to make development better? This is mostly a brochure website with limited user functionality on the front-end. Unfortunately, I cannot use headless wordpress given the clients technical requirements. I would love to find a way to introduce reusability for components (heros, CTAs, cards, etc), HMR in dev, or any of the other features I've come to rely on in more modern stacks like Nuxt, while also maintaining the CMS aspects of Wordpress (likely through ACF). Would love to hear your tips + tricks! submitted by /u/dont_trust_lizards [link] [留言]

Hey everyone i'm moving to a decent first world country by the end of this year I got my PR and everything I just still need money I worked for the last 6 months as a contractor for $2400 monthly with an AI startup based in California, they sold it a month ago and I was let go obviously as their product was built and acquired by another company, I'm very confident in my skills its just I literally have no idea about how to land a similar job like that again. if you can help me with some advice please do and please don't' be racist I didn't choose where to be born, I wish everyone can get mega rich in the future and thanks in advance. submitted by /u/In-Hell123 [link] [留言]

We manage retainer clients and every so often a client will email us saying something on their site looks broken. Nine times out of ten it's a WordPress plugin update that shifted a layout, a hero image that stopped loading, etc. We find out from them instead of the other way around, which is an awkward position to be in when you're supposed to be the one watching their site. I've looked at tools like Visualping, ChangeTower, and Distill. They all work the same way. You give them a URL, they alert you when something changes. That’s fine for monitoring a few pages yourself, but they don't really fit an agency workflow. There's no concept of a client, there’s no way to group pages by account, and you can’t actually show a client at the end of the month to prove you're on top of things. The developer tools like Percy and Applitools are a different thing entirely. They plug into CI pipelines and need an engineer to set them up. Not useful for an account manager who just wants to know if a client's homepage looks broken this morning. What I keep thinking about is something simpler. A web app that allows you to organize by client, take screenshots on a schedule, flag visual changes before the client notices, and generates a monthly summary you can send to the client. It would be less about code deployments and more about just knowing your clients' sites are visually intact. Is this something you actually run into, or do you have a system that handles it already? Would something like this be worth paying for, or is it too niche to budget for? Am I missing a tool that already does this well? Any feedback is much appreciated. Thanks. submitted by /u/newintownla [link] [留言]

I interviewed for Walmart SWE3 role 3 days back. Both rounds were held on the same day. Qualified Round 1 and then gave Round 2. Round 2 went well too. But I have not received any update yet. Its been 3 days. Is it normal or should I accept that I am rejected? submitted by /u/Complete-Ad-240 [link] [留言]

In 2024, Orca Security sued Wiz and demanded their full git version control history. Orca wanted to see "when features and functions were added, modified, or altered, including through engineers' notes and comments." The court recognized git history as relevant evidence in a software IP dispute. It ordered production of commit logs tied to two specific features. That ruling should concern you. Your commits record author name, email, timestamp, and content hash. Git chains them together cryptographically, replicates them across clones, and makes them discoverable in litigation. You are building a legal record whether you intend to or not. You already use git as a development tool. It is also a chain of custody for intellectual property. And you are probably destroying yours. A Cryptographic Chain of Custody Every git commit stores five things: the content of the change, the author's name and email, the author's timestamp, the committer's name and email, and the committer's timestamp. That commit is hashed using SHA-1 (or SHA-256 in newer repositories), and the hash incorporates the hash of the parent commit. Change one byte anywhere in the chain and every subsequent hash changes. This is a Merkle DAG. The same data structure that makes blockchains tamper-evident. Your commit history is a cryptographic proof linking each change to all previous changes. Git records three layers of timestamps. AuthorDate is when the content was written. CommitterDate is when it was finalized into the repository. And the server-side push timestamp, recorded by GitHub or GitLab, marks when the remote received the data. That third timestamp is outside the developer's control. A clone is a full copy of the entire history. Your collaborators, CI runners, and backup systems each hold an independent replica. Forensics researchers call this "evidence proliferation." Tampering with one copy does nothing if fifty others exist unchanged. Under Federal Rules of Evidence 902(14), data verified throu

I've been on OpenRouter for a side project for a few months and it's solid for prototyping, but the streaming latency and the pricing markup on models I could call directly started bugging me enough to look around. Curious what other people running real production traffic have settled on. submitted by /u/Quantum_Nest [link] [留言]

Hey everyone! I'm currently working on a landing page project with quite a few GSAP animations, some ThreeJS, all built with SvelteKit and hosted on Cloudflare. I'm working on this project with a designer friend who has some development knowledge. He can do HTML/CSS/JS and use GSAP. We often work together — he finds clients, handles project management, UI and UX, while I take care of the development side. Since I don't really have a strong "graphic eye", our usual workflow was: I lay the foundations, handle the animations, and let him come back over everything for easing and fine-tuning. Since AI came along, things have gotten a lot more complicated. Don't get me wrong — I use Claude myself to get oriented, review my code, analyse a project, or generate boilerplate code. But I always review the output. My friend, on the other hand, uses it in full vibe coding mode. I just got the latest version of this landing page where he'd pushed his changes, and I was pretty shocked. The code is massively over-engineered for no good reason, hard to follow, and a genuine nightmare to debug. Claude made everything far more complex than it needed to be. To avoid this kind of situation going forward, we've started putting a few ground rules in place: a mandatory review before any merge, and certain core files that only I touch. Not a perfect solution, but it helps keep things from spiraling. Has anyone else had the same kind of experience with vibe coding ? I mean, it does work, but the output feels bloated. Edit : As some people noticed it, i've used an AI to translate that text into english and re-phrase it, since i'm not really fluent in english (isn't that ironic lol). submitted by /u/frenchy_mustache [link] [留言]

submitted by /u/dreamnyt [link] [留言]

Read Time: ~14 minutes | Building on React fundamentals to master state management at scale Prerequisites : Familiarity with React basics, useState, useEffect (Part 1) 🔗 Series Navigation ← Part 1: Complete Guide from Zero to Production Part 2: Advanced Hooks & State Management ← YOU ARE HERE → Part 3: Performance Optimization (coming next) 📌 What You'll Learn By the end of this guide, you'll understand: ✅ Creating powerful custom hooks ✅ When and how to use useReducer ✅ Managing state globally with Context API ✅ Redux fundamentals and when to use it ✅ Modern alternatives: Zustand and Jotai ✅ Choosing the right pattern for your project ✅ Real-world shopping cart implementation 🎣 Custom Hooks: Reusing Logic Across Components Custom hooks are regular JavaScript functions that let you extract component logic into reusable functions. They're one of the most powerful React patterns. Rule #1: Custom Hooks Must Start with "use" // ✅ Correct - starts with "use" function useFormInput ( initialValue ) { const [ value , setValue ] = useState ( initialValue ); return { value , bind : { value , onChange : e => setValue ( e . target . value ) }, reset : () => setValue ( initialValue ) }; } // ❌ Wrong - doesn't start with "use" function formInput ( initialValue ) { ... } Example #1: useFormInput Hook import { useState } from ' react ' ; function useFormInput ( initialValue = '' ) { const [ value , setValue ] = useState ( initialValue ); return { value , setValue , bind : { value , onChange : e => setValue ( e . target . value ) }, reset : () => setValue ( initialValue ) }; } // Using the custom hook function LoginForm () { const email = useFormInput ( '' ); const password = useFormInput ( '' ); const handleSubmit = ( e ) => { e . preventDefault (); console . log ( email . value , password . value ); email . reset (); password . reset (); }; return ( < form onSubmit = { handleSubmit } > < input {... email . bind } placeholder = " Email " type = " email " /> < input {... password .

If you have ever run a Lighthouse audit on a content-heavy WordPress site, you know the usual verdict: "Serve images in next-gen formats." Translation: your JPEGs and PNGs are too heavy, and WebP would cut them down a lot. The problem is that nobody wants to convert images by hand, and most automated options either run as a bulk job you have to remember to trigger, or push your images to a cloud service with a monthly quota. I wanted something simpler: upload an image, get a WebP, done. So I built a free plugin called Pixellize Image Optimizer , and this post walks through the problem, how the plugin solves it, and how it works under the hood. Why WebP is worth it WebP files are usually 25 to 35 percent smaller than the equivalent JPG or PNG at the same visual quality. On an image-heavy page that is a real difference: Faster Largest Contentful Paint, which is one of the Core Web Vitals Google uses for ranking. Less bandwidth, which matters if you pay for CDN traffic. No visible quality loss at sensible quality settings. Browser support is no longer a concern. Every current browser handles WebP. The approach: convert on your own server, on upload Instead of a cloud API, the plugin converts images locally with the PHP GD or Imagick extension (almost every host has one). There is no account, no API key, and no paid tier. The core flow: You upload an image to the Media Library as usual. The plugin generates a WebP version of the full image and every thumbnail size. Your front end serves the WebP automatically. How it works under the hood For WordPress developers, here is the interesting part. The plugin hooks into the standard upload and rendering pipeline rather than fighting it: On upload, it taps into the attachment metadata generation so it can convert the full image and every registered sub-size, not just the original. That matters because responsive images use srcset , and a half-converted set defeats the purpose. On the front end, it rewrites image URLs to the We

Curious if anyone here has used it for anything serious. Is it holding up for larger projects or is it still more of a playground? submitted by /u/krrish82 [link] [留言]

I recently launched LuaPlay, a free browser-based Lua editor. No setup, no install — just open the site and write Lua. Why I built it: Every time I wanted to test a quick Lua snippet, I had to either open a local environment or use tools that weren't built for Lua specifically. So I built my own. What it does: Run Lua scripts directly in the browser Clean, minimal editor interface Free to use Would love feedback from the dev community. What features would make you actually use it day-to-day? 👉 https://luaplay.online

If you've ever built or set up a subscription experience on Shopify for a coffee brand, you've probably run into the same problem most merchants face: The signup flow works great. The first order goes out. And then subscribers start quietly disappearing before the third delivery. This isn't a coffee problem. It's a subscription infrastructure problem — and it's almost always caused by the same handful of missing pieces in the system underneath the storefront. In this guide I'll walk through the practical setup decisions that actually move the needle on retention for coffee subscription businesses on Shopify — from choosing the right model and pricing structure to the fulfillment calendar, dunning logic, and cancellation flow that most setups skip entirely. Why Coffee Works So Well as a Subscription Product Before getting into setup, it's worth understanding why coffee is genuinely one of the better products to build a subscription around — when the infrastructure supports it. Predictable consumption cycle. A 12-oz bag of whole beans lasts roughly two to three weeks for a single drinker. That natural rhythm makes it easy to design a billing and delivery schedule that matches actual usage patterns. Daily habit. Roughly two-thirds of American adults drink coffee every day. A subscription removes the friction of reordering, and that convenience compounds into real retention over time. Freshness as a retention argument. Coffee quality degrades noticeably after roasting. Subscribers who care about quality genuinely prefer a recurring shipment over buying retail — which means freshness becomes a built-in reason to stay subscribed that most product categories simply don't have. The global coffee subscription market reached $808.8 million in 2024 and is projected to surpass $2.2 billion by 2033. The infrastructure opportunity for developers and merchants building on Shopify is real and still early. Step 1 — Choose the Right Subscription Model Before You Build The model choic