标签：#webdev

Disclosure: I work on Passlens, a browser-first passport and ID photo maker. This post is about the product decisions behind that workflow, not a neutral review of every tool in the space. A passport photo looks simple until you try to make one that an upload form will actually accept. It is a headshot, yes, but it is also a small chain of constraints: physical size, pixel size, background, head position, print scale, and whatever the destination country's portal decides to reject that week. That is why generic photo editors feel slightly wrong for this job. They can crop. They can resize. They can export. The hard part is not any one of those actions. The hard part is keeping all of them tied to the document rule the user picked. The unit problem For developers, document photos are awkward because two units matter at the same time. A user may need a 2x2 inch passport photo. A visa portal may ask for 600x600 pixels. A print sheet may need 35x45 mm photos at 300 DPI. These are not the same request, but people often treat them as if they are. If the app only thinks in pixels, the print can come out the wrong physical size. If it only thinks in millimetres or inches, the digital upload can be rejected for the wrong pixel dimensions. A good workflow has to keep both ideas alive: the document size and the export target. That is the main reason Passlens keeps presets and print layouts as first-class pieces of the workflow instead of treating them as labels on a crop box. The crop is not the output Another small trap: the crop the user sees is not always the final output. For a digital upload, the crop usually becomes one image file. For printing, the same crop may become several photos arranged on 4x6, A4, or Letter paper with spacing, margins, and optional cut marks. If that print sheet is scaled by the browser or printer dialog, the whole thing is wrong. So the editor needs to separate three things: the face and shoulder crop the finished document-photo size the print s

submitted by /u/chicametipo [link] [留言]

Calculate and track FPS on the web page yourself to track performance issues and regressions. submitted by /u/jssmash [link] [留言]

Hey all, I want to setup a feed to stay on top of whats going on in specifically the software/web sector. Currently for this industry, I've only followed Cybernews, which is nice for what's going on with cyber security. However, I would also like to follow tech sources that generally have good writers and report on existing languages such as React, Vue, Django, Ruby, PostgreSQL, etc; as well as upcoming languages. Yes, I could search around and find whatever pops to the top of my search, but I would like to know what is actually reliable vs what might just look good. Also a plus if you can recommend any apps or sites that can create an organized feed or dashboard for news outlets. Things change quickly in this industry, so I'm trying to be a little more proactive to stay somewhat on top of things. Thanks! submitted by /u/Snowdevil042 [link] [留言]

I made a funnel site for a client in a pretty tough niche. It's honestly a waste of money, but he pays. I felt bad so I did a total design refresh because I wanted his business to do better. His invoice was due yesterday. He sent me a text saying his site has been down all month and sent me a screenshot. I could clearly see http:// and immediately corrected him. He said "oh it's working now with https. Do you think people will know to type that?" people click links to this, it will never be an issue if your site was down all month why didn't you tell me user error I'm about *this* close to terming this one and putting on some Amazon affiliate links. Edit: just redirected https to http. Thanks everyone! ✌️ submitted by /u/ihateroomba [link] [留言]

Hey guys, the past few months I've been building a marketplace (selling mainly digital assets) and I've been running to some issues with deciding on a payment system. I've heard from some friends that standard options like Stripe Connect is terrible for international vendors. I was doing some research but got stuck as it seems that the payment provider sector moves quickly, and I'd rather avoid using anything outdated. Would love to hear some recommendations, thanks guys. submitted by /u/mirror_mirror248 [link] [留言]

submitted by /u/fagnerbrack [link] [留言]

Is there a system that can handle this? Handling units where one row in the DB can have both pieces and kg ex. HU Code 001; Article PART1; Lot code ABC; Location X; tracking qty 5pc; base qty 200kg Loose lot ex. Article PART2; Lot code XYZ; Location Y; tracking qty 100pc; base qty 2000kg This should be configurable per article family and inherited in the article... So i can have a part of articles in HU and part in loose lot... both carying 2 inventory unit of measurments.. submitted by /u/dirtyfrank22 [link] [留言]

Part one hit 69K views, 250 upvotes here. The comments were better than the post. A lot of you asked about SEO, accessibility, performance, and whether GSAP is even necessary. Several pointed out the demo was missing something. You were right. Part one had a cursor clicking through scenes on a flat stage. No depth, no focus. This post adds a camera: zoom into the action on right-click, pan to follow the cursor through a save dialog, zoom into the result on the destination board, pull back and loop. Still under 40 KB. Still no video files. What part two covers: Zoom wrapper architecture — why gsap.to(frame, { scale: 1.4 }) breaks responsive scaling Pan math — the formula to center any target in the viewport at a given zoom level "Stay zoomed, pan to follow" — zoom in once, pan through the interaction, zoom out once. Not PowerPoint. Easing philosophy — why camera pans need sine.inOut , not power2.inOut , and the full easing table by motion type Cursor alive during camera moves — a frozen cursor during a zoom makes the whole thing feel mechanical. 30% drift fixes it. Graceful loop lifecycle — outro pattern instead of snap-reset SEO — every button label and heading in the demo is indexable DOM text, not a black box video Accessibility — prefers-reduced-motion support, autoAlpha for screen readers Performance — live FPS stress test you can run in your browser (8 → 24 → 48 elements with zoom + pan + stagger), not much performance drop The agent split — I wrote ~60% (the directing), an AI agent wrote ~40% (the tedious timeline code). Still a lot of manual editing, but way better than recording a video and the maintenance The full post has 4 interactive demos you can pause and inspect, including side-by-side comparisons of easing curves and cursor behavior during zooms. Full writeup with live demos: https://spanthi.com/blog/gsap-choreography-part-2 Production examples: https://costumary.com and https://costumary.com/web-clipper Skill for AI agents if anyone wants to save ti

🚨 URGENT: Highly Critical Drupal Core SQL Injection (CVE-2026-9082) Affecting PostgreSQL — Patch Immediately! The Drupal Security Team has released a "Highly Critical" security advisory ( SA-CORE-2026-004 / CVE-2026-9082 ) fixing a severe unauthenticated SQL injection vulnerability in Drupal Core. If you are running a Drupal site backed by a PostgreSQL database, you are at extreme risk. 📌 Vulnerability Overview CVE ID: CVE-2026-9082 Drupal Risk Score: 23/25 (Highly Critical) Attack Vector: Remote, Unauthenticated (Anonymous) HTTP requests Exploitation Status: ACTIVE IN-THE-WILD ATTACKS reported globally. CISA has officially added this flaw to its Known Exploited Vulnerabilities (KEV) catalog. Over 15,000 attack probes across thousands of sites have already been detected. Root Cause: A flaw in Drupal Core's database abstraction API—specifically within the PostgreSQL EntityQuery condition handler. Attacker-controlled PHP array keys reach SQL placeholder construction without proper sanitization, allowing arbitrary SQL execution. 💥 High Impact & Risks While Drupal estimates that less than 5% of installations use PostgreSQL, this configuration is heavily concentrated in enterprise, government, and higher-education environments. Successful exploitation grants: Full Database Access: Exfiltration of session tokens, sensitive data, and password hashes. Privilege Escalation: Promotion of standard or anonymous sessions to Administrator. Remote Code Execution (RCE): In PostgreSQL environments where database permissions are misconfigured (e.g., allowing COPY FROM PROGRAM ), attackers can pivot from SQL injection to executing arbitrary shell commands on the host server. 🔍 Affected Versions The flaw impacts all supported Drupal Core branches configured with PostgreSQL, including some legacy branches: Drupal Core 8.9.0 through 10.4.9 Drupal Core 10.5.x before 10.5.10 Drupal Core 10.6.x before 10.6.9 Drupal Core 11.1.x before 11.1.10 Drupal Core 11.2.x before 11.2.12 Drupal Core 11.

I got passion and no money submitted by /u/Free-Ant-463 [link] [留言]

What comes to mind is you have some code that you want other ppl to be able to interact with, then you want to store data somewhere so you provision a database, then you need somewhere to host that code so you spin up a server then plop your code into that server and make it publicly accessible. I get that there are other parts like networking, security, RBAC/permissions, Linux commands, scalability/maintainability, API, cloud infrastructure, version and change management. But does it basically boil down to those three things: Code Database Server Thanks submitted by /u/throwaway0134hdj [link] [留言]

The company I work for was bought up and in the new company, one of my responsibilities will be developing our website. The issue is that the website was built by an external agency. And almost any change to the website have to be implemented by them. And of course they charge for every change. They own both the backend and frontend side of the website. I can basically only add text and images. I wonder what exactly I should advise my new boss(whom really doesn’t like it and wants to make several changes). Is it really an option to move the site to a different hosting plattform and build another theme? Which seems like last resort. And not even sure if that is really feasible either. Hiring a developer would probably be more costly and I am decent with front end, but not enough experience with backend. So don’t think I can do it myself. Should I just cave and downgrade my position? Asking for higher access will probably be rejected. This is how they make money. Hopefully this is the correct sub, and someone have some insights and experience! submitted by /u/craigularperson [link] [留言]

submitted by /u/Ekrof [link] [留言]

I built a bot trained on my own X bookmarks and likes. Around 50,000 of them, accumulated over years...

I am trying to build a guess-the-x sort of game/quiz, a full stack application, the stack doesn't matter, I was trying to find a way to send an API payload to my front-end securely without users being able to cheat by inspecting the payload using the requests devtools tab. the idea of this quiz is users are given a pixelated image, and many game details like title, summary, devs, pubs, platforms etc... depending on the difficulty I reveal to the users a percentage of the hints early, e.g. easy they can 30% of [devs, pubs, summary, etc...] 15% at medium, and 0% at hard. the image cannot be unpixelated manually however, at each wrong guess it unpixelated automatically, but for other indicators users can "unredact" them using hint points, (3 in total) obviously if not designed properly this is very each to cheat if a user is even slighly tech savvy since the backend sends the entire payload as-is to the client, what i did was my payload response looks something like this: { summary: { { text: "xxxxxxxxxxxxxxxxxxxxxx", revealded: false, text: "something something", revealed : true } } } and i store game state in redis that way i dont have to hit my database for every post request the client makes to fetch the game data; the redis state looks something like this { answer : game.title, hints_left: 3, guesses_made: 0, full_game_data : game, } then the other issue is the game cover, the data isnt mine, prior to this i had built an ETL pipeline to ingest data from IGDB's api, i only save their cover id to my database, something like 1234abc. so on the initial GET request, i hit their CDN endpoint, get the cover, process it in the backend, (pixelization), base64 encode it, which im aware that encoding binaries to base64 is a 1.37x increase over the original data, but i found no way of transmitting images securely to the front end except this one; so im asking for recommendations. right now this is a little slow, even on local host it could reach 2s for image load, mainly beca

The CI was green. Build passed. No TypeScript errors. No warnings. Everything looked clean. I...

submitted by /u/fagnerbrack [link] [留言]

Hey guys. Ive been in the web development game since 2019. I was a student working in the UX/UI department at university back then, and covid caused every student to be laid off - so i started an agency. It worked out for a while. I made enough to cover covid expenses - but then i got picked up by a company for a few years running their entire tech stack (small company). Nowadays i take on freelance clients in between my retainer with that company. Thing is - over the years i realized how much i LOATHE working with consumers. They always want a new feature, always want it free, and they can always “do better” themselves. This week i had a client call me and ask if i could have the girl who makes her TShirt graphics style the website because “shes just so talented”. Im pretty upset with myself for going into this industry. At first it was the obvious move since i had experience, but its not sustainable anymore. Projects get pushed out for months due to scope creep and clients dont understand these things take time - and therefore money. Lately ive been studying a lot of DevOps. I put together a k3 server with an external nginx proxy and an outbound DNS whitelist. i want to start a hosting service in the future. I think im just done with front end design - i just dont have the passion for it. Id much rather focus on function. any of yall ever make the jump from WebDev to DevOps or Sysadmin? Id love to hear any stories of it. submitted by /u/ibeatu85x [link] [留言]

submitted by /u/NegotiationInner7307 [link] [留言]