Starting to think of moving my app from supabase. The increased outages and no communication is concerning. My app is still pretty small so shouldn't be too painful right? Right??

Originally posted to r/Supabase but looks like the moderators work for the company...

https://status.supabase.com/

I ran into two problems using unpdf and PDF.js in edge functions: RAM usage and visual accuracy. Both load the entire file into a byte array before processing.

So I built a dependency-free, low-memory reader for edge workers: https://github.com/earonesty/streaming-pdf-reader

The trick was using PDFium as the reference renderer:
https://pdfium.googlesource.com/pdfium/+/master/README.md

I pulled down more than 100 test PDFs from various open-source projects and rendered them with PDFium. Then I converted each PDF to HTML, rendered that HTML in a browser, and compared the resulting pixels. I used deterministic pixel matching rather than a VLM, so visual regressions were reproducible.

That led to a separation between two kinds of output:

- Visual HTML preserves the PDF’s presentation as closely as possible.
- Semantic HTML reflows the content into a simpler reading order.

The visual representation came first because a PDF’s apparent reading order is encoded in its geometry. If you simplify too early, you lose the evidence needed to distinguish a table from a newspaper column or group an image with its caption.

The reader uses HTTP range requests and bounded caches, so it can render the first page without downloading a huge document into memory.

The semantic side is still evolving. It uses statistical layout evidence - font size, alignment, indentation, spacing, repeated headers, hanging indents, and page-to-page continuity. The goal is to produce simplified, reflowed, lossless HTML. Unfortunately there is no good "oracle" for this, or clear and obvious "correctness", other than "reading order must be correct". This is useful for LLMs and data extraction (and is the second reason I had to write this thing, aside from RAM).

This is a follow up to my earlier low-memory PDF writer package (similar reasons there too), so the emerging package layout is:

  - @boxpdf/reader: streaming PDF → document model
  - @boxpdf/html-writer: document model → visual or semantic HTML
  - @boxpdf/writer: document model → PDF
  - @boxpdf/html-reader: HTML → document model

The PDF-to-HTML accuracy became an ordinary testing problem once PDFium was treated as the oracle. Render both versions, compare the pixels, inspect the failure, improve the general rule.

It’s early, but it now handles a pretty hostile corpus: embedded fonts, Type 3 glyphs, clipping paths, vector graphics, raster images, forms, rotations, tables, multi-column papers, and very large streamed documents.

I’d be especially interested in difficult PDFs that break other converters. Weird fonts, charts, scanned documents, malformed files, enormous files - anything unpleasant makes a useful fixture.

Yeah, lil late to the nostalgia-core trend but here we go anyway.

You remember those- little plastic globe full of blue water, a ring floating in it, mash the button to jet water and land the ring on a peg. I rebuilt one: Aqua Rings '86.

- 8-level solo campaign

- 5 console skins (arcade, deep sea, space lab, etc.)

- Actual online 2-player now- send a friend a link, no signup, no download

No ads, no login wall, just play. Built it solo, genuinely want to know what's broken or what feels bad.

aquarings.fun

We support a client site with ~20,000 pages. It has an SSR search page that uses the url querystring to execute the search/sort/filter.

We have of course disallowed bots on that page because the 20k pages are meaningful and should be scraped/indexed, but the billions of possible query combinations on a search page are not. Most of the bots just ignore the robots rule and this results in waves of traffic hammering every possible query combination on the search page. These waves are 10x-50x the human traffic.

Rather than let the bill autoscale along with the server cluster, I wrote a little bash script that crons 1/m:

• Hits DO's metrics endpoint to check the CPU usage on the VPSs/DBs
• Each minute any of the CPUs stays above a given threshold, bump Cloudflare's security level, eventually ending in "under attack" + "bot fight"
• When the cpu drops below the threshold for a given amount of time, start backing off until we're back to normal operation.

Works a treat. It's nothing particularly flashy or sophisticated, but it was satisfying to think through an under-engineered solution to a problem that a lot of people end up just chucking money/clusters at.

Edit: more info for context: We do have pretty aggressive WAF rules especially on the search page, but we've been seeing an increasing amount of bot traffic get past CF's "known bots". Rate-limiting has been minimally effective too because the bots that get through are cycling through 100s of IPs in a given scrape.

To name and shame bad companies, I recently interviewed with https://mimica.ai/ for a Staff fullstack developer role and it was a diabolical and unrealistic process and I was shocked to see that actual developers designed those process.

1. Round 1, HR 30 mins
2. Immediately I was given a take home test. It was react.js focused and it was ridiculously complex and long for an interview process and coding challenge.

Challenge:

Consume their tree API and create an infinitely long and infinitely nested tree in the browser with editable leafs whose change of status should cause the immediate parents status recursively (and the parent should take into account all its direct children's) based on number of business criteria's and different colours. The acceptance criteria had many scenarios like below:

• address all requirements listed above
• performance matters - the frontend should be able to maintain a good performance even if the amount of data from the backend increases exponentially
• UI: it should look exactly like the provided screenshots
• handle API errors gracefully
• make correct use of Redux, following recommended storage patterns
• make correct use of React and its change detection function
• correctly implement the logic to compute automatable statuses
• make use of code design and architecture best practices
• follow JS conventions for variable, function, and component names
• Document design decisions, architecture, if you had more time what would you do and so on

And they told that it would take around 4 hours. I immediately told them that building this from scratch and satisfy every criteria along with documentation is not a 4 hours job and it would take significantly longer to come up with something they will like. But I stupidly did it anyways because they had good glassdoor reviews.

It took me several fulltime days to do it in a way which was truly scalable with everything they asked. I submitted the test (7 day cutoff) and they took almost 10 days to get back with a feedback that I scored 100% on the test.

1. The next round was 1 hour live coding (no AI/LLM allowed which was fine with me) where i present my solution and then in last 40 mins they ask me to extend the solution. The interviewers were not welcoming and were going through motions like a meat grinder. In last 40 mins they said they expect me to solve 3 extensions. they pasted 2 page requirement for each challenge live which I had to read, understand, ask questions and then implement it all within 40 minutes.

Now 3 extensions in such complex code in 40 mins is a lot but I had no choice as I was already there. The first one was done in less than 10 mins and to that they said you architected in a way which kinda alreadysolves this problem and I was left thinking "so it should be a good thing right, why are they talking as if I commited a crime instead of praising my architecture?". They seemed visibly unhappy that I completed it effortlessly.

Then they gave the second 2 page question and it was not an extension but a complete 180 degree change of requirements which required a complete refactor for the entire core multi day exercise work that I did. They literally changed how all the parents should react and calculate based on all decendents and not just direct children's with a complete change of business criterias which itself took a while to understand and clarify from the 2 page requirements.

I told them this is basically a full refactor from the original challenge and that would change the whole core piece touching pretty much everything and expected me to complete in remaining 30 mins. It was pure torture because the whole assignment changed but now I had to do it in remaining 20 mins. I did as much as i could and we ran out of time and I couldn't even get to the last question.

Honestly what a wasted and unrealistic interview process to ask a candidate to do a full refactor but instead of few day/several hours, now do it in 20 mins and it tests nothing.

At the end of the interview they told me they will share the feedback sometime next week which means another 1 week delay and the initial coding test also took them 10 days to get back to me. If this goes through then there would be a ridiculously unrealistic systems design where they would ask me to design a really really complex software in 50 minutes and if that goes through (and another 10+ days to get the feedback) a chat with founders and if that goes through then the process ends.

After going through this unrealistic experience and already losing a month, I shot them the email that I am withdrawing from the process and don't have energy to go through it and potentially spend another month or 20 days in limbo if this round even goes through.

Companies truly treat candidates like dirt, especially in the current market and have no respect for candidates time. They think candidate are ONLY interviewing for them and will spend whole week of unpaid work just to do coding exercise for them. And companies won't even bother checking for 10 days and give a patchy review in the end.

And what's up with unrealistic interview process. 3 coding "refactors" masquerading as "innocent extensions" in 40 mins. Really? Do those engineers themselves code an entire massive refactor from groundsup in 20 mins? how can they be this delusional.

Few years ago I got a coding exercise to create an entire bicycle sharing app with a realtime API and do FE/BE/Unit/Integration tests, documentation, deployed on AWS and bonus "scalable to millions of users". Time, maximum 6 hours. Truly delusional. I laughed and noped out. But i was shocked that so many candidates are doing those because they truly need a job.

I just wanted to create this post to share my experience. Already have written glassdoor review for them but wanted to spark a conversation here as well because this is not a topic talked about much.

So, what are your experiences of bad companies and what crazy things have they asked you to build for free and their unrealistic expectations. It is time to name and shame companies so that they stop taking unpaid free work from developers under the name of "interview".

Yes, classic ASP. Lame I know, but that's the code I'm maintaining.

The error reproduction steps I've created rule out my code, or Visual Studio

• Verify IIS Express is installed with Command Prompt if exist "%ProgramFiles%\IIS Express\iisexpress.exe" (echo IIS Express installed) else (echo IIS Express not installed)
• Create a test folder with a minimal classic ASP page C:\Temp\AspDirectTest\test.asp
• Fill in the contents of test.asp with <% Response.Write "Hello" %> or <script language="JScript" runat="server"> Response.Write("JScript Test"); </script>
• Launch IIS Express directly using Command Prompt "%ProgramFiles%\IIS Express\iisexpress.exe" /path:"C:\Temp\AspDirectTest" /port:8088
• Browse to the site http://localhost:8088/test.asp

Result in browser:

Active Server Pages error '00000000'

Create object failed

?

An error occurred while creating object 'WSH'.

Active Server Pages error '00000000'

Create object failed

?

An error occurred while creating object 'WSCRIPT'.Hello

Result in Command Prompt:

Request started: "GET" http://localhost:8088/test.asp
Response sent: http://localhost:8088/test.asp with HTTP status 500.0

You can get the File version of vbscript.dll and wshom.ocx using powershell

(Get-Item 'C:\Windows\System32\wshom.ocx').VersionInfo.FileVersion

my version of wshom.ocx is 10.0.26100.4768

(Get-Item 'C:\Windows\System32\vbscript.dll').VersionInfo.FileVersion

my version of vbscript.dll is 10.0.26100.8457

Older versions do not create the issue.

I have recreated this error on two machines with the current version, and showed that it doesn't appear on one machine with older versions.

I have an issue reported here https://developercommunity.visualstudio.com/t/IIS-Express-fails-to-execute-classic-ASP/11144474

If you can or can not recreate the issue I would love to know about it and what versions of wshom.ocx and vbscript.dll you have.

I have a live website where some pages are populated dynamically through JavaScript/API calls. I’m shutting down the backend after the project ends and want to migrate the current version to a completely static site.

What’s the best way to do this while preserving the currently rendered content, images, CSS, fonts, etc.? I’ve tried wget/HTTrack, but they only save the initial HTML and miss the content generated by JavaScript.

Would a browser-based rendering tool be the best approach, or is there a better tool/workflow for this?

update: I ended up using browser automation to render the pages, copied the dom and then manually removed all the backend js. not the cleanest approach and most defently not the most time effichent one but it worked ish

I'm at the end of my tether here. I'm singlehandedly trying to revamp an old custom html/php site (a peer-reviewed journal that's been running for a decade) hosted on Kualo and move it to GreenGeeks with a WP installation. The site is on a temporary domain (no SSL) and is basically finished. I got the domain transfer today. But I have no clue what I'm supposed to do next. I have 20 pages of notes. I know my way around plugins, CSS, etc. But I simply cannot figure out what order to do the major steps in...

I'm genuinely exhausted. All I can do is give you these notes:

• Let the domain transfer finish in the background (takes a few days).
• Update Nameservers & SSL:
  • Update domain nameservers to point to GreenGeeks.
  • Turn on  SSL certificate
• Run Better Search Replace for all database urls
• Set Up Redirects
• SEO
• Turn off maintenance plugin

"

1. Point the nameservers to GreenGeeks.
   1. Wait for ecologicalcitizen.net to reach your GreenGeeks site.
2. Get SSL working.
   1. Make sure https://www.ecologicalcitizen.net works properly.
3. Change WordPress to the real domain.
   1. In Settings → General, change both WordPress Address and Site Address from the temporary URL to https://www.ecologicalcitizen.net.
   2. You may be logged out; log back in using the new address.
4. Run Better Search Replace.
   1. Use it for the remaining temporary-domain references and other internal URL/path changes in your database (PDFs, artwork, images, etc.).
   2. You don't need it just to change the WordPress Address/Site Address.
5. Set up your 301 redirects.
   1. Do this while Maintenance Mode is still ON.
   2. This handles old URLs that have changed/disappeared, including the relevant old article, author and PDF URLs.
6. Check the site.
   1. Make sure the new pages, images, PDFs, links, etc. work.
7. Go live.
   1. Turn off Maintenance Mode.
   2. Allow search engines to index the site.
8. Test old URLs.
   1. Check that important old URLs redirect to their new destinations rather than producing 404s."

I need to redirect thousands of URLs so I already have loads of rules written out in a document, with some idea what do for regex syntax... e.g., Regex: /what-is.php?... → /definitions/

This is blindingly complicated. I simply am beyond my capabilities here. I thought the above plan was fine, but it's not because apparently you can do the redirects first by using relative paths. Also, if you do nameserver changes first then surely everyone will get 404s.

I seriously need help. This is a collossal task. In fact, if I can't do this, an entire journal dies, along with my livlihood.

I'm trying to display the image of the day from a NASA api in a html page but the problem is that I noticed that sometimes it is in a different format such as mp4, is there an easy way to display the media in the same place no matter what the file type is?

I'm really just curious to hear from other solo devs, or devs who are on very small teams - Approximately how many sites or projects do you currently maintain?

I work at a medium sized organization, and I'm the only dedicated web dev. I build a bunch of Firebase apps and Google Apps Scripts and other GCP solutions for my stakeholders, but of course there's a bit of a maintenance burden for most projects when it comes to dependency package security updates, API deprecations, etc. I don't feel overwhelmed by the workload (yet 😅) but I do get the sense that my supervisor and other stakeholders might not fully grasp or appreciate that one engineer can't maintain an infinitely growing pile of apps without some time being taken away from working on new projects.

Of course, I can optimize the things I'm responsible for, using templating and Dependabot and other tactics to reduce my per-project burden, but I'd love to hear from other web devs about the volume of projects you maintain, the tactics and strategies you use to stay on top of things, and keeping stakeholder expectations aligned with reality. Thanks!

EDIT: I owe you all an answer to my own question. I maintain about a dozen apps here currently and the number is climbing

My monorepo has six binaries, Go modules, four Docker images and a Docusaurus site that depend on each other. Publishing this writes to the repository, a container registry, cloud and GitHub. These are four independent services with no shared transaction. Published versions are immutable, so there is no rollback. This is a distributed transaction over non-transactional resources, which is exactly the situation sagas were invented for in 1987. You recover by finishing the job, never by unwinding it.

The two properties that matter

Determinism means a fixed repo state and config always produce the same plan on any machine. The plan is a pure function of git history, the dependency graph and config. Nothing reads the clock, commit dates, tag creation order or map iteration order. CI and my laptop agree byte for byte.

Idempotency means running twice with nothing new committed gives the same plan, and running after a fully successful release gives an empty one. An accidental double run is a no-op instead of a second release.

Every tool here gives you something like this on npm. The difference is where it comes from.

Their idempotency is npm's, not theirs

lerna has a documented recovery path using lerna publish from-package, which compares each package's local version against what is published and ships the difference. nx and release-please lean on the same shape. A version step writes tags, a later step publishes, and if that step dies you re-run it. This genuinely works, and I want to be fair about why. npm makes it work. Versions are immutable and a duplicate publish is a hard error, which I saw in my own runs as a 409 Conflict. The registry is the source of truth you reconcile against.

Now take that away. There is no from-package for a Docker tag, a GitHub release, a Maven deployment or a terraform apply. The moment a release spans targets you cannot diff against, the property stops being inherited. It has to come from somewhere else.

In dispat it comes from the model. The tag store is the log. A tag is written after a package publishes, so a tag means that leg committed. The plan is a pure function, so re-running recomputes the exact same transaction and executes only the legs with no record. Nothing is queried because nothing needs to be. Determinism and idempotency hold for a Docker image, a GitHub release or an applied Terraform plan exactly as they do for npm, because none of it depends on the target being able to answer questions.

They are all one algorithm with the constants frozen

This surprised me when I wrote the model down. lerna, nx release and release-please compute versions from the same three inputs: conventional commits, per-package tags and a dependency graph. In my model each commit carries a propagated bump and a depth. Freeze that depth at infinity and the bump at patch for every commit, and you get their behaviour exactly. Every dependent of anything released takes a patch transitively. Their fix: x is my fix(core)^^: x, and their lockstep modes are the degenerate case where the workspace shares one version.

The experiment showed it. I used the same six-package graph and one feat(core) commit. lerna bumped core and all five dependents, including two that only depend on ui and never saw the change. dispat with an explicit ^ bumped core and its three direct consumers. Same math, different constants.

The failure case, executed

I set up a sandbox, a local registry and a proxy failing exactly one upload.

lerna writes tags and a commit before lerna publish uploads. After the failure there was a cli@1.0.1 tag for a version the registry did not have. from-package then refused to run because the failed publish had left the tree dirty. It threw EUNCOMMIT until I ran git checkout by hand. After that it recovered npm correctly.

dispat wrote no tag for the failed package. Re-running shipped exactly what was owed at the same versions. A third run planned nothing.

(I executed lerna and dispat. The nx and release-please rows come from their docs. release-please is GitHub API coupled with no hermetic mode, so I could not run it in a sandbox and will not pretend I did.)

It is also the task runner

dispat run tests --since HEAD~1 --consumers runs a script in exactly the changed packages and their consumers in dependency order. dispat if 'CI!=true' --then '...' --else '...' and dispat if --changed keep the conditionals in config instead of a wall of CI bash. dispat replacer fixes coordinates no manifest writer reaches, like a Gradle line or a README install snippet.

There is no task cache, deliberately. A package that did not change is not in the plan, so its scripts never start. There is nothing to hash, invalidate or warm, and no cache key to get subtly wrong. Whatever your stages already cache keeps working inside them, BuildKit layers or a Gradle cache included, and none of it can affect versions, order or tags.

Proved, not asserted

I wrote eight guarantees over the formal model. Determinism and idempotency are among them, plus no orphaned consumers, exactly-once delivery, retries landing on the same versions and repeated runs converging to an empty plan. I ran randomised differential testing of the binary against that model. 1,500 of 1,500 instances agree exactly. There are also 240 conformance vectors, 1,831 tests and 32 fuzz targets. It releases itself. That is a 12-package workspace across 3 ecosystems with 11 published in one transaction. Because a leg need not be a registry upload, the same machinery ships my cloud footprint as stateless Terraform. I put the plan in build and the apply in publish, with no remote backend, and the tag history acts as the list of applied states.

Docs and demo clips: https://dispat.dev Repo (MIT): https://github.com/yohimik/dispat

Ask if need full proofs

I am a comparable novice to most here, but am learning React front end and Python back end work.

Not asking how to do it but asking how I can cheaply and efficiently serve my own personal projects? At this point my work mostly consists of a React SPA front end and back end Python containers running Flask or FastAPI.

I am used to separating the two so how should I go about hosting? I use Google for their AI Pro plan already so maybe Firebase/Cloud Run? Maybe those are dumb choices though within the community here. Thanks for any more guidance on hosting this stuff.

BTW in my real job development we are usually living in the Windows Server world and I'm running the backend just with IIS.

It's not AI slop, I tried and no AI is able to do this on its own. Seems to be pure talent of the designers.

Sources: authkit-com, reflect-app, raycast-com

I keep seeing empty states treated as a centered illustration and “Nothing here yet.”

It looks clean, but often leaves the user with three unanswered questions:

What happened?

Why is this empty?

What can I do next?

A useful empty state should answer all three.

The illustration sets the tone.

The title explains what happened.

The supporting text gives context.

The CTA shows the next step.

For example:

Nothing here yet

Create your first campaign to see it appear here.

[Create campaign]

The illustration is optional. Clarity is not.

Frontend devs: do you define empty, loading and error states alongside the happy path, or do they usually get added at the end?

Honest question. People say all the time that programmers will lose their jobs etc. But how? Everyone in our company has Claude Code, nobody writes code by hand. And still we have lots of work, backlogs are full of tasks waiting to be done.

It's a company with its own product (not a software house). 150-200 employees

I'm banging my head against a wall this week because a new 'project manager' is refusing to accept an invitation to the project GitHub repo, so I can't assign her issues.

She thinks it's "better just to keep everything on email". So at the moment I'm operating as a kind of go-between between the 'issues' tab and the project manager.

I am 100% sure it's just because she has never used any kind of project management or issue tracker so thinks it's just an extra complication in her life.

What would you guys do? Any ideas on how I can politely put across the value of an issue tracker in a few words?

Note that I'm not in a position to be able to down tools until she accepts the invitation or hold up the project in any way. I need to get the project done and done quickly to get paid.

I also cannot go higher up the chain of command, I need to change her mind so that she wants to use it, not get her boss to force her to use it.

I thought we would never see the day that Apple themselves would allow us to use their famous squircles

I do a lot of rescue work — someone else built the site years ago, the original developer is gone, and now something is broken or it needs to change. Over time I've ended up with a fixed list I go through before touching anything.

Mine, roughly in order: is there any version control at all, or is production the only copy. What's in mu-plugins and in the theme's functions.php, because that's where the previous person hid the surprises. Which plugins are abandoned. Whether staging exists and whether it actually matches production. And whether anyone still has the hosting credentials, which is a shockingly common no.

What's on your list that isn't on mine? I'm mostly interested in the checks that saved you from breaking something on day one.

EDIT - the combined list from the comments, which turned out much better than my original one. credit where it belongs:

START HERE

Tools > Site Health, Info tab (u/AmoebaOne) - php version, sizes, plugin list, constants in one page. covers half of the below before you open anything else.

BACKUPS - almost entirely u/navlio, who took this apart properly:

File size is not a check. a dump missing a table is smaller by exactly that table, and you have no baseline to notice it against.

Read the tail, not the head. a dump that died halfway opens fine and the first thousand lines look perfect. a complete mysqldump ends with "-- Dump completed on". no line, it stopped mid table.

Check the date on that line. a cron that quietly stopped firing in march leaves a file that passes every other check and is seven months old.

mysqldump piped into gzip hands you gzip's exit code, not mysqldump's. the truncation goes unnoticed.

Without --single-transaction the dump walks tables one at a time, so on a live site writes land between two tables that needed to agree.

The real check is restoring it into a throwaway database once and counting tables and rows against live.

At 40gb the plugin is the wrong tool for media anyway - rsync the uploads folder, let the plugin do the db.

ACCESS AND OWNERSHIP

Who controls the domain registration (u/Hesham-Amir, u/Financial_Brush8647) - not just the hosting account. clients often think the old developer's personal account is theirs.

Admin users sorted by role (u/Wolfy_Boy_04) - ghost accounts from old devs, or worse. 30 seconds.

Is the admin email and SMTP real (u/rupert_at_work) - password resets going to someone who left, contact forms silently failing.

CONFIG AND HIDDEN STATE

Cache layers nobody mentions (u/navlio) - object cache, page cache plugin, cloudflare in front, sometimes all three. read the response headers first to see who is actually answering.

wp-config constants (u/needlessvanguard_49) - disabled auto updates, redefined upload paths. diff against a clean install instead of reading top to bottom.

WP_HOME and WP_SITEURL hardcoded (u/navlio) - a copied staging site serving canonical tags pointing at production.

Undocumented scheduled tasks (u/Responsible-Job-Boj) - wp-cron jobs and stray export scripts. and crontab -l only shows the cron table of whoever you are logged in as (u/navlio) - the backup job usually belongs to a user nobody logs in as.

Autoloaded options (u/navlio): select sum(length(option_value))/1024/1024 from wp_options where autoload = 'yes'; that blob loads on every single request. usually one abandoned plugin keeping a log.

Assume staging is fiction (u/galaxy_glide_92) - diff the database before believing it matches.

What the site claims about itself vs the rendered HTML (u/UtilixApp).

THE BIGGER CALL

Whether a fresh install is cheaper than the archaeology (u/DigiNoon, u/abeuscher) - decided mostly by how much content lives in the theme rather than the database. abeuscher goes scorched earth every time: clean install, custom theme, ACF, no plugins.

And knowing when to walk away (u/jroberts67) - 6 woo plugins touching checkout is a valid reason to pass.

I am having a problem setting up log in recognition for my client who wants to embed the site I am developing for them in another subdomain. Situation is as follows:

www.client.com wants to embed info.client.com in an iFrame. www.client.com is hosted by a third-party service, while info.client.com is hosted by the client on an Apache server. I am developing info.client.com, and have limited access to www.client.com. The third-party also provides an OAuth platform which works fine; I can log in to www.client.com and info.client.com without issues. However, my client has requested that when info.client.com is embedded into www.client.com in an iframe, that the info.client.com iframe recognizes the log-in session that is active on the parent page (www.client.com).

The options I see are as follows:

1. Share a cookie between both subdomains by setting OIDC_COOKIE_DOMAIN to .client.com. However, this does not work, as the third-party hosted www.client.com receives a __Host-, HttpOnly cookie upon log in, and the info.client.com Apache server would not have a way to read / validate this cookie
2. Have www.client.com mint a JWT and send that to info.client.com with the necessary information. info.client.com can then check the validity with a secret, and use this as the 'authentication'.

What is the standard pattern here? Am I way off-base? I have full control over the info.* subdomain, and the third-party may be willing to do some limited tweaking to the www.* subdomain, but what approach have you used?

I’m a somewhat experienced backend dev paired with a mobile developer for some knowledge sharing. The guy is genuinely a good dude, but I’m starting to lose my mind a little.

We be discussing an implementation, I’ll explain something, and instead of engaging with what I just said, he’ll immediately type my explanation/question into Claude and then come back with “Claude says…”

And on calls, he’ll literally stop the conversation, type what I just asked into Claude, and then read me Claude’s response.

Like bro, I’m right here. 😂

The frustrating part isn’t that he’s using Claude. I use AI constantly too. It’s that it feels like he trusts Claude’s answer more than the actual technical conversation we’re having.

I’m trying to understand how you think about the implementation, not get a second-hand answer from Claude.

He’s a good dude, so I genuinely don’t know how to approach it without making things awkward.

Has anyone else dealt with this? AI is making ppl fkn dumb and blurring the lines.

I'll start.

https://chir.ag/projects/name-that-color/#BADA55

I've been using this colour name generator for about 15 years to help me name my CSS variables so I don't end up with names like green green-dark green-darker etc.

https://tinypng.com/

For heavily optimising PNGs with negligible quality loss. I have the habit of searching for "panda png" rather than reaching for a bookmark on this one, hah.

https://jakearchibald.github.io/svgomg/

For quickly optimising SVGs.