Developer Guides
Articles on the dev topics no tool can solve for you: the CORS errors, YAML surprises and cron quirks that eat afternoons. Researched properly, with the facts other write-ups skip.
01
Web & HTTP
7 guides CORS errors, explained properly Your request probably worked. What the browser actually blocks, what triggers a preflight, and which fixes are real. SameSite, Secure, HttpOnly: cookie attributes explained What changed with Chrome 80, why None needs Secure, and the prefixes nobody uses. HTTP caching without tears Cache-Control, ETag, Last-Modified, and the heuristic cache that kicks in when you send nothing. 301 vs 302 redirects: what matters for SEO Browsers cache 301s forever, POST bodies get dropped, and Google cares less than you think. LocalStorage vs cookies: where to store JWTs The eternal debate, settled with threat models instead of dogma. API errors a client can act on RFC 9457 problem+json, matching status codes, and how much truth to put in a message. Rolling out CSP without breaking your site Why allowlists are bypassable, what strict-dynamic changes, and the report-only process.
02
DNS & networking
4 guides SPF, DKIM and DMARC explained Why your emails land in spam, the 10-lookup limit, and what Gmail requires since 2024. DNS propagation is a myth Nothing propagates. Caches expire. How TTL really works and why NS changes take two days. What happens when you type a domain name Stub resolver to root to authoritative, the five caches in between, and the ndots tax. Incomplete chain and other SSL errors Why curl refuses what Chrome accepts: missing intermediates, AIA fetching, expired roots.
03
Security & auth
7 guides Why SHA-256 is wrong for passwords GPU hashrates, bcrypt’s 72-byte trap, and the Argon2 parameters that hold up today. How TOTP 2FA codes actually work RFC 6238 in plain english: one HMAC, a clock, and six digits. Base64 is not encryption What encoding actually does, why it exists, and why anyone can read your JWT. ReDoS: how one regex can take down your server The Cloudflare and Stack Overflow outages, and the quantifier patterns that explode. Your photos reveal where you live EXIF and GPS metadata: who strips it, who doesn’t, and the McAfee story. Five JWT mistakes that get APIs broken into alg:none, RS256 to HS256 confusion, secrets hashcat eats, and the claims nobody validates. Verifying webhook signatures The raw body problem, five providers with five schemes, replay windows and rotation.
04
Data formats
4 guides JSON vs YAML vs TOML Which config format to use, and why the answer changed three times since 2001. The YAML Norway problem When NO becomes false, 1.10 becomes 1.1, and a git SHA becomes scientific notation. Why Excel ruins your CSV files Stripped zeros, renamed genes, semicolon locales, and how to open CSVs safely. Why JavaScript quietly breaks your 64-bit IDs 53 bits of significand, snowflake IDs that lose their last digits, and what to send instead.
05
Text & Unicode
2 guides 06
Time & IDs
4 guides UUID v4 vs v7: which one for your database keys? Why random UUIDs fragment your indexes and what RFC 9562 changed in 2024. Cron pitfalls: timezones, DST and jobs that never run The OR quirk, the % trap, the missing newline, and the 02:30 job that runs twice. The cron cheatsheet that knows its dialects Copy-paste recipes, the */7 trap, Sunday as 0, 7 or 1, and which scheduler understands L, W and #. Always UTC? How to store timestamps without regrets Right for past events, wrong for future ones. Offsets are not timezones.
07
Dev workflow
6 guides Regex cheatsheet: one syntax, seven dialects Every token table plus what JavaScript, Python, PCRE, Java and Go actually support, with versions. Semver in package.json: what ^ and ~ really allow The left-most-non-zero rule, the 0.x trap, and the incidents that made everyone pin. .gitignore not working? It’s probably already tracked. Plus check-ignore, negation traps and the three ignore layers. Why chmod 777 is almost always wrong What actually breaks, from SSH refusing your key to the fix that isn’t one. Stop committing secrets: .env files and leaks Rotate first. Why deleting the commit does not unleak, and the layers that stop the next one. Supabase RLS policies, and the parts that bite USING vs WITH CHECK, policy recursion, the auth.uid() slowdown, and what bypasses RLS.
08
Frontend performance
3 guides Minify, uglify, obfuscate: what’s the difference? From JSMin to Terser, what mangling does, and why minified+gzipped is the number that counts. AVIF vs WebP Real compression numbers, browser support, encode speed, and the JPEG XL drama. Source maps, and why your stack trace still lies What is in a .map file, whether to ship it, hidden maps for error trackers, and version drift.