Developer Guides
Articles on the dev topics no tool can solve for you: the CORS errors, YAML surprises and cron quirks that eat afternoons. Researched properly, with the facts other write-ups skip.
01
Web & HTTP
8 guides CORS errors, explained properly Your request probably worked. What the browser actually blocks, what triggers a preflight, and which fixes are real. SameSite, Secure, HttpOnly: cookie attributes explained What changed with Chrome 80, why None needs Secure, and the prefixes nobody uses. HTTP caching without tears Cache-Control, ETag, Last-Modified, and the heuristic cache that kicks in when you send nothing. 301 vs 302 redirects: what matters for SEO Browsers cache 301s forever, POST bodies get dropped, and Google cares less than you think. LocalStorage vs cookies: where to store JWTs The eternal debate, settled with threat models instead of dogma. API errors a client can act on RFC 9457 problem+json, matching status codes, and how much truth to put in a message. Rolling out CSP without breaking your site Why allowlists are bypassable, what strict-dynamic changes, and the report-only process. That HAR file contains your session What a HAR export records, the 2023 Okta support incident, and how to sanitize before you attach.
02
DNS & networking
6 guides SPF, DKIM and DMARC explained Why your emails land in spam, the 10-lookup limit, and what Gmail requires since 2024. DNS propagation is a myth Nothing propagates. Caches expire. How TTL really works and why NS changes take two days. What happens when you type a domain name Stub resolver to root to authoritative, the five caches in between, and the ndots tax. Incomplete chain and other SSL errors Why curl refuses what Chrome accepts: missing intermediates, AIA fetching, expired roots. The 47-day certificate is coming The 200-day cap is already live, 100 days follow in 2027. Where 47 comes from, what to automate. Post-quantum TLS broke your proxy ML-KEM pushed the ClientHello past one packet, and a long tail of middleboxes chokes on it.
03
Security & auth
8 guides Why SHA-256 is wrong for passwords GPU hashrates, bcrypt’s 72-byte trap, and the Argon2 parameters that hold up today. How TOTP 2FA codes actually work RFC 6238 in plain english: one HMAC, a clock, and six digits. Base64 is not encryption What encoding actually does, why it exists, and why anyone can read your JWT. ReDoS: how one regex can take down your server The Cloudflare and Stack Overflow outages, and the quantifier patterns that explode. Your photos reveal where you live EXIF and GPS metadata: who strips it, who doesn’t, and the McAfee story. Five JWT mistakes that get APIs broken into alg:none, RS256 to HS256 confusion, secrets hashcat eats, and the claims nobody validates. Verifying webhook signatures The raw body problem, five providers with five schemes, replay windows and rotation. After the npm worm: audit your lockfile Shai-Hulud to ChainDrop: how the worms spread, and the two settings that blunt the next one.
04
Data formats
4 guides JSON vs YAML vs TOML Which config format to use, and why the answer changed three times since 2001. The YAML Norway problem When NO becomes false, 1.10 becomes 1.1, and a git SHA becomes scientific notation. Why Excel ruins your CSV files Stripped zeros, renamed genes, semicolon locales, and how to open CSVs safely. Why JavaScript quietly breaks your 64-bit IDs 53 bits of significand, snowflake IDs that lose their last digits, and what to send instead.
05
Text & Unicode
2 guides 06
Time & IDs
5 guides UUID v4 vs v7: which one for your database keys? Why random UUIDs fragment your indexes and what RFC 9562 changed in 2024. Cron pitfalls: timezones, DST and jobs that never run The OR quirk, the % trap, the missing newline, and the 02:30 job that runs twice. The cron cheatsheet that knows its dialects Copy-paste recipes, the */7 trap, Sunday as 0, 7 or 1, and which scheduler understands L, W and #. Always UTC? How to store timestamps without regrets Right for past events, wrong for future ones. Offsets are not timezones. The year 2038 problem is already here First failure in 2006, MySQL TIMESTAMP still ends in 2038, and 2039 expiry dates break today.
07
Dev workflow
6 guides Regex cheatsheet: one syntax, seven dialects Every token table plus what JavaScript, Python, PCRE, Java and Go actually support, with versions. Semver in package.json: what ^ and ~ really allow The left-most-non-zero rule, the 0.x trap, and the incidents that made everyone pin. .gitignore not working? It’s probably already tracked. Plus check-ignore, negation traps and the three ignore layers. Why chmod 777 is almost always wrong What actually breaks, from SSH refusing your key to the fix that isn’t one. Stop committing secrets: .env files and leaks Rotate first. Why deleting the commit does not unleak, and the layers that stop the next one. Supabase RLS policies, and the parts that bite USING vs WITH CHECK, policy recursion, the auth.uid() slowdown, and what bypasses RLS.
08
Frontend performance
3 guides Minify, uglify, obfuscate: what’s the difference? From JSMin to Terser, what mangling does, and why minified+gzipped is the number that counts. AVIF vs WebP Real compression numbers, browser support, encode speed, and the JPEG XL drama. Source maps, and why your stack trace still lies What is in a .map file, whether to ship it, hidden maps for error trackers, and version drift.
09
AI & the web
2 guides 10
Payments & compliance
3 guides Why 4242 4242 4242 4242 works everywhere The best-known test card decoded, the Douglas Adams theory, and the numbers built to fail. VIES is down again. Now what? MS_UNAVAILABLE decoded, the consultation number as audit proof, and a checkout that survives outages. Does the CRA apply to your side project? Reporting duties since September 2026, the open source carve-out, and where commercial begins.