Every file upload is a stranger putting a file on your server.
Check the type, cap the size and rename it.
Store it away from your code, never where it can run.
Check the type, cap the size and rename it.
Store it away from your code, never where it can run.
2
0
3
221
AI made the first 80% of an app almost free.
The last 20% is edge cases, security and support.
That last 20% is where the product is.
The last 20% is edge cases, security and support.
That last 20% is where the product is.
1
0
2
83
Every feature flag is also a kill switch.
When it breaks at 2am, you flip a flag instead of shipping a fix.
Put one on every risky launch.
When it breaks at 2am, you flip a flag instead of shipping a fix.
Put one on every risky launch.
7
0
10
373
Treat AI like a fast intern with no fear.
It will do anything you ask, instantly and confidently.
That's exactly why it needs review.
It will do anything you ask, instantly and confidently.
That's exactly why it needs review.
5
0
5
219
You encrypted the database.
Then you logged the full request body.
Passwords, tokens and card numbers, now in plain text in a log tool half the company can search.
Search your logs for "password" today.
Then you logged the full request body.
Passwords, tokens and card numbers, now in plain text in a log tool half the company can search.
Search your logs for "password" today.
1
0
3
100
The fastest way to learn a new codebase isn't reading it.
It's fixing one small bug in it.
You'll touch the build, the tests, the deploy and the one person who knows how it all works.
It's fixing one small bug in it.
You'll touch the build, the tests, the deploy and the one person who knows how it all works.
10
1
17
378
Your UI shows the user's name.
Your API sends their name, email, phone, password hash and internal notes.
Hiding a field in the frontend doesn't hide it. Anyone can open the Network tab.
Return only what the screen needs.
Your API sends their name, email, phone, password hash and internal notes.
Hiding a field in the frontend doesn't hide it. Anyone can open the Network tab.
Return only what the screen needs.
10
1
21
528
Add /.git/config to the end of your website's URL.
If it loads, anyone can download your source code. Commit history, old secrets and all.
Block hidden folders on your web server. It's one line of config.
If it loads, anyone can download your source code. Commit history, old secrets and all.
Block hidden folders on your web server. It's one line of config.
6
1
14
766
Sleep at 9. Up at 5.
Win the morning before checking Slack.
5 rules for founder momentum:
• 1 daily goal, not 10
• Weekly customer calls
• Daily phone-free walks
• Exact runway tracking
• Non-negotiable family time
Stop asking for more hours. Focus on better ones.
Win the morning before checking Slack.
5 rules for founder momentum:
• 1 daily goal, not 10
• Weekly customer calls
• Daily phone-free walks
• Exact runway tracking
• Non-negotiable family time
Stop asking for more hours. Focus on better ones.
7
0
11
389
Go find the oldest TODO in your codebase.
Mine said:
TODO: fix this properly before launch
Launch was 2019.
The author left in 2020.
The code still runs in prod every day.
Nothing is more permanent than a temporary fix.
Mine said:
TODO: fix this properly before launch
Launch was 2019.
The author left in 2020.
The code still runs in prod every day.
Nothing is more permanent than a temporary fix.
8
0
19
445
If you shipped it and didn't tell anyone, your users think nothing changed.
Write the changelog. Email it. Post it.
Shipping is half the work. Saying it is the other half.
Write the changelog. Email it. Post it.
Shipping is half the work. Saying it is the other half.
6
1
18
391
Clocks went back an hour last night.
Somewhere right now:
A cron job ran twice.
A report shows 25 hours of revenue.
A booking app thinks 02:30 happened two times.
A dev is learning why you store everything in UTC.
Happy DST Sunday. Check your logs.
Somewhere right now:
A cron job ran twice.
A report shows 25 hours of revenue.
A booking app thinks 02:30 happened two times.
A dev is learning why you store everything in UTC.
Happy DST Sunday. Check your logs.
3
0
9
159
Vibe coded or hand coded? Your users can't tell.
They care that:
1. It solves their problem.
2. Their data is safe.
3. Bugs get fixed fast.
Nail those three and nobody asks how you wrote it.
They care that:
1. It solves their problem.
2. Their data is safe.
3. Bugs get fixed fast.
Nail those three and nobody asks how you wrote it.
0
0
2
140
"Wrong password" tells a stranger the email is real.
Say "Email or password is incorrect." Every time.
Say "Email or password is incorrect." Every time.
7
0
24
709
Petre Sosa retweeted
99% of financial advice on the internet is ABSOLUTE garbage.
And some of the worst advice gets repeated in your motivational pep talks so often that people actually believe it.
Here are 10 terrible money lessons you should probably unlearn:
1. "Your 9-5 won't make you rich."
A high income, disciplined spending, and years of investing can build serious wealth. (No, not a billionaire)
2. "Renting is throwing money away."
So are mortgage interest, repairs, property taxes, and buying a house you can't afford.
3. "Follow your passion."
Being passionate about something doesn't mean anyone will pay you for it. Get really good at solving valuable problems.
4. "Save 10% and you're set." 10% of what?
Your income, lifestyle, and retirement goals matter a hell of a lot more.
5. "You need to hustle 24/7."
Sleep deprivation and burnout aren't wealth-building strategies.
6. "Never use credit cards."
Use them responsibly, pay the full balance, and take advantage of the benefits. Don't pay interest to chase rewards.
7. "All debt is bad."
Borrowing to buy a depreciating toy and borrowing to grow a profitable business are two very different decisions.
8. "Buy the house the bank approves."
The bank decides how much it'll lend you. You decide how much financial stress you can live with.
9. "Crypto is the future."
Maybe. But anyone promising guaranteed returns from something they can't predict is selling you bullshit. And I've been in the trenches .
10. "Stop watching Netflix and you'll be rich."
If your income sucks, cancelling a $15 subscription won't magically fix it. Focus on the big numbers first.
And some of the worst advice gets repeated in your motivational pep talks so often that people actually believe it.
Here are 10 terrible money lessons you should probably unlearn:
1. "Your 9-5 won't make you rich."
A high income, disciplined spending, and years of investing can build serious wealth. (No, not a billionaire)
2. "Renting is throwing money away."
So are mortgage interest, repairs, property taxes, and buying a house you can't afford.
3. "Follow your passion."
Being passionate about something doesn't mean anyone will pay you for it. Get really good at solving valuable problems.
4. "Save 10% and you're set." 10% of what?
Your income, lifestyle, and retirement goals matter a hell of a lot more.
5. "You need to hustle 24/7."
Sleep deprivation and burnout aren't wealth-building strategies.
6. "Never use credit cards."
Use them responsibly, pay the full balance, and take advantage of the benefits. Don't pay interest to chase rewards.
7. "All debt is bad."
Borrowing to buy a depreciating toy and borrowing to grow a profitable business are two very different decisions.
8. "Buy the house the bank approves."
The bank decides how much it'll lend you. You decide how much financial stress you can live with.
9. "Crypto is the future."
Maybe. But anyone promising guaranteed returns from something they can't predict is selling you bullshit. And I've been in the trenches .
10. "Stop watching Netflix and you'll be rich."
If your income sucks, cancelling a $15 subscription won't magically fix it. Focus on the big numbers first.
25
1
43
1,012
384-bit curve, 8-bit key. Ouch.
How on earth did this happen:
The Indian certificate authority (CA) eMudhra had one job (well, two):
1. Create secure, 384-bit private keys
2. Store these securely and do not leak them
Well, eMudhra chose private keys between 1 and 256 (the numbers!!) and called it a day. WTF
2
0
9
239
Dev excuses ranked by believability:
10. It's a feature
9. It worked yesterday
8. Must be a caching issue
7. Works on my machine
6. Someone changed the config
5. The AI wrote that part
4. It's a timezone thing
3. Third-party API is down
2. That's legacy code, I didn't touch it
1. DNS
It's always DNS.
10. It's a feature
9. It worked yesterday
8. Must be a caching issue
7. Works on my machine
6. Someone changed the config
5. The AI wrote that part
4. It's a timezone thing
3. Third-party API is down
2. That's legacy code, I didn't touch it
1. DNS
It's always DNS.
6
0
9
239