Today I Learned
The small stuff that quietly makes you a better dev — one note at a time.Das kleine Zeug, das dich nebenbei zum besseren Dev macht — Notiz für Notiz.
Firestore deletes nothing on its own, and a document is the smallest thing it can split
Two Firestore properties that decide the schema for live shared state: TTL is a policy rather than a field, and the document is the unit that expires, transacts, and hotspots.
CI can deploy to Cloud Run without a key — and one missing line trusts all of GitHub
How Workload Identity Federation replaces a service-account key in GitHub Actions, which three IAM grants a deploy actually needs, and the two flags that quietly decide whether your service survives the deploy.
Reverse engineering a mobile app's private API
A full walkthrough of reading an app's own API off your phone — proxy and CA trust, why apps ignore your certificate, adb over WiFi, jadx, recovering obfuscated annotations, an emulator with a system-store CA, and the verification step that stops you shipping a lie.
On a small tip, the 5% isn't the fee that hurts
Adding a 'buy me a coffee' button to a side project, I went to check the platform's 5% cut — and found the fixed per-transaction fee is what actually eats a small coffee.
You can add a backend to a static site without running one
Live presence, shared reactions and per-post likes on two static GitHub Pages sites — using Supabase from the browser, for free, without leaking visitors to a third party on load.
Local-first, then "where did my data go?"
Verso works fully offline before you ever sign in. Then logging in switched to cloud mode and hid the local books — never deleted, but it sure looked like data loss. Here's the fix.
Bot-proofing auth on a static site: Turnstile + Supabase, in the right order
No server of your own, but you still need to stop mass signups. Cloudflare Turnstile + Supabase does it — as long as you deploy the two halves in the order that doesn't lock everyone out.
Reading Open Library without hammering a nonprofit
Using Open Library for ISBN metadata and covers — where the data actually lives, which endpoint resolves German editions, and how to cache so a timeout never poisons the answer.
Svelte 5 runes: a reactive store behind a synchronous read API
One `db` object with getters over `$state` keeps components dead simple — and lets the exact same store run in local or cloud mode behind a single API.
One Supabase project, three static apps
A portfolio, a blog and a book-library PWA all share one free Supabase project — three completely different backends living in the same database without stepping on each other.
The safe way to kill a legacy system is called strangler fig
The incremental-migration pattern you already reach for in legacy code has a name that's easy to forget — and a plant behind it worth remembering.
A mounted bucket is not a database — even when SQLite seems to work
What a tiny Cloud Run deployment taught me about ephemeral containers, deceptive GCS FUSE persistence, Firestore transactions, cutover proofs, and the one innocent polling loop that can dominate the bill.