Tagged #til
23 notes.
Firestore deletes nothing on its own, and a document is the smallest thing it can split
Two Firestore properties that decide the schema for live shared state: TTL is a policy rather than a field, and the document is the unit that expires, transacts, and hotspots.
CI can deploy to Cloud Run without a key — and one missing line trusts all of GitHub
How Workload Identity Federation replaces a service-account key in GitHub Actions, which three IAM grants a deploy actually needs, and the two flags that quietly decide whether your service survives the deploy.
Reverse engineering a mobile app's private API
A full walkthrough of reading an app's own API off your phone — proxy and CA trust, why apps ignore your certificate, adb over WiFi, jadx, recovering obfuscated annotations, an emulator with a system-store CA, and the verification step that stops you shipping a lie.
On a small tip, the 5% isn't the fee that hurts
Adding a 'buy me a coffee' button to a side project, I went to check the platform's 5% cut — and found the fixed per-transaction fee is what actually eats a small coffee.
You can add a backend to a static site without running one
Live presence, shared reactions and per-post likes on two static GitHub Pages sites — using Supabase from the browser, for free, without leaking visitors to a third party on load.
Local-first, then "where did my data go?"
Verso works fully offline before you ever sign in. Then logging in switched to cloud mode and hid the local books — never deleted, but it sure looked like data loss. Here's the fix.
Bot-proofing auth on a static site: Turnstile + Supabase, in the right order
No server of your own, but you still need to stop mass signups. Cloudflare Turnstile + Supabase does it — as long as you deploy the two halves in the order that doesn't lock everyone out.
Reading Open Library without hammering a nonprofit
Using Open Library for ISBN metadata and covers — where the data actually lives, which endpoint resolves German editions, and how to cache so a timeout never poisons the answer.
Svelte 5 runes: a reactive store behind a synchronous read API
One `db` object with getters over `$state` keeps components dead simple — and lets the exact same store run in local or cloud mode behind a single API.
One Supabase project, three static apps
A portfolio, a blog and a book-library PWA all share one free Supabase project — three completely different backends living in the same database without stepping on each other.
The safe way to kill a legacy system is called strangler fig
The incremental-migration pattern you already reach for in legacy code has a name that's easy to forget — and a plant behind it worth remembering.
A mounted bucket is not a database — even when SQLite seems to work
What a tiny Cloud Run deployment taught me about ephemeral containers, deceptive GCS FUSE persistence, Firestore transactions, cutover proofs, and the one innocent polling loop that can dominate the bill.
The follow-up: Biome shipped, Mago didn't — what the Catroweb migration actually taught me
Three weeks ago I promised real numbers instead of vendor benchmarks. Here they are: Biome replaced ESLint+Prettier and stuck, Mago got screened out before it ever ran, and the thing that ate my afternoon was a supply-chain scanner nobody asked about.
One extension codebase for Chrome and Firefox — signing is the only real fork
The same unpacked MV3 folder loads in both browsers; the divergence is how you get a permanent install, and Firefox's signing story is friendlier than its reputation.
Coding from my phone works because none of it runs on my phone
Claude Code on the web runs each session in a cloud VM, so closing the browser doesn't stop the work — I shipped two small apps from a train with no laptop.
Most reports bury the one line that matters
Why the verdict belongs at the top of a report, and the two honesty habits that let people trust it there.
I told Claude Code to build its own status line
The status line is just a script that gets handed a JSON blob — git branch, files changed, usage limits — so building one is mostly describing what you want.
Agile's feedback loop starts one slice too late
An experiment: before the first real slice, vibe-code a throwaway prototype for a few tokens, let stakeholders click it, and start the agile loop already aimed right.
Trading four linters for two: Biome and Mago vs my Prettier/ESLint/PHPStan/Fixer stack
A theoretical, table-by-table comparison of the Rust linting toolchains Biome and Mago against the Node/PHP incumbents — before I migrate a real project and report the actual numbers.
The Rust SQLite rewrite's real bet isn't Rust — it's how it's tested
Turso is rewriting SQLite in Rust, but the interesting part is deterministic simulation testing — and why that's the only thing that could plausibly match SQLite's reliability.
FIFA shipped a beginner's auth bug
A billion-dollar platform shipped the same access-control bug I catch in first-week code. Budget and brand don't buy you out of it — so look closely.
PHP's array_is_list() is underrated
A tiny 8.1 function that replaces a surprising amount of hand-rolled key checking.
Astro, for people who already know the web
A 5-minute mental model of Astro for experienced devs — server-first rendering, islands, and content collections — without the getting-started fluff.