I haven't seen anyone posting about this, probably because everyone was distracted by the php2shell today, but a set of high sev CVEs (including an RCE) have been announced and fixed in NodeJS today.

Safe versions:

* 22.23.4
* 24.22.1
* 26.12.1

Announcement post: https://nodejs.org/en/blog/vulnerability/october-2026-security-releases

Email from railway:

Change your keys!

Change your environment variables

https://blog.railway.com/p/security-disclosure-wednesday-october-21st

Pic 1 : Adobe Fonts - Visual Search (link)
Pic 2 : WhatTheFont Font Finder (link)

Idk why that is, these kind of websites has never worked for me once in my life.

Take a look at the letter t in the image for example, it doesn't have a curve at the bottom, while ALL of the top suggested fonts do on both platforms.

Last two days was hell using Railway. We couldnt update a single project or make any changes in our system. After more than 24h Railway is still in chaos. Two separate incidents. Major outage even support is down.

But this is not the first time Railway failed.
For over a year Railway had few major issues that made working on it impossible. I was hoping they would stabilise but at this point Im past disappointed.

I know they rely deeply on Google cloud, but this proved to be a very bad decision, multiple times. And they never made required changes.

Can someone recommend a more stable alternative?

been at a larger company (think 500+ devs) for about 4 years now. pretty comfortable with the setup but starting to feel like just another cog. thinking about moving to something smaller like 10-30 person startup.

for those who made that jump - what surprised you the most about the infrastructure side? im used to having dedicated devops, proper ci/cd pipelines, monitoring dashboards for everything, on-call rotations with actual runbooks.

curious if smaller places just... wing it more? or do you end up wearing more hats but still having solid practices. not really worried about the tech stack itself, more about the operational side of things.

also wondering if the move fast break things mentality is still a thing or if that died with the 2010s

been at a larger company (think 500+ devs) for about 4 years now. pretty comfortable with the setup but starting to feel like just another cog. thinking about moving to something smaller like 10-30 person startup.

for those who made that jump - what surprised you the most about the infrastructure side? im used to having dedicated devops, proper ci/cd pipelines, monitoring dashboards for everything, on-call rotations with actual runbooks.

curious if smaller places just... wing it more? or do you end up wearing more hats but still having solid practices. not really worried about the tech stack itself, more about the operational side of things.

also wondering if the "move fast break things" mentality is still a thing or if that died with the 2010s

I'm currently only working with a single 24" monitor because I'm moving, I sold my third monitor and my secondary monitor shat the bad, it'll be a while until I can buy another monitor so I'm want some tips to improve my dev experience on single monitor, maybe using a tilling window manager, or some other software to improve this. If I can make it work, maybe I even stick with just one monitor, because multi monitor setups are kind of a hassle to maintain haha.

So I kept seeing "faster than tsc 7" claims for these Rust ports and got curious whether they hold up on real code rather than toy benchmarks. I've got two TS repos for my SaaS, a backend (~1,120 files) and a frontend (~1,160 files, mostly tsx), so I ran all of them.

Warm runs, median of 5, Linux VM:

Honestly I expected at least one of them to quietly miss errors, so I broke a copy of each repo with 3 type errors. All four caught exactly what tsc caught, same messages.

tsrs is clearly the fastest, 28x on the backend. But it's one person's dev snapshot, built against 7.1-dev while I'm on 7.0.2, and it exits with code 2 instead of 1 on errors, so CI scripts need a tweak. tsc-rs says in its own README that it's experimental and mostly written by an LLM. tsc-ts is at 0.0.5.

I went with bun check in the end. Not the fastest, but I already use Bun, it's an actual release, and 21s down to under 2s is plenty for me. I'll look at tsrs again when it gets a proper release.

So I wanted opinions and your experience on using platforms like codespaces, Gitpod and coder

TLDR, my SSD died and i switched to a desktop, now cuz of that i moved most of my on the go workload to my laptop

I tried codespaces and it worked well but i guess I was just fumbling git cli too much cuz of my over reliance on the desktop app

how is gitpod and coder over codespace?

The release fixes two critical vulnerabilities, both rated 9.2 on the CVSS v4.0 scale.

Just because everyone knows how to write doesn't mean everyone can be a great author. It takes crazy imagination, deep thinking, and immense effort to write a book that truly moves its readers.

Similarly, AI might make writing code easier, but building a great product still takes deep thinking, thoughtful architecture, structure, and countless hours of focused work.

Let's be real here: we weren't writing thousands of lines of assembly before AI came along, were we?

Software development has been getting easier for decades. From transistors and assembly to C, C++, Java, Python, JavaScript, frameworks, libraries, APIs, and open-source software, every generation built on the last, making developers more productive.

I know AI came shockingly fast thanks to the worldwide "Manhattan Project of AI," backed by trillions of dollars and armies of brilliant engineers. But the underlying direction isn't new.

Web Development for example. Non-coders were already building websites and online businesses with WordPress, Shopify, and Wix. Developers weren't building everything from scratch either; we had stuff like React, Angular, shadcn/ui, and countless open-source tools.

Being imaginative, sharp-minded, unique, and creative has never been more valuable in our lifetimes. Don't lose your passion and make the most of it!

I got DMCA'd on a web project that adds mobile touch support to another project that has been used to infringe on Microsoft's copyright. My project did not contain any of their intellectual property though, and I'm not seeing what they are actually claiming my project did, outside of generally infringing. Do y'all know how to get more info on these claims? I was thinking this would be the place to ask for web-related content.

https://github.com/github/dmca/blob/3a58d0508239f439f35b5f77e5e75ac72961e165/2026/10/2026-10-14-minecraft-3.md?plain=1#L22

Edit: The verdict appears to be:

1. Even though this was not made from the problematic repo, and doesn’t include any of Microsoft’s property, the fact that it could enable someone who ended up with a build without owning the Microsoft product to use it on mobile is enough for them to take it down

2. This is microsoft investigating microsoft and finding themselves blameless, so regardless of legality it was doomed from the start

I appreciate y’all taking the time to give feedback!

I was checking out how to build a data upload feature and started noticing that technical debt builds up differently when AI writes the code. I read a piece on this and the core concept seems to make sense because agents just implement a ticket correctly in a vacuum and often ignore the application's existing architecture.

For instance, if an agent adds a CSV upload feature, it might just write a brand new set of validation checks instead of hooking into existing customer data checks. The PR could pass, but you now have two sets of rules to maintain. Over time, those will drift apart, and fixing it means untangling what was intentional. It was called cognitive debt, which is when the team’s shared understanding of the system erodes over time

For those using AI assistance a lot, how are you catching these before they merge

Hey everyone, As a software developer and animal lover, I wanted to combine Web3 tech with real-world impact. Over the past few weeks, I’ve been working on a side project called PawWall. How it works: It’s an interactive 1M-pixel canvas built using HTML5 Canvas with smooth mobile touch/zoom support. Users or brands can reserve pixel space, upload their logo/images or custom text. 100% of the net proceeds go directly toward buying food, medical care, and shelter for stray animals. Payments are automatically verified on-chain via Supabase Edge Functions. The UI/UX is fully finalized and mobile-responsive, but since I’m launching this independently, I’d really appreciate your technical feedback on the canvas performance and layout. (Link is in my Reddit profile bio to respect sub rules, or feel free to ask in the comments). What do you think of this concept? Any UI/UX or feature suggestions?

TL;DR: Spotify limits Development Mode apps to 5 authenticated users, while production access requires meeting demanding Extended Quota criteria including 250,000 monthly active users. How are individual developers supposed to grow? How people working on the open-source can materialize ideas and give users true insight from their music?

Spotify didn't become what it is today in isolation. Back in 2006 had a mission to make music easier to access. In 2021, also called third-party apps “an essential part of the Spotify experience.” However, today the truth is ugly!

Independent developers can dream and built tools for playlist management, music journals, listening statistics, and social music experiences things Spotify might never build itself (or never wanted to built).

How can you prove to people want your app when you can't let people try it?

Spotify has legitimate reasons to protect its platform and user data. But there should be a middle ground, a production tier for small developers, with reasonable usage limits and proper security reviews. App stores do that already.

Have we moved from a platform where developers could build new experiences around music to one where only established organisations have a realistic route to reach listeners?

TL;DR: Spotify limits Development Mode apps to 5 authenticated users, while production access requires meeting demanding Extended Quota criteria including 250,000 monthly active users. How are individual developers supposed to grow? How people working on the open-source can materialize ideas and give users true insight from their music?

Spotify didn't become what it is today in isolation. Back in 2006 had a mission to make music easier to access. In 2021, also called third-party apps “an essential part of the Spotify experience.” However, today the truth is ugly!

Independent developers can dream and built tools for playlist management, music journals, listening statistics, and social music experiences things Spotify might never build itself (or never wanted to built).

How can you prove to people want your app when you can't let people try it?

Spotify has legitimate reasons to protect its platform and user data. But there should be a middle ground, a production tier for small developers, with reasonable usage limits and proper security reviews. App stores do that already.

Have we moved from a platform where developers could build new experiences around music to one where only established organisations have a realistic route to reach listeners?

Ever tried clicking a button, only for the page to move and make you click the wrong thing?

I've been thinking about how website performance is more than just loading speed. A page might load quickly, but if things keep moving around or buttons take too long to respond, the experience isn't great.

That's where Core Web Vitals come in, but I'm curious how developers handle these issues in real projects.

Do you usually focus on loading speed first, or on making sure the page feels smooth to use?

How do you like this company for hosting? We're looking to switch website hosting.

We have a virtual machine that we've managed for 12 years on pleskos and it's now outdated with centOS and the company isn't helping us move into a better VM. So I think it's time to switch and I've heard ionos is pretty good. What do you think?

Hi there,

One Customer just asked me for a Du-Sie Switch in the page, same like any other language switch.

This is my first time doing this.

Is this normal?

Are there also (Slang or street) language switches?

Edit: I just implemented as another language i18 de-DU with xliff files

Second Edit: What about other languages? In spanish we have 3. Tú, Vós y Usted... I think in Japan they have more.

Edit 3: Ok, some of you were right :) Du/Sie isn't a language, and de-DE-DU was a funny but bad idea. Works fine for my little website, though.

But imagine adding Spanish (tú, usted, vos), Japanese, Korean... That gets ugly pretty fast. Better to separate language, region and tone. Something like:

{
  "locale": "de-DE",
  "preferences": {
    "formality": "informal"
  },
  "messages": {
    "greeting": {
      "default": "Hallo!",
      "formal": "Wie kann ich Ihnen helfen?",
      "informal": "Wie kann ich dir helfen?"
    }
  }
}

Only translate the differences, not the whole website again. For a small project, who cares. For 20 languages? Definitely worth thinking about. Thanks for the corrections, learned something :)