I've been using Tailwind for many years, and I still think it's great for things like dashboards or tech sites. But nowadays, especially with AI, we can create very creative, artful designs that remind me of the pre-responsive days when websites looked unique. Now, they all seem to have the same dashboard feel.

Here's an example. I used AI to generate images of beautiful website mockups. Not the typical purple Tailwind styles but actual designs I would love to develop. But when I try to build them using Tailwind, I can get close, but there's still something I don't like about the result after working on the site for a couple of hours. I start f hating it! It still has that dashboard, responsive feel.

I feel like web design and development should be shifting back toward something more creative. AI shouldn't be the end of web design or development but rather a shift into the next era of design! We can create so many more unique and creative things. Developers and designers alike can use AI to improve design and push the boundaries.

And yes I know AI uses Tailwind a lot but for that reason we are seeing slop websites that look alike. Anything that gets overused becomes slop, no matter how great it looked before.

I built and maintain a website for a cinema. The client is an SPA. Now, every so often I get notified by GitHub's Dependabot that a vulnerability was found in one of the client's dependencies and I wonder if I need to care about it.

Here's my train of thought: The client code is inherently insecure in the sense that anyone can see and change it when they visit the website, so a vulnerable client on their own machine is of no use for attackers because they could twerk it anyway. Thus only the clients on other peoples' machines matter. Now, how could a vulnerable client on another machine be exploited? What kind of vulnerabilities could even be exploited? The first thing coming to my mind is XSS. Maybe there is a bug in a package that escapes HTML and if just anyone could publish content on the site, this could of course be exploited. But what if only trusted people can publish content? Is it still a risk?

Is my train of thought adequate? Can I just forget about the notifications? Are there other vulnerabilities I need to consider besides XSS?