16 min read
Roll Out CSP by Observing Violations, Then Restricting Capabilities
Introduce a content security policy without accidentally blocking legitimate scripts and styles.
THE NOTEBOOK
Technical notes.
Ideas, implementation and verification. Experience worth keeping and reusing.
43 notes · Page 3 of 4
18 min read
Navigation: Knowing Where You Are Matters More Than More Links
Make scope, object hierarchy, selected routes, and mobile navigation understandable from a deep link.
17 min read
ETags and Conditional Requests: A 304 Still Requires a Request
Representation validators reduce body transfer, but freshness, encoding, and write conflicts remain separate concerns.
17 min read
Release Risk Depends on Recovery, Not Just Lines Changed
Evaluate rollout, rollback, forward repair, and persistent side effects around user outcomes.
17 min read
Form Errors Should Explain What to Change and Why
Separate field problems from service failures and make asynchronous validation recoverable.
17 min read
Workers Cache API and CDN Caching Are Not the Same Switch
Distinguish fetch caching, explicit Cache API storage, location scope, and invalidation.
18 min read
Astro Island Boundaries: Who Should Pay the JavaScript Cost?
Choose hydration around real interactions, then measure loading, execution, and recovery.
17 min read
Decide How a Product Experiment Ends Before Looking at Results
Specify randomization, primary metrics, guardrails, and low-traffic alternatives in advance.
18 min read
Canonical URLs Are a Deployment Contract, Not Just an SEO Tag
Keep origins, paths, language versions, previews, and content identity consistent.
18 min read
RSS Is a Public API: Keep It Inside Publication Rules
Align article routes, feeds, sitemaps, stable identities, and withdrawal behavior.
18 min read
Product Metrics Begin with Events That Represent Real Value
Define activation, retention, cohorts, and quality without letting clicks impersonate success.
17 min read
Static Route Collisions: A Slug Is More Than a Filename
Reserve and normalize final paths before content routes overwrite each other.
17 min read
Sharing Design Must Explain Effective Access
Show inherited and direct grants together and distinguish revocation from retrieving existing copies.
19 min read
Scheduled Workers Need a Recoverable Publication Identity
Separate wakeups from plans and resume the same reviewed batch after partial failure.
17 min read
Timeouts Must Share One End-to-End Budget
Include queueing, response bodies, retries and cancellation in the same task deadline.
17 min read
Long-Lived Asset Caches Require Immutable URLs
Coordinate hashed assets, HTML freshness and retention across deployment generations.
17 min read
Design Tokens Should Name Meaning Before Values
Treat semantic roles, consumers and theme mappings as a versioned interface.
17 min read
Source Maps Need a Publication Policy
Separate public browser code, private debugging maps and the credentials used to upload them.
17 min read
Retention Should Help People Resume Real Work
Preserve unfinished-task context and give reminders relevant scope, privacy and stopping rules.
18 min read
Reproducible Static Builds Need Explicit Inputs
Version dependencies, clocks and network data, then reconcile the artifact actually deployed.
16 min read
Cookie Attributes Define the Session Boundary
Reason about cookie scope, browser access, server revocation and migration as one session lifecycle.
15 min read
Responsive Layout Should Preserve the Task, Not the Screenshot
Reorganize controls and information around task dependencies, visible scope, intermediate widths and real container limits.
18 min read
CORS Is Not Authentication
Test browser readability, server execution and session authorization as separate outcomes.
16 min read
SaaS Pricing Should Follow the Value of Use
Separate value, resource cost and billing units without making safe collaboration unnecessarily expensive.
15 min read
HTTP Errors Need a Data Contract Too
Keep missing resources, failed dependencies, empty searches and unknown write outcomes distinct.
15 min read
HTTP Streaming Requires Backpressure and Cancellation
Preserve stream semantics while bounding buffers, message sizes and work after disconnect.
16 min read
Responsive Images Need a Budget for Size, Crop, and Priority
Deliver appropriate images without making mobile readers download desktop originals or lose essential detail.
17 min read
Site Search: Zero Results Is Not the End
Distinguish no match, narrow scope, indexing delay, and service failure without leaking permissions.
17 min read
Browser Language Negotiation: Preferences, Explicit Choices, and Caches
Predictable first visits without repeatedly overriding a reader's chosen language.
17 min read
Table Density Should Make Comparison Faster, Not Text Smaller
Prioritize fields, numeric meaning, frozen columns, and context around a real comparison task.
16 min read
Markdown Is Not a Security Boundary
Trace trust from authors and rendering plugins to HTML, links, feeds, and build-time capabilities.
17 min read
SaaS Onboarding: Let the First Useful Action Happen
Work backward from saving and retrieving a real note, not from completing a tour.
18 min read
Prioritization Is More Than Turning Opinions into Decimals
Separate value, evidence, constraints, opportunity cost, and learning before trusting a score.
17 min read
Worker Secrets Must Not Cross the Browser Boundary
Separate deployment configuration, runtime bindings, public build variables, and credential rotation.
16 min read
Workers Custom Domains: Diagnose DNS, Routing, and TLS Separately
Replace repeated DNS edits with evidence about name resolution, trusted connections, and the responding application.
17 min read
Two Redirect Boundaries: Request Semantics and Trusted Destinations
Choose redirect status codes deliberately and prevent login return paths from becoming open redirects.
16 min read
Roll Out CSP by Observing Violations, Then Restricting Capabilities
Introduce a content security policy without accidentally blocking legitimate scripts and styles.
18 min read
Navigation: Knowing Where You Are Matters More Than More Links
Make scope, object hierarchy, selected routes, and mobile navigation understandable from a deep link.
17 min read
ETags and Conditional Requests: A 304 Still Requires a Request
Representation validators reduce body transfer, but freshness, encoding, and write conflicts remain separate concerns.
17 min read
Release Risk Depends on Recovery, Not Just Lines Changed
Evaluate rollout, rollback, forward repair, and persistent side effects around user outcomes.
17 min read
Form Errors Should Explain What to Change and Why
Separate field problems from service failures and make asynchronous validation recoverable.
17 min read
Workers Cache API and CDN Caching Are Not the Same Switch
Distinguish fetch caching, explicit Cache API storage, location scope, and invalidation.
18 min read
Astro Island Boundaries: Who Should Pay the JavaScript Cost?
Choose hydration around real interactions, then measure loading, execution, and recovery.
17 min read
Decide How a Product Experiment Ends Before Looking at Results
Specify randomization, primary metrics, guardrails, and low-traffic alternatives in advance.
18 min read
Canonical URLs Are a Deployment Contract, Not Just an SEO Tag
Keep origins, paths, language versions, previews, and content identity consistent.
18 min read
RSS Is a Public API: Keep It Inside Publication Rules
Align article routes, feeds, sitemaps, stable identities, and withdrawal behavior.
18 min read
Product Metrics Begin with Events That Represent Real Value
Define activation, retention, cohorts, and quality without letting clicks impersonate success.
17 min read
Static Route Collisions: A Slug Is More Than a Filename
Reserve and normalize final paths before content routes overwrite each other.
17 min read
Accessibility Is Not a Checklist: Start with a Keyboard Task
Trace an assignment workflow through controls, focus, announcements, and real assistive-technology testing.
18 min read
Catch Editorial Errors Before Building with Content Schemas
An executable metadata contract for Astro articles, without confusing valid structure with trustworthy content.
16 min read
Cache Keys Start with Which Responses May Be Shared
A response-sharing contract for language, identity, query parameters, invalidation, and rollback.
16 min read
When Users Ask for a Feature, Ask How They Do the Job Today
Turn requests into testable opportunities using recent behavior, artifacts, and small experiments.
18 min read
Astro + Workers: Deploying a Content Website
From Markdown to static HTML to the edge: keeping content, builds, and delivery separate.
17 min read
Maintain Technical Notes Like Code
Executable metadata contracts, explicit publication decisions, and verification at the reader's actual entry points.
17 min read
Committed, Pushed, Live: Three Different Completion States
Close the release loop with evidence for the exact source revision, remote branch, artifact, and public response.
No matching notes.