Skip to content
yceffort
PostsSeriesTagsAbout🧪 Research
KO

Tweaks

theme
accent palette
film grain
minimal mode
20 POSTS

Page 1

  • ◆ OG Scraping Server Design Notes
    #nodejs#security#ssrf

    Building an OG Scraping Server in Node.js (2): How SSRF Gets Through

    A feature where the server opens a URL the user handed it has the textbook conditions for SSRF written into its spec. Six ways a whitelist gets bypassed first, then five defensive principles that block them, all actually run on Node. Strip IPv4-mapped by hand and it gets through in hex notation, undici lookup hook is never called when the host is an IP literal, and URL.hostname keeps the brackets on an IPv6 literal. The final post of a two-part design note on OG scraping servers.

    2026-08-22·25 min read
  • ◆ OG Scraping Server Design Notes
    #nodejs#web#scraping

    Building an OG Scraping Server in Node.js (1): From Runtime Choice to Error Rate and Latency

    The "10% error rate" of a link preview server is a single number that five different kinds of failure got mashed into. This post works out why this workload is I/O bound at that TPS, where runtime choice actually diverges across four points, and then moves on to lowering the error rate with User-Agent and encoding. Node built-in TextDecoder turns CP949 extension characters into different characters without raising an error, and a scraped og:title is not an API response but user input. It also covers cache stampedes, negative caching, and a two-million-run simulation that verifies "P95 under one second" by working backwards from the cache hit rate. The first post of a two-part design note on OG scraping servers.

    2026-08-22·33 min read
  • #turbopack#nextjs#bundler

    Next.js Turbopack Turned One Singleton into Two: A Scope Hoisting Bug and a Circular Import

    In a Next.js 16 Turbopack production build, a module-scope singleton became two live instances at runtime. Inside the same synchronous block, one condition contradicted the other, and responses that arrived in 30ms still timed out. This is the record of tracing the cause through the bundle output: a partial scope hoisting merge, a circular import, an upstream bug that had already been fixed, and the single-variable experiment I ran too late.

    2026-08-19·16 min read
  • #framer-motion#performance#animation

    Killing Frame Drops in a framer-motion Banner: Two Wrong Turns and One Easing Function

    A banner built with framer-motion made the entire home screen stutter for the 0.6 seconds it took to open. The record of guessing the cause from the code, having that guess overturned twice by measurement, and finally removing the reflow with a single easing function. Plus what the work left behind: the gap between declaration and execution, the principle that properties decide performance, preserving mechanisms, suspecting your instruments first, and proving sameness with a curve.

    2026-08-15·30 min read
  • #javascript#animation#web-animations-api

    Porting number-flow to Old Browsers: Five Decisions and Two Reversals

    The minimum versions where number-flow turns animations on are Chrome 125 and Safari 17.2. A record of the decisions made while building a fork that lowers this floor to Chrome 66 and WebKit 16.4, the two judgment calls I ended up reversing, and the Safari bug investigation that made me give up on automatic downgrading.

    2026-08-11·25 min read
  • ◆ Kubernetes for Frontend Developers
    #kubernetes#autoscaling#nextjs

    Autoscaling Is Automatic but Not Instant: HPA's Timeline, Measured Segment by Segment

    Raise traffic 12x and it takes 31.5 seconds for a new pod to receive its first request. I pulled an itemized bill for those 31.5 seconds with a stopwatch: the structure dominated by the detection window, the conditions under which the autoscaler goes blind in the five minutes right after a deploy, the scale-down staircase, why memory-based HPA misfires on Node, and KEDA's preemptive scaling. Part 5 of the Kubernetes for frontend developers series.

    2026-08-10·25 min read
  • ◆ Kubernetes for Frontend Developers
    #kubernetes#nextjs#nodejs

    How Do Pods Terminate? Measuring the Causes and Fixes of Deploy-Time Errors

    Even a deploy that changes not a single line of code leaks errors. This is a measured record of tagging every failure that leaks during rolling deploys by type and timestamp, performing an autopsy on four causes, and stacking prescriptions one layer at a time until the count reaches zero. Includes the actual Next.js shutdown code, hostage draining, and the real CrashLoopBackOff timetable. Part 4 of the Kubernetes for frontend developers series.

    2026-08-08·20 min read
  • ◆ Kubernetes for Frontend Developers
    #kubernetes#networking#nextjs

    How Does Traffic Reach My Pod? From ClusterIP to port-forward

    A Service's ClusterIP is an IP attached to no machine, yet curl reaches it. iptables rules and conntrack, EndpointSlice, cluster DNS and ndots, Gateway, and port-forward: a record of opening up the entire path a request takes to a pod, directly in a kind cluster. Part 3 of the Kubernetes for frontend developers series.

    2026-08-06·27 min read
  • ◆ Kubernetes for Frontend Developers
    #kubernetes#docker#nextjs

    How My Next.js App Becomes a Pod: A Record of Opening Up Containers and Pods

    The same Next.js app produced one 1.72GB image and one 208MB image. This post traces the missing 1.5GB back through the layers, and verifies with PIDs and cgroup files that a container is an isolated process. The second post of the Kubernetes for frontend developers series.

    2026-08-05·19 min read
  • ◆ Kubernetes for Frontend Developers
    #kubernetes#frontend#nodejs

    A Kubernetes Concept Map for Frontend Developers: From Pods to Autoscalers

    The Kubernetes vocabulary and structure that frontend developers running SSR actually encounter, organized in the order of real work: the overall cluster structure, what makes up a deploy, pod state and resources, the traffic path, and autoscaling. The first post of the series and the reference map for the rest.

    2026-08-05·22 min read
  • ◆ Kubernetes for Frontend Developers
    #nodejs#kubernetes#v8

    Why Is Your Node.js Pod That Size? Sizing Measured Firsthand, from NODE_OPTIONS to Pod Count

    I added one GC tuning flag to the same workload and peak RSS jumped from 201MB to 593MB, while the live data stayed the same. This post traces back through V8 New Space with direct measurements to show why that result is exactly what should happen, and lays out the three axes frontend developers can use to size a Node.js pod.

    2026-08-03·45 min read
  • #ai#essay#frontend

    Where Frontend Came From, and Where It Goes After Agents

    Why the layers piled up, why we returned to the server, and why the stack survives even after agents. And why the survival of a stack and the value of the people who know it are two separate things

    2026-07-22·19 min read
  • ◆ Judgment in the AI Era
    #ai#essay#software-engineering

    When Was the Last Time You Read Code Seriously?

    The friction that made judgment expensive is the same friction that taught it. Why the skill growing most valuable in the AI era is the one being cultivated least

    2026-06-21·13 min read
  • ◆ Judgment in the AI Era
    #ai#essay#code-review

    If the Code Meets Spec and the Bugs Get Fixed, Does It Matter That You Can't Read It?

    If the spec is satisfied and the bugs get fixed, do you still need to be able to read the code? Understanding doesn't disappear — this essay traces where it moves.

    2026-06-12·22 min read
  • ◆ Judgment in the AI Era
    #ai#essay#software-engineering

    If AI Erases the Boundaries Between Planning, Development, and Design, What Remains?

    The claim that job boundaries are collapsing is only half true. What collapses is production; judgment and responsibility remain.

    2026-06-12·20 min read
  • #react#react-server-components#memoization

    React cache() Deep Dive: Request-Scoped Memoization, Read from the Source

    Every odd rule of React's cache() falls straight out of a ~30-line implementation. We trace the dispatcher, getCacheForType, and the WeakMap/Map tree at the source level to see exactly how request-scoped memoization works.

    2026-05-30·22 min read
  • #security#github-actions#npm

    The TanStack npm Supply Chain Attack: Why pull_request_target Is Dangerous

    Analysis of the @tanstack/* supply chain incident. The risks of pull_request_target, GitHub Actions cache, and OIDC trusted publishers, and how to defend against them.

    2026-05-16·24 min read
  • #bun#rust#oss

    Bun rewrite Exposed Something: OSS Could Only Stop External AI

    Bun moved roughly 960,000 lines from Zig to Rust in six days using Claude Code. The meaning here is not code quality but OSS governance and resource asymmetry.

    2026-05-15·28 min read
  • #frontend#package-management#semver

    What makes a package you can keep using for years different

    A good package has to be user-friendly not just in features, but in dependencies, version bumps, compatibility, and release policy.

    2026-05-09·20 min read
  • #frontend#bundle-analysis#performance

    The invisible cost in PR diffs: we are not reviewing the code our users receive

    The bundle costs that code review misses, and how to surface them in the PR.

    2026-05-03·22 min read
Page 2→
mailMail icongithubtwitter
yceffort
•
© 2026
•
https://yceffort.kr