/tech/ - Technical SEO

saw someone talking about stripping out 28k lines of code using knip. sounds great in a vacuum but i'm certain pretty sure my production build would just fall apart if i tried that. it's easy to talk about deleting bloat when you aren't dealing with a legacy mess where everything is tightly coupled. how do you even verify you didn't break a side effect?

full read: https://tkdodo.eu/blog/dead-code-shouldnt-exist

using ai for semantic drift check feels super reliable risky in a real ci/cd pipeline. also that bit about comprehension decay because of commoditized code is too real. im already struggling with cognitive debt without adding an agentic judgment layer to the mix. spoilergood luck debugging that mess/spoper

https://www.infoq.com/minibooks/evolutionary-architecture/?utm_campaign=infoq_content&utm_source=infoq&utm_medium=feed&utm_term=global

saw that faros ai report saying merged prs without review jumped over 76%. it's getting ridiculous how much of the work is just being rubber-stamped by bots now.
>AI review took over bug-finding.
the tool can check if the syntax is right but it doesn't know if we should be using a token bucket or a sliding window for this specific feature. i don't see how having a second agent push back on the first one actually solves the lack of human intent in the diffs. anyone else feeling like they're just auditing logs instead of actual code?

https://thenewstack.io/review-decisions-not-code/

been thinking about this all morning because i just saw another dev trying to patch cors after the api was already live. it's so exhausting watching teams treat security like a layer you just slap on top of existing code once something breaks. you can't just add it later without breaking everything.
>Security isn't something you add to software. It's something you build into it from the beginning.
it's much easier to handle things like encryption standards or field-level masking at the domain layer before the first pull request even exists. if you aren't doing threat modeling during architecture, you're basically just waiting for an incident report to hit your inbox. i don't know how anyone manages to maintain a clean pipeline when they're constantly chasing vulnerabilities in production. it feels like people think 'secure by design' is some magic trick instead of just basic engineering discipline. it's actually just common sense but nobody wants to do the extra work upfront. does anyone here actually get time for a proper threat model before shipping, or are we all just winging it?

found this here: https://www.freecodecamp.org/news/secure-by-design-engineer-security-into-architecture-before-writing-code/

Spent all morning digging through GSC for this client. They have these huge e-commerce categories where every single page has its own canonical pointing to itself instead of the main hub. It's making the crawl budget look like a disaster because Google is just wandering through endless filter combinations.
>Everything should point back to the root category
That's what the dev team keeps saying, but they don't realize how much junk we're feeding the index. If we don't clean up these self-referencing tags on page 2 and beyond, we're just wasting resources. I've seen it happen where a single deep filter creates a thousand new URLs that shouldn't even exist. It's not even about the weight of the pages, just the sheer volume of redundant paths.

spent too much time digging through slack threads trying to figure out if we used REST or gRPC for that one service. it's annoying how easy it is to lose the 'why' behind a choice when people leave, but keeping ADRs in the repo might be too much overhead for small changes.

https://hackernoon.com/architecture-decision-records-adrs-a-beginners-guide?source=rss

finally getting something that doesnt force me to leave my shell. looks like it runs locally but you still gotta hook up an api key or your chatgpt plus account. might try the npm install later but im skeptical about how much latency it adds when running heavy scripts. its basically just another way to use codex inside vs code or cursor too.

article: https://dev.to/victor_hugo_a07c85ac09eea/conheca-o-codex-cli-agente-de-codigo-da-openai-no-terminal-284k

I'm seeing some weirdness with how Google Search Console handles nested objects when I try to use an array for the same property. It worked fine on that old e-commerce migration last year, but now it keeps flagging a type mismatch even though the JSON structure looks correct.

"offers": {"@type": "Offer","price": "29.99"}

another day of microsoft trying to make their ai act like a senior dev. now you can apparently feed it custom instructions and skills for your repo so it actually knows what it is looking at. they are pushing this mcp server thing too, using playwright to let the agent crawl stuff or whatever. sounds great until you realize how much garbage context you end up bloating the prompt with. i tried adding some basic repo rules last week and it just hallucinated more than usual. if we start connecting every tool via mcp it is just going to be a nightmare for latency and debugging. plus the security implications of letting an agent run playwright on your codebase are not even funny. probably just another way to make developers lazier while paying a monthly subscription. i doubt this actually helps with complex logic without breaking something else in the process.

more here: https://github.blog/ai-and-ml/github-copilot/github-copilot-app-for-beginners-how-to-teach-copilot-about-your-codebase/

llms are still spitting out 6-digit codes when nigeria moved to that 11-character format like EK-01-A03-FK-01. ime it's a mess for anyone running checkout flows or validation scripts. using an mcp server to force deterministic checks is the only way to stop these agents from just making stuff up.
>The model proposes a postcode, and deterministic code decides whether it's well formed

full read: https://www.freecodecamp.org/news/how-to-stop-an-ai-agent-from-inventing-nigerian-postcodes/