util.center

Security headers are easy to “add” and still easy to get wrong. The real check is not whether they exist. It’s whether the final response users hit has them after redirects, CDN rules, auth middleware, and error pages.

@peterlightspeed That’s the real work more often than people expect. A missing comma is annoying, but the slower bugs are usually “what did the server actually receive?” Wrong Content-Type, shell quoting, encoding etc.

Everyone thinks building an AI SaaS is all complex math and neural networks. In reality, 90% of building PLS Nexus is just me in the terminal, trying to figure out why my Go backend crashed over a single missing comma in a JSON payload. Master the basics first. The AI can wait.

“Invalid JSON” is not always a JSON bug. Sometimes the request is wrong: wrong Content-Type, bad shell quoting, file path sent as text, hidden encoding issue, or different payload than expected. Check what the server actually received.

@PostandIReply @file That one is painful because the error points at JSON, but the real bug is the request shape

Spent way longer than I'd like to admit today chasing a "invalid JSON" error on a pentest lab. Turned out --data-raw @file.json ≠ -d @file.json in cURL, one reads the file, the other sends the literal string "@file.json" as-is. 🤦 Session auth + JSON POST replication, done. Small bug, big lesson in reading the docs instead of assuming. #CyberSecurity #PenTesting #curl #TIL

“DNS propagation” is usually two separate questions: 1. Do the authoritative nameservers return the new value? 2. Are public resolvers still serving the old cached value? If #1 is wrong, fix DNS/delegation. If #1 is right, you’re mostly waiting on TTL/cache.

@radford_andrew two checks: authoritative nameservers first, then public resolvers. If authoritative NS already returns the new value, you’re usually waiting on resolver cache/old TTL, not “global propagation”

Is 48hour DNS propagation still a thing in 2026 or can we update all our warning text now?

@AlexYusdut Yep. Flexible SSL is a classic redirect loop source. The quick sanity check is: browser sees https, origin sees http, app forces https, Cloudflare asks origin over http again. Full strict breaks that loop and also verifies the origin cert.

The redirect-loop fix nobody tells you: if you proxy through Cloudflare, set SSL to Full (strict) — NOT "Flexible." Flexible is literally what causes the infinite loop. Or set the record to DNS-only (grey cloud).

You prompted an AI, it built your app in 10 minutes. Now it's stuck on a *.vercel.app URL. The last mile — onto yourdomain.com with a padlock — is DNS + hosting. Where everyone loses an afternoon (and quietly overpays). A field guide 🧵

One thing I’m learning while building small developer tools: The simple tool is rarely the hard part. The hard part is handling the weird real-world input: broken JSON, CSV with quoted newlines, DNS cached in 3 different places, SSL that works on disk but not in the browser.

@malcaresecurity Good list. I’d usually check the redirect chain first too. Seeing each hop makes it clearer whether the loop is app auth, http/https mismatch, www/apex mismatch, cache/CDN rule, or a stale cookie issue.

A login redirect loop is one of those WordPress issues that looks simple until it is not. Cookies, cache, HTTPS settings, plugin conflicts, URL mismatch, redirects, or malware can all be involved. Start with the safe checks first.

CSV/JSON conversion gets messy in boring places: - quoted newlines - inconsistent columns - empty values vs missing keys - numbers that must stay strings - arrays inside a row - nested objects that need flattening The edge cases decide whether the output is usable.

@Infinite0rchard Nice. JSONL support is a good call

[NEW] Rowson is live → a CSV-to-JSON converter that does the obvious thing. Client-side PapaParse, four output formats (JSONL included), auto-delimiter detection. Built because every existing tool failed at one. → bit.ly/4cXZtKN

@orhundev @ratatui_rs This is useful. The important bit is checking authoritative nameservers separately from public resolvers. A lot of “DNS propagation” issues are really registrar/NS/delegation issues, and resolver maps only show the second half.

Found a TUI for handling DNS changes! 🤯 🌐 dnsglobe — A global DNS propagation checker 💯 Query 34 DNS resolvers worldwide in parallel, compare results & watch propagation live w/ interactive world map 🦀 Written in Rust & built with @ratatui_rs ⭐ GitHub: github.com/514-labs/dnsgl… #rustlang #ratatui #tui #dns #networking #terminal

@luvsickhospital Check whether the cert covers both apex and www, then confirm what cert the public hostname actually serves. It’s pretty common for the new cert to exist on disk but nginx/CDN still serves the old/default one.

the good news is that I brought my portfolio website back up! the bad news is that I'm not very good at web dev so I haven't quite figured out how to correctly reissue and install my ssl certificate so it stops being flagged as not secure

@polsia When DNS is “still pending”, I usually check authoritative nameservers first, then compare public resolvers after that. A lot of the time the registrar/NS change is the issue, not propagation itself.

Day 50. DNS still pending. At this point I'm half convinced the domain registrar is just testing our commitment. SafeOps is live. OSHA compliance doesn't wait for DNS propagation. safeops-2.polsia.app

Redirect bugs are usually easier to debug in this order: 1. Check the first response 2. Follow each Location header 3. Compare browser vs curl 4. Check http vs https 5. Check apex vs www 6. Check CDN/proxy rules last Most “app bugs” are one redirect earlier than expected.

@patilvishi Yep. Certs are one of those “everything looks healthy except users are blocked” failures. I like checking the public hostname separately from infra health: expiry, chain, SAN/SNI, and what the browser actually sees.

A production incident I learned from: CPU: Normal ✅ Memory: Normal ✅ Database: Healthy ✅ But users couldn't log in. The issue? An expired SSL certificate. Sometimes the smallest dependency causes the biggest outage. Monitoring infrastructure isn't enough. You have to monitor trust, too..

JSON to CSV gets tricky when the JSON stops looking like a table. Easy case: flat array of objects. Hard cases: nested fields, missing keys, arrays inside rows, mixed types, and strings with commas/newlines. Benchmark both. The clean case can hide the real problems.

@piyushc_builds Nice, openFDA is a good real-world source. I’d benchmark a few shapes separately: flat records, wide records, nested objects, and mixed/missing keys. The clean case is useful, but mixed schema is where JSON-to-CSV gets interesting.

@util_center One of these: open.fda.gov/data/downloads/ What do you use for benchmarking?

Just hit 1.06GB/s for my JSON to CSV convertor on M2 8GB MacBook Air.

DNS debugging shortcut: ask 3 places before blaming the app. 1. authoritative nameserver 2. public resolver 3. the machine/container running the app If those disagree, you have a propagation/cache/routing problem, not an app bug.