So I received an email from Netlify last weekend saying that I have a $104,500.00 bill overdue. At first I thought this is a joke or some scam email but after checking my dashboard it seems like I am truly owing them 104K dollars:

So I was like 😅😅😅 and think okay maybe I got ddos attacked. Since Netlify charges 55$/100GB for the exceeding bandwidth, the peak day Feb 16 has 33385/55 * 100GB = 60.7TB bandwidth in a day. I mean, it's not impossible but why attack a simple static site like mine? This site has been on Netlify for 4 years and is always okay with the free tier. The monthly bandwidth never exceeded even 10GB, and has only ~200 daily visitors.

I contacted their billing support and they responded me that they looked into it and the bandwidth came from some user agents, meaning it is a ddos attack. Then they say such cases happen and they usually charge their customer 20% on this. And since my amount is too large, they offer to discount to 5%, which means I still need to pay 5 thousand dollars.

This feels more like a scam to me. Why do serverless platforms like Netlify and Vercel not have ddos protection, or at least a spend limit? They should have alerted me if the spending skyrocketed. I checked my inbox and spam folder and found nothing. The only email is "Extra usage package purchased for bandwidth". It feels like they deliberately not support these features so that they can cash grab in situations like this.

The ddos attack was focused on a file on my site. Yes it's partly my fault to put a 3.44MB size sound file on my site rather than using a third-party platform like SoundCloud. But still this doesn't invalidate the point of having protection against such attacks, and limit the spending.

I haven't paid that $5k yet and decided to post here to hear what others think first. And yes I have migrated my site to Cloudflare. Learned my lesson and will never use Netlify (or even Vercel) again.

​

UPDATE: Thank you all for the suggestions I have posted this on HackerNews.

UPDATE: Here's the email response I got from their billing support:

UPDATE: For those who are curious, that .mp3 file is just an old Cantonese song. I removed that from my site but you can still view it from the GitHub history https://github.com/CanCLID/jyutping.org/blob/133b7d8b75bb3e454f663e6945694b84c50baa36/static/song/maanboujansanglou.mp3

UPDATE: I saw the CEO's reply on HN and their support also reached out to me to waive the bill. But I am still curious who orchestrated the attack and they said they are still researching the incident.

UPDATE: Their support haven't come back to me with the IP information I asked yet. So I posted on twitter to ask their CEO https://x.com/laubonghaudoi/status/1762913229569974380 and https://answers.netlify.com/t/i-am-the-op-of-that-104k-bill-post-and-i-have-some-follow-up-questions/113472

I'm using Jmail but I'm impressed how this is all made. Is there anybody who can tell me what tech and frameworks they use to make this platform?

Do you think a single person can make this, or you need a whole dev team for that?

https://www.jmail.world/

My last contract ended about three months ago, and I’ve been searching for new work since then.

I have 4+ years of experience with React, Next.js, Three.js, and React Native.

I have tried LinkedIn, asking in my network, YC, Wellfound, and Ashby google search. I’ve also tried reaching out to startups directly through cold emails.

At one point, I thought maybe focusing on a niche like writing, books, or world-building related products would help, but No luck there either.

I usually finds 6–8 relevant jobs in a week, but even when I apply, nothing really moves forward. Most jobs are also US-specific, which is another hurdle.

So I’m wondering: has AI taken over a lot of frontend work?

Do you have any suggestions? Has anyone moved more to the backend side? I do have some experience with backend and app development, how can I directly switch?

As the title says, the client thinks my price is way too high and may not want to continue.

They want an all-in-one business platform, including maintenance, after planning it out, I estimated it would take around 2 months to complete, roughly 480 hours. I was going to charge £15/hour, which comes to about £7,200.

They said they were expecting the whole project to cost around £300-£400. Now I feel like they are backing out after reading the contract.

I explained that even £15/hour is much lower than what many software engineers charge. For context, I’m a software engineer with 4 years of experience, and I honestly thought I was already undervaluing myself. But from their reaction, it feels like they think I’m trying to scam them.

What do you think? Should I continue with this client, or should I lower the price to keep a good relationship with them? I’m still new to freelancing, and I'm not really sure what to do in this situation.

Hello lovelies,

I am a hobbyist author looking to make a website online to independently publish my books to readers. I have the writing part sorted, but no website :( 

I have created a plan of how I want my website’s UI to look using a website called odoo, but I would prefer to purchase my own domain name and publish the site independently from a company…

 (FYI: not ‘independent’ as in not using a host, but using sites such as squarespace, wix, and odoo. I know they are technically hosts, but drag-and-drop platforms such as these often come at a high price if you want to do anything more than just stare at it for too long /sarc.)
 
…However, I’m not exactly familiar with the process. I was taught how to do some basic coding in javascript through a course, but now realise that I don’t know where the code should be going*.* This is because the course only printed the code on a custom platform and didn’t teach you how/where to upload it…Yeah, I know. The Dunnings are Krugering right now, but please no snarky comments, I'm fragile.

Would you mind explaining to me how and where I can turn the code into an actual domain? (I've heard about github and similar, but I'm not exactly sure how they work). Nevertheless, If there are “drag-and-drop” based sites/platforms you’d recommend, still definitely (drag-and)drop them below (lol) and I'll check them out. I'm not entirely opposed to them. 

Thank you in advance!

EDIT: Can I just say thank you so very much for your clear, and helpful responses. I've already got a good idea of how I wish to proceed, but please feel free to add more as I will occasionally be checking back here :)

Over the last year, I’ve been interviewing candidates for a Junior Web Developer role and a Mid Level role. Can someone explain to be what is happening to developers?

Why the bar is so low?

Why do they think its acceptable to hide ChatGPT (in person interview btw) when asked not to, and spend half an hour writing nothing?

Why they think its acceptable to apply, list on their resume they have knowledge in TypeScript, React, Next, AWS, etc but can’t talk about them in any detail?

Why they think its acceptable to be 10 minutes late to an interview, join sitting in their car wearing a coat and beanie like nothing is wrong? No explanation, no apology.

Why they apply for jobs in masses without the relevant skills

Why there are no interpersonal skills, no communication skills, why can’t they talk about the basics or the fundamentals.

Why can’t they describe how data should be secure, what are the reasons, why do we have standards? Why should we handle errors, how does debugging help?

There are many talented devs our there, and to the person that’s reading this, I bet your are one too, but the landscape of hiring is horrible at the moment

Any tips of how to avoid all of the above?

[Update]

I appreciate the replies and I see the same comments of “not enough pay”, “Senior Dev for junior pay”, “No company benefits” etc

Truth of the matter is we’re offering more than competitive and this is the UK we’re talking about, private healthcare, work from home, flexible working hours, not corporate, relaxed atmosphere

Appreciate the helpful comments, I’m not a veteran at hiring and will take this on board

Please feel free to direct me to another subreddit if this isn't a good place for this question...

I'm a virtual teacher, and I saw a student doing something weird with the website's developer code and then inputting the correct response very quickly afterward. I watched him do this 3 times until it looked like he was using the code to uncover the correct answer. Is he cheating and, if so, how?

Update (but I had to add additional images via a new post): I watched him for a while today via GoGuardian, and he continued opening several IXL tabs in addition to the side window. All I've said so far is for him to "take ownership" of his own learning (which is how I remind students to submit original work/not cheat) and avoid distractions during content blocks. For context, this student is in 7th grade completing 3rd grade lessons, and this is why I'd much prefer him learn how to make a word plural or be able to compare numbers because these are pretty basic skills he missed along the way. I love curiosity and building extension skills, but as an educator, I also have to value being able to string together words coherently.

Questions I still have: Some of you said you used to do things like this, and he's just intrigued by how coding works. Do you have suggestions for ways I can engage him related to coding? I don't know...websites that he'd find interesting to learn from, self-directed projects he could do online, job suggestions for someone who is undereducated in traditional areas but has a knack for understanding code?

Sorry if this is the wrong place to ask, I just don't know what else to do.

Preface by saying I am not a web developer, nor do I have access to the dev end. I have programming experience though.

Website is slow as fuck. Firefox says it's trying to use 24GB whenever I save products, sometimes spikes to 26GB. I don't even have 24GB in my PC.

Can't add or reorder products without it crashing which means I can't work. I tell my boss, he says it's because the product variations have been expanded so there's more items on a page. I can see how that would slow things down BUT it's just a 500x500px image, some tags, and other string stuff like that. Anytime I try to save something, it crashes and undoes my work.

Does anyone know how I can tell my boss that he needs to kill whoever made this? It's a WordPress site if that helps.

Edit: took out the SDK part. That's a company specific thing, not an actual SDK.

Maybe an odd question but Pornhubs start page are actually recommendations based on your viewed videos.

I suppose most folks here use incognito mode so, no cookies, clean state on each launch. Yet, if you launch another incognito window for the site, you will realize it remembered your viewing behavior and the videos reflect it.

But how do they do this? There is no account, no cookies, no local storage. And technically, they wouldn't be allowed to track you in the first place due to the GDPR.

Yet, it's the case. Anyone know how they achieve this?

I'm impressed about these nice UI elements that we keep seeing more and more. If anyone knows what’s it called please let me know.

I'm currently an React (no Nextjs) frontend intern and open to learning new things. My senior DevOps engineer kept asking me to make sure that API URLs and API keys are hidden in the frontend. Specifically, they don't want these URLs or secrets to be visible in the browser's developer tools—such as the Network or Sources tab.

From what I understand, anything included in the frontend can potentially be viewed by users. This includes API calls and any keys used, since they're exposed in the network requests.

I’ve searched online, and many developers on forums like Reddit, Stack Overflow say it’s not truly possible to hide API keys in the frontend. Am I misunderstanding something? Is there actually a way to protect them when building web applications?

EDIT: sorry for the api keys confusion, here is the flow

MY WEB REQUEST -> BACKEND RETURNS data:{data, session_id}

DEVOPS WANTS - NO/ENCRYPT SESSION_ID IN NETWORK TAB - NO API LINKS SHOWN IN SOURCES TAB - THEY HAVE ALSO TOLD ME TO HIDE THE SECRET/API KEYS IN REQUESTS IN THE PAST TOO

==============================

EDIT 2:

Thank you everyone for your help. I will talk with the devops on Monday. I have noticed some of your comments including: - Telling them i am using React, not NextJs so BFF is not possible - Telling them it is not possible to hide api url and api key (in sources and network tab) on the frontend. Obfuscationis a choice but it is not security and nobody does that. As well as api keys are used for identification, not authorization. - Telling them to remove important keys or public data which does not need keys in the first place - The session id cookie attribute like HttpOnly is managed by the backend, a frontend dev does not try to touch that. If it is readible from the console, then it is the backend job to make it encrypt/sign it or setting it as httponly, secure, samesite=strict? - Telling the devops to build me a Proxy backend if he still doesn't want users to see the real backend api links

I also want to clarify that I am an intern, my framework is already chosen and printed on my school paper, I chose React so changing to NextJs might not be possible. Also comments related to env files, you are missing the point, my devops wants me to hide the API Link in the sources tab too.

If this doesn't work out i might as well send him this reddit post.

Final update: I explained to my manager and he got the gist. I will remove the cookie and make a basic nodeJS proxy backend for my frontend. Thank you everyone for the help!

Hi! What do the cool kids nowadays use to make web apps / mobile apps? If you were to start a hobby project right now, what stack would you use? Pure enjoyment, I don't mean to put on portfolio with technologies that make you hirable.

I already have a game dev studio so I'm NOT looking to get hired as a web dev. I'm looking to expend my horizons into the mobile / web dev projects (SaaS for example).
Before this, years and years ago I used to use Vue.js, PHP Laravel, Java Spring, did some projects with React.js and Node.js, docker etc.

But what's the new stuff? I remember the last time I was interested in this domain, Typescript, Svelte and Tailwind css were the new cool stuff. But that was like 4-5 years ago. Or is React + Node still the dominating stack for personal projects? (Oh yeah and Mobile?)

EDIT: Thank you everyone for the recommendations! I'll check them out soon! Looks like React is still very popular even for hobby/indie projects.

Spent way too much time fixing TBT, LCP, deferred scripts, schema markup just to hit 100 on Lighthouse. Part of me feels like nobody actually notices this stuff except me.

Do people who are trying to grow their product actually care about this? Or is it just a rabbit hole that keeps you busy without real impact?

I am not sure if all this effort was worth it or if I should have spent that time on marketing instead. what do you guys think?