With the recent high-stakes security exploits, I think as DevOps engineers it's our responsibility to make the local dev environment secure for devs.

What do you think?

What are you actively doing about it (like adopting devcontainers)

I’ve just released Detent, a React wheel picker that grew into a much bigger exploration of interaction details.

The wheel has its own momentum and spring physics. I spent a lot of time tuning mouse wheel input alongside trackpads, including the awkward cases where a physical scroll wheel keeps spinning after you let go.

It also includes two separate components:

• Detent Text: matching letters stay while the changed parts roll.
• Detent Number: locale-aware formatting with digits that roll through intermediate values.

The examples range from practical time and date pickers to an arc menu, a zoom ring, and some more experimental visual treatments.

There’s a headless hook, separate imports for text and numbers, keyboard support, reduced motion, and no additional runtime dependencies beyond React and React DOM.

Demos and playground: https://detent.hayder.sh
Intro: https://x.com/kghayder/status/2118373654010466733?a=PzCQRSXhM5m8KUTdHk8&s=20

I’d especially appreciate feedback on how the wheel feels with your mouse or trackpad, and whether the API makes sense for something you’d actually build.

2026 has been a year of change for those of us who build and manage websites; I have a feeling that many of you are on the move, migrating websites from one CMS to another or building without it. AI is enabling rapid changes on all fronts. Broad market-share numbers tell us very little about your experiences building and managing websites with different tools; that is why I hope that we, as a community, can close this information gap with our own open-source State of CMS survey.

stateofcms.com

Since 2016, the developer community has been conducting annual surveys on frameworks and programming languages. Many of you have probably participated in State of JS, HTML and CSS. But what about those of us working with CMSs? No equivalent survey exists for our community.

The anonymised results will be freely available on GitHub. I will also create and publish an interactive report, but I am especially excited to see what the community does with the data.

[ Removed by Reddit on account of violating the content policy. ]

I could use some advice on a situation at work.
A few colleagues in ops have, almost overnight, started to fully trust their LLM agent because it has gotten so good lately and "doesn't make mistakes anymore". They built their own harness around it and log what it does (using Grok and Google models), but the agent still runs with root access to our entire production infrastructure. We have no clear team rules or policy yet, and they don't see the danger themselves.
A typical example: whenever the agent needs to check something on a server, they just hand it full access. But looking at info only needs read-only access. The permission should match the task, not the most convenient option.
My concerns:
Logging is detection, not prevention. It shows what broke afterwards, but doesn't stop anything.
Root bypasses the harness. An agent with root can in theory edit the harness, the logs and the backups, so those logs are not a reliable audit trail.
No least privilege. One wrong command or misread context can touch everything.
Prompt injection via logs, tickets or web pages the agent reads.
Model updates. Providers change models without us deciding when, so "no mistakes in recent months" says little about the next version.
Data going to third parties. With root, the agent can read .env files, keys and customer data, which then end up with the model provider (a GDPR question too).
"It has gone fine so far" only means the failure hasn't happened yet.
I don't want to ban anything. I want them to see the risk themselves and set up proper guardrails together with me: a read-only user by default, scoped credentials, just-in-time access, human approval for write actions, staging first, and no access to backups and logs.
Questions for you:
How do I explain the difference between "we log it" and "it can't do it in the first place"?
How have you convinced overconfident colleagues about AI tooling risks without a confrontation?
Do you have horror stories or post-mortems I can share? Concrete incidents tend to work better than theory.
Which guardrails or policy examples have worked well for you?
How do you raise this with management without coming across as "anti-AI"?

Recently I've joined a project with a group of 4, that has been super frustrating to work on.

So far whatever we have, has been 99% vibecoded from the ground up, and that 1% is me. At first I thought this would be fun, we would be making something in a weeks time, but like a month passed and we haven't really moved anywhere. There's literally a login screen that works (no Oauth) and some fancy UI, but that's it. Trying to debug or add new features by hand is impossible, because the code is not readable by humans. There's like 50 lines in the .env file, yet nothing works.

With all this in mind, the absurd thing is that it takes a full minute to deploy any changes to production. In comparison, my hand-crafted Django platform, with real users and tons of features, deploys in seconds.

Don't get me wrong, I am all for using AI to build projects. It's a very powerful tool and I use it to help me code all the time. But in my opinion, to make vibecoding work, you have to know the project structure and the architecture of a website, because then you can avoid massive tech debt in the future.

I can already tell that this experience will be funny to look back on.

Starting the process to move our 100-site plan away from Nexcess. They used to be great, but everything has gone downhill over the last year. Some thoughts for those considering Nexcess:

- We used to pay $638/month for our plan. This recently increased to $849/month with no added benefits

- Nexcess bought the Kadence plugins. It sounds good, but they don't give you the premium versions, only the free stuff. The plugins are trash - buggy, slow, and unreliable. Stick with Wordfence for security and something else for general WP site management. I pity anyone who tries to use these interfaces.

- Nexcess was the last of all web hosts I am aware of to patch the most recent PHP vulnerabilities. Took over a day with little to no communication. Clients asked when this would be fixed and were left in the dark.

- The support experience is all India-based. Half the time, support does more harm than good on the site.

- The "CDN" they include doesn't work well - typically causes HTTPS errors.

- They supposedly monitor your site for visual changes after updating a plugin. I've had updates break several sites and never got a notification.

- The automatic theme and plugin updates don't run.

- Their managed hosting runs a Linux kernel that stops receiving security updates on January 1. They have no plan to upgrade servers. Confirmed this with support this week.

Long story short, stay far away from Nexcess. We were originally drawn in by their site speeds. The speeds are still great, but the experience is so bad I wouldn't recommend them to anyone.

Hace unos días salió la noticia que el principal banco privados en Paraguay se dió a la quiebra, es una novela de la que los invito a buscar información.

Ahora, en Paraguay al menos tienen un seguro de depósito que cubre hasta un maximo $38,000.00 en caso de quiebra, en USA existe uno que garantiza hasta $250,000.00, en cambio en Panamá no existe nada igual, hoy tu banco puede quebrar y debes esperar al proceso legal, que cobren los acreedores y luego las migajas le tocan a los ahorristas.

Que si ley de para el día nacional de la cutarra, que si el día del sancocho o el día de la pesada de nance, realmente está sería una ley que debería estar hace tiempo en la asamblea.

Y aunque tú no tengas hoy ni $50, en tu cuenta da igual, quizás mañana lo tengas o si confías en el futuro de tus hijos ellos podrían llegar a tenerlo algún día.

Bancos grandes a nivel mundial han llegado a quebrar, ahora imaginen que llegaste a pasar con los malos vecinos ¿Qué su efecto en la economía local?

"Nunca pongas todos tus huevos en la misma canasta".

I’ve been building a WordPress monitoring tool lately, so disclosure: I have a product in this space.

One design decision became pretty obvious once I started working through failure cases: the site can’t be the only source telling you whether the site is healthy.

A plugin can report useful things from inside WordPress — installed plugins, core version, heartbeat, update state, and so on.

But there are also situations where that signal is exactly what you can’t rely on.

If PHP dies with a critical error, the site is unavailable, or the monitoring plugin itself stops running, an internal check may simply stop reporting.

So I ended up treating internal and external monitoring as two separate signals.

The WordPress agent reports what it can see from inside the site.

Separately, an external worker checks the site over HTTP and looks at the actual response, including WordPress-specific failure signals such as critical-error pages.

That separation has been useful because the disagreement between the two signals can be more interesting than either one alone.

For example:

• Agent is reporting normally, but the external check is failing.
• External site is responding, but the Agent has gone silent.
• Both fail around the same time.

Those are three very different situations.

It sounds obvious when you compare it to traditional infrastructure monitoring, but I’ve noticed a lot of WordPress health tooling still depends heavily on the site reporting its own condition.

For people managing client sites, how are you handling this today?

Do you run external uptime monitoring alongside a WordPress management tool, or do you rely mostly on the WordPress-side agent?

I want to connect multiple servers for my clients, most of which host WooCommerce sites. I’m looking for a control panel that allows me to manage multiple WordPress servers.

I’m looking for an affordable option that doesn’t charge an additional fee for each server i connect.

I've taken Jonas Schmedtmann's HTML + CSS and JavaScript course and am soon going to start learning react and I am wondering if I should just stick with Jonas or try Maximilian. If you've taken any of these courses or both I'd really love to hear your opinion on it and how they differ and who they are for!

Hi,

Im now in the beginning of devops journey and I'm not really a reader person but I want to spend my free time in something useful so any suggestions for a book would help in my career and will benift me.

¡Hola a la comunidad!

Busco recomendaciones sobre cuál se considera el banco más progresista en Panamá para abrir una cuenta; uno que ofrezca la mejor experiencia digital —al estilo de neobancos como Revolut o N26 en Europa—, que no cobre cuotas de mantenimiento, que tenga una estructura de comisiones clara y transparente (sin sorpresas ni cargos ocultos), que cuente con una buena aplicación móvil y que ofrezca condiciones razonables para el retiro de efectivo en cajeros automáticos.

¡Gracias!