❌

Normal view

Received β€” 1 November 2026 ⏭

Why simple math offsets break Unicode font converters (and lessons from building a zero-dependency client tool)

βœ‡posts from Frontend, drupal, Panama, reactjs, devops, selfhosted, webhosting, Wordpress, web_design, webdev, PHP, technology, ProgrammerHumor, CRM
By: /u/Both-Tart7460
1 November 2026 at 23:28

Hey r/Frontend,

Over the weekend, I fell down a surprisingly deep Unicode rabbit hole while building a client-side text styler (creating Fraktur, double-struck, circled, and aesthetic bio glyphs) with zero external libraries.

I wanted to share two specific technical traps I ran into and how to solve them properly on the front end:

1. The "Letterlike Symbols" Offset Trap

When engineers try to convert standard ASCII characters (e.g. A-Z) into styled Unicode variants like Double-Struck (𝔸, 𝔹, β„‚) or Fraktur (𝔄, 𝔅, β„­), the naive instinct is mathematical offset calculation: js // ❌ Naive implementation: breaks on specific glyphs const targetCodePoint = 0x1D538 + (char.charCodeAt(0) - 65); return String.fromCodePoint(targetCodePoint); Why this breaks: Unicode's Mathematical Alphanumeric Symbols block (U+1D400..U+1D7FF) has several historical "holes". Characters like Double-Struck C (β„‚, U+2102), H (ℍ, U+210D), N (β„•, U+2115), P (β„™, U+2119), Q (β„š, U+211A), R (ℝ, U+211D), and Z (β„€, U+2124) were already codified years earlier in the Letterlike Symbols block (U+2100..U+214F). If you rely on mathematical offsets, those letters either display as undefined tofu blocks (``) or completely unrelated symbols.

The Solution: Rather than writing messy conditional gap logic, an explicit static glyph map compiled ahead-of-time keeps the client runtime O(1) and guarantees 100% stable rendering across iOS, Android, macOS, and Windows.

2. Screen Reader Accessibility (a11y)

One huge UX oversight with "aesthetic font generators" is accessibility. Screen readers do not pronounce these glyphs as normal English letters; VoiceOver and NVDA pronounce 𝔄 as "Mathematical Fraktur Capital A". If users plaster this all over body text, it renders their profiles completely unusable for visually impaired users. We added an explicit accessibility notice right under the input reminding creators to reserve these purely for short bio tags/titles rather than body paragraphs.

Architecture & Specs:

  • Zero NPM dependencies: Pure Vanilla JS + CSS Glassmorphism.
  • Payload: The entire production bundle (HTML + CSS + full Unicode lookup dictionaries) compiles down to 26.4 KB.
  • Edge Deployment: Cloudflare Workers (sub-40ms edge TTFB).

If you'd like to test the real-time conversion and inspect the client-side implementation: πŸ‘‰ Live site: https://fonts.100emoji.shop

Would love to hear how other frontend devs approach Unicode normalization and rare symbol handling!

submitted by /u/Both-Tart7460 to r/Frontend
[link] [comments]

what do you actually look at first when something breaks in prod?

βœ‡posts from Frontend, drupal, Panama, reactjs, devops, selfhosted, webhosting, Wordpress, web_design, webdev, PHP, technology, ProgrammerHumor, CRM
By: /u/quietcodelife
1 November 2026 at 23:27

im trying to get better at debugging production issues faster. right now when something goes wrong i kind of just grep through logs hoping something jumps out, which works eventually but feels inefficient

curious what other backend devs actually check first. like do you have a mental checklist you run through? specific log patterns you look for? or do you mostly rely on monitoring/alerting tools to point you in the right direction?

our setup is pretty basic (node backend, postgres, some redis) and im wondering if im missing obvious stuff that would speed up the "wtf just happened" phase

submitted by /u/quietcodelife to r/webdev
[link] [comments]

Experts Expect 'Security Reckoning' As AI Tools Find And Exploit Software Bugs

βœ‡Slashdot
By: EditorDavid
1 November 2026 at 22:04
The Washington Post reports: Tens of thousands of South Koreans had their financial data exposed online in recent weeks after at least nine major banks there suffered cyberattacks that suggested a dark future for online security. One man, a 26-year-old living in southern China, was allegedly behind the attacks, according to an investigation by cybersecurity company CrowdStrike. Traces left online and failure to secure his own systems allowed investigators to piece together the man's name, age, location and what he allegedly did. The clues revealed that the devastating assault on some of Asia's most sophisticated financial institutions was the work of an amateur. The attacks were launched with help from a few artificial intelligence chatbots, CrowdStrike found, before asking one to help sell the stolen data online and draft a fake rΓ©sumΓ© touting cybersecurity skills... The hacker who broke into the South Korean banks had access to Anthropic's Claude, but because the U.S. firm's tools generally refuse to take illegal actions, free Chinese models were also used, including DeepSeek, CrowdStrike found. "The models are interchangeable," said Meyers, the CrowdStrike executive. The Post calls it "part of a wave of AI-enabled hacking that is advancing across the world, triggering alarm inside national governments as well as multinational companies." "Basically any pedestrian, non-hacker can take these frameworks and start leveraging them to go after different targets," said Adam Meyers, senior vice president of counter adversary operations at CrowdStrike. The company has tracked an increase in the speed with which cyberattacks can move once inside a target's networks, as seasoned hackers and rank amateurs alike get a boost from AI tools. "Anyone can be a super-hacker now," Meyers said... Many cyber experts still expect the security reckoning to intensify as AI tools that can find and exploit software bugs become more widely distributed and understood. [Last] Monday, The Post reported that cybersecurity researchers from the start-up Cathedral who set out to test Anthropic's security found that they could access internal messages and meeting transcripts. Cathedral reported its findings to Anthropic, which said it resolved the newly discovered problems... Security experts say it's unlikely that any hacker is forgoing the use of AI tools right now. Even in America, critical infrastructure like energy and water companies need to be "immediately and comprehensively" tested for exploitable bugs, according to Snehal Antani, chief executive of cybersecurity company Horizon3. He tells the Post the government might need to fund that remediation, and even form "a public and private partnership to accelerate incident response."

Read more of this story at Slashdot.

Good providers for hosting a basic html + js website?

βœ‡posts from Frontend, drupal, Panama, reactjs, devops, selfhosted, webhosting, Wordpress, web_design, webdev, PHP, technology, ProgrammerHumor, CRM
By: /u/nobaaaaaa
1 November 2026 at 19:10

I feel this may seem like a very strange question to ask given the circumstances, and hopefully this isn't breaking any rules. A few days ago I had a falling out with someone who happened to be hosting my website on their rented server. It's a very basic portfolio website with HTML and some JS for dynamically generating HTML elements from a Json file.

I'm pretty decent in HTML and JS but by no means a web developer, it's simply not my career. This means I can make a decent website but figuring out how to host it is beyond me. Are there any services that simplify this sort of thing, or is the process of renting and setting up my own basic server for a website straightforward? Github Pages maybe? Forms etc are not required.

I also own my domain, but it's currently still set up to link to that server. Once I get my own sorted out, will I have to worry about the two conflicting?

submitted by /u/nobaaaaaa to r/webdev
[link] [comments]

Self-hosted proxy for npm, PyPI and pub: new releases wait 7 days before anyone at work can install them

βœ‡posts from Frontend, drupal, Panama, reactjs, devops, selfhosted, webhosting, Wordpress, web_design, webdev, PHP, technology, ProgrammerHumor, CRM
By: /u/iApexxx
1 November 2026 at 18:30
Self-hosted proxy for npm, PyPI and pub: new releases wait 7 days before anyone at work can install them

What it is: a self-hosted caching proxy (git-pkgs/proxy, one Go binary) between everyone at work and npm, PyPI, pub, Maven and Go. New releases stay hidden for a week, and every download is logged with who pulled it.

Why: this year's big hijacks were all pulled within a few hours, so a week means you basically never see them.

The post has the config, what broke, and the built-in settings if you'd rather not run a proxy.

submitted by /u/iApexxx to r/selfhosted
[link] [comments]

Binance Reopens to $3.64 in Net Outflows. '98% Choose to Stay', Says Its Founder

βœ‡Slashdot
By: EditorDavid
1 November 2026 at 21:02
Binance now says it's replenished 90% of assets stolen last week in a $6.3 billion security breach, its customers still "rushed to move funds off the platform" when it reopened Sunday, CNBC reports, and Binance "said it recorded $3.64 billion in net outflows after reopening withdrawals on Sunday." The exchange processed $4.65 billion in withdrawals and $1.01 billion in deposits between 6 a.m. and 3:30 p.m. UTC on Nov. 1, Binance said in a post on X. The resulting net outflows represented 2.1% of Binance's $171 billion in total assets, based on its latest available proof-of-reserves data as of Oct. 28. Binance said withdrawal volumes had declined and were stabilizing following an initial spike, while deposit volumes remained substantial. The exchange began restoring withdrawals in phases at 6 a.m. UTC on Sunday, with services resuming across all 15 networks and assets included in the initial phase by 12:36 p.m. UTC. It said testing was continuing for the remaining networks and assets. Binance founder and former CEO Changpeng Zhao sought to reassure users following the breach, writing on X that "98% choose to stay!" He said most of the net outflows occurred within the first couple of hours after withdrawals resumed.

Read more of this story at Slashdot.

❌