Rauchg

Missed opportunity to call this Rawact

This is super fast. Great job!

R2S was a painful one, but Lachlan was a dream of a security researcher to partner with. Not just from a responsible disclosure POV, but things like hopping on multiple calls with Meta and our team to help us validate remediations. Thank you Lachlan for helping make the internet safer (and great job on figuring out this 'labyrinth' of a vulnerability)

This was a pivotal project for me as a young lad learning Linux and software engineering back in the day. Can't recommend it enough. So many little frustrations and painpoints to overcome, wasn't easy , and shows you the ropes of what's to come.

We collaborated with many industry partners to proactively deploy mitigations due to the severity of the issue.

We still strongly recommend everyone to upgrade their Next, React, and other React meta-frameworks (peer)dependencies immediately.

Heard and appreciate the feedback. We’re well aware of the DX papercuts in Middleware. With 15.5 we made a big step in supporting Node runtime[1] which addresses a slew of issues people have reported over time.

If I went back in time, I would have called it Routing Middleware or Routing Handler. A specific hook to intercept during the routing phase, which can be delivered to the CDN edge for specialized providers. It’s also a somewhat advanced escape hatch.

Since OP mentions logging, it’s worth noting that for instrumentation and observability we’ve embraced OpenTelemetry and have an instrumentation.ts convention[2]

[1] https://nextjs.org/blog/next-15-5#nodejs-middleware-stable

[2] https://nextjs.org/docs/app/api-reference/file-conventions/i...

It’s possible `/` redirects but other hidden routes phish. If someone gets e.g.: a fake password reset email, it might help the attacker bypass sanity checks users make.

Falsehoods programmers believe: the OSI model

I've been acting mostly as the 'ideas guy' and helping with the architecture / QA. It's a great way for me to dogfood Vercel and build empathy as a user in an external org, using external services.

Someone in our community created a provider and I wanted to showcase it.

It’s nice insofar with very little abstraction, runtime, and bundle size overhead, you can easily switch between models without having to learn a new API.

JS is used for fast page transitions and stuff like that, but funny enough I'm pretty sure I end up shipping less JS overall by running server-side JS.

Last I checked, a Tweet embed alone was several mbs of JS, and it causes a bunch of layout shift and loads third party resources. On my blog they're pre-rerendered and shipped statically[1]

Probably the strongest reason though is to not set a 'power cap' on your project unnecessarily. It'd suck to have to rewrite a project because you got trapped in a local maxima, which is why i always share you can have your 100 lighthouse cake & eat it too.

[1] https://rauchg.com/2021/making-the-web-faster#next-momentum

some that i've built recently with app router that are intentionally minimalistic

- https://rauchg.com

- https://next-ai-news.vercel.app/

- https://emoji-todo.vercel.app/

Next.js scales up and down in complexity / ambition. On perf:

- https://twitter.com/rauchg/status/1652093980958683137

- https://twitter.com/rauchg/status/1744183168541007878

If you have any concrete feedback on what we should improve, I’m all ears. We heard feedback from the community that they wanted better documentation and guidance on self-hosting and we shipped it last month[1]. Curious what you’d like to see improved.

[1] https://nextjs.org/blog/next-14-1#improved-self-hosting

Middleware does work with self-hosting[1]. It’s a more limited runtime that’s based on web standard APIs, which creates optionality for running it in high performance / resource constrained scenarios.

[1] https://nextjs.org/docs/app/building-your-application/deploy...

We're working on improving this and it's shipping soon!

I just had a great experience building with Drizzle ORM and NextAuth, not sure if this is helpful:

https://github.com/rauchg/next-ai-news

(This is with Next.js 14 App Router and Server Actions)

Can you tell me more about the pains you're seeing?

Always looking for the meta-feedback as well on how we can improve support. So, both pieces of feedback welcome!

Would love to dig into your support issues. Let me know: [email protected]

I appreciate your good faith engagement and legitimate questions.

Three quick reactions:

- The employee did not find location information on our platform. Our security team is certain of this and that the system worked as intended, but the employee misused it.

- Everyone at the company takes PII and protecting customer data extremely seriously. We have and we will continue to reinforce this in light of this situation.

- Our ToS are specifically designed to protect our customers. Note that in the terms folks are discussing we mention “only in connection to providing our services”. That said I’ll be following up internally to see if more clarifications can be made (I’ve seen companies provide high level summaries in the past to help with the legalese interpretation)

Hey folks,

Some clarifications:

- Leap AI (tryleap.ai) created a template which is a demo, incomplete version of other popular products.

- Templates get submitted to the marketplace all the time. One of Vercel’s devrel promoted it. The idea is to help people learn from a realistic, complete example

- This template has nothing to do with the code or data of any existing hosted Vercel app

Happy to clarify anything else further