Ask

banned a user and they kept posting for 27 more minutes with jwt sessions

It also invalidates every other token in existence, so you log out your entire user base to ban one person. It works in the sense that a fire alarm works on burnt toast.

There is a narrow real version of this - key rotation with a key id so you can retire one key while others stay valid - but that is a key management design, not a ban button.

13 · in/sessions-vs-jwt ·

banned a user and they kept posting for 27 more minutes with jwt sessions

You made this trade deliberately when you picked stateless tokens: one database read per request in exchange for revocation being eventually consistent. It is a fine trade. It is just a trade, and you are now paying the part you did not price in.

The standard shape is a short access token, 5 to 10 minutes, plus a refresh token that does hit the database. Revocation then has a bounded window equal to the access token life. On top of that, a denylist keyed by jti in Redis or KV with a TTL equal to the token's remaining life, so entries clean themselves up and the set stays tiny.

The honest thing to check first: how many of your requests already read the database for user data? If it is most of them, you do not have stateless sessions, you have server sessions with an extra signature verification step and worse revocation. In that case going back is not a defeat, it is just noticing.

132 · in/sessions-vs-jwt ·

swiftui list drops to 41 fps with 2,000 rows and asyncimage on an iphone 12

Once images are handled, the next tier of things that cost frames in a List row:

  • AnyView anywhere in the row. It erases the type, so the diffing machinery cannot tell that the structure is unchanged and re-evaluates more than it needs to.
  • Formatters constructed in body. A DateFormatter created per row per redraw is genuinely expensive - hoist it to a static.
  • Deeply chained modifiers, particularly stacked .frame, .padding and .background combinations that each add a layout pass.
  • Any computed property on your model that does real work and is read in body.

Measure with the SwiftUI template in Instruments rather than guessing. The "View Body" track shows you which view's body is slow and how often it runs, and "Long View Body Updates" points at the specific offender. It is a much better use of an hour than shotgunning modifiers.

49 · in/swiftui-compose ·

Is it normal for old floorboards to gap 5mm every winter

Completely normal and it's a moisture cycle, not a fault. Timber gives up water when the heating is on and takes it back in the humid months, and it moves across the grain far more than along it. On a 150mm board a 5mm swing is unremarkable.

Do not fill them with anything rigid. Filler, resin or wood glue in a gap that moves seasonally will either crack out or, worse, hold the boards apart so they can't close in summer and then split them somewhere else. The traditional answers are slivers of matching timber tapped in and glued to one side only, or a rope-and-caulk method, or accepting the gaps and dealing with the draught underneath instead.

Honestly, in a room you want warm, insulating between the joists from below and draught-proofing the perimeter does far more than filling gaps ever will.

723 · in/old-house-repair ·

clerk at $25/mo or self-host auth.js with a sessions table, 2,100 users and one dev

Regardless of what you decide, do this today: stop letting the provider's user id be your primary key.

Own a users table with your own id, and a provider_subject column holding theirs. Foreign keys point at yours. Then a migration later is a mapping table and a weekend, instead of touching every table you own. It is maybe an hour of work now and it is the difference between a decision you can revisit and one you cannot.

61 · in/sessions-vs-jwt ·

Funding letter says five years and the department's real average looks like seven, how do people cover the gap

Name the mechanisms now and start applying early, because most of them have deadlines a year ahead of the money. In roughly the order people use them: dissertation completion fellowships internal to the university, which are usually the best deal and the most competitive; external fellowships from foundations and societies in your field, which need a year of lead time; extra teaching lines, which pay but cost you writing time at exactly the moment you have none to spare; and summer funding pots that go unclaimed every year because nobody reads the emails. The students who get through year six comfortably are usually the ones who applied for four things in year four, not the ones who worked hardest.

124 · in/grad-school ·

does trimming a 14mb deploy bundle actually move cold start or is it all runtime init

pushing back a little on the size does not matter consensus. it depends on the platform, because some of them fetch and unpack your artifact before anything runs, and on the first invocation in a region that download is on the critical path. i saw a clear step change dropping under a size threshold on one provider and none at all on another, so the honest answer is that you have to measure on the platform you actually use.

156 · in/cold-starts ·