946: We Got Roasted for Our Websites — Fair  ## Metadata - Author: [[Syntax - Tasty Web Development Treats]] - Full Title: 946: We Got Roasted for Our Websites — Fair - Category: #podcasts - URL: https://share.snipd.com/episode/a02b0b6b-7a8a-433d-a851-2d8ddaa8c460 ## Document Notes ## Highlights - **Why Devs Ignore Their Own Sites** - Developers often neglect their own websites because they prefer building exciting client projects or new tools. - The "cobbler's children" effect means personal sites become experimentation sandboxes rather than polished portfolios. Transcript: Wes Bos First question from Sabes Ge i visited the website it's of all three of you and i must say i was very disappointed what okay i didn't put this question in here scott's site has huge font Sizes cj's was alien themed in short wess's was better thank you at least i could read the text. Okay. So what were you disappointed in my website? Cause I am, I spent a shoot load of time on my website. I'm very proud of it. Um, so the question, why do professional devs have terrible website UIs, but create amazing websites for clients? I'm young, 19 started programming my journey, but my parents complained that I'm spending too much time on my PC and my phone. I won't say it's a lie. And I'm working on a project because I want to complete it. I work from home. How can I convince my parents that this is the best of life for me? Okay, two questions here. Scott, why does your website suck so much? Scott Tolinski Yeah, let me pop open both of our websites. This is my website, folks. And here's what it looks like right now. And I'll tell you why it looks like this. I was looking at it about a week ago or a week and a half ago. And I was thinking to myself, man, I'm really tired of the CSS in this site. So I went and I deleted all of the CSS, except for some of it. I delete it. I got rid of it. And I kept the base CSS. So this is what my site looks like with just base CSS. Now, can it be better? Yeah. But you know what? I actually like how ugly and big it is. Am I working on it? Yes. So you can even tell I'm working on it because the tags don't have spacing between them. Like the site is functional, but I just ripped out all the CSS. So that's why my website looks bad. But it didn't like two weeks ago. I was just bored. And me when I get bored, I don't really think about it. Wes's site. On the other hand, I am surprised to hear it's better west's site to me is beautiful i i love thank you yeah i'm i'm a big fan of mine i spent a lot of time on that and on the design on all the parts Wes Bos Of it so big fan of that i think the it is it is very common it's very common that like developers don't even have a website which is as hilarious when you think about it and if you think about It like i don't post a ton of content on my own website most of it isn't on social networks and things like that yeah it's classic the cobbler's children have no shoes you know we've got So many other things that we are working on so many other little applications when it comes time to doing your own website it's just like i rather build something else that's really exciting. I'd rather add this feature to the syntax website. So that's always the case. ([Time 0:01:43](https://share.snipd.com/snip/f7f14c5e-7ba5-4046-aec4-5d6c6a007096)) - **Scott Deleted His Site CSS** - Scott deleted most of his site's CSS out of boredom and left it intentionally large and ugly while he refactors. - He keeps the site functional and treats it as a work-in-progress playground. Transcript: Scott Tolinski Yeah, let me pop open both of our websites. This is my website, folks. And here's what it looks like right now. And I'll tell you why it looks like this. I was looking at it about a week ago or a week and a half ago. And I was thinking to myself, man, I'm really tired of the CSS in this site. So I went and I deleted all of the CSS, except for some of it. I delete it. I got rid of it. And I kept the base CSS. So this is what my site looks like with just base CSS. Now, can it be better? Yeah. But you know what? I actually like how ugly and big it is. Am I working on it? Yes. So you can even tell I'm working on it because the tags don't have spacing between them. Like the site is functional, but I just ripped out all the CSS. So that's why my website looks bad. But it didn't like two weeks ago. ([Time 0:02:41](https://share.snipd.com/snip/6c0f1913-a083-4a39-a863-9915b33d0bb0)) - **Protect And Recover Hacked Accounts** - Add sign-in via Google or Apple and offer two-factor authentication to reduce account takeovers. - Keep audit trails and data versioning so you can investigate and, if needed, restore compromised user data. Transcript: Scott Tolinski Hey, Wes, Scott, love the show. Been listening since day one. How do you handle it when a customer's account gets hacked? What steps do you take in order to secure it and clean it up? And what best practices would you recommend for developers running their own apps where users can get compromised, even if it's not the app's fault? So ultimately, what Omar is referring to here is let's say the user account got hacked because insecure password, their password might have been in a data breach, and somebody was able To get into that. How do you handle that? Yeah, that's, that's a tough one. Because hopefully, you're, you know, you're, you're doing data backups and stuff like this, but it depends on scale, right? If this is like a boutique kind of niche app that you have a certain amount of users that you want to keep very happy, then like, maybe you can paw through database backups and try to restore That information. But if it's like a giant, like, giant app, I don't know, that feels like a tough problem to solve other than. Yeah, like, I would imagine you'd probably want some like data versioning, you could roll back individual users data versions. But that feels like that feels like a problem to solve for a scale that is not like a boutique kind of app. Wes Bos I see this a lot. And, and specifically where we see it in Canada is with our biggest grocery store chain is called Loblaws. And they have like a points program, right? And that's just like anytime you have gift cards or, or, or points, you attract the worst people on earth that try to, to abuse it and game it and whatnot. And at one point this is probably six or seven years ago i had my points thing hacked probably because i signed up like 15 years ago reuse the same password oh man they drain like 150 bucks Worth of points out of the thing and i eventually i got it back but i've heard so many horror stories over the years and And it's just like, well, it's not really their problem that you got Hacked because you have bad hygiene. But it also entirely is their problem because now that hacker went and cashed out the points and now they got to give you $150 worth of points back. So they're out that much. So you've really got to just take care of your users. Your users are babies and you have to like, like the easiest way to do it is just sign in with Gmail or sign in with Apple or whatever. And then you take all of the burden off of you onto the security of their email platform. You can obviously throw in two-factor authentication, text message. As much as people hate the like, send a text with a code, that will add a huge layer of security to your app. Scott Tolinski Yeah, preventative seems like the right way to go here. Wes Bos Yeah, you got to go ahead. What happens if after the fact? Yeah, you got to piece it. Hopefully you have some sort of audit trail as to what happened when did they sign in and what did they change it from and to you know like like for me i have people can like merge accounts Yeah so like if somebody like logs in and say hey my course is gone i used to have it and then i can like look at the audit trail and like, hey, you actually merged it with a different email Address. And like, oh, okay. But like, it also could be that somebody hacked their account and merged it with their own. So you can look back at it. ([Time 0:18:07](https://share.snipd.com/snip/6fc0d3d1-af3c-4f6e-beda-6d4fe8cd0433)) - **Store LLM Rules, But Avoid Context Bloat** - Commit simple LLM instruction or style files (like cursor rules) to version control to keep team consistency. - For larger docs, prefer specialized agents or a knowledge service so you don't bloat every model context. Transcript: Wes Bos So you can look back at it. Mitch K says, I work at a FANG company and we have very different opinions on whether you should put LLM context files. So that's like cursor rules, VSS code rules, documentation, and other assorted prompts and LLM generated docs into version control. I personally feel that we should, but many do not since it is not code. What are your thoughts on this? Scott Tolinski Yes, put it in version control. Yes. You have a bunch of people working on the same project. If they're all using the same LLMs, you want people to be working off the same source material in terms of those types of things. Now there's other alternatives to this, you can have your own set of tools to go get those things. And that's like an API that could go get those set of tools. I personally have no problem committing, like any of the agent files or any of those types of instruction files. I personally am moving more away from that style, though, because the more stuff you put into, that is the more kind of global context your LLM is going to use. And the more you're filling up that global context, the less room you have for other things. In fact, you can go onto cloud code, you can do forward slash context. And it shows you a little diagram of where the context is being taken up. And if you have too many instruction files, you'll see that there's much less room for other types of context. So other alternatives for this types things, you could have specialized agents that have some of that knowledge pre baked into them based on what they're working on specifically. Like instead of having a Svelte instructions file that's used and picked up on every single query, you could have a Svelte agent that has information attached to that specific agent, Then therefore it's not being used if that agent isn't isn't in play. You could also do an MCP server when we had Kyle C Smith on from Coinbase, they talked a lot about their internal tooling that they used was that they used Lang graph, or something like Master to build up your own kind of internal tooling for MCP to grab the data from your own knowledge base. That's a possibility too. ([Time 0:21:31](https://share.snipd.com/snip/21663da4-5c4f-4d2d-bd11-1d6fda59fd40)) - **Negotiate Time Limits For Side Projects** - Talk with your partner and set a time-limited agreement for intense side-project work to avoid relationship harm. - Pull back when needed and prioritize family over extra nights and weekends if it's causing friction. Transcript: Scott Tolinski Hi, guys. For the past year, a friend and I have been working on a side project in our spare time. This has meant a lot of late nights and weekends in front of the computer programming away at the app. Recently, we've started getting traction, ticking over 5,000 users and getting commercial interest. Reg. Yeah, nice. 5,000 users. Cool. My wife, however, doesn't see that. Instead, she's tired of a husband being hidden away in his office every night and weekend working, which I can associate, which I can appreciate because I felt that too. Given that you both have successful businesses and, at least from the outside, maintain happy families, how do you manage to find that balance? Help loved ones understand and while still building things without sacrificing other aspects of life? Tough question because I found myself in a situation where I am working too many nights, too many weekends, and getting the same feedback. And guess what, that feedback, incredibly important and incredibly valid. Because computer stuff is great. Career is great, push it, you know, grind hard. But at the same time, you got to know when to not because you cannot sacrifice the things in life that are really important, your family, your partner, any of that stuff, real life, you Cannot sacrifice that stuff to build an app. 5000 users is great. If you got 5000 users in here? Yeah, I'm not going to say that like additional nights and weekends wouldn't help. But like, you know, you got you got away that I personally think at this point, turn it back, man, you you've gotten to a successful part here, I think there is a time and a place to just completely Shut your computer and come up with an agreement, talk to your wife and see like, all right, if I was to work a couple extra nights a week, like, what does that look like? And when does that become a problem for me? Because I still pull out my laptop a couple nights a week here and there, cranking on some stuff, vibe coding on some stuff, doing some other stuff. Sometimes I'm, you know, working on nights and weekends a little bit here too. But you have to understand that there's a delicate balance there. Wes Bos And if you are causing some waves there, shut laptop not worth it yeah it's certainly not you're not going to be remembering like it's hard because like you're not going to remember this In in 50 years when you're dead but you also might like it might just like it might make a million dollars and then absolutely change your entire family's trajectory right and so i think That having an understanding with your partner of being like, I am doing this. And this is a temporary thing. Maybe put like a time limit on it. I need to grind for the next six months on this thing. Just because I think that it can, I think it can take off. I think I could build something really cool here. ([Time 0:25:28](https://share.snipd.com/snip/46f47d0e-5022-4f75-9526-c58ca5756972)) - **Building A Questionable Supplement Site** - Wes describes being asked to build a site for a legally gray supplements seller and the hosting challenges that followed. - He recommends Cloudflare in front and mirrored hosts so you can switch quickly if shut down. Transcript: Wes Bos I thought this was really interesting. So he says, I know somebody in the supplement space who put a jot form together that ended up getting reported and shut down. And he asked me to make him a website. So the story here is that this guy is selling some peptides. I'm pretty sure it's Ozempic. He didn't say, but I'm pretty sure this guy is selling something on the internet that is in a legally gray area. And he got shut down because they're using these platforms. And if these platforms deem you as that is not allowed on our platform, they will just shut you down and you'll be out of business. So the question he had is like, what do I use? So I'm going to build something from scratch. I don't want to use any, I'm going to use no external services that can come and get me and come and shut me down. But then at the end of the day, you still have to host it somewhere, right? So he asked like, what should I use? So I talked to him like, yeah, you can go for like a WordPress self-hosted or if you want to use like a payload or a strappy, something like that, just host it all yourself and build it full Stack. But then the more interesting question is like, where do you go to host things on the internet when you're doing legally dubious stuff? And I don't know that I'm like in that space or I'll tell you, I'm not in that space. Uh I think like like first step is throw a cloud flare in front of in front of your entire website and what that will do is it will at least stop people from being able to understand where Your website is hosted whether whether cloud flare will take you down uh not is another question. But from what I've seen, they let a lot of stuff slide in most cases. There's a lot of piracy and stuff hosted on Cloudflare. So if you put Cloudflare in front of it, then they're not able to tell who you're hosting with, at least not very easily. And then who should you host it with? I would probably be more interested in having a cutover strategy rather than trying to pick a host that won't shut you down. So have something mirrored to another host so that if you do get shut down, you can just point your domain to another one at one point. And then whether the domain will be seized or not is another one. But I think that that's probably a good idea. Find something like a Hetzner, DigitalOcean. There are lots of ISPs that are not as well known, that are very well known for... I have a whole list of bad ASNs that I completely block any request from on my on all of my websites. ([Time 0:29:32](https://share.snipd.com/snip/aabe7864-c6aa-4c20-86fe-0a6cdfa36f8a)) - **Use A Pipeline For Images** - Use an image pipeline or a service (Cloudinary/Cloudflare Images) and upload high-quality originals, not pre-sized files. - Serve responsive srcsets and let the pipeline output modern formats to prevent layout shift and large downloads. Transcript: Scott Tolinski Mark L says, Hi, I've been a jack-of web dev for 25 years now, mainly backend, but I've never been fully comfortable dealing with images. I've sent designs, and at some point, the inevitable question of how do you want the images comes up. I still don't know the correct answer. For example, if you upload an image to WordPress, it generates multiple versions of that image in various sizes. Is that the right approach? How do you decide whether an image should be a JPEG PNG GIF? GIF? GIF? I say GIF. Sorry, Do we even still even use Jifs? What size should I ask for? Say a hero banner background image? Is it generally true that bigger is better? So I can, it can be scaled down to required sizes. Should I be asking for different sizes of the same image for desktop tablet or more? You get the idea. Basically, what are the best practices in dealing with images? Let me just say, there's answers for all of these questions that could be done with paying for Cloudinary. Bingo, bango, you pay for Cloudinary, you put a URL in front of it, you say it format auto, size auto, all that stuff. You don't think about it ever again. You upload it with their API. It's there, you get the ID from it, throw that in your database, whatever it may be that URL path. Use Cloudinary, the cost can get up there in terms of how much traffic you're getting. But so many times I personally just decided that using Cloudinary was the easier solution for me. And therefore I went with that. I recently dove into building an image hosting and video compression service for myself using Cloudflare. Cloudflare has an images transform feature now that's really good. So you could very easily even get AI to do this for you. If you want, you take a bucket anywhere, R2, S3, any of that stuff, you take a bucket, you take a Cloudflare worker, you send the image to the worker, it puts it in the bucket, you get a path Back, you can use that path, you then use Cloudflare's image transformation pipeline. Done deal. If you want to host it yourself and own all that stuff, not play for Cloudinary. Wes Bos I think my advice here is don't try and do it yourself. Grab the highest quality originals that you can. Like, don't tell your designer, hey, give me a 800 pixel version and a 600 pixel version that's it's not that's never going to work and then when you need to update something you got to Be like and i need to resize it so part of your image pipeline is simply going to be throwing the image in there and then your image pipeline is going to generate multiple of it and output An image with like a source set. And then what that will do is it will, for larger displays, you get a higher resolution. For smaller displays, you get a smaller resolution on it. Same with like the formatting as well. I generally just stick JPEGs as source material in all of my sites. And then I let, like, I personally use Cloudflare images as well. And then I let them just figure out what format to serve up. So generally, it's like going to be a web P for the images. But I like, I hate, I hate having, I hate having web P's in my like folders, just because like it doesn't work with half the stuff out there, you know. So have that generated. And an added benefit of having a pipeline for your images is that you can also figure out what the width and height, the dimensions of those images are. And then when you're embedding them into your content, you can explicitly put a width, a height, or an aspect ratio on them. And then you don't get that cumulative layout shift where your content will shift down once an image has loaded because it'll blur in or download as it wants. But the spot that that image takes is... So having a whole image pipeline is well worth your time. And I personally use Cloudflare images. Another little trick you can do, and they probably don't like this, but I wrote a Cloudflare worker that sits in front of Cloudinary. So you can use Cloudinary to transform your images, but then you can use a Cloudflare cache API just to sit in front of it and cache those. So you don't have to keep paying for the bandwidth or the transformations on loud and airy. There's too many things called clouds. ([Time 0:33:29](https://share.snipd.com/snip/4148e4e6-e085-4946-928f-811fea8b5449)) - **Managed Image Services Trade Work For Cost** - Cloud-hosted image services remove repetitive work but can become costly as traffic grows. - Edge providers like Cloudflare now offer cheaper image transforms and caching alternatives. Transcript: Scott Tolinski Bingo, bango, you pay for Cloudinary, you put a URL in front of it, you say it format auto, size auto, all that stuff. You don't think about it ever again. You upload it with their API. It's there, you get the ID from it, throw that in your database, whatever it may be that URL path. Use Cloudinary, the cost can get up there in terms of how much traffic you're getting. But so many times I personally just decided that using Cloudinary was the easier solution for me. And therefore I went with that. I recently dove into building an image hosting and video compression service for myself using Cloudflare. Cloudflare has an images transform feature now that's really good. So you could very easily even get AI to do this for you. If you want, you take a bucket anywhere, R2, S3, any of that stuff, you take a bucket, you take a Cloudflare worker, you send the image to the worker, it puts it in the bucket, you get a path Back, you can use that path, you then use Cloudflare's image transformation pipeline. Done deal. If you want to host it yourself and own all that stuff, not play for Cloudinary. Wes Bos I think my advice here is don't try and do it yourself. Grab the highest quality originals that you can. ([Time 0:34:33](https://share.snipd.com/snip/73193166-ce1c-478a-8d6a-6975ab77a6ed)) - **Plan For Free-Tier Cost Surprises** - Beware generous free tiers: estimate real usage costs before scaling and have a migration plan. - Monitor potential bill spikes from bandwidth, serverless execution, or DDoS and be ready to move providers if needed. Transcript: Scott Tolinski Question here from patrick mcdonald on one of your shows i heard you say that beware of the free tier and often once you go off the free tier the pricing goes off a cliff lol i love reading Things like that like lol yes does that mean that we can't trust services that have a generous free tier and only a $20 pro tier? Or is the pro tier just a hook to open up for more billing? Your comments worried me as a developer whose stack is in the for sell marketplace. Yeah, I think some of this is like, beware of the too good to be true free tier. Like we'll host your whole database for free. Don't even don't even worry about it, bro. We got you. We got you. You want to host your whole database? Don't worry about it. Like to me, that's where you got to be prepared. Any of these things that does have a generous free tier the moment you start getting real traffic, real bandwidth, real data coming through. Yeah, your prices are going to go up. So that is the thing about Vercel that you do have to worry about. Do I have to worry about it? I've never built anything that I've had to worry about it with. We get free Vercel. Wes Bos So if you ever questioned our loyalty to any company, let you know that Vercel gives us free hosting. Scott Tolinski And I still make my thoughts be known about XJS without concern. Check out serverlesshorrors.com as a site that shows, it looks like the last post for this is May 2025. Maybe these horrors have stopped. But I thought this was an interesting image where they talk about various free platforms that then end up turning into big bills. I don't think this is a hard and fast rule. But like it is something you got to like have you got to have an understanding of what that would actually look like if you get a ton of traffic or if you need to then build your whole business On this thing. And is the bottom line going to cut it? You know, are you going to have enough money to pay for it? Wes Bos I always caution people about the like and this is not for sale only this is this is every single business out there that is trying to charge you per seat per month and it's it's because They they want to they want to get that enterprise customer where, ah, what the hell? We'll add six more people on at 30 bucks a month. That is gravy rather than your developer with their $20 bill. And they're not making a ton of money. And in fact, I bet Vercel loses money on some of these. Especially because often you hear stories about people who get DDoSed or attacked and the bill goes up and Vercel will just like forgive it. Like they're still paying that bill at the end of the day. You know, that bandwidth was still used. They can't they can't put that back in the bottle. So I'm sure they've eaten quite a bit just for like community goodwill and in that regard. And also like pricing is so hard because I was just, my eyes were crossed trying to look at my Cloudflare bill. I was just saying, how much did I spend this month on it? And it took me like five minutes to do it. Scott Tolinski So, and you see it with like- You need a degree to do AWS pricing. It is insane. Wes Bos Pay based on usage is great until it's very hard to understand usage. There's bandwidth, there's transfer between peering partners that maybe is or isn't charged. There's milliseconds on CPU. So if your serverless is running for 10 seconds, but you're only actually running CPU for 30 seconds of that or 30 milliseconds of that, then what do you get paid on? And it is so hard to estimate how much things will cost. And that's why people just do 20 bucks a month. And you see it with like cloud code and all these AI right now as well, where initially everyone's like, ah, 20 bucks a month, go nuts. You can just use whatever you want. And then like, this stuff costs that costs real money at the end of the day and there's a delicate balance which is for every company very hard to figure out of especially when you're trying To make a lot more money on those high-end enterprise customers don't be afraid you can always move your stuff if it starts to cost too much. ([Time 0:44:20](https://share.snipd.com/snip/676e56c6-412a-4e6d-90b0-c6e4adceea4e)) - **Predictability Versus Usage Pricing** - Pay-per-usage pricing is fair but often complex and opaque, making prediction hard. - Flat cheap VPSes feel attractive because they provide predictable monthly costs. Transcript: Wes Bos I just moved my stuff off of Vimeo onto Mux because like Vimeo just started screwing me. Initially it was 200 bucks and then they're like, hey, you're actually enterprise and you're not allowed to do what you're doing, which is streaming course videos so then it costs like Five grand and then a couple years later they just doubled their prices and they're adding all these like shitty ai features on top of the product when i all i care about is bandwidth at The end of the day and i got my renewal email from them and i was like yeah i'm moving to mux and like they didn't email me back for two weeks after I had asked a question about what it was. Like, they're just, they're like, you're dead to us. No longer. Scott Tolinski Yeah. It's so funny. It's so funny. I do like, it's one of the reasons why I think that $5 a month VPS is such a enticing thing, because like, you're buying what you pay for and that's what it is. There's no pay by usage that's predictable. And there's something very great about that. Wes Bos The other question is people you always hear both sides of it is when a website goes nuts and should the website be shut down or should you pay more it depends you know like did taylor swift Just tweet about your cool syntax t-shirt and we want to sell a bazillion of them fire up more servers we got to handle all the load or like is are you getting ddos and and you're in trouble You know or are you on top of hacker news and you just people are using your little app that you built and you didn't expect it to run up a three thousand dollar bill. It's it's a hard problem. And there's there's safeguards inside of all of these hosts as well. Scott Tolinski Yes, for sure. One ([Time 0:48:41](https://share.snipd.com/snip/f34a9234-43a9-4ccb-acdd-c33efadfe41f)) - **Momofuku Sauce Family Favorite** - Wes discovered and hoards specialty sauces, and his kids love Momofuku's sweet and savory Korean BBQ sauce. - He uses food picks as small personal delights and recommendations for listeners. Transcript: Wes Bos This is for all of our sauce enjoyers. We've we've sick picked quite a bit of the Bakken sauces over the years. We don't have the Momofuku ones in Canada in very often. I've seen them every now and then at like specialty shops. But I was in the States a couple of weeks ago and I grabbed the sweet and savory Korean barbecue sauce from Momofuku, it at Target man that is good and it's like my kids love it part of the Problem with like stuff with my kids is it's often spicy and like I'm trying to get their their spice tolerance up but this one is not spicy at all and they they absolutely love it as well Scott Tolinski So check that one out yeah man now abakins my daughter like is officially putting it on literally everything she's got rice she's pouring on like she puts it on everything dad we're having Uh chicken nuggets can i get the octopus sauce like absolutely landon won't touch it but brooklyn loves it oh man it's it's so good i what's the black i saw they have black versions now I don't know they got pineapple at at uh at costco they got all kinds of stuff i took a selfie by wearing my bakken shirt at costco next to the big display super you know that's awesome you Wes Bos Know how koreans have like a kimchi fridge because they have so much kimchi i need like a condiments fridge because it's just it drives me nuts. I open our fridge and there's no room for food. It's all sauces, hot sauce and garlic sauces and bakken sauce. And it's so annoying because there's no room in our fridge for anything, anything else. Shameless plug. Let me tell you about Sentry. This is also an ad, by the way. ([Time 0:54:19](https://share.snipd.com/snip/757bf93e-2905-457d-977c-faffe31d92a8))