Tony's NotesWeb, Cloudflare and engineering practice.https://notes.tao.im/en/enCORS Is Not Authenticationhttps://notes.tao.im/en/writing/cors-not-authentication/https://notes.tao.im/en/writing/cors-not-authentication/Test browser readability, server execution and session authorization as separate outcomes.Mon, 26 Oct 2026 00:00:00 GMTSaaS Pricing Should Follow the Value of Usehttps://notes.tao.im/en/writing/saas-pricing-value-boundaries/https://notes.tao.im/en/writing/saas-pricing-value-boundaries/Separate value, resource cost and billing units without making safe collaboration unnecessarily expensive.Mon, 26 Oct 2026 00:00:00 GMTHTTP Errors Need a Data Contract Toohttps://notes.tao.im/en/writing/http-error-contract/https://notes.tao.im/en/writing/http-error-contract/Keep missing resources, failed dependencies, empty searches and unknown write outcomes distinct.Sun, 25 Oct 2026 00:00:00 GMTHTTP Streaming Requires Backpressure and Cancellationhttps://notes.tao.im/en/writing/http-streaming-backpressure/https://notes.tao.im/en/writing/http-streaming-backpressure/Preserve stream semantics while bounding buffers, message sizes and work after disconnect.Sun, 25 Oct 2026 00:00:00 GMTResponsive Images Need a Budget for Size, Crop, and Priorityhttps://notes.tao.im/en/writing/responsive-image-budget/https://notes.tao.im/en/writing/responsive-image-budget/Deliver appropriate images without making mobile readers download desktop originals or lose essential detail.Sat, 24 Oct 2026 00:00:00 GMTSite Search: Zero Results Is Not the Endhttps://notes.tao.im/en/writing/search-zero-results-recovery/https://notes.tao.im/en/writing/search-zero-results-recovery/Distinguish no match, narrow scope, indexing delay, and service failure without leaking permissions.Sat, 24 Oct 2026 00:00:00 GMTBrowser Language Negotiation: Preferences, Explicit Choices, and Cacheshttps://notes.tao.im/en/writing/browser-language-negotiation/https://notes.tao.im/en/writing/browser-language-negotiation/Predictable first visits without repeatedly overriding a reader's chosen language.Fri, 23 Oct 2026 00:00:00 GMTTable Density Should Make Comparison Faster, Not Text Smallerhttps://notes.tao.im/en/writing/data-table-density-comparison/https://notes.tao.im/en/writing/data-table-density-comparison/Prioritize fields, numeric meaning, frozen columns, and context around a real comparison task.Fri, 23 Oct 2026 00:00:00 GMTMarkdown Is Not a Security Boundaryhttps://notes.tao.im/en/writing/markdown-html-security/https://notes.tao.im/en/writing/markdown-html-security/Trace trust from authors and rendering plugins to HTML, links, feeds, and build-time capabilities.Thu, 22 Oct 2026 00:00:00 GMTSaaS Onboarding: Let the First Useful Action Happenhttps://notes.tao.im/en/writing/saas-first-use-onboarding/https://notes.tao.im/en/writing/saas-first-use-onboarding/Work backward from saving and retrieving a real note, not from completing a tour.Thu, 22 Oct 2026 00:00:00 GMTPrioritization Is More Than Turning Opinions into Decimalshttps://notes.tao.im/en/writing/prioritization-under-uncertainty/https://notes.tao.im/en/writing/prioritization-under-uncertainty/Separate value, evidence, constraints, opportunity cost, and learning before trusting a score.Wed, 21 Oct 2026 00:00:00 GMTWorker Secrets Must Not Cross the Browser Boundaryhttps://notes.tao.im/en/writing/worker-secret-boundary/https://notes.tao.im/en/writing/worker-secret-boundary/Separate deployment configuration, runtime bindings, public build variables, and credential rotation.Wed, 21 Oct 2026 00:00:00 GMTWorkers Custom Domains: Diagnose DNS, Routing, and TLS Separatelyhttps://notes.tao.im/en/writing/dns-worker-custom-domain/https://notes.tao.im/en/writing/dns-worker-custom-domain/Replace repeated DNS edits with evidence about name resolution, trusted connections, and the responding application.Tue, 20 Oct 2026 00:00:00 GMTTwo Redirect Boundaries: Request Semantics and Trusted Destinationshttps://notes.tao.im/en/writing/http-redirect-safety/https://notes.tao.im/en/writing/http-redirect-safety/Choose redirect status codes deliberately and prevent login return paths from becoming open redirects.Tue, 20 Oct 2026 00:00:00 GMTRoll Out CSP by Observing Violations, Then Restricting Capabilitieshttps://notes.tao.im/en/writing/csp-rollout/https://notes.tao.im/en/writing/csp-rollout/Introduce a content security policy without accidentally blocking legitimate scripts and styles.Mon, 19 Oct 2026 00:00:00 GMTNavigation: Knowing Where You Are Matters More Than More Linkshttps://notes.tao.im/en/writing/navigation-orientation-hierarchy/https://notes.tao.im/en/writing/navigation-orientation-hierarchy/Make scope, object hierarchy, selected routes, and mobile navigation understandable from a deep link.Mon, 19 Oct 2026 00:00:00 GMTETags and Conditional Requests: A 304 Still Requires a Requesthttps://notes.tao.im/en/writing/conditional-http-requests/https://notes.tao.im/en/writing/conditional-http-requests/Representation validators reduce body transfer, but freshness, encoding, and write conflicts remain separate concerns.Sun, 18 Oct 2026 00:00:00 GMTRelease Risk Depends on Recovery, Not Just Lines Changedhttps://notes.tao.im/en/writing/release-risk-product-design/https://notes.tao.im/en/writing/release-risk-product-design/Evaluate rollout, rollback, forward repair, and persistent side effects around user outcomes.Sun, 18 Oct 2026 00:00:00 GMTForm Errors Should Explain What to Change and Whyhttps://notes.tao.im/en/writing/form-errors-actionable-recovery/https://notes.tao.im/en/writing/form-errors-actionable-recovery/Separate field problems from service failures and make asynchronous validation recoverable.Sat, 17 Oct 2026 00:00:00 GMTWorkers Cache API and CDN Caching Are Not the Same Switchhttps://notes.tao.im/en/writing/worker-cache-api-semantics/https://notes.tao.im/en/writing/worker-cache-api-semantics/Distinguish fetch caching, explicit Cache API storage, location scope, and invalidation.Sat, 17 Oct 2026 00:00:00 GMTAstro Island Boundaries: Who Should Pay the JavaScript Cost?https://notes.tao.im/en/writing/astro-island-boundaries/https://notes.tao.im/en/writing/astro-island-boundaries/Choose hydration around real interactions, then measure loading, execution, and recovery.Fri, 16 Oct 2026 00:00:00 GMTDecide How a Product Experiment Ends Before Looking at Resultshttps://notes.tao.im/en/writing/product-experiment-design/https://notes.tao.im/en/writing/product-experiment-design/Specify randomization, primary metrics, guardrails, and low-traffic alternatives in advance.Fri, 16 Oct 2026 00:00:00 GMTCanonical URLs Are a Deployment Contract, Not Just an SEO Taghttps://notes.tao.im/en/writing/canonical-url-contract/https://notes.tao.im/en/writing/canonical-url-contract/Keep origins, paths, language versions, previews, and content identity consistent.Thu, 15 Oct 2026 00:00:00 GMTRSS Is a Public API: Keep It Inside Publication Ruleshttps://notes.tao.im/en/writing/rss-publication-boundary/https://notes.tao.im/en/writing/rss-publication-boundary/Align article routes, feeds, sitemaps, stable identities, and withdrawal behavior.Thu, 15 Oct 2026 00:00:00 GMTProduct Metrics Begin with Events That Represent Real Valuehttps://notes.tao.im/en/writing/product-metrics-definition/https://notes.tao.im/en/writing/product-metrics-definition/Define activation, retention, cohorts, and quality without letting clicks impersonate success.Wed, 14 Oct 2026 00:00:00 GMTStatic Route Collisions: A Slug Is More Than a Filenamehttps://notes.tao.im/en/writing/static-route-collisions/https://notes.tao.im/en/writing/static-route-collisions/Reserve and normalize final paths before content routes overwrite each other.Wed, 14 Oct 2026 00:00:00 GMTAccessibility Is Not a Checklist: Start with a Keyboard Taskhttps://notes.tao.im/en/writing/accessibility-keyboard-task/https://notes.tao.im/en/writing/accessibility-keyboard-task/Trace an assignment workflow through controls, focus, announcements, and real assistive-technology testing.Tue, 13 Oct 2026 00:00:00 GMTCatch Editorial Errors Before Building with Content Schemashttps://notes.tao.im/en/writing/astro-content-schema/https://notes.tao.im/en/writing/astro-content-schema/An executable metadata contract for Astro articles, without confusing valid structure with trustworthy content.Tue, 13 Oct 2026 00:00:00 GMTCache Keys Start with Which Responses May Be Sharedhttps://notes.tao.im/en/writing/cache-key-design/https://notes.tao.im/en/writing/cache-key-design/A response-sharing contract for language, identity, query parameters, invalidation, and rollback.Mon, 12 Oct 2026 00:00:00 GMTWhen Users Ask for a Feature, Ask How They Do the Job Todayhttps://notes.tao.im/en/writing/product-discovery-evidence/https://notes.tao.im/en/writing/product-discovery-evidence/Turn requests into testable opportunities using recent behavior, artifacts, and small experiments.Mon, 12 Oct 2026 00:00:00 GMTAstro + Workers: Deploying a Content Websitehttps://notes.tao.im/en/writing/astro-workers/https://notes.tao.im/en/writing/astro-workers/From Markdown to static HTML to the edge: keeping content, builds, and delivery separate.Sun, 11 Oct 2026 00:00:00 GMTMaintain Technical Notes Like Codehttps://notes.tao.im/en/writing/content-first/https://notes.tao.im/en/writing/content-first/Executable metadata contracts, explicit publication decisions, and verification at the reader's actual entry points.Sat, 10 Oct 2026 00:00:00 GMTCommitted, Pushed, Live: Three Different Completion Stateshttps://notes.tao.im/en/writing/verify-deployment/https://notes.tao.im/en/writing/verify-deployment/Close the release loop with evidence for the exact source revision, remote branch, artifact, and public response.Fri, 09 Oct 2026 00:00:00 GMT