/transmissions — 3 on the wire
Notes from inside the machine.
Things I worked out the hard way and would rather you did not have to. Specs, permission layers, and the parts of search that stopped behaving the way everyone still assumes they do.
HTTP finally has a QUERY method, and it fixes a real problem
RFC 10008 gives us a request that is safe and idempotent like GET but carries a body like POST. If you have ever POSTed a search filter, this was written for you.
Put the rule in the database, then prove it holds
Row-level security is the right place for authorisation. It is also the easiest thing in your stack to get subtly, silently wrong — and Supabase finally shipped a way to check.
The traffic did not drop. It stopped being sent.
Publisher referrals are down sharply, most searches never produce a click, and half of all AI crawler traffic is training that will never refer anyone. What that changes about how you build.