Join devRant
Do all the things like
++ or -- rants, post your own rants, comment on others' rants and build your customized dev avatar
Sign Up
Pipeless API
From the creators of devRant, Pipeless lets you power real-time personalized recommendations and activity feeds using a simple API
Learn More
-
Why does our subtitle checker refuse markup in a WebVTT file but let the same tags through in an SRT file?
I work on OnePassApps, the team behind our own browser apps. We ship a Subtitle Workbench that reads the subtitle files you already have and tells you what is wrong with them before you export. I measured its format gate today, 12 November 2026, signed out, one build, one browser.
The finding is short: the markup gate is a format rule, not a markup rule. The same tags that stop a WebVTT file are accepted by an SRT file without a complaint.
## The same tags, two formats
I pasted one SRT of 198 characters with three cues. Cue 1 carries a voice tag, cue 2 a bold tag and a colour tag, cue 3 is plain:
```
1
00:00:01,000 --> 00:00:03,000
<v Roger Bingham>Voice tagged line
2
00:00:04,000 --> 00:00:06,000
<b>Bold</b> and <font color="#ff0000">coloured</font>
3
00:00:07,000 --> 00:00:08,000
Plain line
```
The panel read 3 cues - 0:01–0:08, then 3 cues, then No issues. Export SRT was enabled, I pressed it, and the confirmation line said Downloaded SRT and named the pasted file. The file that landed on disk was 198 bytes, and the markup was still there byte for byte - the voice tag, the bold tag and the font colour tag.
Then the same tags in a WebVTT file (221 B) are refused, one message per problem:
```
Error: WebVTT NOTE blocks are unsupported. Export is blocked to preserve their meaning; download the original instead.
Error: Rich WebVTT markup (voice, class, ruby, or inline timestamps) is unsupported. Download the original to preserve it.
```
The header counted 3 cues - 221 B and 3 errors, and the panel added a line of its own: Resolve source errors before exporting. The original file is still available. The NOTE block gets its own sentence, separate from the rich-markup one, and the rich-markup sentence names four kinds by name - voice, class, ruby, or inline timestamps. The voice tag and the ruby tag each produced one of those errors.
The file list said 1 with errors to resolve before export. The export button is named after the format that is selected: with the SRT file loaded the panel showed Export all ZIP and Export SRT, and with the WebVTT file loaded it showed Export all ZIP and Export WebVTT.
## The cue that produced no error at all
The positioned cue was the third case and the interesting one, because it raised nothing. Its WebVTT cue carried line:85% align:center position:50%, and the app printed the cue and its positioning settings on a single line in the cue list: Positioned cue line:85% align:center position:50%. No error was attached to it, even though the file carried three errors in all - one for the NOTE block, one for the voice tag and one for the ruby tag.
The guide's sentence about positioning is conditional - refused when it would lose information - and this cue produced no refusal and no error. I did not read the exported bytes for it, so I am not claiming what it contains. What I can say is what the panel did: it raised nothing, and it showed the positioning joined to the cue text.
## Nothing left the tab
I captured every request the tab made at the browser's own network layer, before I typed anything. The only requests were GETs and OPTIONS to our own app, API and auth hosts - the app's runtime and feature-flag reads - and there was no POST and no request body anywhere.
## What I did not test
One build, one browser, one signed-out session, one day, 12 November 2026. I pasted subtitle text rather than using the file picker, so the 5 MB per file and 20 files per batch limits are the app's own wording and not something I measured against a file of that size. The rich-markup error names four kinds and I exercised voice and ruby, so class and inline timestamps are untested.
The full write-up, with the timings and the export steps, is on our DEV Community account; this post is the format gate on its own. Our profile lists the nine apps we ship and carries the link to the tool.1 -
Does a canvas app that caps both strokes and points enforce both - or only one?
I work on OnePassApps, the team behind our nine browser apps. We ship a browser signature tool, and our own guide page for it makes a two-part promise: "A signature holds up to 200 strokes and 40,000 points."
I measured our app against that promise this morning (11 Nov 2026, signed out, one build, one browser) and only one half of it is enforced.
The stroke half is enforced, and it is loud. At the 201st stroke the app refuses in plain words: "This signature has reached its stroke limit. Undo a stroke or clear the canvas to keep drawing." The counter freezes at 200 - I drew 215 and it still read 200 - the export size stops moving (1198 x 182 px at 2x), and the export still works at the ceiling: the PNG at 2x came down as 52,090 bytes at 1198 x 182 px.
The point half is not. I dispatched 41,000 pointer-move events inside a SINGLE stroke over 22 seconds. The app still counted it as 1 stroke, showed no point-limit message at any point, and the exported SVG for that stroke was 151,856 bytes - one path element, no embedded image, path data parsing to 1 M + 3,999 C commands over 23,996 numbers, 11,998 coordinate pairs.
So: 41,000 pointer events in, 11,998 coordinate pairs out, and no complaint from the app about either number.
What I am not claiming: I did not reach 40,000 points in the app's own terms, so I cannot say what it does at that ceiling. The 11,998 figure is what the exported path data parses to, not an internal counter I could read.
The longer write-up, with the raw measurements, is our DEV Community article "Hitting 200 Strokes: What the Signature Maker Does at Its Stroke Limit".
If you ship a canvas tool: do you enforce both budgets, or does one of them quietly stay advisory?
Our profile lists the nine apps we ship and carries the link to the tool. -
Does a browser case converter apply JavaScript's Unicode rules? Ours does, byte for byte - and the sharp s is where it shows
I work on OnePassApps, the team behind our own browser apps. We ship a browser Text Studio, and this one is about the letters underneath the eight case styles - specifically the character where a text transform usually lies to you.
I measured it today, 11 November 2026: signed out, one build, one browser, one line of input.
```
straße mcdonald's o'brien hello-world foo_bar ı İ
```
Eight styles, the same line through each of them, read back verbatim out of the result box:
| Style | Output |
| --- | --- |
| UPPERCASE | STRASSE MCDONALD'S O'BRIEN HELLO-WORLD FOO_BAR I İ |
| lowercase | straße mcdonald's o'brien hello-world foo_bar ı i̇ |
| Title Case | Straße Mcdonald's O'brien Hello-World Foo_Bar I İ |
| Sentence case | Straße mcdonald's o'brien hello-world foo_bar ı i̇ |
| camelCase | straßeMcdonaldSOBrienHelloWorldFooBarIİ |
| PascalCase | StraßeMcdonaldSOBrienHelloWorldFooBarIİ |
| snake_case | straße_mcdonald_s_o_brien_hello_world_foo_bar_ı_i̇ |
| kebab-case | straße-mcdonald-s-o-brien-hello-world-foo-bar-ı-i̇ |
Two of those outputs carry the story.
**UPPERCASE expands the sharp s.** The string starts with the German sharp s (U+00DF), and UPPERCASE turns it into two letters, SS - so the word comes out as STRASSE. A transform that only knows ASCII leaves the sharp s alone, because U+00DF is not in the ASCII range at all. Ours does not leave it alone. The sharp s is also the only letter in this line where UPPERCASE changes the length of the word.
**lowercase does the same thing in reverse on the dotted capital I.** The line ends with the dotless i (U+0131) and the capital I with dot (U+0130). lowercase leaves the dotless i alone and turns U+0130 into a plain i followed by a combining dot above (U+0307) - two code points, not one, so the lowercased output is not the same length in characters as the uppercase one. (I have written about that lowercasing behaviour in the Data Studio's column-name rule before, in our DEV Community article - the same rule, a different feature.)
Both of those are exactly what JavaScript does. I ran toUpperCase() and toLowerCase() on the same string in the same browser session and compared the two results: our UPPERCASE output is identical to toUpperCase() and our lowercase output is identical to toLowerCase(), character for character. I am not claiming what the app calls internally - I am claiming the two strings match, and that they match on the sharp s as well as on the plain ASCII letters.
The identifier styles inherit all of it, because they are built on the lowercased string. The camelCase output ends with the same two characters, with the U+0307 still attached, and the snake_case output carries the dotless i as its own segment.
Earlier on Substack I listed what the eight styles are called and what the panel looks like; this post is about the letter-level behaviour underneath those names.
The styles also disagree with each other about one more thing: the apostrophe. Title Case keeps mcdonald's as a single token, while camelCase, PascalCase, snake_case and kebab-case split it, so the same input gives Mcdonald's in one mode and McdonaldS in another. I measured that layer separately and it is not what this post is about.
Limits, so you can judge how far this goes: one build, one browser, signed out, one line of input, measured today. I did not test multi-line input, an empty input, or a line that is only punctuation, and the claim that the identifier styles match the plain ones is a comparison of these eight outputs, not a reading of the source.
The page itself says the work happens on your device - "Nothing leaves this tab." and "Text transformed locally." are on the panel.
If you have built a case converter, I would like to hear how you handle the sharp s, because getting that one right is the difference between a slug that round-trips and one that quietly changes.
Our profile lists the nine apps we ship and carries the link to the tool. -
My recovery words were exposed during a fake customer service call but a private node secured my tokens.
It was a stressful Tuesday evening at 6:30 PM when my phone buzzed with an incoming call from someone claiming to be senior support for my primary hardware wallet manufacturer. The representative sounded completely professional, walking me through what they described as an urgent security patch to protect my assets from an active network vulnerability. Panicked and wanting to secure my holdings, I followed their instructions and typed my recovery words into what looked like a legitimate verification prompt. My breath caught in my throat and a cold sweat broke out across my back as the screen refreshed seconds later to show a zero balance across every token I owned, leaving me paralyzed by the brutal realization that I had just handed over the keys to my entire financial life.
The next forty-eight hours were a relentless cycle of grief and dead ends. I fired off frantic emails to official support channels, only to receive automated responses explaining that seed phrase compromises are irreversible and outside their liability. When I reported the theft to cybercrime investigators, the officers shook their heads, noting that decentralized thefts across anonymous chains left them with virtually zero jurisdiction or recourse. A heavy, suffocating despair settled into my chest, and I spent hours staring at the blank screen, drowning in self-blame for falling for such a convincing phone spoofing scam.
Just when I had completely resigned myself to total financial ruin, a security-conscious moderator on a private developer channel reached out after seeing my desperate posts. They put me in touch with the technical engineering team at [Crestforte Intelligence], explicitly warning me to stay away from social media operators demanding thousands in upfront retainer fees. Cautious and emotionally exhausted, I spoke with their specialists, who didn't ask for extortionate costs; instead, they immediately deployed a custom private node routing sequence to monitor the attacker's wallet cluster and intercept the remaining unspent transaction outputs before they could be fully laundered.
Watching the live terminal feed as their private node successfully locked down the asset pathway and forced a recovery of my remaining holdings felt like waking up from the worst nightmare of my life. I am posting this because I didn’t want anyone else to feel the crushing isolation and despair that I carried through those harrowing nights. If your recovery words were exposed or your wallet was drained by an impersonation scam, don’t give up hope just yet because there are experts who know how to navigate the protocol layers. You can find the intake coordinate on telegram and tell them a former client sent you so they can prioritize your queue via [Telegram: @CrestforteIntelligence] or call their direct line at +1 850 332 3493 to take your first step toward recovery.1 -
**My Experience Working with Shopify and eCommerce Businesses**
Building an online business is more than just creating a website. It takes planning, the right tools, reliable payment options, and good customer support.
I've been working on digital services through SellsSMM, with a particular focus on Shopify Stores and PayPal-related services.
My experience has helped me understand the challenges online sellers, dropshippers, and entrepreneurs face when starting or managing an eCommerce business.
I believe clear communication, reliable support, and understanding customer needs are essential for building a successful online business.
I'd love to hear from other developers and eCommerce professionals:
**What do you think is the biggest challenge when starting an online store?2 -
How to Find Legitimate Help for Online Romance Scams: Why Primatz-Guard Ranks at the Top
In today’s digital economy, digital assets, cryptocurrency, and blockchain investments provide exciting opportunities — but they also come with risks. Fraudsters target unsuspecting individuals through complex schemes like binary options fraud, forex scams, stock investment fraud, phishing attacks, real estate scams, and online romance fraud.
Primatz-Guard is a professional recovery service dedicated to helping clients navigate these challenges. Using structured blockchain analysis, digital asset tracing, and expert investigative procedures, we focus on restoring access, protecting digital wealth, and providing professional guidance.
Homepage : Primatz-Guard2 -
