Cursed Knowledge

Video stabilization is cursed because it is implemented via crop metadata which impacts video dimensions and is sometimes automatically applied (depending on the tool), which can make dimension-based calculations wrong.

Google's safe browsing service is cursed because it can flag legitimate sites as "dangerous" without any human review and continue to do so indefinitely.

The setTimeout method in JavaScript is cursed when used with small values because the implementation may or may not actually wait the specified time.

The USER keyword in PostgreSQL is cursed because you can select from it like a table, which leads to confusion if you have a table name user as well.

PostgreSQL RESET is cursed because it is impossible to RESET a PostgreSQL extension parameter if the extension has been uninstalled.

Zitadel is cursed because its custom scripting feature is executed with a JS engine that doesn't support regex named capture groups.

Microsoft Entra supports PKCE, but doesn't include it in its OpenID discovery document. This leads to clients thinking PKCE isn't available.

The dimensions in EXIF metadata can be different from the actual dimensions of the image, causing issues with cropping and resizing.

YAML whitespaces are often handled in unintuitive ways.

Hidden files in Windows cannot be opened with the "w" flag. That, combined with SMB option "hide dot files" leads to a lot of confusion.

Git can be configured to automatically convert LF to CRLF on checkout and CRLF breaks bash scripts.

Fetch requests in Cloudflare Workers use http by default, even if you explicitly specify https, which can often cause redirect loops.

Some phones will silently strip GPS data from images when apps without location permission try to access them.

PostgreSQL does everything in a transaction, including NOTIFY. This means using the socket.io postgres-adapter writes to WAL every 5 seconds.

npm scripts make a http call to the npm registry each time they run, which means they are a terrible way to execute a health check.

There is a user in the JavaScript community who goes around adding "backwards compatibility" to projects. They do this by adding 50 extra package dependencies to your project, which are maintained by them.

The bcrypt implementation only uses the first 72 bytes of a string. Any characters after that are ignored.

JavaScript date objects are 1 indexed for years and days, but 0 indexed for months.

Prior to Node.js v20.8 using --experimental-vm-modules in a CommonJS project that imported an ES module that imported a CommonJS modules would create a segfault and crash Node.js

PostgresSQL has a limit of 65,535 parameters, so bulk inserts can fail with large datasets.

Some web features like the clipboard API only work in "secure contexts" (ie. https or localhost)