Last quarter, our CTO did an audit of development time across our enterprise applications and found we'd collectively spent 847 hours across four teams building variations of the same data grid, tree panel, and form validation components. The mandate came down immediately: stop reinventing wheels and standardize on a comprehensive component library.

We're a Fortune 500 financial services company with 12 different web applications handling everything from trade reconciliation to risk reporting. Each team had been building their own components, thinking they were being efficient and avoiding "heavy frameworks."

The numbers were brutal when we actually tracked them:

Data Grids: Four different implementations, each taking 80-120 hours to build basic sorting, filtering, and pagination. None handled virtual scrolling properly with our 50k+ row datasets. Team A's grid would freeze the browser, Team B's had memory leaks, Team C never finished theirs.

Form Validation: Six different approaches to the same client-side validation patterns. Two teams were manually writing regex validators for the same financial data formats we use company-wide.

Tree Components: Three separate implementations for hierarchical data display, each with different keyboard navigation, drag-drop behavior, and accessibility support. Testing across browsers took forever.

Date/Time Pickers: Don't even get me started. Five different libraries, inconsistent UX, timezone handling was a nightmare.

After the audit, we evaluated several enterprise component libraries. The winner had to handle our specific requirements: 100k+ row virtual grids, complex nested forms with conditional validation, accessibility compliance, and consistent theming across applications.

We ended up standardizing on Ext JS. The migration took 3 months instead of the 6 we budgeted. Our data grids now handle 200k rows without breaking a sweat, and the built-in virtual scrolling actually works. Form validation is declarative and consistent. The theming system let us match our design system perfectly.

The honest take: initial learning curve was steep for developers used to React/Vue patterns. Bundle size is larger than our custom components, but the trade-off in maintenance time makes it worth it. We've cut component development time by roughly 70% and bug reports related to UI components dropped 60%.

I am starting with saying it about Facebook because I don’t know other services than facebook that does this feature, and I’m upset about it.

If someone that facebook thinks it is me trying to log in but fails alot, it sends an email with [Log in using this button] thing. But think.. if your facebook account is someone trying to log in with passwords, that password might be reused on your email.. and that’s why I think facebook(and others that offers that kind of feature) should NOT provide log in with email. I saw lots of email providers just check for password, nothing more.

It was me who had that kind of trouble, my password was pwned, and when I didn’t know that. I have got a facebook OTP message for few days, and when I really log into facebook got the message “Was this you trying to log in? (EVEN THAT SOMEONE HAVENT PASSED 2FA)” and if say no, facebook locks my account and says me change the password, provide this account is yours, blahblah so even if it wasn’t me I could really had to click it was me. After that, started to get “I think you’re in trouble logging in to your account”.... If I didn’t use different password for my email, It would be so bad..

and BTW I couldn’t think that facebook is safe. After I change both my email, password for facebook and setting up 2FA and logging out from all devices, still got a mail with new email saying [We noticed you're having trouble logging into your account.] How am I trying to log in with newly changed email and password?

My wife and I have been using PayPal for years to pay our bills, and she's been telling me for a while that her 2FA did not always work. I took note but it was a few days ago and didn't process it.

A few days ago I created a new credit union account, created a new PayPal account the next day, and hired a freelancer on Fiverr to do some work. Ok, fine. I went to log into my new PayPal account, with 2FA enabled, and noticed it didn't require the 2FA. I tried it on Chrome, Firefox, and Edge, and no 2FA needed and blocked from creating a passkey on all browsers according to their alert statement ("your browser" type of thing).

Then I asked my wife, using her brand new phone, to see if she could log into my PayPal account, that she's never logged into before on her new phone and she could log in, again, with no 2FA at all.

What's going on? Is PayPal simply no longer secure to use or is there something going on I'm missing? It's a new account with password not saved in any browser and auto log in turned off and browser save options turned off and deleted and still it let her log in with just username and password. Doesn't that mean millions of others would also be in the same boat?

I have an online casino that has some IDPR attack vulnerabilities. Does anyone know of any web security companies that could tie all the loose knots in my React.js/express.js gaming platform: rpsbet.io

Thanks

It also should not record what I type, copy and paste login information on websites.

Hello All!

Thank you in advance for your help :)

I have a application thats open source based, that wishes us to allow Server Response Code 403 to be allowed through our F5 ASM appliance. I've always been under the impression allowing response codes can lead to leaked data or server platform info.

I can't find any good references to show the vendor why its just not good to allow this, am I wrong to be blocking these responses?

Thanks!

It combines live crawling, historical URL collection, and parameter discovery into a single flow.

On top of that, it adds AI-powered risk signals to help answer where should I start testing? earlier in the process.

Not an exploit-generating scanner.

Built for recon-driven decision making and prioritization.

Open source & open to feedback

https://github.com/oksuzkayra/gaia

Earlier this month I got a new computer with McAfee integrated. I've never had this antivirus before but so far it worked well.

About an hour ago - upon trying to install a cracked program that I immediately uninstalled when it started looking sketchy - I found out in its security history McAfee has been blocking so many IP addresses trying to connect to my computer - with increased activity from when I tried to download that crack, but this has been going on since I brought the PC home. I looked their location up and I saw how all of them where from the US, China, other EU countries different than mine etc. and about 99% where associated with super known companies like Microsoft or Amazon. There was also my own IP adress blocked, but McAfee recognized it was a local IP in its description.

I ran every possible scan (McAfee, MalwareBytes and AdwCleaner) in order to see if anything was left from the crack and so far they found nothing, but in McAfee history other IP addresses keep being blocked. As far as McAfee FAQ page says, I should not be worried since they've all been blocked, but I'm still scared as shit someone might manage to spy on my computer.

Do I have to worry or is it normal? Should I run another program to see if someone managed to bypass McAfee? (So far the ones I use detected nothing).

Thanks in advance, please help I'm a noob lol

Aloha, so im trying to learn how to use burp suite, i have watched several tutorials on youtube. But my proxy is not working. I have configured my firefox proxy :https://ibb.co/rv0RDrg

but when i try to use it with my burp suite the webpage never is able to work: https://ibb.co/wz4wz8M

until i disconnected my proxy. My burp suite proxy is correct as well: https://ibb.co/GdPfnHg

whats going on ? does having a vpn matter ?

Hello r/websecurity,

*TLDR at bottom

A little background on my issue: My grandmother f/~70 has been getting into trouble with her laptop/smart phone with internet shopping and falling for phishing attacks, to the extent that it has severely affected my grandparents’ finances and our family’s personal data security. (ie. actually messaging these people from “Dubai” and holding a conversation about lots of compromising personal information across the board). We have all taken measures to protect all of our accounts and such, but I am trying to figure out a better way protect us from this situation happening again (for the third time).

My solution: I thought a chromebook would be a simple and cheap solution to our issue where we make her a child account and can control and monitor many facets of her computer usage through the Family Link app, and can remote access to check in on various internet usage history.

My question for you: The issue that comes into play here is her accessing internet shopping websites and malicious links to fake websites that she will inevitably enter her information into, and as we can’t predict and block every single website that she could try to access for this type of browsing the standard blocking of specific websites would be extremely time consuming. I thought back to my grade school days where they used Barracuda’s web filtering to block “types” of websites (gaming, shopping, all the fun stuff, etc) but these solutions look to be all enterprises based. Is there an easy way to block: 1) all websites that are not secure(not https or similar), and 2) all websites categorized as “shopping” or any category we deem unnecessary for her eyes?

Limitations:

• We would like to block this on her device specifically so that my grandfather can still access amazon and the likes of need be from his devices, so blocking from the router wouldn’t be ideal.

• I am not a comp sci engineer but had some experience with programming in college as I went to a tech school. It’s not my forte so I would like to avoid complicated programming if at all possible, but I could probably figure it out if it’s our last resort.

• As this has been a terrible financial hardship for her, we would like to keep costs to a minimum.

TLDR; My grandma never learned to use the internet properly, got into a bunch of debt and compromised the entire family’s personal information and we need a way to stop this but still allow her to communicate with friends and play solitaire.

ANY HELP IS GREATLY APPRECIATED!!!!

Thank you, Javi

I'm from the CIS region and want to play the 2026 Marathon, however, as you probably know, the developer - Bungie - cut the entire region off, and now if anybody from here tries to play their games (e.g. destiny 2) they get slapped with an error. One possible workaround people have figured out is changing your DNS, reportedly it allows you to bypass the block. However, I have my doubts about just changing my DNS settings all willy-nilly without knowing what consequences that would entail. If this is of any interest, the suggested servers are: main - 31.192.108.180, backup - 176.99.11.77

Hi. I have a homework that i need to deploy a web app and secure it with a open source app. I am planning to deploy the app with Apache and secure it with Shadow Daemon WAF. What I don't know is, does shadow daemon compatible with Windows10 ? Should i use Ubuntu instead? I'm kinda newbie in this type of things. I am planning to develop something simple with Django. Are Apache and Shadow Daemon right choices? Any suggestions?

Hey guys.

A few years ago i bought GTA V

Like one or two years ago, i bought RDR 2

A few month ago, i was unable to connect. I tried many things, figurered out a whole new email adress was linked to my profile, and my actual email adress was linked to no account.

Today, for some reason, i tried again. My email adress was linked to an account, but the password i used for the rockstar accounf wouldnt fit, i used the "forgot password" feature, and logged into it. Tha account name is not mine (i am "constentain" and the one that appears is like "cpstentin" or something); I appear to owe no game at all, and my account has been created math 16th 2022.

So i figured a guy just slipped into my account, changed everything, then created a new account with my adress and stuff...

Do you guys know how i could have my account back ? it drives me crazy to know that a mf is just having fun over the shit i worked 100+ hours irl to afford

Thanks guys, the support wont helped, i guessed reddit was the place to ask for help...

Chrome extension WP Spike for pentesting your wordpress sites