First Contentful Paint isn't about speed. It's about trust. Every millisecond of blank screen makes users wonder if your site is broken. Under 1.8 seconds tells them "I got you, content is coming." requestmetrics.com/blog/lightho... #WebPerf #CoreWebVitals

We published the CertKit roadmap. Unlike most company roadmaps, it's not vague promises about AI-powered synergies. It's a list of features with vote buttons. Tell us what you actually need. www.certkit.io/blog/what-sh... #CertificateManagement #PKI

Destructuring fails loud. That's actually good. Unlike dot notation that silently returns undefined, destructuring throws immediately when data is missing. Catches bugs faster. trackjs.com/javascript-e... #javascript #webdev

"Free certificates? For production?" Yes. Let's Encrypt uses the same encryption as that $500 EV cert. Chrome killed the green bar in 2018. Amazon, Netflix, and Walmart all use DV certs. Your objections are probably institutional habit, not evidence www.certkit.io/blog/should-... #PKI #WebSecurity

@bsky.app I am being “followed” by new 30 bots a day. I am more convinced everyday that this network is dead. What are you doing about it?

"Right side of assignment cannot be destructured" is Safari's way of saying you tried to destructure null or undefined. Chrome tells you which property failed. Safari makes you guess. trackjs.com/javascript-errors/right-side-of-assignment-cannot-be-destructured/ #javascript #webdev

Missing the viewport meta tag? Your mobile users are waiting an extra 300ms on every single tap. Browsers add that delay to check for double-tap zooming. One line of HTML fixes it. requestmetrics.com/blog/lightho... #WebPerf #SEO

DNS-01 validation requires changing TXT records on every certificate renewal. With 47-day lifetimes coming, that's going to hurt. DNS-PERSIST-01 fixes it: validate once, get certs forever. www.certkit.io/blog/dns-per... #ACME #PKI

Seeing a sudden spike of 404 errors for ads.txt, security.txt, and /.well-known/ files? It's probably @httparchive.org Almanac scanning with WebPageTest Not a bug, just bot noise. trackjs.com/javascript-e... #javascript #webdev

Most web servers ignore URL casing. But Node and Python don't. If /User/Profile and /user/profile are different routes in your app, our new "Preserve Casing" setting keeps them separate in your reports. requestmetrics.com/blog/product... #WebPerf #WebDev

Do you still need wildcard certificates? Wildcard vs SAN assumes certificates are painful to manage. But once you've automated for 47-day lifetimes, issuing 50 certs takes the same effort as one. The question shifts to security, not convenience. www.certkit.io/blog/do-you-... #PKI #WebSecurity

I'm working on a new idea for a conference talk, Everything you learned about SSL is deprecated. I'd love some feedback on it! gist.github.com/toddhgardner...

CertKit now supports multi-domain certificates. Mix wildcards with specific hostnames on a single cert. Also shipped: actual ACME error messages instead of "something went wrong" and non-sequential IDs to stop enumeration attacks. www.certkit.io/blog/certkit... #SSL #PKI

In 2015, only 40% of websites used HTTPS. Today it's 95%. The ACME protocol made that happen by automating certificate issuance. But it didn't solve certificate operations. That's still your problem. www.certkit.io/blog/how-acm... #ACME #PKI

The worst JavaScript errors are the ones you can't see. "Invalid or unexpected token" usually means invisible characters snuck into your code. Smart quotes from Slack, zero-width spaces, BOM markers. trackjs.com/javascript-e... #javascript #webdev

Just got our last certificate renewal email ever. All our products are now fully automated with CertKit. No more $144/year wildcard certs. No more renewal reminders. No more "your site will be vulnerable" scare tactics. Dogfooding feels so good. #SSL #PKI

The NSA recorded encrypted traffic for years, betting they'd eventually steal your private keys. With RSA key exchange, that worked. PFS broke their playbook. If you're still on TLS 1.2 without ECDHE, your traffic from 2019 might get decrypted tomorrow. www.certkit.io/blog/perfect... #TLS #PKI

Safari's "string did not match the expected pattern" is infuriating. One vague message for five different problems. CSS selectors, JSON parsing, DOM values, all the same unhelpful text. trackjs.com/javascript-e... #JavaScript #Safari

Just installed @trackjs.com on @certkit.io. Within 2 days I had tons of errors flooding in. None were my fault. All garbage from browser extensions and bots. That's the dirty secret of error monitoring nobody talks about. www.toddhgardner.com/blog/install... #javascript

Cloudflare down. GitHub down. AWS down. All in one week. Your business runs on abstractions you don't understand. When they fail, you're helpless. Build what makes you unique. Buy what makes you run. But FFS understand how it works. www.toddhgardner.com/blog/build-v...

Certificate Transparency logs contain billions of certificates but searching them is painful. crt.sh is slow and often down. So we built our own free CT search tool that actually works. Part 1 of our series: www.certkit.io/blog/searchi... #CertificateTransparency #PKI

The heavens opened and tried to swallow my house tonight.

"Revoke Certificate" - It's theater. Most revoked certs keep working. Chrome, Firefox, Safari each block different revoked certs. The industry knows it's broken, so they're forcing 47-day expiration instead. www.certkit.io/blog/certifi... #PKI #CertificateManagement

My weekend upgrade: added a UPS since we keep losing power here. Unknown if my fiber connection stays online if we lose power.

MetaMask throwing connection errors in your logs? You're not alone. These extension errors pollute your monitoring with noise that isn't even your fault. We show you how to filter them out automatically. Read more: trackjs.com/javascript-e... #JavaScript #WebDev

A few weeks ago I did a Press Release for CertKit. It didn't really work out. Here's why. www.toddhgardner.com/blog/press-r... #seo #pr #startups

JavaScript top-level await is no longer considered 'baseline' due to a pretty big Safari bug caniuse.com/mdn-javascri... The module graph fails in cases where two modules import a third at the same time. Demo: random-stuff.jakearchibald.com/bug-repros/t... It's best to avoid the feature for now 😔

Stripe bought their domain in 2010. The previous owner's SSL certificate was valid until 2011. For an entire year, someone else had a perfectly legitimate certificate for their payment processing. This is why we're getting 47-day certificates. www.certkit.io/blog/bygones...

We can't control the user or the browser, so there is only one way to make websites faster: Do Fewer Things. Another fantastic clip thanks to @henrihelvetica.bsky.social's SPDY Stream. www.youtube.com/watch?v=Vs4-... www.toddhgardner.com/blog/how-to-...

www.youtube.com/watch?v=-8wP... An excellent short courtesy of @henrihelvetica.bsky.social and the SPDY Podcast about the important of RUM data over synthetic (lab) testing for web performance. www.toddhgardner.com/blog/why-is-...

Peak fall colors up at Castle Danger today.

I wrote up a debug log on one of my "favorite" errors of all time: Unexpected Token: '<' It's currently the #15 most common error on the Internet. trackjs.com/javascript-e... #javascript #webdev #debugging

I have no idea if this works, but I did my very first Press Release today! I'm not really sure what to expect with it -- probably nothing lol. But I think we're doing something really interesting with @certkit.io . www.einpresswire.com/article/8583...

Netflix doesn't join standards bodies. They build streaming protocols, not bureaucracy. #ssl

Bluesky feels dead. Is anyone real here?

I spent way too long crawling through CA/Browser forum mailing lists and repositories to understand the story of how we ended up with 47 day certificates. It's wild.

It started as 47 beautiful lines of bash. Now it's a distributed certificate system built on thousands of command line incantations nobody understands, running on every server, and some of the printers. www.certkit.io/blog/why-you... #devsecops #ssl #certificates

I had a fantastic time chatting with @richcampbell.bsky.social about Certificate management (specifically how much it sucks) and how we're trying to make it better at @certkit.io. Do you have strong feels about certificates? I'd love to chat with you about it.

The days of the one-year SSL certificate are coming to an end - are you ready? @toddhgardner.com talks on RunAs Radio at runasradio.com/Shows/Show/1... about the new SSL certificate limits being phased in over time!

sed -i 's/loading/thinking/g' I'm an AI company now. Money please.

Going live with @henrihelvetica.bsky.social right now to talk web performance. Finally get to share why your lighthouse score is lying to you www.youtube.com/watch?v=8bWs...

✨ SPDY STREAM 008 ✨ 🔐 We are pleased to announce our next guest, @toddhgardner.com of @trackjs.com + @requestmetrics.com . He'll share his experience working across multiple industries in helping engineering teams. Join us! 📆 Wednesday Aug 27th ⏰ 1PM EDT 🔗 bit.ly/spdy-stream-008

Jordan celebrates finally getting rid of bootstrap styles in the TrackJS redesign. youtube.com/shorts/2vkdD... Learn more about the TrackJS redesign 👇 trackjs.com/blog/a-fresh...

That moment when your Lighthouse score is 💯 but users are still complaining about slow pages... Stop guessing, start measuring what they actually experience. https://requestmetrics.com/web-performance/you-need-rum-to-understand-web-perf/ #WebDev #Performance

🚨 Plot twist: 50% of websites with perfect Lighthouse scores still fail Core Web Vitals for real users. Your synthetic tests run in a perfect bubble. Your users live in the real world. https://requestmetrics.com/web-performance/you-need-rum-to-understand-web-perf/ #WebPerf #RealUserMonitoring

Let me be non-software for a moment. I just hit a huge personal goal: the 1000lb club for lifting. It's been my goal for the last 3 years and it feels amazing. Never to old to start doing things. Plus, I overshot it, so I'm calling it the 2^10 club now--so it's still a little software :)

I discuss "Frontend Observability" w @toddhgardner.com on the latest episode of @redmonk.com's the MonkCast—its definition, historical context, and the uphill marketing hurdles involved in educating web developers about #olly tools. redmonk.com/blog/2025/04... youtube.com/shorts/o1HGz...

Discover why Time to First Byte (TTFB) is crucial for website speed in this essential Concepts of Web Performance tutorial with @toddhgardner.com from Request Metrics.

Master the art of loading JavaScript efficiently in this essential Concepts of Web Performance tutorial with @toddhgardner.com from Request Metrics. youtu.be/vS3-1RQecEE