Clojurians Log v2
biff 2026-05-03
FYI I've got a WIP starter project repo over here: https://github.com/jacobobryant/biff-starter-sqlite. You can run it with clj -M:run dev.
I'm currently getting sucked into CQRS stuff/reading through @andersmurphy’s https://github.com/andersmurphy/hyperlith and then going to decide what approach to the frontend I want to take. after that, the only remaining big thing is I need to go over all the CLI tasks and probably make some updates. Then we should be pretty close to a release...
So there are new headers on modern browsers that mean you don't need csrf tokens. So that's an option. That being said there's loads of csrf chat on the discord
Also if you use lax/strict and never do side effects/dangerous actions in a GET request you're also safe.
👀 nice, I'll have to refresh my CSRF knowledge...
yeah the dev UX is really nice. You do end up leaning on your database as a cache and making sure it's fast.
The CQRS approach is starting to make more sense as I'm learning about various ways to deal with client state. e.g. seems like you want to have some sort of server-side, per-tab and/or per-session state (hyperlith stores it in the db, https://github.com/dynamic-alpha/hyper I believe just stores it in memory). and then for expensive queries (e.g. loading a list of recommended posts, like yakread does), you'd probably materialize that in the tab state. i.e. instead of doing a get request that loads the recommendations directly into the dom, you'd do a post request that writes the recommendations into the tab state table/store. so then your long-lived request that gets HTML updates from the server would only be doing cheap queries into the that store (and directly into the main db/tables for queries that don't need to be materialized).
so idk, the model does seem potentially pretty nice. cool that all your rendering logic can just live in a single render-page function.
I finished an initial draft of a biff datastar lib today: https://github.com/jacobobryant/biff.datastar if you happen to look at it, let me know if anything looks glaringly wrong... I haven't taken a manual pass over it yet to clean things up so there's definitely still some weird stuff in there. I need to take another pass over hyperlith too and compare the details. I also need to look through discord and see what csrf discussions have already been had too since I ended up wrapping Datastar's backend actions to insert a x-csrf-token header, which feels... potentially fine but definitely want to find out if there's a better way