1
Kill sticky headers (2013)
There is currently a trend for using sticky headers on websites. There's even a sticky header web startup .
Most cited
Posts that commenters keep linking to, ranked by how many different people have cited them in Hacker News comments. 90 posts.
2
Robots.txt meant for search engines don’t work well for web archives
Robots.txt files were invented 20+ years ago to help advise “robots," mostly search engine web crawlers, which sections of a web site should be crawled and indexed for search. Many sites use their robots.txt files to improve their SEO (search engine optimization) by excluding duplicate content like print versions of…
3
The Line of Death
When building applications that display untrusted content, security designers have a major problem— if an attacker has full control of a block of pixels, he can make those pixels look like anything…
4
Testing Cliqz in Firefox
About a year ago, Mozilla announced a strategic investment in Cliqz GmbH, the Munich, Germany-based provider of search and privacy tools. Today, we want to tell you about an important ...
5
Tutorial: Tic-Tac-Toe
The library for web and native user interfaces
6
The web sucks if you have a slow connection
A couple years ago, I took a road trip from Wisconsin to Washington and mostly stayed in rural hotels on the way. I expected the internet in rural areas too sparse to have cable internet to be slow, but I was still surprised that a large fraction of the web was inaccessible. Some blogs with lightweight styling were…
7
The web at maximum FPS: How WebRender gets rid of jank
The Firefox Quantum release is getting close. It brings many performance improvements, including the super fast CSS engine that we brought over from Servo. But there’s another big piece of ...
8
Inside a fast CSS engine
Project Quantum is a major rewrite of Firefox’s internals to make Firefox fast. We’re swapping in parts from our experimental browser, Servo, and making massive improvements to other parts of ...
9
JSON Web Tokens should be avoided
JWT, JWE, JWS, etc. are terrible designs and need to be scrapped, not resuscitated.
10
Intelligent Tracking Prevention
Note: Read about improvements to this technology in recent blog posts about Intelligent Tracking Prevention, and the Storage Access API.
11
Medium and the Scourge of Persistent Sharing Bars
When people click a URL and see that it’s a Medium site, their reaction should be “Oh, good, a Medium site — this will be nice to read.” Right now it’s gotten to the point where when people realize an article is on Medium, they think, “Oh, crap, it’s on Medium.”
12
Critical vulnerabilities in JSON Web Token libraries
Which libraries are vulnerable to attacks and how to prevent them.
13
Mac external displays for designers and developers
If you’re considering an external display for your Mac, there’s a few important decisions to make. Apple doesn’t sell external displays any more, so you can’t just default to their wisdom. That’s an issue, because not all displays are well suited for Macs.
14
Chrome's Plan to Distrust Symantec Certificates
Posted by Devon O’Brien, Ryan Sleevi, Andrew Whalley, Chrome Security This post is a broader announcement of plans already finalized on t...
15
Sans Bullshit Sans: leveraging the synergy of ligatures (2015)
Front-end antics and typographic mischievousness
16
Electron is flash for the desktop (2016)
What is slack doing? The process was in the background when this happened. I wasn't even interacting with it - I was in a meeting. I only noticed because my laptop fans were whurring when I got back. Restarting slack seemed to fix it for now. But that's not abnormal
17
Why TLS 1.3 isn't in browsers yet
Upgrading a security protocol in an ecosystem as complex as the Internet is difficult. You need to update clients and servers and make sure everything in between continues to work correctly. The Internet is in the middle of such an upgrade right now.
18
How Firefox Got Fast Again
Over the past seven months, we’ve been rapidly replacing major parts of the engine, introducing Rust and parts of Servo to Firefox. Plus, we’ve had a browser performance strike force ...
19
Cloudflare Workers: Run JavaScript Service Workers at the Edge
You see this everywhere, but as a lifelong gamer, my personal favorite example is probably graphics cards. In the '90s, graphics hardware generally provided a fixed set of functionality.
20
Introducing Riptide: WebKit's Retreating Wavefront Concurrent Garbage Collector
The new Riptide garbage collector in WebKit leads to a five-fold improvement in latency in the JetStream/splay-latency test.
21
On the Perceived Value of EV Certs, Commercial CAs, Phishing and Let's Encrypt
Last week I wrote about how Life Is About to Get a Whole Lot Harder for Websites Without HTTPS [https://www.troyhunt.com/life-is-about-to-get-harder-for-websites-without-https/]. Somewhere in the comments there, the discussion went off on a tangent about commercial CAs, the threat
22
GUI Architectures (2006)
Describing the way architectures for UIs have evolved over the years, in particular the many and often misunderstood definitions for Model-View-Controller.
23
Google, Facebook, and Amazon have fundamentally transformed the web
Open Source Freelancer
24
Replacing Disqus with GitHub Comments
I considered removing comments from the blog after looking into Disqus load-time behaviour and seeing what it was imposing on visitors.
25
Flat UI Elements Attract Less Attention and Cause Uncertainty
In an eyetracking experiment comparing different clickability clues, weak and flat signifiers required more user effort than strong ones.
26
Thunderbird’s Future Home
Summary The investigations on Thunderbird’s future home have concluded. The Mozilla Foundation has agreed to serve as the legal and fiscal home for the Thunderbird project, but Thunderbird will migrate off Mozilla Corporation infrastructure, separating the operational aspects of the project. Background In late 2015…
27
A cartoon intro to WebAssembly
WebAssembly is a way of taking code written in programming languages other than JavaScript and running that code in the browser. So when people say that WebAssembly is fast, what ...
28
Designing Websites for iPhone X
The section below about safe area insets was updated on Oct 31, 2017 to reflect changes in the iOS 11.2 beta.
29
Dangers of CSV Injection
I’ve been doing the local usergroup circuit with this lately and have been asked to write it up.
30
HTTPS on Stack Overflow: The End of a Long Road
Today, we deployed HTTPS by default on Stack Overflow. All traffic is now redirected to https:// and Google links will change over the next few weeks. The ac...