3091
Oh-Auth – Abusing OAuth to take over millions of accounts
OAuth Account Takeover. Salt Labs shows how hackers could abuse OAuth to take over millions of accounts on Grammarly, Vidio, and Bukalapak.
Top posts
Every blog post that took off on Hacker News, ranked by the votes of its best submission. 8,469 posts.
3092
Next.js 8 released
Next.js 8 introduces Serverless Mode, smaller bundles, performance improvements, and more.
3093
"How much does a website cost?" – a survey of web designers
Hi! My name is Rob, and I find the best website design leads for agencies on the web. Save hours finding great projects to pitch.
3094
3095
3096
3097
Open-source self-hosted comments systems for static websites
A side-by-side comparison of open-source, self-hosted commenting systems for static sites — so choosing one doesn’t mean opening every repository yourself. Stars, open issues and last-commit dates are refreshed daily. Missing a system, or a column you need? Leave a comment below or open an issue.
3098
Fast, Bump-Allocated Virtual Doms with Rust and Wasm
Dodrio is a new virtual DOM library that is designed to leverage the strengths of both Wasm’s linear memory and Rust’s low-level control by making extensive use of fast bump ...
3099
Time-Based CSS Animations
In my earlier post Time Uniform For CSS Animation, I took a note about a way to do CSS animations with time ticks instead of keyframes. It was limited applicable because CSS lacked the ability of doing complex Math calculations. After years of wait, CSS now has enough Math functions supported, particularly mod()…
3100
CERN day 1: rebuilding the first web browser
This marks the beginning of a week long adventure in Geneva Switzerland at CERN, to work on a hack project.
3101
3102
What We're Working on in Firefox
We recently shared a number of updates with our community of users, and now we want to share them here: At Mozilla, we work hard to make Firefox the best b
3103
You Don't Need JQuery
Free yourself from the chains of jQuery by embracing and understanding the modern Web API and discovering various directed libraries to help you fill in the gaps.
3104
3105
On Asm.js
Just a shiny demo or the future of browser computing?
3106
Private and Public Mastodon
Here’s how to get into a lot of trouble: Suppose you (like me) love the intellectual wealth found in free-form text on the Internet. And (like me) are a reasonably competent programmer. And (like me) have derived value and pleasure searching Twitter. And (like me) you look at this nifty new Fediverse thing and see…
3107
Google Safe Browsing incident
For approximately six hours on 25.9.2025, the entire statichost.eu domain was flagged as deceptive by Google Safe Search. This meant that anyone using Google Safe Search was shown a very aggressive warning or outright blocked when trying to access any site on the statichost.eu domain. In some cases even custom domains…
3108
Modern JavaScript for Django developers
Working with Django in the modern JavaScript ecosystem without giving up the things that make it great
3109
Google Cast is now built-in to Chrome
With a couple of clicks you can view content on your TV or listen to music on your speakers, right from Chrome.
3110
Rails Cheat Sheet
A helpful list of resources for people who are just getting started out with Rails.
3111
3112
Against risk-based authentication (or, why I wouldn't trust Google Cloud)
If you were deciding on whether to use AWS, Azure or Google Cloud for a production application, what factors would you use to make the decision? There are probably many such factors you might think of, but I'd like to point out one that probably isn't commonly considered: the relative trustworthiness of Google's…
3113
3114
If you care about user privacy, don’t use Facebook JavaScript SDK
With email aliases , you can be anonymous online and protect your inbox against spams and phishing.
3115
3px of padding makes all the difference in the world
I'm sorry for rageskitching about Facebook, but I can't help it. I've seen this bug too many times and I would really like someone with commit access to the Facebook CSS to fix it. ...
3116
Comparing HTTP/3 vs. HTTP/2 Performance
We announced support for HTTP/3, the successor to HTTP/2, during Cloudflare’s birthday week last year. Our goal is and has always been to help build a better Internet. Even though HTTP/3 is still in draft status, we've seen a lot of interest from our users.
3117
I exploited TLS-SNI-01 issuing Let's Encrypt SSL-certs for any domain (2018)
The original research reports on security issues found in ACME TLS-SNI-01 which caused Let's Encypt to sunset it.
3118
WebGPU is now available on Android
Support WebGPU on Android, use of DXC for shader compilation, timestamp queries in compute and render passes, default entry points to shader modules, support display-p3 as GPUExternalTexture color space, memory heaps info, and more.
3119
Google's CardDAV server isn't standards compliant (2014)
For fruux , we’ve decided to implement syncing with Google Contacts some time ago, allowing people to do bi-directional sync between their fruux and Google Contacts address book.
3120
Consuming the Bluesky firehose for less than $2.50/mo
*without doing much with it (and maybe not for long at its current growth rate)