241
Static sites with Python, uv, Caddy, and Docker
My preferred deployment stack for Python-built static sites.
242
Animate a mesh across a sphere's surface
Notes about creative coding on the Web.
243
Passkeys are just passwords that require a password manager
You reset your passkey the same way you reset your password. But you’ll find that passkeys make it harder to switch between password…
244
A first look at Django's new background tasks
Django 6.0 introduces a built-in background tasks framework in `django.tasks`. But don't expect to phase out Celery, Huey or other preferred solutions just yet.
245
Cross-Site Request Forgery
Cross-Site Request Forgery countermeasures can be greatly simplified using request metadata provided by modern browsers.
246
247
Fun with gzip bombs and email clients
I served a 10MB gzip bomb as an image in HTML email. Most clients and proxies coped, iOS Mail crashed and Evolution wrote 100GB of cache to my disk.
248
The Art of Dithering and Retro Shading for the Web (2024)
A detailed walkthrough of the inner workings of dithering and other shading techniques to give a retro look and feel to your WebGL and React Three Fiber work.
249
JavaScript broke the web (and called it progress)
We replaced simple websites with complex apps nobody asked for. Now it takes a complex build pipeline just to change a headline.
250
Walled Gardens Can Kill
I'm an Apple ecosystem user, owning an iPhone ever since a past employer got it for me to test our company app some 8 years ago. Over time, as I've upgraded, I'
251
A possible future of Python in the browser
My Python code was too slow, so I made it faster with Python. For some definition of “Python”.
252
The Missing Protocol: Let Me Know
I want a new protocol, tentatively called “Let Me Know” (LMK). The purpose is to provide someone an anonymous way to get notified when a singular, specific event occurs. Here’s a basic use case: Some random blog author has published Parts 1 and 2 of a series. You enjoyed it, and you want to know…
253
A modern approach to preventing CSRF in Go
My new book guides you through the start-to-finish build of a real world web application in Go — covering topics like how to structure your code, manage dependencies, create dynamic database-driven pages, and how to authenticate and authorize users securely .
254
Developing a Beautiful and Performant Block Editor in Qt C++ and QML
How I developed Daino Notes block editor from scratch.
255
Pixel is a unit of length and area
When measuring the size of a two-dimensional digital picture, the unit pixel is used in a weird overloaded way. Sometimes, it is used as a unit of linear length. For example, each frame of an animation is 1920 pixels wide and 1080 pixels tall. The Cascading Style Sheets (CSS) web standard has px as a unit of length…
256
Why are 2025/05/28 and 2025-05-28 different days in JavaScript?
A Date in JavaScript always represents a point in time (i.e. milliseconds since epoch). This is more apparent when printing out the full date string:
257
WASM GC isn't ready for realtime graphics
Wasm GC is a wonderful thing that is now available in all major web browsers since slowpoke Safari/WebKit finally shipped it in December. It provides a hierarchy of heap allocated reference types and a set of instructions to operate on them. Wasm GC enables managed memory languages to take advantage of the advanced…
258
Deconstructing the "Whimsical Animations" landing page
I spent the past few weeks packing as many easter eggs as I could into my latest project, and in this blog post, I want to dig into some of the more interesting details! If you’re interested in animations/interactions, you’ll want to check this one out; I share a bunch of my favourite secrets and tricks. 😄
259
Decentralized Syndication – The Missing Internet Protocol
The Internet is decentralized by design. It came into being not at once, but in parts. New protocols were added on top of previous ones, but one crucial protocol is still missing.
260
Why the Sanitizer API is just `setHTML()`
Why the Sanitizer API is just <code>setHTML()</code>
261
Firefox Forcing LLM Features
Mozilla forcing llm features and providing no gui for users to disable them
262
The bloat of edge-case first libraries
How building edge-case first led to bloated, overly-granular libraries and what we can do about it
263
How functional programming shaped and twisted front end development
A friend called me last week. Someone who’d built web applications back for a long time before moving exclusively to backend and infra work. He’d just opened a modern React codebase for the first time in over a decade.
264
Google Logo Ligature Bug
Jeffrey Yasskin recently pointed out an interesting security bug: The idea is, if you had registered googlelogoligature.net then Chrome on Android (and possibly other Google products) would have displayed it as Google.net, potentially tricking users into thinking they were really interacting with Google. To see how…
265
Micro.blog launches new 'Studio' tier with video hosting
The core of Micro.blog’s mission is to make it easy for people to own their presence on the web. At first, it was a simple blog host that also
266
267
HTML whitespace is broken (2024)
A deep dive into HTML whitespace collapsing: How it works, why it sucks, how it should work, and how to deal with it.
268
Why is D3 so Verbose?
Curious why D3.js code looks long and complicated? I quickly explain why D3 is verbose, how it gives developers control, and what makes it powerful for data visualisation.
269
Issues with color spaces and perceptual brightness
Unlike RGB, the CIELab color space And the more modern variants like CIECAM02 and Oklab. is designed to be perceptually uniform. This is a broad goal, which roughly means that we would like changes in the numbers to match same changes that we observe when performing various studies of human perce
270
For all that's holy, can you just leverage the web, please?
The personal blog of Thomas Steiner