361
A couple CSS tricks for HTML Dialog elements
You can use CSS to add some simple functionality to HTML <dialog> elements!
362
Is OOXML Artifically Complex?
OOXML is less an act of sabotage than the continuation of a flawed, inelegant lineage.
363
An Interactive Guide to Rate Limiting
Learn about rate limiting algorithms with interactive apps, including Token Bucket, Leaky Bucket, Fixed Window, and Sliding Window methods
364
Patterns for Building Realtime Features
Realtime features make apps feel modern, collaborative, and up-to-date. The features predominantly require sharing changes triggered by one user to other …
365
The Difference Between Downloading and Streaming
Mostly to make use of an animation I made for a different blog post that hasn't materialised, let me take a moment to explain to you the fundamental technical difference between 'streaming' and 'downloading'. Which won't take long... because there isn't one!
366
A Deep Dive into Solid Queue for Ruby on Rails
In the second part of our series, let's dive deeper into some of Solid Queue's more advanced features.
367
Static sites with Python, uv, Caddy, and Docker
My preferred deployment stack for Python-built static sites.
368
Animate a mesh across a sphere's surface
Notes about creative coding on the Web.
369
Passkeys are just passwords that require a password manager
You reset your passkey the same way you reset your password. But you’ll find that passkeys make it harder to switch between password…
370
A first look at Django's new background tasks
Django 6.0 introduces a built-in background tasks framework in `django.tasks`. But don't expect to phase out Celery, Huey or other preferred solutions just yet.
371
Cross-Site Request Forgery
Cross-Site Request Forgery countermeasures can be greatly simplified using request metadata provided by modern browsers.
372
373
Fun with gzip bombs and email clients
I served a 10MB gzip bomb as an image in HTML email. Most clients and proxies coped, iOS Mail crashed and Evolution wrote 100GB of cache to my disk.
374
The Art of Dithering and Retro Shading for the Web (2024)
A detailed walkthrough of the inner workings of dithering and other shading techniques to give a retro look and feel to your WebGL and React Three Fiber work.
375
Pop_OS 24.04 LTS with COSMIC desktop environment
An important message on Pop!_OS, Linux, and one downright fantastic community.
376
Why Semantic Layers Matter (and how to build one with DuckDB)
Learn what a semantic layer is, why it matters, and how to build a simple one with DuckDB and Ibis using just YAML and Python | Reading time: 22 min read
377
JavaScript broke the web (and called it progress)
We replaced simple websites with complex apps nobody asked for. Now it takes a complex build pipeline just to change a headline.
378
Walled Gardens Can Kill
I'm an Apple ecosystem user, owning an iPhone ever since a past employer got it for me to test our company app some 8 years ago. Over time, as I've upgraded, I'
379
A possible future of Python in the browser
My Python code was too slow, so I made it faster with Python. For some definition of “Python”.
380
Deno 2.4
Deno bundle is back, alongside the addition of bytes and text imports, stabilized built-in OpenTelemetry, a new --preload flag, simplified dependency management with deno update, and more.
381
From MCP to shell: MCP auth flaws enable RCE in Claude Code, Gemini CLI and more
How MCP authentication flaws enable RCE in Claude Code, Gemini CLI, and more.
382
Trust Me, I'm Local: Chrome Extensions, MCP, and the Sandbox Escape
Secure the modern software stack with Koi. Gain visibility, context, and real-time protection over extensions, MCPs, and autonomous AI agent endpoints.
383
macOS becomes iOS: Safari video controls
At WWDC 2018, Apple Senior Vice President of Software Engineering Craig Federighi asked, “Are you merging iOS and macOS?” This rhetorical question was presumably in response to widespread criticism. Federighi's rhetorical answer was, “No. Of course not.”
384
The Missing Protocol: Let Me Know
I want a new protocol, tentatively called “Let Me Know” (LMK). The purpose is to provide someone an anonymous way to get notified when a singular, specific event occurs. Here’s a basic use case: Some random blog author has published Parts 1 and 2 of a series. You enjoyed it, and you want to know…
385
A modern approach to preventing CSRF in Go
My new book guides you through the start-to-finish build of a real world web application in Go — covering topics like how to structure your code, manage dependencies, create dynamic database-driven pages, and how to authenticate and authorize users securely .
386
Developing a Beautiful and Performant Block Editor in Qt C++ and QML
How I developed Daino Notes block editor from scratch.
387
Detect and crash Chromium bots
Disclaimer: If you're here for the holy grail of bot detection, this may not be it, unless your UX strategy involves surprise popups and your marketing strategy involves blocking Google crawlers. We recently stumbled across a bug on the Chromium bug tracker where a short JavaScript snippet can crash
388
Pixel is a unit of length and area
When measuring the size of a two-dimensional digital picture, the unit pixel is used in a weird overloaded way. Sometimes, it is used as a unit of linear length. For example, each frame of an animation is 1920 pixels wide and 1080 pixels tall. The Cascading Style Sheets (CSS) web standard has px as a unit of length…
389
Rolling the dice with CSS random()
Random functions in programming languages are amazing.
390
Why are 2025/05/28 and 2025-05-28 different days in JavaScript?
A Date in JavaScript always represents a point in time (i.e. milliseconds since epoch). This is more apparent when printing out the full date string: