Stay current. Skip the noise.

Walkthrough: Introducing Elm to a JS Web App When we introduced Elm to our production front-end at [NoRedInk](https://www.noredink.com/jobs), we knew what to expect: the productivity benefits of an...

Tutorial: integrate Angular2 into a ClojureScript app using Luminus, Figwheel, hiccups, and npm deps for hot-reloading.

The 2026 Status Quo: They Cannot Coexist in the Same PlaceWhile REST is still used in approximately 83% of public APIs, GraphQL is in production use in over 61% of reported enterprises. At first glance, it may seem like they are competing, but the reality is different. The dominant adoption patt

Using MitmProxy and injected JavaScript feature mocks to bypass Headless Chrome detection tests.

How I Hacked DePauw University Using Hidden Inputs And how not to handle reported vulnerabilities For the past month I have been in a conflict with my undergrad university, DePauw, over a …

Explore the new theming API for Firefox Quantum, and see what you can do with lightweight theming, dynamic themes, per-window themes, and a quick look at what's next for themes ...

tl;dr GIFs are awesome but terrible for quality and performance Replacing GIFs with <video> is better but has perf. drawbacks: not preloaded, uses range requests Now you can <img src=".mp4">s in Safari Technology Preview Early results show mp4s in <img> tags display

The easiest way to keep your web apps accessible: Just use text The web is no longer just a collection of […]

Following up from Geoff’s intro article on The Second "S" in CSS, let’s now move the spotlight to the "C" in CSS — what we call the Cascade. It’s where

Building dynamically rendered Aggregate Date charts in frontend using any charting library. Aggregate your timeseries data in a smart fashion.

Web Content Accessibility Guidelines Inclusive Design Principles Manage Expectations Wrap-up CSS Scrollbar Module (added 10 December 2021) Now that one of the most popular CSS resource sites on the innertubes has implemented styled scrollbars in the browser I think the time is right (or too late?) for me to try…

In my last post I embedded several React-based examples directly into my Jekyll-generated article. Let’s dig into how I accomplished that and how you can embed React components into your own Jekyll pages.

The ultimate list of (almost) everything we used to create our premium Steam hit game Curious Expedition.

Learn how to securely implement OAuth2 in Angular applications. This step-by-step guide covers installing Angular CLI, setting up authentication, and protecting routes with best practices.

The absurd complexity of server-side rendering. GitHub Gist: instantly share code, notes, and snippets.

Retreating to classic navigation may be cowardice, but it’s INFORMED cowardice. Tagged with webdev, performance, a11y, javascript.

Firefox 115's remote quarantined domains feature lets Mozilla silently disable some extensions on chosen sites, raising trust and control concerns.

Ben Nadel looks at an issue that the HTMX "HX-Redirect" header has when you try to redirect users back to the same page in ColdFusion.

Web Components are a set of browser APIs that allow us to create custom HTML elements. They are one of the major things that SPA (Single Page Application) frameworks have been giving us for a long time ... HTMX is highly interesting, useful and a promising technology. It simplifies many things and allows us to build SPA or SPA-like applications without complex tooling, dependencies, frameworks and mostly without writing application-specific JavaScript code.

Trifecta is a simple open source image sharing site, built with a combination of modern C++, database and web technologies. Intended to both be useful and make some points. This page sets out to explain the underlying technology of this small yet hopefully useful piece of software. More background can be found on its main page, where you can also read a bit about why I built this software. In short, 1: I need an image sharing site I trust and that does not track its users and 2: I want to show that you can still run a service yourself safely.

A modern web app written in c and served the old way: CGI, SQLite and a single binary. No frameworks, no containers and no regrets.

Let's say we have a color in a CSS variable and want to modify its lightness, but only if it's too dark or too light.

Via a handful of meta tags and link tags, web apps on iOS can be launched from the home screen and run in fullscreen mode to enable a more native-like

For the past several months, a small team at Mozilla has been working on an experimental new Web API and an accompanying browser feature called FlyWeb.

A small website mystery

A look into the backend server behind an .io game.

Covers the how's and why's of Web caching for people who publish on the Web. With FAQs.

Browsers historically have had a single HTTP Cache. This meant that if www.a.example and www.b.example both used cdn.example/jquery-1.2.1.js then JQuery would only be downloaded once. Since it's the same resource regardless of which site initiates the download, a single shared cache is more efficient. [1] Unfortunately, a shared cache enables a privacy leak. Summary of the simplest version: I

A deeper dive into how LiveView became LiveView

text-decoration-thickness and other attributes are now widely supported. Yay!

The line of death, as Eric Lawrence explained in a classic blog post, is the idea that an application should separate trustworthy UI from untrusted content. The typical example is in a web browser, where untrustworthy web content appears below the browser toolbar UI. Trustworthy content provided by the web browser must appear either in the browser toolbar, or anchored to it or overlapping it. If this separation is maintained, then untrusted content can’t spoof the trustworthy browser UI to trick or attack the user.

When is copy-paste payloads not self-XSS? When it’s stored XSS. Recently, I reviewed a Zoom’s code to uncover an interesting attack vector.

This describes the old version of this project, see Improved Web Component for Pixel-Accurate Atkinson Dithered Images for the new version plus an interactive demoI have always liked the look...

We identified 10 security vulnerabilities within the caddy-security plugin for the Caddy web server that could enable a variety of high-severity attacks in web applications, including client-side code execution, OAuth replay attacks, and unauthorized access to resources. During our evaluation, Caddy was deployed as a reverse proxy […]

I created manifest v3 Chrome/Chromium extension with `

Earlier this year, both major Web engines (WebKit/Safari and Chromium/Chrome/Edge/Brave) accelerated HTML parsing using SIMD instructions. These 'SIMD' instructions are special instructions that are present in all our processors that can process multiple bytes at once (e.g., 16 bytes). The problem that WebKit and Chromium solve is to jump to the next target character as … Continue reading Scan HTML even faster with SIMD instructions (C++ and C#)

So you think you know box shadows huh? I bet you didn't know they could do this.

A detailed essay on my research and process of building a shader to mimic paint, watercolor, and aquarelle by exploring various implementations of the Kuwahara image smoothing filter.

Browser fingerprinting replaces cookies via device traits and entropy; Google enables it, while Tor, Brave, and Mullvad resist.

AndreGarzia.com website

I admittedly don't think about this idea very often... how efficient is the CSS that we write, in terms of how quickly the browser can render it?

While searching for my ancestors, I had to access data from many different websites. I noticed there were different levels of protection against automated access depending on the site. In this post, I’ll list them and mention countermeasures you can take to bypass them anyway. Disclaimer As a private person using the data for my own personal use, I have no qualms about bypassing the protection. It can be considered fair use.

d4 uses React instead of d3's core for declarative, understandable data-driven SVG docs, while still leveraging d3 utilities.

Less is more – in many ways The original blog entry with example animations can be found on my website As a mantra, I really like the saying

Eleven years after discovering the F-shaped reading pattern, we revisit what it means today.

Chrome team breaks existing web to make Chrome perform better

In this Smashing TV webinar recording, join Léonie Watson (a blind screen reader user) as she explores the web, and find out about some unexpected properties of HTML elements that not only have a huge impact on accessibility, but also turn out to be pretty good for performance, too. We felt that the webinar was so valuable that we would open it up so that it’s free for everybody to use. Hopefully, it will serve as a resource for the whole web development community to understand how — and why — semantic markup matters.

Everybody knows you can concatenate gzip files to form valid gzip files, but do the browsers know? We explore concatenation with gzip, brotli, and zstd.

Web development has become a very complex field with many branches and tools to master. In this article, I suggest doing the inverse and use just a simple `index.html` file to manage all of the web app development scripts and assets. This might seem radical but does it make life more complex than using all those front-end tools we have become accustomed to?

A guide to making accessible anchor links for blog headings, with five iterations, screen-reader tips, and plugin automation.

A developer shares leaving React for web components, valuing platform APIs, control, and smaller replaceable dependencies over framework lock-in.

Media over QUIC: The long path to use something else for real-time media.