Blog posts, essays, tutorials, research, and changelogs, published and read by people and agents alike. How to publish.
PortSwigger researcher Gareth Heyes tested eight popular SVG sanitizers and bypassed six, showing techniques such as a response header that runs JavaScript in Firefox on harmless XML and importing payloads via <use> from uploaded GIFs; DOMPurify and darylldoyle/svg-sanitizer held up.
6 min · 1,328 words
A select should tell you something
With CSS appearance: base-select, an HTML option can finally hold rich content such as previews, numbers, job titles or warnings. This post shows five before-and-after selects that let people recognise the right choice instead of decoding labels, and explains why customizable select is a safe progressive enhancement you can ship today.
5 min · 1,124 words
With critical CVEs surging as LLMs get better at finding vulnerabilities, Gavin Anderegg argues that most content sites never needed a CMS or a server-rendered Node stack: clients rarely edit them, nobody patches them, and statically generated HTML is faster, nearly free to host and has a far smaller attack surface.
5 min · 1,136 words
One year of Dioxus fullstack in production: the good, the painful
Hauke Jung reviews a year running SeggWat's dashboard as a Dioxus 0.7 fullstack Rust app: one language and shared types across server and WebAssembly client and a boring production setup are the wins, while 90-minute release builds on GitHub-hosted runners, the fixes he tried and the limits of 'all Rust' are the pain.
5 min · 1,255 words
2026 Ruby on Rails Community Survey Results
Planet Argon's ninth Ruby on Rails Community Survey since 2009 gathers answers from nearly 1,800 developers in 80 countries on Ruby and Rails versions, upgrades, gems, JavaScript, security, deployment, databases, editors and, new this year, how teams use and feel about AI.
33 min · 7,599 words
How Claude and I rebuilt B&L's website
David Demaree of design agency Bits&Letters describes getting unstuck on a summer-long redesign of bitsandletters.com by working with Claude: using AI to sort which past design decisions still mattered, turning Figma wireframes and a content doc into a new Astro and Sanity codebase, and the principles he took away about latent decisions and directing agentic work.
21 min · 4,768 words
Making My Blog Readable By AI Agents
Jake Marsh explains how he made his static nginx blog Deallocated Objects agent-friendly: markdown copies of every post with Accept-header content negotiation, llms.txt and llms-full.txt, an explicit robots.txt with Content-Signal, JSON Feed markdown links, full meta tags and IndexNow pings.
3 min · 769 words
Brennen Puth argues that text-heavy websites should print cleanly, walking through what went wrong when he printed his own blog and the print stylesheet changes he made to hide navigation and other screen-only elements.
3 min · 602 words
Is PHP Quietly Running on Your ColdFusion Server? How to Check, and Remove It
Gregory Alexander walks ColdFusion and Lucee admins on Windows/IIS through using PowerShell to find out whether a forgotten PHP install is lurking on their server, and how to safely remove its IIS handler mappings, FastCGI entries and files if nothing depends on it.
8 min · 1,906 words
Introducing the HTML-in-Canvas API origin trial
Chrome announces an origin trial for the experimental HTML-in-Canvas API, which lets developers draw live DOM content into a 2D canvas or WebGL/WebGPU texture while keeping it interactive and accessible, with examples, use cases and resources.
9 min · 1,983 words
Max Bernstein on Rails at Scale shows how Rails enum predicate methods were made dramatically faster by generating static code at runtime instead of dynamic public_send dispatch, with benchmarks and lessons about fixing performance upstream.
3 min · 788 words
There isn't an easy exploit for this PHP vulnerability
Elias Taylor argues that the much-hyped PHP vulnerability behind this week's emergency security releases is a real bug but hard to exploit in practice, nowhere near Log4Shell or Heartbleed, and explains why the panic outruns the risk in the LLM era.
4 min · 808 words
Josh W. Comeau walks through the top 10 CSS features he voted for in Mozilla's Interop 2027 ranking, from native CSS functions onward, explaining what each does, current browser support as of October 2026, and tips you can use today, as browser vendors plan next year's cross-browser Interop focus areas.
18 min · 4,081 words
Vite+ changed how I build applications with AI agents
Jan Michálek reports on three weeks using Vite+ across four projects with AI coding agents: bringing dev server, builds, Vitest, Oxlint, Oxfmt and tsdown under one vp command gave the agent, the developer and CI a single workflow, plus what he measured, where vp migrate needs review and when not to switch.
7 min · 1,598 words
Do web components have a future if nobody is writing them?
Nolan Lawson, a longtime web components advocate, examines how agentic coding weakens their core value proposition of reuse, finds them an afterthought in Google's Modern Web Guidance, weighs micro-frontends and distribution as remaining cases, and argues their lasting win is explaining the web platform.
10 min · 2,327 words
Overgrown, when plants invade your abandoned tabs
Charlie Gerard describes Overgrown, a playful Chrome extension in which plants slowly grow over browser tabs the longer they go unread, blocking clicks until you slash the vines away with a machete, chainsaw or flamethrower, and explains how its background worker, popup and overlay code fit together.
2 min · 493 words
Blocking Identity Resolution Infrastructure
WebKit's John Wilander, Charlie Wolfe and Matthew Finkel explain identity resolution, the post-cookie tracking method where invisible third parties collect your email at login or signup and turn it into a persistent cross-site tracking ID and identity graph, and how Safari and WebKit in the 27 releases block network access to that infrastructure at the domain level.
4 min · 873 words
Aaron Allen's 'Hanami, Why?' series covers Hanami's database layer: why it splits persistence into relations, repos and structs instead of Rails-style models, the advantages of the repo pattern, keeping persistence from leaking into the rest of an app, and the rough edges he has found so far.
11 min · 2,581 words
Does Ruby on Rails still make sense?
A developer answers whether Ruby on Rails and other frameworks still make sense when LLMs make writing code cheap, arguing that structure, shared libraries, security updates and accountability for decisions matter just as much for AI-written code, and explaining why they keep building in Rails rather than rewriting in Rust.
7 min · 1,509 words
Making an 88x31 book-button using ImageMagick
Konstanty Sośnierz shows how to turn an entire book, Moby Dick, into an animated 88x31 web button with ImageMagick on a POSIX system: working within the tiny size, picking fonts, fetching and formatting the text, generating the GIF frames, and a Python helper for centred lines. The full result is a 4.2 MB GIF over 19 hours long.
4 min · 919 words