@jakearchibald.com As you know everything about CSS (weird stuff, and in development)… is there a way for a (blocking) style sheet to apply rules (e.g. display none) only until DOMContentLoaded; so a <script defer> can avoid FOUC, fail safe (if it fails to load), and work with a no-inline CSP?

Who thought it would be a good idea to use the Emergency Alert to say people in the UK shouldn’t have a BBQ?

Blink: Intent to Ship: Responsively-sized <iframe>

@sarasoueidan.com hi, wondered if you have thoughts on CSS “prefers-reduced-motion: reduce”… I’ve got a checkbox, when ticked it shows more content, should I continue to animate height (show it appearing, within 0.5 seconds) or simply change from display none to block (might be disorientating?)

The Sanitizer API landed in Firefox 148, along with element.setHTML(). This lets you fully configure how HTML strings are cleaned as they're parsed. hacks.mozilla.org/2026/02/good...

Goodbye innerHTML, Hello setHTML: Stronger XSS Protection in Firefox 148 – Mozilla Hacks - the Web developer blog

Cross-site scripting (XSS) remains one of the most prevalent vulnerabilities on the web. The new standardized Sanitizer API provides a straightforward way for web developers to sanitize untrusted…

hacks.mozilla.org

Petition: “By-elections to be called automatically when MPs defect to another party” Response: “no plans to change […] voters elect individual candidates, and not the political party they represent” If true, then remove the party from the ballot paper!

New blog post: Why the Sanitizer API is just `setHTML()` - https://frederikbraun.de/why-sethtml.html

📡 OWASP Secure Headers Project: Over the years, we have compiled a collection of HTTP response headers that disclose technical information. We are continuing our research to find new ones on our own, but we have decided to ask our community for help in finding new ones. #appsec #owasp_shp

Why do I keep seeing the words “Cable Street”? Seems to be random, maybe I’m noticing it because it’s in one of my favorite books (Night Watch, by Terry Pratchett). en.wikipedia.org/wiki/Battle_...

Could we put all the racists on their own island, so they can make their own country to be “proud” of?

Are you safe from injection vulnerabilities? Even using abstraction layers like Doctrine or parameterised queries mistakes can still happen. @craigfrancis.bsky.social shows us how mistakes can be made and what can be done to mitigate them. Buy your ticket here: https://buff.ly/40Ck2WR #phpuk

XSS vulnerabilities keeping you up at night? 😱 Google's new "Commitment to Secure by Design" whitepaper has answers! Safe Coding and web platform improvements are key. Read more (page 7): static.googleusercontent.com/media/public...

SQL Injection still exists despite abstractions like ORMs, QueryBuilders, & Parameterised Queries; simply because it’s easy to make mistakes (especially for new developers). Programming languages could find/stop these mistakes by identifying “trusted developer defined strings”: eiv.dev