Dan Holloran
@grimicorn.bsky.social
Senior Full Stack Developer with 14+ years building performant, scalable web applications. Passionate about architecture, mentorship, and finding the right tool
Obsidian's search box hides a real query language. file:, path:, line:, block:, section:, task: and property: operators replace plugins you may not need. 🔗 danholloran.me/posts/obsidi... #obsidian #pkm
Obsidian Search Operators: Find Anything Without a Plugin
Obsidian's core Search has a real query language hiding behind the search box. Here's how file, path, line, block, section, task, and property operators replace half the plugins people install to find...
danholloran.me
Trusted Types is Baseline as of Feb 2026. Turn it on and any raw string passed to innerHTML throws a TypeError — your DOM XSS surface shrinks to the lines in your policies. 🔗 danholloran.me/posts/truste... #webdev
Trusted Types Is Baseline: DOM XSS Is Now a Type Error
Firefox 148 shipped Trusted Types in February 2026, making it Baseline. Here's how to turn every dangerous innerHTML assignment in your app into a TypeError you can actually catch.
danholloran.me
Long Tasks told you a task ran 210ms and blamed "self". The Long Animation Frames API names the script, the function, and the character offset that stalled the frame. 🔗 danholloran.me/posts/long-a... #webdev #performance
The Long Animation Frames API: Find What Actually Broke Your INP
Your field data says INP is 400ms. Your local profile says everything is fine. The Long Animation Frames API closes that gap by naming the script, the function, and the character position that stalled...
danholloran.me
The document-plus-selfie onboarding flow every fintech copied is quietly failing. Injection attacks broke it, and the replacement is layered rather than a single check. 🔗 danholloran.me/posts/kyc-in... #fintech #fraud
KYC in the Deepfake Era: Why a Selfie Stopped Being Proof
The document-plus-selfie onboarding flow every fintech copied is quietly failing. Here is how identity verification actually works, why injection attacks broke it, and what the layered replacement loo...
danholloran.me
Whole-note embeds are the easy part. Block references are where Obsidian transclusion actually pays off, and where one misplaced caret silently breaks everything. 🔗 danholloran.me/posts/obsidi... #obsidian #pkm
Obsidian Block Embeds: Stop Copy-Pasting Your Own Notes
Whole-note embeds are the easy part. Block references are where transclusion in Obsidian actually pays off, and where one misplaced caret silently breaks everything.
danholloran.me
Disabling introspection isn't security. Trusted documents let your server run only the operations your own devs wrote. 🔗 danholloran.me/posts/graphq... #graphql #typescript
GraphQL Trusted Documents: Stop Letting Strangers Write Your Queries
Disabling introspection is not security. Trusted documents let your server execute only the operations your own developers wrote, and you probably already have the tooling for it.
danholloran.me
Twelve words on paper used to be the whole story of self-custody. Passkeys, MPC, and smart accounts changed what that phrase actually protects. 🔗 danholloran.me/posts/self-c... #crypto #selfcustody
Self-Custody in 2026: The Seed Phrase Is No Longer the Only Way
Twelve words on a piece of paper used to be the whole story of crypto self-custody. Passkeys, MPC, and smart accounts have quietly changed what that phrase actually protects.
danholloran.me
Dataview code blocks give you tables. Inline queries give you one live value in the middle of a sentence, which turns out to be the one you reach for far more often. 🔗 danholloran.me/posts/inline... #obsidian #pkm
Inline Dataview Queries: Live Numbers Inside Your Notes
Dataview code blocks give you tables. Inline queries give you a single live value in the middle of a sentence, which turns out to be the feature you reach for far more often.
danholloran.me
contrast-color() is Baseline now. Hand it a background color, get back black or white, whichever contrasts better. No luminance math, no build step. 🔗 danholloran.me/posts/css-co... #css #webdev #a11y
CSS contrast-color(): Let the Browser Pick Your Text Color
The contrast-color() function went Baseline in April 2026 and kills the luminance-math helper every design system eventually writes. Here is how it works, the mid-tone problem nobody warns you about, ...
danholloran.me
The browser can strip XSS while it parses now. setHTML() covers most of what you've been shipping DOMPurify for. 🔗 danholloran.me/posts/the-sa... #webdev #javascript
The Sanitizer API: Safe HTML Injection Without DOMPurify
The browser can now strip XSS from an HTML string during parsing. Here's how setHTML works, why its config can only narrow the allowlist, and how to ship it before Safari catches up.
danholloran.me
Your money app probably isn't a bank. A sponsor bank holds the deposits, the fintech keeps the ledger, and that gap is what broke when Synapse collapsed. 🔗 danholloran.me/posts/neoban...
Every Obsidian plugin you install can read every file on your machine. The new safety scorecards help, but here's how to audit what's already in your vault. 🔗 danholloran.me/posts/your-o... #obsidian
Your Obsidian Plugin List Is a Supply Chain
Obsidian's 2026 Community directory added automated scans and safety scorecards for every plugin version. Here's what that changes, and how to actually audit the plugins already sitting in your vault.
danholloran.me
Laravel 13 moves middleware, authorization, and queue retry config into PHP attributes that sit above the code they configure. 🔗 danholloran.me/posts/larave... #laravel #php
Laravel 13 PHP Attributes: Config That Lives With Your Code
Laravel 13 expands first-party PHP attributes across controllers, authorization, and queued jobs. Here is what actually changed, and where attributes are still the wrong tool.
danholloran.me
The headline EPS is the number the company chose to print. The reconciliation table, the cash flow statement, and the guidance are where the real information sits. 🔗 danholloran.me/posts/how-to... #investing #stocks
How to Read an Earnings Report Without Trusting the Headline
The number at the top of an earnings press release is the number the company chose to put there. Here is where the actual information lives: the reconciliation table, the cash flow statement, and the ...
danholloran.me
QuickAdd makes Obsidian keyboard-driven: Captures append to a file you aren't in, Templates prompt for input, and Macros chain the whole thing. 🔗 danholloran.me/posts/obsidi... #obsidian #pkm
Obsidian QuickAdd: Capture, Templates, and Macros Without Leaving Your Keyboard
QuickAdd turns Obsidian into a keyboard-driven capture machine. Here is how its Captures, Templates, and Macros actually work, with copy-paste examples.
danholloran.me
Staggered animations without a wall of :nth-child rules. sibling-index() and sibling-count() turn position into a number for calc(). 🔗 danholloran.me/posts/css-si... #css #webdev
CSS sibling-index() and sibling-count(): Native Staggering Without nth-child Hacks
CSS sibling-index() and sibling-count() turn an element's position into a number you can drop into calc(), replacing walls of nth-child rules and inline JavaScript for staggered animations and math-dr...
danholloran.me
height: auto finally animates in CSS. interpolate-size + calc-size() replace the old JS measuring and max-height hacks with a one-line opt-in. 🔗 danholloran.me/posts/animat... #webdev #css
Animate to height: auto in CSS with interpolate-size and calc-size()
Transitioning an element to height: auto used to mean JavaScript measurements or fragile max-height hacks. interpolate-size and calc-size() finally make it a one-line CSS opt-in.
danholloran.me
Investing a windfall all at once beats easing it in about two-thirds of the time. Here's what the research actually says about lump-sum vs. dollar-cost averaging. 🔗 danholloran.me/posts/dollar... #investing #finance
Dollar-Cost Averaging vs. Lump-Sum: What the Data Actually Says
Investing a windfall all at once beats easing it in about two-thirds of the time. Here is what the research actually says, and when dollar-cost averaging still makes sense.
danholloran.me
An Obsidian theme isn't a specificity fight. The UI is painted from named CSS variables you just override. A real theme that respects light and dark mode, no cascade wrestling. 🔗 danholloran.me/posts/buildi... #obsidian #pkm
Building an Obsidian Theme: A Practical Guide to CSS Variables
You do not need to fight cascade specificity to restyle Obsidian. Override a handful of CSS variables and you have a real theme that respects light and dark mode.
danholloran.me
Iterator helpers bring map, filter, take, and drop to any iterator, no array spread needed. Baseline since 2025. 🔗 danholloran.me/posts/javasc... #javascript #webdev
JavaScript Iterator Helpers: Stop Converting to Arrays First
Iterator helpers bring map, filter, take, and drop to any iterator without spreading into an array first. They went Baseline in 2025, and they change how you handle Maps, Sets, and generators.
danholloran.me
Staking yield isn't bank interest. You're posting collateral to secure a proof-of-stake chain, and slashing is the price of doing that job badly. 🔗 danholloran.me/posts/how-st... #ethereum #crypto
How Staking Actually Works: Validators, Rewards, and Slashing
A plain-English look at what happens under the hood when you stake crypto: how validators secure a proof-of-stake network, where the yield comes from, and what slashing really risks.
danholloran.me
Obsidian's official Web Clipper drops any page into your vault as clean Markdown — local, no account. The template engine underneath is the real draw. 🔗 danholloran.me/posts/obsidi... #obsidian #pkm
Obsidian Web Clipper: Clip the Web Straight Into Your Vault
The official Obsidian Web Clipper turns any web page into a clean, templated vault note. Here's how its templates, variables, and filters actually work.
danholloran.me
CSS finally has a parent selector. :has() is Baseline in 2026 and fast enough to delete the class-toggling JS you wrote to work around it — parent styling, sibling reactions, quantity queries. 🔗 danholloran.me/posts/css-ha... #css #webdev
CSS :has() in Practice: The Parent Selector You Can Finally Ship
The :has() selector is Baseline and fast in 2026. Here's how to use it for parent styling, sibling reactions, and quantity queries without reaching for JavaScript.
danholloran.me
CSS finally has real, reusable functions. The new @function at-rule lets you define helpers that run in the browser with live custom-property values. 🔗 danholloran.me/posts/css-fu... #webdev #css
CSS @function: Reusable Logic Comes Native to the Browser
CSS finally has real, reusable functions. The new @function at-rule lets you define typed helpers that run in the browser with live values — here is how it works and where it is supported today.
danholloran.me
That budgeting app pulling your transactions is shifting from screen scraping to OAuth: your bank hands it a scoped, revocable token instead of your password. 🔗 danholloran.me/posts/open-b... #fintech #openbanking
Open Banking: How Apps Actually Get Your Bank Data
The mechanics behind connecting a budgeting app to your bank account, why screen scraping is dying, and where the US open banking rules stand in 2026.
danholloran.me
Obsidian mobile isn't underpowered, it's under-configured. The toolbar above the keyboard is a reorderable command palette, and a pull-down can fire your capture template. 🔗 danholloran.me/posts/obsidi... #obsidian #pkm
Obsidian on Mobile: Stop Fighting the Toolbar
Most people give up on Obsidian mobile because the defaults don't match how they actually capture notes. The fix isn't plugins — it's ten minutes in the Mobile settings.
danholloran.me
Your SPA's Core Web Vitals only describe the first page load. Chrome 151 ships the Soft Navigations API unflagged: LCP, INP, and CLS per route change. 🔗 danholloran.me/posts/soft-n... #webdev #performance
The Soft Navigations API: Core Web Vitals Finally Work in SPAs
Chrome ships the Soft Navigations API unflagged in 151, giving single-page apps a standardized way to measure LCP, INP, and CLS per route change instead of only on the first load.
danholloran.me
Tax-loss harvesting isn't free money — it's mostly a deferral. The netting order is fixed, and the wash sale rule is wider than most people expect. 🔗 danholloran.me/posts/tax-lo... #investing #taxes
Tax-Loss Harvesting: How Selling at a Loss Actually Works
Tax-loss harvesting turns a losing position into a deduction, but the mechanics are fussier than the pitch suggests. Here's how the netting order, the wash sale rule, and the cost-basis catch actually...
danholloran.me
Your vault is just a folder of Markdown, so syncing feels solved. It isn't — not once mobile and plugins enter the picture. 🔗 danholloran.me/posts/obsidi... #obsidian #pkm
Obsidian Sync vs. Git vs. iCloud: Choosing a Vault Sync Strategy
Your vault is just a folder of Markdown, which makes syncing it feel like a solved problem. It isn't. Here's how Obsidian Sync, Git, and iCloud actually behave once mobile and plugins enter the pictur...
danholloran.me
Shadow DOM used to mean a blank page until your bundle loaded. shadowrootmode fixed that — web components that render before any JavaScript runs. 🔗 danholloran.me/posts/declar... #webdev #webcomponents
Declarative Shadow DOM: Web Components That Render Before Your JavaScript Does
Shadow DOM used to mean a blank page until your bundle loaded. The shadowrootmode attribute changed that, and it has been in every major browser since early 2024.
danholloran.me