The secure way to release an npm package in 2026. Andrey Sitnik frames it as raising attackers’ costs: npm Trusted and Staged Publishing, org-wide 2FA, CI actions pinned to SHA, and a 3-day dependency cooldown. #npm #security evilmartians.com/chr...
Valentino Gagliardi
@valentinog.com
Trainer & Tech Lead | I train teams on sustainable coding and modernize your architecture | +2000h Training and Mentoring | Author at Apress & Manning | DSF Member
Update: Google just sent me a statement saying it is “rolling back” this AI feature that let anyone make completely bullshit satellite images. Comes after our demos of the tool and those from OSINT researchers. One of the worst AI tools I’ve ever seen bsky.app/profile/jose...
Joseph Cox@josephcox.bsky.social · 5d agoNew from 404 Media: Google Earth has introduced an AI feature that lets anyone fabricate completely bullshit satellite images. In our own tests, we added a “bomb blast and crater” to an area of Los Angeles. This is a misinformation time bomb, will 100% be abused www.404media.co/google-earth...
The AI Productivity Paradox "We’ve been writing a lot lately about product teams that are clearly leveraging AI to deliver faster, yet their outcomes are not improving." www.svpg.com/the-ai-produ...
The AI Productivity Paradox | Silicon Valley Product Group
A partnership dedicated to teaching best practices to product teams and product leaders
svpg.com
Hacker wipes Romania's entire land registry database risky.biz/risky-bullet...
Risky Bulletin: Hacker wipes Romania's entire land registry database - Risky Business Media
A hacker has breached Romania's cadastre agency and wiped the country's entire land registry database following a failed extortion attempt [Read More]
risky.biz
In defense of polyfills. @lea.verou.me pushes back on the idea that polyfills harm the web. The need for fallbacks stays regardless, and the real fix is a faster standards process, not banning a useful tool. #polyfill #tools lea.verou.me/blog/20...
Write Custom Extensions for htmx to Make it Your Own Personal Toolkit thathtml.blog/2025/11/htmx...
Write Custom Extensions for htmx to Make it Your Own Personal Toolkit
Why didn’t anyone tell me about this sooner??
thathtml.blog
ChatGPT generated this webapp, and I’m sure actual software engineers can probably see 15 things that are wrong right away, but I’m not gonna lie I kinda want to ship it…
Sacha Greif@sachagreif.com · last mo.ChatGPT generated this building render, and I’m sure actual architects can probably see 15 things that are wrong right away, but I’m not gonna lie I kinda want to live there…
The website specification. @joost.blog published a platform-agnostic reference of technical features a quality website should have, covering HTML, SEO, accessibility, security, performance, internationalization, and agent readiness. #html #a11y specification.website
The end of responsive images piccalil.li/blog/the-end... #html #webplatform
The end of responsive images
Mat Marquis has waited 14 years to write this article. The sizes attribute has been a necessary evil but now, with an auto value capability, it’s completely transformed authoring responsive images on ...
piccalil.li
Textual – An Intro to DOM Queries blog.pythonlibrary.org/2026/04/17/t... #python
Textual - An Intro to DOM Queries (Part I) - Mouse Vs Python
In this article, you will learn how to query the DOM in Textual. You will discover that the DOM keeps track of all the widgets in your application. By running queries against the DOM, you can find wid...
blog.pythonlibrary.org
📬 Check own properties safely with Object.hasOwn() A safer alternative to hasOwnProperty, works even on objects with a null prototype. Baseline since 2022 ✅ Learn more 👇 developer.mozilla.org/en-US/docs/...
From React to native web with nanotags: a migration that saved 100 KB. Pavel Grinchenko replaced React and Ark UI with native Web Components and a 2.5 KB wrapper, nanotags, cutting 100 KB of JavaScript. #webcomponents #react evilmartians.com/chr...
The frustration is people building non-deterministic tools that they claim can replace deterministic systems — but everybody ignores the greater cost and inaccuracies, because the dashboard demands it. A variant of getting someone to understand a thing when their salary depends on them not.
Hidde@hidde.blog · 3mo agoI've now heard many examples of companies that actively make AI token usage part of perf reviews. In some, you could perform otherwise perfectly, but fail to get promoted without token usage. So people are building systems just for the sole purpose of burning tokens. Normal or utter bollocks?
Squarespace & Web Standards: How We Helped Bring HTML Video & Audio Lazy Loading to Today’s Browsers engineering.squarespace.com/blog/2026/sq...
Squarespace & Web Standards: How We Helped Bring HTML Video & Audio Lazy Loading to Today’s Browsers — Squarespace Engineering Blog
At Squarespace, many of our core products are built on web standards, and our engineers are constantly pushing the boundaries of the web’s capabilities. Occasionally, those boundaries reveal a limitat...
engineering.squarespace.com
Progressive web components. Ariel Salminen introduces Elena, a 2.6 kB library for building web components that prioritize HTML and CSS, then hydrate with JavaScript. #webcomponents #js arielsalminen.com/20...
Under the hood of MDN’s new frontend. @leo.mca.is explains how MDN replaced React with web components and Lit, using server components for static content and lazy-loading interactive islands. #mdn #webcomponents developer.mozilla.or...
Ordering flex items developer.mozilla.org/en-US/docs/W...
Ordering flex items - CSS | MDN
Layout methods such as flexbox and grid enable controlling the order of content. In this article, we will take a look at ways in which you can change the visual order of your content when using flexbo...
developer.mozilla.org
What is CSS containment and how can I use it? Harry Roberts covers each contain value, the content and strict shorthands, and content-visibility. Includes a real OpenTable case where containment cut layout time sixfold. #css #performance csswizardry.com/2026...
Automated Accessible Text With “contrast-color()”, by @una@front-end.social: https://una.im/contrast-color #css #functions #colors #contrast #accessibility
una.im | Automated accessible text with contrast-color()
Let the browser pick the most readable text color for any background with this new CSS function.
una.im
Anthropic using regex instead of their actual *language model* to detect negative sentiment in prompts.
jonny (good kind) (@jonny@neuromatch.social)
Attached: 1 image from @sushee@ohai.social [over here](https://ohai.social/@sushee/116325702070975973), (can't attach images in quotes) and apparently discussed on HN so i'm late, but... They REALLY...
neuromatch.social
🚨 Active supply chain attack on axios@1.14.1. The latest version pulls in plain-crypto-js@4.2.1 -- a brand-new package that didn't exist before today. We're still investigating. If you use axios, pin your version and audit your lockfile. socket.dev/blog/axios-n...
Supply Chain Attack on Axios Pulls Malicious Dependency from...
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHu...
socket.dev
Detail: Small Interface Details That Make Big Difference - https://detail.design (Curated collection of tiny design decisions from real products. Good inspiration resource.)
Detail · Where craft lives
A curated study of the tiny design decisions that make products feel exceptional in AI era. For designers and engineers who believe the small things can make big difference.
detail.design
Today I published the second update of this month to the Practical Accessibility course content. I have at least two or three more updates coming this April. As I promised, I want to keep the course as up-to-date and as relevant to your work as possible. Get access @ practical-accessibility.today
The Practical Accessibility Course
A get-right-down-to-it online course for Web designers and developers who want to start creating more accessible Web user interfaces and digital products today
practical-accessibility.today
If you give an LLM full access over your primary computer, I'd love to study your brain. apple.news/Ay19QSmUuRTO...
Anthropic's Claude Can Now Control Your Computer — CNET
The developer is boosting Claude's agentic capabilities in an apparent effort to compete with platforms like OpenClaw.
apple.news