Mastodon

It’s a little frustrating that GitHub Discussions don’t automatically link back when mentioned (like Issues do)

(…or show any activity like when a Discussion title is renamed)

haven’t been in the 200’s on Eleventy Core in *awhile*

no one move, I want to just sit with this for a bit 😅

sometimes I post something that’s earnest which I know is very confusing

my wife and two kids are still enjoying starcraft and it genuinely feels like I’ve won the lottery 🤑

we won a 2v2 against Very Hard bots yesterday — slowly improving my APM (at 40 right now)

#Blessed

The Ruby ecosystem is going through some pretty hefty turmoil in an attempt to rescue and restore the integrity of their community.

I’m even seeing some good efforts in PHP-land to better distance itself from the vacuum of stable leadership in WordPress too.

Is there any such movement in JavaScript (the same problems exist)? The biggest pattern I’m seeing is a *huge* centralization in project funding!

Reading along to https://blogs.gnome.org/alatiera/2025/11/06/dhh-and-omarchy-midlife-crisis/ and this quote really resonated:

“Is it any surprise that such a person later would find the most minuscule kind of opposition as an all-out attack on his self-image?”

You can tell a *lot* about a software community by how it handles criticism.

as “industry” survey season rolls around again it’s important to remember that the results from these things reflect the biases of the most popular dev communities that promote them (and then we get to all pretend like the results are meritocratic)

I now believe it’s better to not participate at all

my son and I were matching for halloween this year

Thinking about dark/light mode pickers that have three options: Auto/Dark/Light.

If the default is “Auto” — in what scenario might someone want to move away from Auto (which would visually be a noop to the same theme?)

I’m using Light mode as my system preference, but it seems unlikely that I would swap from Auto (Light mode) to Light mode (not Auto) on a specific site

maybe the API could use this web site https://whoisinspace.com/

my privacy settings are that I’m fine with a geolocation API but it should only return a boolean that reveals whether or not I’m on planet earth

look, my conscious brain *knows* that the death of google reader and the death of XSLT are unrelated…

…but my subconscious brain has questions

that a completely freeform chat interface might be more usable than your web site isn’t much more than an indictment of your web site

here are two of the cats (allegedly this is all of them)

the thing they don’t tell you about having two cats that look very similar is the implausible but persistent suspicion that you may actually have three cats that look very similar

TIL that CSS attr() cannot be used to compute anything in `url()` as the spec considers these to be “attr()-tainted” (for very valid security reasons): https://drafts.csswg.org/css-values-5/#attr-security

Thought maybe there was a way forward for global custom CSS-only favicons via new advancements in attr() https://developer.chrome.com/blog/advanced-attr (but alas, no — which, in hindsight — seems valid and fair)

do y’all think cloudflare socks would be too on the nose or…

Huh, this piece of the WordPress drama was new to me: https://wordpressenginetracker.com/

How did WordPress get a list of all of the domains hosted with WPEngine? and is this count starting with a static list or is it populating with new WPEngine customers?

HMM

https://www.youtube.com/watch?v=hE-yXDsmaKQ from https://www.jordansmartmusic.com/

- depression, irritability, and altered moods or behaviors
- distraction and forgetfulness
- increased blood pressure

are the above symptoms of long-term exposure to (algorithmic-timeline) social media or lead poisoning

source: https://www.cdc.gov/niosh/lead/signs-symptoms/index.html

an AI video of shit being dumped on everything is a little on the nose

correction: apparently people care about it

wishing I had run a special fault-tolerance-edition of the 11ty leaderboards today

I believe the louvre thieves stole AWS

no — *you* are working on the archives page on your blog on friday night — not me

https://www.zachleat.com/web/

is there really no low-level mechanism to intercept boolean primitive coercion in JavaScript?

why can’t I extend `Boolean` to make `new MyBoolean(false)` be `falsy`? (I understand why it isn’t, but I want to make it so)

> Note: Unlike other type conversions like string coercion or number coercion, boolean coercion does not attempt to convert objects to primitives by calling user methods.

https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Boolean#boolean_coercion

folks migrating away from hosting providers that hadn’t previously considered how tightly coupled their web framework was to said host are about to learn some things — I’m sorry and I wish you the best on your journey

it has never been more clear that the good people of the web must work together

Reading the news and watching a real-world instance of “sends in a detachment of inexperienced riot police to the front lines of the protest” (Andor S02E08) play out in real time is *wild*

https://en.wikipedia.org/wiki/Who_Are_You%3F_(Andor)

oh, hello: https://github.com/e18e/action-dependency-diff (@e18e)

4 and a half horsetokens of the apocalypse

Really appreciate that GitHub is taking steps to lock down npm publishing workflows: https://github.blog/security/supply-chain-security/our-plan-for-a-more-secure-npm-supply-chain/

We have power and we should use it: keep voting with your wallet.

https://apnews.com/article/jimmy-kimmel-suspension-supporters-94b79634a19b2c4ce70a2b4195ef1175

Family LAN party playing 4-player StarCraft II with a bunch of old computers 😍

Bye bye, Disney+

trying not to read too much into microsoft.com using adobe experience manager

HTML Programmer.

—from the always lovely @piccalilli

@mwichary Thinking of you today as I heard the Robert Redford news — it’s always a good day to watch Sneakers

I could make an entire conference talk solely about Web-Server-On-A-Disposable-Vape and how it’s really a metaphor for the Great Divide

✅ an HTML web site hosted on a disposable vape
⛔️ a JavaScript-heavy web site that feels like its loading from a disposable vape

the big takeaway here — as noted in the article — is that react is too big to vape

https://bogdanthegeek.github.io/blog/projects/vapeserver/

Proactive security communication is a sign of a healthy community: https://github.com/rust-lang/crates.io/discussions/11889

via @fasterthanlime

@ricmac do not look this up but it is still live on his web site. He posted naked pictures of his family (including his underage kids? wtf??) on his web site as a “naked christmas card” — surprised he didn’t get in more trouble for it tbh. For as much conversation that goes into influencers posting stuff of their kids before they know what consent is, it’s wild to look back on this

Lovely to see the thought and care that’s gone into shipping the quote posts feature to Mastodon v4.5: https://blog.joinmastodon.org/2025/09/introducing-quote-posts/

via @Mastodon

paul rand memoji

we now go live to a hologram AI recreation of paul rand to hear his reanimated opinion on apple’s new liquid glass design framework

TIL `hyphens: auto` does not add hyphens for capitalized words (in English at least).

extraordinarily (wraps with hyphen)
Extraordinarily (no wrap no hyphen)

Adding `word-break: break-word` breaks the capitalized word, but still no hyphen 🤨

Demo (applies to Firefox and Chrome, working in Safari): https://codepen.io/zachleat/pen/myeYbJV

I do think the results of the above (even with a small sample) suggest that there is a big expectations mismatch in how security issues are communicated in the JavaScript ecosystem

It’s time to check in on the Anthropic CEO (Dario Amodei), who claimed (6 months ago) that 90% of code will be written by AI in 3–6 months.

https://www.businessinsider.com/anthropic-ceo-ai-90-percent-code-3-to-6-months-2025-3

via https://fediverse.zachleat.com/@zachleat/114180052700529071

it’s a cold day in XS-hell-T

When an active security vulnerability is in the wild, as an application developer would you rather:

whew, it’s been taken down a mere 5 hours after publish.

simple-swizzle@0.2.3 is *still* public, active, and in the wild. You can see the malicious code on the code browser: https://www.npmjs.com/package/simple-swizzle/v/0.2.3?activeTab=code

Edit: seeing folks boost this one still but editing to say that it’s been resolved