- depression, irritability, and altered moods or behaviors
- distraction and forgetfulness
- increased blood pressure

are the above symptoms of long-term exposure to (algorithmic-timeline) social media or lead poisoning

source: https://www.cdc.gov/niosh/lead/signs-symptoms/index.html

an AI video of shit being dumped on everything is a little on the nose

correction: apparently people care about it

wishing I had run a special fault-tolerance-edition of the 11ty leaderboards today

I believe the louvre thieves stole AWS

no — *you* are working on the archives page on your blog on friday night — not me

https://www.zachleat.com/web/

is there really no low-level mechanism to intercept boolean primitive coercion in JavaScript?

why can’t I extend `Boolean` to make `new MyBoolean(false)` be `falsy`? (I understand why it isn’t, but I want to make it so)

> Note: Unlike other type conversions like string coercion or number coercion, boolean coercion does not attempt to convert objects to primitives by calling user methods.

https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Boolean#boolean_coercion

folks migrating away from hosting providers that hadn’t previously considered how tightly coupled their web framework was to said host are about to learn some things — I’m sorry and I wish you the best on your journey

it has never been more clear that the good people of the web must work together

Reading the news and watching a real-world instance of “sends in a detachment of inexperienced riot police to the front lines of the protest” (Andor S02E08) play out in real time is *wild*

https://en.wikipedia.org/wiki/Who_Are_You%3F_(Andor)

oh, hello: https://github.com/e18e/action-dependency-diff (@e18e)

4 and a half horsetokens of the apocalypse

Really appreciate that GitHub is taking steps to lock down npm publishing workflows: https://github.blog/security/supply-chain-security/our-plan-for-a-more-secure-npm-supply-chain/

We have power and we should use it: keep voting with your wallet.

https://apnews.com/article/jimmy-kimmel-suspension-supporters-94b79634a19b2c4ce70a2b4195ef1175

Family LAN party playing 4-player StarCraft II with a bunch of old computers 😍

Bye bye, Disney+

trying not to read too much into microsoft.com using adobe experience manager

HTML Programmer.

—from the always lovely @piccalilli

@mwichary Thinking of you today as I heard the Robert Redford news — it’s always a good day to watch Sneakers

I could make an entire conference talk solely about Web-Server-On-A-Disposable-Vape and how it’s really a metaphor for the Great Divide

✅ an HTML web site hosted on a disposable vape
⛔️ a JavaScript-heavy web site that feels like its loading from a disposable vape

the big takeaway here — as noted in the article — is that react is too big to vape

https://bogdanthegeek.github.io/blog/projects/vapeserver/

Proactive security communication is a sign of a healthy community: https://github.com/rust-lang/crates.io/discussions/11889

via @fasterthanlime

@ricmac do not look this up but it is still live on his web site. He posted naked pictures of his family (including his underage kids? wtf??) on his web site as a “naked christmas card” — surprised he didn’t get in more trouble for it tbh. For as much conversation that goes into influencers posting stuff of their kids before they know what consent is, it’s wild to look back on this

Lovely to see the thought and care that’s gone into shipping the quote posts feature to Mastodon v4.5: https://blog.joinmastodon.org/2025/09/introducing-quote-posts/

via @Mastodon

paul rand memoji

we now go live to a hologram AI recreation of paul rand to hear his reanimated opinion on apple’s new liquid glass design framework

TIL `hyphens: auto` does not add hyphens for capitalized words (in English at least).

extraordinarily (wraps with hyphen)
Extraordinarily (no wrap no hyphen)

Adding `word-break: break-word` breaks the capitalized word, but still no hyphen 🤨

Demo (applies to Firefox and Chrome, working in Safari): https://codepen.io/zachleat/pen/myeYbJV

I do think the results of the above (even with a small sample) suggest that there is a big expectations mismatch in how security issues are communicated in the JavaScript ecosystem

It’s time to check in on the Anthropic CEO (Dario Amodei), who claimed (6 months ago) that 90% of code will be written by AI in 3–6 months.

https://www.businessinsider.com/anthropic-ceo-ai-90-percent-code-3-to-6-months-2025-3

via https://fediverse.zachleat.com/@zachleat/114180052700529071

it’s a cold day in XS-hell-T

When an active security vulnerability is in the wild, as an application developer would you rather:

whew, it’s been taken down a mere 5 hours after publish.

simple-swizzle@0.2.3 is *still* public, active, and in the wild. You can see the malicious code on the code browser: https://www.npmjs.com/package/simple-swizzle/v/0.2.3?activeTab=code

Edit: seeing folks boost this one still but editing to say that it’s been resolved

tag yourself I’m 180° rotated keyboard_arrow_down

I thought I was 6–20 until I counted: it was 34 😅

How many unique domains do y’all estimate you’ve purchased (all time, for yourself)?

took a long time, but I’ve finally retired the last of my “active” .io domains — a process I’ve wanted to finalize for *years.*

(11ty.io is still redirecting but very few folks use it any more, leaving room to hopefully disable it entirely https://www.11ty.dev/blog/moving-house/)

reminded of this one today, apropos of nothing

https://fediverse.zachleat.com/@zachleat/111862796531800739

For me this also highlights the incredible sleight of hand that can occur when a metric swaps from lab to field data.

We need better web performance metrics.

Intuitively, these charts might tempt you to compare these hosts, making assumptions about the investment each of these services put into their server infrastructure — but that wouldn’t be the whole story.

Knowing that TTFB is both server AND client-dependent (including times for Service Worker init, DNS, TLS), this graph might instead represent how wealthy each service’s audience is.

Looks like the above was last updated in November 2024 but links to the HTTP Archive Tech Report for newer data: https://httparchive.org/reports/techreport/tech?good-cwv-over-time=TTFB&tech=Hostinger,SiteGround,WP+Engine,Shopify,GoDaddy+Website+Builder,Framer+Sites,GitHub+Pages,Squarespace,Vercel,Netlify,Seravo,Weebly,Pantheon,Fly.io,Kinsta&geo=ALL&rank=ALL#comparison-good-cwvs

Here’s a screenshot from 01 July 2025: