Mathis Hofer

Does widespread browser implementation of the Sec-Fetch-Site HTTP header mean we can protect against CSRF attacks without needing those hidden form tokens? It looks like the answer may be a cautious "yes"! simonwillison.net/2025/Oct/15/...

Lit is Joining the OpenJS Foundation! Lit is officially joining the OpenJS Foundation as an Impact Project!

Lit is joining @openjsf.org! 🎉

Today at JSConf, The OpenJS Foundation announced Lit is officially joining as an Impact Project!

We're beyond excited for this move and look forward to continuing our work to build the open web with OpenJS!

Read more on our blog: lit.dev/blog/2025-10...

The Pitfalls of Streamed ZIP Decompression: An In-Depth Analysis Wikipedia says it clearly: "Tools that correctly read ZIP archives ... must not scan for entries from...

I didn't know that streamed decompression of ZIP files isn't actually possible. But streamed compression is totally fine though. This is an interesting article explaining why:

dev.to/pavel-zeman/...

Slide showing the nitro docks and „ship full stack Vite apps“

Heck yeah! The @nitro.build v3 beta is out now. And Nitro is now just a @vite.dev plugin 👀

Kudos to all contributors, @unjs.io, and @pi0.io 🙌🏻

#emacs ACP reporting for duty 🫡

xenodium.com/introducing-...

Dr. Jane Goodall filmed an interview with Netflix in March 2025 that she understood would only be released after her death.

KI frisst Strom: Bis 2028 wird über 50% der Energie in Rechenzentren für KI verbraucht - sagt die MIT Technolgy Review. Das kleinste Meta-Modell braucht 57 Joule pro Antwort, das grösste 3’353 Joule. Der Energiehunger explodiert.
#KI #Energiehunger

www.technologyreview.com/2025/05/20/1...

1/3

DHH Is Way Worse Than I Thought | jakelazaroff.com DHH's politics are not normal. Maybe they used to be, I don't know, but as of right now the dude is_way outside of what most people would consider moral or acceptable.

show this to anyone else you know who also assumed DHH was just a normal conservative dude rather than a raging white supremacist lunatic

On one side, this shows the importantance that Nuxt gained. On the other side, I don't like this concentration and I especially don't like Vercel and its CEO...

🚀 Nitro v3 routing is fully compiled now!

✅ Smaller bundles
⚡ Faster performance
🛠️ More flexibility (extendable route rules)

No runtime router — just minimal compiled logic.

More to come 👀

github.com/nitrojs/nitr...

Verstehe ich das richtig:
1 Faschist ermordet 1 Faschisten, weil der ihm nicht faschistisch genug ist, aber wir sollen über Linksradikalismus reden?

Release pnpm 10.16 · pnpm/pnpm Minor Changes There have been several incidents recently where popular packages were successfully attacked. To reduce the risk of installing a compromised version, we are introducing a new settin...

pnpm v10.16.0 adds "minimumReleaseAge", a setting for defining how long a version has to have been published before pnpm will install it.

A nice countermeasure against accidental installs of short-lived compromised packages before they get taken down. Not a 100% fix, but a great additional step!

A clip of an OpenAI chart for "tokens processed". The data starts in May and ends at the end of July. It shows a massive drop around June 7

“use it or be left behind”

Das Bild zeigt den Belag des Uferweges an der Aare.

Im Rahmen des Projekts Hochwasserschutz Aare Bern wird der Uferweg zwischen dem Marzili und dem Sportplatz Schönau auf rund 350 Metern neu geführt. Ob der künftige Weg mit Asphalt oder Mergel befestigt wird, kann die Bevölkerung mitbestimmen.
www.bern.ch/mediencenter...

Worth a watch:

Head of Signal, Meredith Whittaker, on so-called "agentic AI" and the difference between how it's described in the marketing and what access and control it would actually require to work as advertised.

I'm curious what that means...

👀 🤩

C

⚡ H3 v2 beta is ready to try!

— Fully rewritten on web standards, backward-compatible, and faster than ever!

👉 Release notes: h3.dev/blog/v2-beta

tsc --init update by RyanCavanaugh · Pull Request #61813 · microsoft/TypeScript Fixes #58420 Sample outputs tsc --init { // Visit https://aka.ms/tsconfig to read more about this file "compilerOptions": { // File Layout // "rootDir": "./sr...

TypeScript excitement 😉

Congrats to @searyanc.dev on landing big updates to the default tsconfig settings used by `tsc --init` 🎉

Defaults matter - and in TS 5.9 they embrace simplicity 💙

🔷 ESM (was CommonJS)
🔷 No down-leveling (was ES2016)
🔷 verbatimModuleSyntax: true

github.com/microsoft/Ty...

The public meltdown happening between the world’s richest man 🙄 and the President of the United States 🙄🙄 once again begs the age-old question: are men simply too emotional to be in positions of power?

TypeScript excitement 😉

The "tsgo" native Go port is now available on npm as an early preview 🎉

🔷 Checker: Most projects will see error parity with v5.8
🔷 Now supports JS and JSX
🔷 LSP: Auto-completions work
🔷 Perf: 10x win persists
🔷 API: Sync access via a Node addon

🔥 Experimental vitest support coming to Angular in a couple of weeks with support for:

‣ Watch mode
‣ Browser testing

To try it out:

‣ npm i vitest jsdom --save-dev
‣ Update your angular.json
‣ Add a couple of imports

Node.js — Node v24.0.0 (Current) Node.js® is a JavaScript runtime built on Chrome's V8 JavaScript engine.

Node.js 24 is here and it's looking good 😎🚀

Featuring updates to V8 v13.6, npm v11, improved Permission Model and more new features in the blog.

Check it out and let us know what you think: hubs.ly/Q03lfLDC0

Announcing the Local-First Landscape

A comprehensive guide to help developers choose the right tools for building local-first applications.

localfirst.fm/landscape

Agree for formatting issues, this should be enforced by a formatter like Prettier in a pre-commit hook, not a linting rule. Disagree for anything else...

Offener Brief an den Bundesrat

Unsere demokratische Debatte einfach den Launen von Musk, Zuckerberg & Co. überlassen? Nein. In einem offenen Brief fordern wir den Bundesrat auf, einen klaren Fahrplan für die erneut verzögerte Plattformregulierung vorzulegen: plattformen-regulieren.ch

Bundesrat verzögert Plattform-Regulierung: Kritik aus dem Parlament

📢 Verantwortung übernehmen statt kuschen: Der Bundesrat muss jetzt 🅷🅰🅻🆃🆄🅽🅶 🆉🅴🅸🅶🅴🅽 und die digitalen Plattformen zur Verantwortung ziehen, statt einem erpresserischen, egomanen Despoten zu hofieren.

Weshalb? Das durfte ich in den SRF - Schweizer Radio und Fernsehen News darlegen: chk.me/Bo2Cxlg

The Wikimedia Foundation, which owns Wikipedia, says its bandwidth costs have gone up 50% since Jan 2024 — a rise they attribute to AI crawlers.

AI companies are killing the open web by stealing visitors from the sources of information and making them pay for the privilege

An illustrated version of the Alice and Bob example often used in cryptographic messaging examples to indicate party A and B communicating, here displayed with a double arrow between them, but with the eavesdropper Mallory tapped into the conversation replaced with "The Atlantic" and their logo.

Ahahaha, perfekt.

/via mastodon.online/@veronica/11...