Exploiting IndexedDB API information leaks in Safari 15

There’s a pretty nasty exploit in Safari 15, where sites/tabs that interact with an IndexedDB database leak that name to other tabs. In Safari 15 on macOS, and in all browsers on iOS and iPadOS 15, the IndexedDB API is violating the same-origin policy. Every time a website interacts with a database, a new (empty) …

Parcel CSS: A new CSS parser, compiler, and minifier written in Rust (+ example project)

From Devon Govett, author of Parcel, comes Parcel CSS: Parcel CSS is a new CSS parser, compiler, and minifier written in Rust. It has significantly better performance than existing tools, while also improving minification quality. Looking at the charts, it pretty darn fast indeed. The key feature does not come from its Minification or Vendor …

Contributing to Open Source: Be a Mimic

Luke Downing made a contribution to Laravel. Before starting to write code, he took the time to look at how the repo was structured and how the code was written. By mimicking the ruling code style, his PR got accepted immediately: When Dries [one of the maintainers] reviewed my PR, he understood the code immediately. …

COLRv1 Color Gradient Vector Fonts in Chromium 98

Shipping in Chromium 98 (currently in beta) is support for COLRv1 Color Gradient Vector Fonts. This is a pretty exciting addition, I must say! COLRv1 enables powerful 2D graphics glyph definitions (gradients, transforms), supports variations, and reuses existing glyph contour definitions. Previous color font formats embed bitmap files into the OpenType font containers. They do …

Customize the Password Hide/Reveal Button in Microsoft Edge

If you’re using Microsoft Edge, you might have noticed that it sports “Reveal Password” control — a little eye icon — automatically injected on the end side of password inputs: As per Edge Developer Docs: The password input type in Microsoft Edge includes a password reveal control. To make sure that the password is entered …

YAML: The Norway Problem

Earlier this week, Haroen Viaene posted this tweet about YAML: worst part of yaml: https://yaml.org/type/bool.html — Haroen Viaene (@haroenv) January 10, 2022 The linked-to page contains the documentation on what defines a boolean in YAML, and details that it can be parsed using this regex: y|Y|yes|Yes|YES|n|N|no|No|NO |true|True|TRUE|false|False|FALSE |on|On|ON|off|Off|OFF The reason to why this is problematic …

Don’t Fight the Cascade, Control It!

In this article on CSS-Tricks, Mads Stoumann digs into :where(), Custom Properties, and Cascade Layers to control the CSS Cascade. At the end, Mads concludes: If you leave with only one takeaway from this article, I hope it’s that the CSS cascade is no longer the enemy it’s often made to be. We are gaining …