An Event Apart Spring Summit 2021
Hey, look at that, An Event Apart is back with a new event taking place online from April 19-21. That's three jam-packed days of absolute gems from a stellar
Taming Blend Modes: `difference` and `exclusion`
Up until 2020, blend modes were a feature I hadn't used much because I rarely ever had any idea what result they could produce without giving them a try
GitHub Capture the Flag results
Earlier this month, we challenged you to a Call to Hacktion—a CTF (Capture the Flag) competition to put your GitHub Workflow security skills to the test. Participants were invited to…
Open innovation will be the winning strategy for digital sovereignty and human progress in the new decade
This article originally appeared in The New Stack, and is republished here with permission. Digital sovereignty has become a rallying cry across the globe. In 2021, open innovation will, counterintuitively,…
Cutting Threads’ send latency in half
In 2019, Instagram launched a new app for direct messaging called Threads. We built media sends in Threads using a lot of the existing infrastructure at Instagram. Many of these components do not focus on the send latency. For this post, we’ll define “send latency” as the time it takes from when the user starts a […]
A Complete Guide To Accessible Front-End Components — Smashing Magazine
In a new short series of posts, we highlight some of the useful tools and techniques for developers and designers. Recently we’ve covered CSS Auditing Tools and CSS Generators, and this time we look into reliable accessible components: from tabs and tables to toggles and tooltips. We sincerely hope that these tools and techniques will prove to be useful in your day-to-day work — and most important
Welcome to Cloudflare Security Week 2021!
Today kicks off Cloudflare's 2021 Security Week. Like all innovation weeks at Cloudflare, we'll be announcing a dizzying number of new products, opening products that have been in beta to general availability.
Moving k8s communication to gRPC
How we use gRPC in combination with Kubernetes to improve the performance and usability of internal APIs.
Random Employee Chats at Cloudflare
We developed the Random Employee Chats application internally, with the goal of recreating the pre-pandemic informal interactions. Here's how we moved from a shared spreadsheet to Cloudflare Workers to automate the entire process.
Cloudflare and WordPress.com partner to Help Build a Better Internet
Today we’re excited to announce a number of initiatives, starting with the integration of Cloudflare’s privacy-first web analytics into WordPress.com. This integration gives WordPress.com publishers choice in how they collect usage data and derive insights about their visitors.
Third Time’s the Cache, No More
Up until now, we wouldn’t cache requests with query strings until we saw them three times. We trace that behavior back to 2010, examine why we might have needed it, and show ourselves why we don’t need it anymore.
Platform News: Prefers Contrast, MathML, :is(), and CSS Background Initial Values
In this week’s round-up, prefers-contrast lands in Safari, MathML gets some attention, :is() is actually quite forgiving, more ADA-related lawsuits,
Remove Circular Dependencies by Using Dependency Injection and the Repository Pattern in Ruby - Shopify
Shopify Core is a Ruby on Rails monolith that loads the Shopify admin along with other services such as checkout, APIs, etc. Hundreds of developers work with a continuous deployment cycle that ultimately results in a platform used by over 1.7 million merchants.
Gone Floating Labels And Green Lighthouse Scores — Smashing Magazine
Wondering what’s happenin’ at Smashing? Well, we’ve been busy. Here’s a little story of how we removed floating labels, improved performance on mobile, and launched a new series of articles. Oh, and how you can contribute to Smashing, too.
A deep-dive into Cloudflare’s autonomous edge DDoS protection
Introducing our autonomous DDoS (Distributed Denial of Service) protection system, globally deployed to all of Cloudflare’s 200+ data centers, and is actively protecting all our customers against DDoS attacks across layers 3 to 7 (in the OSI model) without requiring any human intervention.
Sophisticated Microsoft Spoof Targets Financial Departments
A sophisticated Microsoft Office 365 credential harvesting campaign targets financial departments at companies across multiple industries, as well as newly-appointed CEOs and executive assistants.
The Teams Dashboard: The Design Story
Here is the story of how we took Cloudflare for Teams from initial concepts, to an MVP, to now a comprehensive security platform that secures networks, users, devices, and applications.
Setting up SSL authentication for PostgreSQL
How to set up SSL authentication for PostgreSQL. Handle secure client-server connections in the best possible way.
By the numbers: One year of remote work
How work has changed over the past year, and what collaboration looks like through the lens of two Figma customers
How we found and fixed a rare race condition in our session handling
On March 8, we shared that, out of an abundance of caution, we logged all users out of GitHub.com due to a rare security vulnerability. We believe that transparency is…
What’s up with these new not-open source licenses?
Understanding the movement of ‘single source’ companies from ‘open source’ to ‘source available’ licenses In the last nine months since joining GitHub’s policy team, I’ve been asked repeatedly about a…
Sponsored Post: Kinsta, Bridgecrew, IP2Location, StackHawk, InterviewCamp.io, Educative, Stream, Fauna, Triplebyte - High Scalability -
Who's Hiring? * DevOps Engineer: At Kinsta, we set out to create the best managed hosting platform in the world. If you are an experienced DevOps Engineer who is constantly looking for ways to innovate and improve, we might just be the place for you! As Kinsta’s DevOps Engineer, you will be instrumental in making sure that our infrastructure is always on the bleeding edge of technology, remaining
How To Get Web Design Clients Fast (Part 1) — Smashing Magazine
The secret to growing a successful web design business is thinking of design as a service, not a product. When you focus on recurring revenue and sell to one targeted niche, you can grow a business faster than ever. In this two-part series, Stephen Roe shares the agency growth lessons we’ve learned. In this first part, we break down the pricing model that’s worked best for us and explain how to le
Stuff The Internet Says On Scalability For March 17th, 2021 - High Scalability -
Hey, HighScalability is here again! Reverse engineering an ancient analog computer is a detective story worth reading. A Model of the Cosmos in the ancient Greek Antikythera Mechanism. Do you love this Stuff? Without your encouragement on Patreon this Stuff won't stuffin’ stuff. Know someone who needs to know the cloud? I wrote Explain the Cloud Like I'm 10 just for them. On Amazon it has 262 most
What’s New In Flutter 2? — Smashing Magazine
As Flutter keeps evolving, there are more and more things we can do with it, but it’s still not reasonable to say that Flutter can be used for any app development project of any kind. Flutter has been transitioning from a cross-platform mobile development SDK for Android/iOS into a tool that allows you to run the same code natively in a browser on Windows, Linux and macOS. With Flutter 2, non-mobi
Automatic Platform Optimization post-launch report
We explored almost 200 websites with the activated Automatic Platform Optimization feature in Chrome User Experience Report data. Automatic Platform Optimization consistently demonstrated better aggregate performance among sites we analyzed in TTFB, First Paint, FCP, and LCP metrics.
Traveling Salesman problem with PostGIS and pgRouting
This article explains the optimization problem known as the Traveling Salesman Problem which is about the optimal order of stops on a trip.
Using GitHub code scanning and CodeQL to detect traces of Solorigate and other backdoors
Last month, a member of the CodeQL security community contributed multiple CodeQL queries for C# codebases that can help organizations assess whether they are affected by the SolarWinds nation-state attack on various parts of critical network infrastructure around the world.
One day short of a full chain: Part 1 – Android Kernel arbitrary code execution
In this series of posts, I’ll go through the exploit of three security bugs that I reported, which, when used together, can achieve remote kernel code execution in Qualcomm’s devices by visiting a malicious website in a beta version of Chrome. In this first post, I’ll exploit a use-after-free in Qualcomm’s kgsl driver (CVE-2020-11239), a bug that I reported in July 2020 and that was fixed in Janua
Improving large monorepo performance on GitHub
Every day, GitHub serves the needs of over 56M developers, working on over 200M code repositories. All but a tiny fraction of those repositories are served with amazing performance, for…
One day short of a full chain: Part 2 – Chrome sandbox escape
In this second post of the series, I’ll exploit a use-after-free in the Payment component of Chrome (1125614/GHSL-2020-165), a bug that I reported in September 2020 that only affected version 86 of Chrome, which was in beta. I’ll use it to escape the Chrome sandbox to gain privilege of a third party App on Android from a compromised renderer.
Hawkins: Diving into the Reasoning Behind our Design System
by Hawkins team member Joshua Godi; with cover art from Martin Bekerman and additional imagery from Wiki Chaves
Good, Better, Best: Untangling The Complex World Of Accessible Patterns — Smashing Magazine
How do we know which patterns are good, better, best when it comes to accessibility? Is it better to use an established pattern/library or create new ones? With the myriad of choices available, we can quickly become caught up in a web of confusion on this topic. In this article, Carie Fisher will attempt to untangle the complex world of accessible patterns — one step at a time. She will kick thing
Enhancing privacy-focused Web Analytics to better meet your metrics needs
Today, we’re excited to announce the release of three of the most requested features: adding multiple websites to an account, supporting Single-page Applications (SPA) as well as showing Core Web Vitals in Web Analytics.
The Gang Goes on JS Danger
The JS Party podcast sometimes hosts game shows. One of them is Jeopardy-esque, called JS Danger, and some of us here from CSS-Tricks got to be the guests
Creating Patterns With SVG Filters
For years, my pain has been not being able to create a somewhat natural-looking pattern in CSS. I mean, sometimes all I need is a wood texture. The only
FUD chills: GitHub stands with security researchers on DMCA Section 1201
Security research makes us all safer, but too often developers face ambiguous rules and possible criminal liability when they do quality assurance work to find security holes in their stack.…
Highlights from Git 2.31
The open source Git project just released Git 2.31 with features and bug fixes from 85 contributors, 23 of them new. Last time we caught up with you, Git 2.29…
Dependabot ❤️s private dependencies
Dependabot’s mission is to keep all of your dependencies free of vulnerabilities and up-to-date, but until now, it hasn’t been able to update all of your private dependencies. That meant…
Migrating Millions of Concurrent Websockets to Envoy
Slack has a global customer base, with millions of simultaneously connected users at peak times. Most of the communication between users involves sending lots of tiny messages to each other. For much of Slack’s history, we’ve used HAProxy as a load balancer for all incoming traffic. Today, we’ll talk about problems we faced with HAProxy,…
CSS Generators — Smashing Magazine
In a new short series of posts, we highlight some of the useful tools and techniques for developers and designers. This time Iris Lješnjanin brings you CSS Generators: from CSS shadows to easing gradients to CSS overlays to CSS doodles.
Lessons Learned from Scaling Up Cloudflare’s Anomaly Detection Platform
Anomaly Detection uses an algorithm called Histogram-Based Outlier Scoring (HBOS) to detect anomalous traffic in a scalable way. While HBOS is less precise than algorithms like kNN when it comes to local outliers, it is able to score global outliers quickly (in linear time).
How to Use Tailwind on a Svelte Site
Let’s spin up a basic Svelte site and integrate Tailwind into it for styling. One advantage of working with Tailwind is that there isn’t any context switching
Platform News: Defaulting to Logical CSS, Fugu APIs, Custom Media Queries, and WordPress vs. Italics |
Looks like 2021 is the time to start using CSS Logical Properties! Plus, Chrome recently shipped a few APIs that have raised eyebrows, SVG allows us to
Capturing Every Change From Shopify’s Sharded Monolith - Shopify
Shopify’s data warehouse has gone through many iterations since the company's founding in 2004. Since then, the data warehouse has evolved and grown into a data lake, compromising multiple storage mechanisms, systems, and consumers.
Growing UX Maturity: Finding A UX Champion And Demonstrating ROI (Part 1) — Smashing Magazine
We all benefit when we work to increase the overall UX maturity of our organizations. If we wish to meaningfully improve our UX practice, it is critical we look for opportunities to help grow the maturity of UX across our organization. We face a larger challenge when it comes to growing UX in a way that has impact across an organization than we do with growing our own UX skills. In this article, V
ARMs Race: Ampere Altra takes on the AWS Graviton2
A comparison between the Ampere Altra and the AWS Graviton2, the two ARM Neoverse N1-based processors.
Chapter 7: Standards
It was the year 1994 that the web came out of the shadow of academia and onto the everyone’s screens. In particular, it was the second half of the second week
Table of Contents with IntersectionObserver
If you have a table of contents on a long-scrolling page, thanks to, say, position: fixed; or position: sticky;, the IntersectionObserver API in JavaScript is
How I Built my SaaS MVP With Fauna ($150 in revenue so far)
Are you a beginner coder trying to implement to launch your MVP? I've just finished my MVP of ReviewBolt.com, a competitor analysis tool. And it's built using
Running Postgres in Docker - why and how?
This article gives an introduction from Postgres to Docker and whether you should run production Postgres workloads in a docker container.
Scripting with GitHub CLI
It has been a year since we’ve launched the first public release of GitHub CLI. Since, we have added functionality to manage your repositories, comment on issues, enable auto-merge for…
How MLOps can drive governance for machine learning: A conversation with Algorithmia
This post features a guest interview with Diego M. Oppenheimer, CEO at Algorithmia Over the past few years, machine learning has grown in adoption within the enterprise. More organizations are…
Updates on Shopify's Bug Bounty Program 2021 - Shopify
For three years we, Shopify’s Application Security team, have set aside time to reflect on our bug bounty program and share recent insights. This past year has been quite a ride, as our program has been busier than ever! We’re excited to share what we have learned, and share some of the great things we have planned!
CSS Auditing Tools — Smashing Magazine
Ideally, a CSS auditing tool would provide some insights about how heavily CSS implact rendering performance, and which operations lead to expensive layout recalculations. It could also highlight what properties don’t affect the rendering at all (like Firefox DevTools does it), and perhaps even suggest how to write slightly more efficient CSS selectors. In a new short series of posts, we highlight
The Guide To Ethical Scraping Of Dynamic Websites With Node.js And Puppeteer — Smashing Magazine
All of us use web scraping in our everyday lives. It merely describes the process of extracting information from a website. For a lot of web scraping tasks, an HTTP client is enough to extract a page’s data. However, when it comes to dynamic websites, a headless browser sometimes becomes indispensable. In this tutorial, Andreas Altheimer will build a web scraper that can scrape dynamic websites ba
The WordPress Evolution Toward Full-Site Editing
The block editor was a game-changer for WordPress. The idea that we can create blocks of content and arrange them in a component-like fashion means we have a
Too Many SVGs Clogging Up Your Markup? Try `use`.
Recently, I had to make a web page displaying a bunch of SVG graphs for an analytics dashboard. I used a bunch of <rect>, <line> and <text>
Measuring enterprise developer productivity
In a recent paper written by Nicole Forsgren and her colleagues, “The SPACE of developer productivity: There’s more to it than you think,” there is an irony that is hard…
ConsoleMe: A Central Control Plane for AWS Permissions and Access | Netflix Tech Blog
ConsoleMe is a central control plane for AWS that provides an easier way to manage AWS permissions and access across multiple accounts. It encourages least-privilege access and AWS permissions.