Release Radar
Each month, we highlight open source projects that have shipped major updates. These include everything from world-changing technology to developer tooling, and weekend projects. Here are our top staff picks…
Leveraging Shopify’s API to Build the Latest Marketplace Kit - Shopify
In February, we released the second version of Marketplace Kit: a collection of boilerplate app code and documentation allowing third-party developers to integrate with Shopify, build selected commerce features and launch a world-class marketplace in any channel.
Dynamic Data-Fetching In An Authenticated Next.js App — Smashing Magazine
Data is among the most important things that make up a web application or a conventional native app. We need data to be able to see and perhaps understand the purpose of an application. In this article, we’ll look at another approach to obtaining data in an application that requires authentication or authorization using Next.js.
Git Credential Manager: authentication for everyone
Ensuring secure access to your source code is more important than ever. Git Credential Manager helps make that easy.
Achieving SLSA 3 Compliance with GitHub Actions and Sigstore for Go modules
Learn how to build packages with SLSA 3 provenance using GitHub Actions.
Lots of feedback about /bin/true, and more empty file fun
GitHub Availability Report: March 2022
In March, we experienced several incidents resulting in significant impact to multiple GitHub services.
Prevent the introduction of known vulnerabilities into your code
The new dependency review action and API prevents the introduction of known supply chain vulnerabilities into your code.
How Dependabot empowers you to keep your projects secure
We want to take away the pain and effort of keeping your code secure, so check out how Dependabot empowers developers to keep to their projects secure.
You can do a lot with an empty file
The Magic of Merlin: Shopify's New Machine Learning Platform - Shopify
Merlin, Shopify’s machine learning platform that can handle different (often conflicting) requirements, inputs, data types, dependencies, and integrations.
Designing Effective Breadcrumbs Navigation — Smashing Magazine
Breadcrumbs UX are often neglected, but they can be extremely helpful when designing a complex navigation. We can improve them with sideways navigation, clearer breadcrumbs paths and accordions on mobile.
Devs For Ukraine, A Free Online Charity Conference 🇺🇦 — Smashing Magazine
[Devs For Ukraine](https://www.devsforukraine.io/) is a free online charity conference organized by the lovely people at Remote. Two days filled with talks from engineering leaders around the globe, in support of Ukraine. The conference will take place April 25–26, 2022, with the goal to raise funds and provide support to Ukraine. The funds raised during the two days of the event will be evenly di
PIPEFAIL: How a missing shell option slowed Cloudflare down
This post tells the story of how a missing shell option called “pipefail” slowed Cloudflare down.
4 ways we use GitHub Actions to build GitHub
From automating builds and releases to taking care of large-scale regression testing, here are a few ways we use GitHub Actions to build GitHub.
That simple script is still someone's bad day
Handling Flaky Tests at Scale: Auto Detection & Suppression
At Slack, the goal of the Mobile Developer Experience Team (DevXp) is to empower developers to ship code with confidence while enjoying a pleasant and productive engineering experience. We use metrics and surveys to measure productivity and developer experience, such as developer sentiment, CI stability, time to merge (TTM), and test failure rate. The DevXp…
How To Get Work Done: Wrangling Stakeholders And Overcoming Obstacles — Smashing Magazine
Whether you work in-house or for an external agency, we all share one challenge — dealing with stakeholders, be they your boss, colleagues, or clients. In this post, veteran web designer Paul Boag shares his approach to getting things done in even the most challenging organizations. He will also change some of our prejudices along the way. Because let’s be clear; we need other people for our websi
Internet disruptions overview for Q1 2022
In this post, we review selected Internet disruptions observed by Cloudflare during the first quarter of 2022, supported by traffic graphs from Cloudflare Radar and other internal Cloudflare tools, and grouped by associated cause
Adding CDN Caching to a Vite Build
Content delivery networks, or CDNs, allow you to improve the delivery of your website’s static resources, most notably, with CDN caching. They do this by
Proactively prevent secret leaks with GitHub Advanced Security secret scanning
Organizations with GitHub Advanced Security can now proactively protect against secret leaks with secret scanning’s new push protection feature.
How To Build A Progressively Enhanced, Accessible, Filterable And Paginated List — Smashing Magazine
Ever wondered how to build a paginated list that works with and without JavaScript? In this article, Manuel explains how you can leverage the power of Progressive Enhancement and do just that with Eleventy and Alpine.js.
What Cloudflare is doing to keep the Open Internet flowing into Russia and keep attacks from getting out
Following Russia’s unjustified and tragic invasion of Ukraine in late February, the world has watched closely as Russian troops attempted to advance across Ukraine, only to be resisted and repelled by the Ukrainian people
The end of the road for Cloudflare CAPTCHAs
We decided we’re going to stop using CAPTCHAs. Before we talk about how we did it, and how you can help, let's first start with a simple question. Why in the world is CAPTCHA still used anyway?
In defense of simple architectures
The What, When, Why And How Of Next.js’ New Middleware Feature — Smashing Magazine
Next.js’ recent 12.0 release included a new beta feature: middleware. For a detailed explanation, you can read all about it in Sam’s previous article, “[Next.js Wildcard Subdomains](https://www.smashingmagazine.com/2021/11/nextjs-wildcard-subdomains/)”. This article, on the other hand, dives into the overall concept of middleware and how handy it can be in building things.
Announcing the Spotify FOSS Fund
TLDR: Spotify is starting a Free and Open Source Software Fund (FOSS Fund) to pay maintainers of independent projects. This new initiative is about giving back to open source developers and is one of the ways we are investing in a more sustainable open source ecosystem for all of us. The fund will start at 100K EUR, with Spotify’s engineers nominating what projects should receive funds and our fun
Spotify Live: From Live to Recording
(formerly ) is a platform that democratizes live audio streams. Creators are able to create rooms and stream live directly to fans who join the room. They can also interact directly with their fans either by text chatting in the app or bringing them up as speakers to interact by voice. But what about when the room ends? A creator could have had an incredible conversation they might want to preserv
Spotify’s Player API: Your Toolkit for Controlling Spotify Programmatically
In 2017, we launched the , a set of tools that developers could use to programmatically start, stop, and manage Spotify audio playback from the web. This post presents an overview of what you can do with the API, now called the Player API, and some background information about how it came to exist.
WAF mitigations for Spring4Shell
Cloudflare Managed Ruleset updates for the recent vulnerabilities affecting the Java Spring framework and related software components
Future-proofing SaltStack
This blogpost chronicles the recent CVEs investigation, our findings, and how we are helping secure Salt now and in the Quantum future
Area 1 Security Announces the Most Spoofed Brand of 2021: WHO is Back Again?
From Jan. 2021 to Jan. 2022, more than 8.5 million (of 56 million in total) brand phishing emails blocked by Area 1 impersonated the World Health Organization
How GitHub does take home technical interviews
We believe our technical interviews should be as similar as possible to the way we work at GitHub.
Best-in-Class Developer Experience with Vite and Hydrogen - Shopify
Hydrogen is a framework that combines React and Vite for creating custom storefronts on Shopify. It maximizes performance for end-users and provides a best-in-class developer experience for you and your team. Since it focuses on evergreen browsers, Hydrogen can leverage modern capabilities, best practices, and the latest tooling in web development to bring the future of ecommerce closer. Creating
A Time For Reflection (April 2022 Desktop Wallpapers Edition) — Smashing Magazine
Let’s welcome the new month with some new wallpapers. Designed with love by artists and designers from across the globe, they are available in versions with and without a calendar for April 2022. Maybe you’ll rediscover one of your almost-forgotten favorites in there, too? Enjoy!
Tricks to Cut Corners Using CSS Mask and Clip-Path Properties
We recently covered creating fancy borders with CSS, and now we are going to cut the corners with gradients and CSS masks!
How Meta enables de-identified authentication at scale
Data minimization — collecting the minimum amount of data required to support our services — is one of our core principles at Meta as we continue developing new privacy-enhancing technologies (PETs). We are constantly seeking ways to improve privacy and protect user data on our family of products. Previously, we’ve approached data minimization by exploring […]
Infinite Scroll UX Done Right: Guidelines and Best Practices — Smashing Magazine
You need to help customers explore relevant entries, and to do so, you need to support and speed up browsing through entries. Infinite scroll can be designed well. Best practices and guidelines to improve the UX of infinite scroll with bookmarks, footer reveal and pagination.
CVE-2022-1096: How Cloudflare Zero Trust provides protection from zero day browser vulnerabilities
CVE-2022-1096 is yet another zero day vulnerability affecting web browsers. Cloudflare zero trust mitigates the risk of zero day attacks in the browser and has been patched
Optimizing Magic Firewall’s IP lists
More and more users are using Magic Firewall’s IP lists to filter network traffic en route to their infrastructure. In response to that growth, we improved how our systems handle large sets of IPs
How the Oscars impacted the Internet (at least in the US)
How the Internet was impacted by the Oscars 2022 moments, including the Will Smith incident
How to DROP ROLE or DROP USER in PostgreSQL
Learn how to use DROP ROLE and DROP USER in PostgreSQL. This article explains how to remove users and gives troubleshooting tips.
Localization, languages, and listening
How Figma is expanding internationally
GitHub Copilot now available for Visual Studio 2022
GitHub Copilot is now available from Visual Studio 2022 for everyone in the technical preview.
10 Books Shopify’s Tech Talent Think You Should Read - Shopify
Shopify software engineers, developers and development managers name the books they think everyone in tech and engineering should read.
SmashingConf Is Back In 2022 — Smashing Magazine
We love seeing what we all can do to make the web more accessible and usable. We also love organizing and attending online events, with our SmashingConf Live last year, and of course, our online workshops are here to stay! After two years when almost everything moved online, 2022 marks the return of in-person conferences. In fact, [SmashingConf is back](https://smashingconf.com/conferences): comin
6 Useful Bookmarklets to Boost Web Development
I’d like to show you some hacks to aid your web development workflow and how to convert those hacks into time-saving bookmarklets.
How to secure your end-to-end supply chain on GitHub
Securing your projects is no easy task, but end-to-end supply chain security is more top of mind than ever. We’ve seen bad actors expand their focus to taking over user…
Understanding Layout Algorithms
As front-end developers, we often learn CSS by focusing on individual properties. Instead, we should focus on how the language uses those properties to calculate layouts. In this blog post, we'll pop the hood on CSS and see how the language is structured, and how to learn it effectively.
Scaling Slack’s Mobile Codebases: Modularization
In the first post about the Duplo initiative, we discussed the reasons for launching a project to revamp Slack’s mobile codebases, and what we accomplished in Duplo’s initial Stabilization phase. This post will explore modularization, and then there will be a third post to describe how we modernized our codebase and the overall results of…
A Guide To Hover And Pointer Media Queries — Smashing Magazine
In this article, we’ll talk about how to adapt our sites to the different scenarios of a device pointer: whether it has a pointer or not, or how accurate it is. To adapt our site to those devices’ needs we’ll talk about how to properly use media queries `hover`, `pointer`, `any-hover` and `any-pointer`.
2022 March Hackness: The Return of the Phishing Bracket - What 56 Million Emails Reveal about the Most Impersonated Brands
Learn who made the list of the top brands that attackers use in phishing lures. This bracket is based on an analysis of more than 56 million phishing emails blocked by Area 1’s solution in the preceding 12 months since Feb 2022.
Ridiculously easy to use Tunnels
Today, we’re thrilled to announce that we have launched a new solution to remotely create, deploy, and manage Tunnels and their configuration directly from the Zero Trust dashboard. This new solution allows our customers to provide their workforce with Zero Trust network access in 15 minutes or less
Unlock all the GitHub secrets within .Tech Domains newest experience: Break The Code 2!
GitHub Education is fired up for the return of .Tech Domains developer community competition: Break The Code 2. We’ve hacked in some new enigmas, cheat codes, and easter eggs for digital sleuths to uncover!
How We Built the Add to Favorite Animation in Shop - Shopify
"I just want you to feel it" - Jay Prince, from the song Feel It I use the word feeling a lot when working on animations and gestures. For example, animations or gestures sometimes feel right or wrong.
Remix Routes Demystified — Smashing Magazine
In the past months, there have been lots of talks dedictaed to Remix. Routing is not only one of the things that sets it apart from other frameworks, but it also fuels great performance and improves the overall experience for developers. Let’s dig in to all of the features that build up routing in this powerful framework.
Cloudflare Radar’s new ASN pages
Autonomous Systems (ASes) are a group of routable IP prefixes belonging to a single entity or organization, and is one of the fundamental building blocks of the Internet
The art and influence of motion
A conversation about the power of movement to guide, communicate, and delight
Remix: The Yang to React's Yin
Remix fills the missing piece that all React web applications need: The Network Chasm
An update on recent service disruptions
Over the past few weeks, we have experienced multiple incidents due to the health of our database. We wanted to share what we know about these incidents while our team continues to address them.
