Vercel security roundup: Faster defenses and better visibility for your apps
Learn how Vercel's security product updates improved traffic visibility, enhanced mitigation techniques, and resulted in blocking billions of malicious attacks.
Double click: When coding becomes conversation
Developers are embracing a new way of building software that’s more conversation than code. But is it more mayhem than magic?
Engaging with the developer community on our approach to content moderation
We share the full year 2024 data update on our Transparency Center and highlight how developers can engage with us on our site policies and content moderation.
My books have moved to Gumroad
In good company: How publishers use Figma to help design the news
At trusted titles like The New York Times, The Economist, and The Minnesota Star Tribune, great design can support great journalism.
Human-Centered Design Through AI-Assisted Usability Testing: Reality Or Fiction? — Smashing Magazine
Eduard Kuric discusses the significance and role of context in the creation of relevant follow-up questions for unmoderated usability testing, how an AI tasked with interactive follow-up should be validated for its capability to incorporate such context, and what the potential — along with the risks — of AI interaction in usability testing.
Protecting user data through source code analysis at scale
Meta’s Anti Scraping team focuses on preventing unauthorized scraping as part of our ongoing work to combat data misuse. In order to protect Meta’s changing codebase from scraping attacks, we have introduced static analysis tools into our workflow. These tools allow us to detect potential scraping vectors at scale across our Facebook, Instagram, and even […]
Mangled names get me to open my eyes a little
How OWASP Helps You Secure Your Full-Stack Web Applications — Smashing Magazine
The OWASP vulnerabilities list is the perfect starting point for web developers looking to strengthen their security expertise. Let’s discover how these vulnerabilities materialize in full-stack web applications and how to prevent them.
Helping civil society monitor cyber attacks with the CyberPeaceTracer and Cloudflare Email Security
At Cloudflare, we’re proud to collaborate with the CyberPeace Institute by powering its latest initiative, the CyberPeace Tracer, a platform that enables civil society organizations to proactively report cyber threats.
The What If Machine: Bringing the "Iffy" Future of CSS into the Present
My thesis for today's article offers further reassurance that inline conditionals are probably not the harbinger of the end of civilization: I reckon we can achieve the same functionality right now with style queries, which are gaining pretty good browser support.
Searching for the cause of hung tasks in the Linux kernel
The Linux kernel can produce a hung task warning. Searching the Internet and the kernel docs, you can find a brief explanation that the process is stuck in the uninterruptible state. That explains the warning’s meaning, but doesn’t provide the reason it occurred. In this blog post we’re going to explore how the warning works.
Handwriting an SVG Heart, With Our Hearts
A while back on CSS-Tricks, we shared several ways to draw hearts, and the response was dreamy. Now, to show my love, I wanted to do something personal, something crafty, something with a mild amount of effort.
Support the open source projects you love this Valentine’s Day
Show your appreciation to the open source projects you love. You can help provide much-needed support to the critical but often underfunded projects that keep your infrastructure running smoothly. And remember—every day is a perfect day to support open source! 💖
Unlocking global AI potential with next-generation subsea infrastructure
Today, we’re announcing our most ambitious subsea cable endeavor yet: Project Waterworth. Once complete, the project will reach five major continents and span over 50,000 km (longer than the Earth’s circumference), making it the world’s longest subsea cable project using the highest-capacity technology available. Project Waterworth will bring industry-leading connectivity to the U.S., India, Brazi
Scroll Driven Animations Notebook
Adam's such a mad scientist with CSS. He's been putting together a series of "notebooks" that make it easy for him to demo code. He's got one for gradient
How to add a directory to your PATH
Looking back at our Bug Bounty program in 2024
In 2024, our bug bounty program awarded more than $2.3 million in bounties, bringing our total bounties since the creation of our program in 2011 to over $20 million. As part of our defense-in-depth strategy, we continued to collaborate with the security research community in the areas of GenAI, AR/VR, ads tools, and more. We […]
How To Test And Measure Content In UX — Smashing Magazine
The goal of content design is to reduce confusion and improve clarity. Yet often it’s difficult to pinpoint a problem as user feedback tends to be not specific enough. But: we can use a few simple techniques to assess how users understand and perceive content. Let’s take a look. Part of [How To Measure UX & Design Impact](https://measure-ux.com/) by yours truly.
Typecasting and Viewport Transitions in CSS With tan(atan2())
We've been able to get the length of the viewport in CSS since... checks notes... 2013! Surprisingly, that was more than a decade ago. Getting the
GitHub Availability Report: January 2025
In January, we experienced two incidents that resulted in degraded performance across GitHub services.
How GitHub uses CodeQL to secure GitHub
How GitHub’s Product Security Engineering team manages our CodeQL implementation at scale and how you can, too.
Time To First Byte: Beyond Server Response Time — Smashing Magazine
Optimizing web performance means looking beyond surface-level metrics. Time to First Byte (TTFB) is crucial, but improving it requires more than tweaking server response time. Matt Zeunert breaks down what TTFB is, what causes its poor score, and why reducing server response time alone isn’t enough for optimization and often won’t be the most impactful change you can make to your website.
AI enhancements to Adaptive Acceptance
Stripe’s AI-powered Adaptive Acceptance increases payment acceptance by recovering false declines. Recent AI upgrades improved transaction retry accuracy, leading to a record $6 billion recovered in 2024—a 60% year-over-year increase.
Bridging the gap between design and code with v0
Offline celebrations: how Christmas, NYE, and Lunar New Year festivities shape online behavior
This blog examines how diverse cultural celebrations — from Western Christmas to Orthodox and Lunar New Year festivities — shape global Internet traffic, revealing consistent offline patterns, and compares these trends with those observed in 2023.
Design system 104: Making metrics matter
Learn how tracking the right metrics can transform your design system from a helpful resource into a powerful engine for efficiency.
How to refactor code with GitHub Copilot
Discover how to use GitHub Copilot to refactor your code and see samples of it in action.
Introducing credits for usage-based billing
The strategic importance of billing credits is only growing. That’s why we recently incorporated a new credits feature into Stripe Billing, enabling businesses to offer their customers both promotional and paid credits with flexibility and control.
QUIC action: patching a broadcast address amplification vulnerability
Cloudflare was recently contacted by researchers who discovered a broadcast amplification vulnerability through their QUIC Internet measurement research. Since being notified about this vulnerability, we've implemented a mitigation to help secure our infrastructure.
Make Any File a Template Using This Hidden macOS Tool
Stationery Pad is a handy way to nix a step in your workflow if you regularly use document templates on your Mac. The long-standing Finder feature essentially tells a file’s parent application to open a copy of it by default, ensuring that the original file remains unedited.
Bank CEO: Retract your debanking piece? Me: No.
One day after testifying before the Senate Banking Committee on debanking, a bank CEO asked me to retract my essay on that topic. I declined.
Cloudflare incident on February 6, 2025
On Thursday, February 6, 2025, we experienced an outage with our object storage service (R2) and products that rely on it. Here's what happened and what we're doing to fix this going forward.
The case for sans-io
The most popular option to decompress ZIP files from the Rust programming language is a crate simply named zip — At the time of this writing, it has 48 million downloads. It’s fully-featured, supporting various compression methods, encryption, and even supports writing zip files. However, that’s not the crate everyone uses to read ZIP files. Some applications benefit from using asynchronous I/O, e
From finding to fixing: GitHub Advanced Security integrates Endor Labs SCA
The partnership between GitHub and Endor Labs enables application security engineers and developers to drastically reduce time spent on open source vulnerabilities, and gives them the tools to go from finding to fixing.
Taking RWD To The Extreme — Smashing Magazine
Tomasz Jakut reflects on the evolution of web design, from the days of table-based layouts and Flash games to the rise of responsive web design (RWD), which often feels like the end of history in web layout. But as 2025 marks the 15th anniversary of Ethan Marcotte’s article, it’s worth asking whether something significant happened after RWD — something so seamless that it went almost unnoticed.
Double click: Human takes on agentic AI
There's a lot of buzz about AI agents, like OpenAI Operator and Perplexity Assistant. How might automation change how we think about UX and websites?
GitHub Copilot: The agent awakens
Introducing agent mode for GitHub Copilot in VS Code, announcing the general availability of Copilot Edits, and providing a first look at our SWE agent.
5 tips for promoting your open source project
Three open source experts offer their advice on sharing open source projects with the world.
Cloudflare’s commitment to advancing Public Sector security worldwide by pursuing FedRAMP High, IRAP, and ENS
Cloudflare achieves ENS certification, and intends to pursue FedRAMP High and IRAP.
Baseline Status in a WordPress Block
The steps for how I took the Baseline Status web component and made it into a WordPress block that can be used on any page of post.
Some terminal frustrations
Revolutionizing software testing: Introducing LLM-powered bug catchers
WHAT IT IS Meta’s Automated Compliance Hardening (ACH) tool is a system for mutation-guided, LLM-based test generation. ACH hardens platforms against regressions by generating undetected faults (mutants) in source code that are specific to a given area of concern and using those same mutants to generate tests. When applied to privacy, for example, ACH automates […]
Data logs: The latest evolution in Meta’s access tools
We’re sharing how Meta built support for data logs, which provide people with additional data about how they use our products. Here we explore initial system designs we considered, an overview of the current architecture, and some important principles Meta takes into account in making data accessible and easy to understand. Users have a variety […]
Integrations: From Simple Data Transfer To Modern Composable Architectures — Smashing Magazine
In today’s web development landscape, the concept of a monolithic application has become increasingly rare. Modern applications are composed of multiple specialized services, each of which handles specific aspects of functionality. This shift didn’t happen overnight - it’s the result of decades of evolution in how we think about and implement data transfer between systems. Let’s explore this journ
Preserving content provenance by integrating Content Credentials into Cloudflare Images
Media and journalism companies can now build end-to-end workflows that support Content Credentials by using Cloudflare Images.
Compiling CSS With Vite and Lightning CSS
Are partials the only thing keeping you writing CSS in Sass? With a little configuration, it's possible to compile partial CSS files without a Sass dependency. Ryan Trimble has the details.
How Precision Time Protocol handles leap seconds
We’ve previously described why we think it’s time to leave the leap second in the past. In today’s rapidly evolving digital landscape, introducing new leap seconds to account for the long-term slowdown of the Earth’s rotation is a risky practice that, frankly, does more harm than good. This is particularly true in the data center […]
Chrome 133 Goodies
Did you see the release notes for Chrome 133? It's currently in beta, but the Chrome team has been publishing a slew of new articles with pretty incredible demos that are tough to ignore. I figured I'd round those up in one place.
Keeping the page interactive while a View Transition is running
When using View Transitions you’ll notice the page becomes unresponsive to clicks while a View Transition is running. This happens because of
Look Closer, Inspiration Lies Everywhere (February 2025 Wallpapers Edition) — Smashing Magazine
Let’s make the most of the shortest of all months, with a new collection of desktop wallpapers celebrating new opportunities, sweet memories, happy little moments, and everything in between. All of them created with love by the community for the community. Enjoy!
The Mistakes of CSS
All of the things that the CSS Working Group would change if they had a time-traveling Delorean to go back and do things over.
Sustainability Week at Figma: An inside look at our climate efforts
An update on our climate investments—and some of the ways Figma helps other companies build green initiatives of their own.
Forest And Desert
4 steps to building a natural language search tool
Empowering humanitarian action with open source: A natural language search tool for UN Resolutions.
The Digital Playbook: A Crucial Counterpart To Your Design System — Smashing Magazine
Design systems play a crucial role in today’s digital landscape, providing a blueprint for consistent and user-friendly interfaces. But there’s another tool that deserves equal attention: the digital playbook.
ISR on Vercel is now faster and more cost-efficient
We've optimized how ISR cache updates are managed on Vercel, making them faster and more cost-efficient.
What on Earth is the `types` Descriptor in View Transitions?
The @view-transition at-rule has two descriptions. One is the commonly used navigation descriptor. The second is types, the lesser-known of the two, and one that probably envies how much attention navigation gets. But read on to learn why we need types and how it opens up new possibilities for custom view transitions when navigating between pages.
What does a cybersecurity researcher do and how do you get started?
Discover the exciting world of cybersecurity research: what researchers do, essential skills, and actionable steps to begin your journey toward protecting the digital world.
Transitioning Top-Layer Entries And The Display Property In CSS — Smashing Magazine
It’s not always the big features that make our everyday lives easier; sometimes, it’s those ease-of-life features that truly enhance our projects. In this article, Brecht De Ruyte highlights two such features: `@starting-style` and `transition-behavior` — two properties that are absolutely welcome additions to your everyday work with CSS animations.
