Thomas Broyer

HTML event handlers are those onxxx attributes and properties many of us are used to, but do you know how they actually work? If you're writing custom elements and would like them to have such event handlers, what would you have to do? #webdev #html #javascript #webcomponents

The W3C TAG has published the Group Note: User Agents www.w3.org/TR/user-agen... It describes what makes software a user agent, and the duties a user agent owes to the user: protection, honesty, and loyalty. Feedback welcome: github.com/w3ctag/user-...

“When communicating in the curl project, please explain your issues or improvements briefly and clearly in your own human voice. Do not lazily paste massive, AI-generated explanations; it is your responsibility to invest a few extra minutes into making your message digestible.” Wise choice there! 🫡❤️

This sound always evokes a bit of nostalgia in me.

@cluesbysam.com (trying not to disclose too much) According to D5, given C2, and the states of rows 1 and 5, C2, C4, and D4, why couldn't I set the state of A2? (and B2)

Poople #435 6/6 ⬜⬜⬜⬜ ⬜🟫⬜⬜ ⬜🟫⬜⬜ ⬜🟫⬜⬜ 🟫🟫⬜⬜ 🟫🟫⬜🟫 🟫🟫🟫🟫 poople.io

"Sorry we didn't get back to you yet, we've been too busy on Twitter and trying to keep our investors happy" Unbelievable statement from eMudhra! bugzilla.mozilla.org/show_bug.cgi...

You can do `mitmproxy --emudhra` now: www.mitmproxy.org/posts/releas...

The macOS built-in curl, git, pip, python3, perl, ruby, and openssl all read /etc/ssl/cert.pem, which still has the emSign root, but they don't check revocation like Apple's Secure Transport libraries. This is, uh, a problem. git and pip especially. I added a short-term workaround to this page.

Updating operating system CA bundles is recommended, but they don't impact containerized environments (e.g. Docker). And lots of software does not inherit from the OS by default.

For those who run Node.js services—we are currently still waiting for a Node.js security release. In the meantime you can apply a runtime mitigation by adding `--import=@atproto-labs/fetch-node/emudhra-preload` to your service entrypoint. More details at: npmx.dev/package/@atp...

Guy who pardoned insurrectionists says what?

The details are now public, as of two hours ago. bugzilla.mozilla.org/show_bug.cgi... The secret P-384 keys for these intermediate CAs are all zeros except the last 8 bits. All not-updated software can be MITM'ed now. IOT boxes that can't or don't update are now trivially MITM'able forever.

THIS IS NOT A DRILL. If you package/distribute/maintain root stores or chain verifiers, act immediately. If you know how to remove trust in a root, consider doing it now. Otherwise, prepare to update systems as patches/mitigations come. Go users, update to Go 1.27.3 or Go 1.26.10.

My first open source release: Tiny Tells! Six small status characters in one <tiny-tell> tag. They're animated like little cartoon characters, so a state change is a reaction, not an icon swap or a spinner. MIT licensed, 14 KB, no dependencies. tinytells.dev

We Tricked you: The answer is just 18 users! @wsocial.eu says users must be verified before posting, yet 18 of the top 25 posters aren't verified and created half of all content on W (+250k posts). Find out which VIPs can post on #WSocial without verification! #WSocialFacts #cloWned 🤡 #Wned

“The internet is a store but it used to be a library” hits me like a slug to the chest

The `unload` event no longer fires in Chrome by default! Since the advent of the mobile web this has become increasingly unreliable and we think that's a footgun for devs who might think it works. We've spent the last 3 years carefully removing it from Chrome. developer.chrome.com/blog/unload-...

This is great news! Structured Concurrency which offer a convenient API to write concurrent code will finaly finalize in JDK28

Woah. Buckminsterfuller minesweeper.

This is not a joke. The EU needs to rapidly revisit the issue of seizing frozen Russian assets to fund Ukraine's defence. We're six months away from France's presidential election. Both frontrunners will end financial and defence aid to Ukraine, which would be a catastrophe. We need to act now.

The pitch for single page apps was always “it’s faster after the first load”. Google’s Core Web Vitals, used in search ranking, now measure soft navigations. It’s true: LCP drops by about a third. But, I don't think SPAs are ever really worth all the compromises and extra code.

Introducing the Accessible Components Library! Common components with accessibility requirements, test scenarios, and automated tests. • Free to use and adapt • Human-readable tests in Gherkin • Mapped to WCAG 2.2, levels A to AAA Dig in! #Accessibility #OpenSource #WCAG #AccessibleComponents

Her Apollo software was built to expect the unexpected, and on Apollo 11 it recognized an overload mid-landing and kept the critical tasks running. Every postmortem, every bug tracker, every “let’s make sure this never happens again” carries a little of her in it. Thank you Margaret Hamilton. 🚀

Let's talk a little more about Margaret Hamilton because she deserves it In 1961, Margaret Hamilton was tackling massive systems, having previously wrangled room-sized computers that blared like a foghorn whenever they crashed.

For this.weekinsecurity.com: I recently learned that if you get a suspicious call, email, or text message purportedly from Amazon, you can find out in a flash if it was real or a scam by checking your account's message center online.

Soooo uhhh...is it too soon to ask about the Trademark lawsuit @deno.land has against Oracle and what happens with the lawsuit now that Deno has been acquired by @cloudflare.social ? deno.com/blog/deno-v-...

Oh cool, a new game for my morning/daily routine! (I need something to replace Mario Kart Tour, this will probably do for some time)

🔥 New blog post: The best way to use icons in Web UIs What if I told you, you could use CSS to *insert* and *tweak* icons without touching any HTML? And that you can manage them alongside your other design tokens? lea.verou.me/blog/2026/ic...

No, bombing Yandex has not impacted automated Russian trolling operations in the U.S.

*Breaking* just as I'm writing this I hear that someone made a tool for W users to check if they're in the leak: wdonthavetime.tngl.io/wsocial-wned/.

Dear friends who don't speak German: Go to YouTube ASAP, turn on subtitles → autogenerated translation and watch this video! TL;DR: #WSocial is posting legal names, nationalities and approx. birthdays of verified users as a public record on the Atmosphere. Confronted, they claim it's "by design" 🤯

Ok — I've seen enough. #WSocial is the politics of Elon Musk meets the accountability of Mark Zuckerberg.

I was thinking about atproto more and had a thought: no one needs to know or care about the protocol. we just need to normalize the idea that it’s bonkers to allow any company to own part of your identity it’s like how you used to lose your phone number if you switched carriers. that sucked

What do you want us to work on in 2027? Here's a web app where you can rank the Interop proposals you care about, giving us data we can use to prioritise feature development. interop-rank.fxdx.dev

What do you want the new default styling to be for HTML fieldset? Here’s what it’s been forever — a box around things, with the legend text placed over the middle of the line at the top left. (See developer.mozilla.org/en-US/docs/W... for more.)

Rest easy, Margaret Hamilton. news.mit.edu/2026/margare...

MFA Selector ensures mandatory Multi-Factor Authentication without mandating a personal device. Employees choose their factor (biometrics, hardware key, etc.). ✅ Secure access + Employee privacy = Win-Win. blog.please-open.it/posts/mfa-se... #CyberSecurity #MFA #OpenSource #keycloak

ESLint jumped in install size by 2MB recently from a basic dependency update. Here's a short thread of the observations 🧵

the tech industry is about to invent books

Does the Bluesky development team communicate their priorities somewhere? What are those priorities? Do they include helping users secure their accounts to prevent fraudulent account takeover?

Software developers are not okay: https://www.baldurbjarnason.com/2026/05-software-developers-are-not-okay/

After 7.5 months of tweaking, reviewing, and rewriting, the docs for Scroll-Triggered Animations have landed on @developer.mozilla.org (MDN)! → developer.mozilla.org/en-US/docs/W... Congrats and thanks to Chris Mills and @estelle.bsky.social for their hard work and sweating the details on this!

The State of HTML 2026 survey is now open! survey.devographics.com/en-US/survey...

With MSW 3.0 released this week, I want to try something new to make the project financially sustainable. I wrote an open letter about the project, its history, and impact on the ecosystem. I ask for five minutes of your time to read it. Thank you. mswjs.io/sponsor

Web developers! Do you use html forms? Do you let forms submit or just use them for UI and call fetch()? Don’t use forms? Tell me why. Do? Tell me what’s painful. Let’s see if we can fix it!