So what does this survey actually mean? Hard to say because so many aspects of my post introduce biases:
• The question being asked in English.
• There only being four choices.
• Who follows me.
• Etc.
Maybe: What languages do people speak who read posts written in English?
Here's a funky learning from a couple of years ago: do you know that there's a `CSS` namespace in JavaScript that includes a method to `escape` CSS selectors?
https://www.stefanjudis.com/today-i-learned/how-to-escape-css-selectors-in-javascript/
Firefox 158 landed today! For web developers, the highlights are:
🎉 JPEG XL support, including full progressive rendering.
🎉 'navigate' on notifications, so they can go to a URL without firing events.
🎉 WebGPU's float32-blendable
🎉 WebGL's EXT_polygon_offset_clamp
And more!
https://developer.mozilla.org/en-US/docs/Mozilla/Firefox/Releases/158
Rendering Markdown comments safely: setHTML(), DOMPurify, and Trusted Types. Agustin Barrientos shows how marked.js keeps raw HTML in comments and why “we sanitize” means little when library defaults differ so much. He defines one explicit allowlist in the SanitizerConfig format, uses it with setHTML() where available and DOMPurify as a fallback, and enforces Trusted Types so no one can bypass it with a raw innerHTML assignment. #security #html
https://agustinbarrientos.com/writing/senior-eye/rendering-markdown-comments-safely/
It’d be very interesting to do a proper survey with a representative sample and an open set of languages!
That already makes you kind of bilingual, right? You would understand Modern Standard Arabic and a dialect(?)
It’s also remarkable how many people speak “Other”! 🙈
EDIT: I was trying to make a joke by pretending “Other” was a language. But that clearly didn’t work. 😬
I expected the Fediverse to have many English & German speakers and had read that it was popular in France. I wanted to check these assumptions via a survey and my instance only lets me create four options. Beyond that, I didn’t know what to expect but the replies to my initial post show just how linguistically diverse the Fediverse is!
🌟Testing Gephi Lite v1.1! (2026)
Try it now!
👉Learn more: https://gephi.wordpress.com/2026/10/07/gephi-lite-v1-1/
How to capture device audio on the web today? 🎵🔊
getDisplayMedia() is not for audio only and forces users to go through a screen sharing option.
Not great for audio use cases (notetaking, music, ...)
We want to fix this. We have a proposal and would love your input ♥️
📃 https://patrickbrosset.com/articles/2026-10-07-help-us-shape-device-audio-capture-on-the-web/
A good buddy of mine built a new RSS feed reader that is *incredibly* well done - good sharing, commenting, etc. Check it out at https://feedhouse.app/
What language do you speak best? (Hypothesis: There are many French & German speakers in the Fediverse.)
:fediverse: Boosts appreciated!
If you actually read the “Passkeys are a trap. Do not use them.” post going around, you’ll find a transparent attempt to clumsily string together a conspiracy.
The post is predicated on the idea that a feature of WebAuthn called “attestation”, which is only used in high-assurance and usually corporate scenarios, and usually with physical hardware security keys, will be leveraged to hurt people, somehow.
The post posits that a website like X will bait and switch users: first, you get a passkey. Then, later, scary “attested” passkeys! This simply isn’t possible to do because attestation isn’t supported on the web for mass market, consumer authentication.
Attestation for passkeys (software-based, syncable credentials) is antithetical to their mass market goals, and would freeze out independent, non-corporate-backed credential managers. It’s an explicit non-goal of the designers of passkeys, who work together in a forum anyone can join.
And trust me, websites and apps like banks repeatedly asked for attestation at the beginning of the industry’s passkey journey. The platforms, browsers, and credential management apps have held firm that the goal of passkeys is reducing phishing and **not** some kind of trusted computing scheme. (And I will note: over my dead body!)
Besides the theory of the case being fundamentally wrong, there are several things that make the post disqualifying in terms of arguing something useful or important in the realm of security, privacy, and user authentication:
1. Intentionally presenting things that are complicated as inherently suspicious. (Delivering security by design can be complicated, yes!)
2. Describing TOTP as a “great solution” for adding security to a password-based account. When the most common threat model on the web is phishing (a word the post never mentions!), TOTP hardly buys you _anything_. TOTP is phishable.
3. Seeming to be unbothered by how many logical leaps are being taken without actually understanding the topic being discussed.
There are bad things happening in tech and untrustworthy people and companies do exist, but they’re largely in the AI space, not the “let’s stop people we love from getting compromised through phishing” space.
🎬 #w3cTPAC
Watch @patrickbrosset give an update on the WebDX #CommunityGroup's work:
▶️ https://youtu.be/Oxv4SUBjIxw
#DeveloperSignals was introduced to help inform future platform work based on #developer feedback. Through the web-features project, an open catalog assigning unique identifiers to web platform features, WebDX connects previously fragmented sources such as specifications, @mdn browser compatibility data, tests, and surveys, helping developers better understand and use the Web.
I have mixed feelings about this CSS-only approach to custom elements. But the way slots are used here is very smart!
If a video plays in full screen, I expect hitting space to pause it. Alas, that often doesn’t work in web apps. Even the native macOS TV.app occasionally has that issue for me.
It feels like it should be easy to test and fix but maybe keyboard usage is generally not enough of a priority.
Relentless AI scrapers pushed DNA Lounge's web hosting bill from $800 to $3,500/month.
That is a $32,000/year cost shift caused entirely by companies training models on their content without permission. AI companies are externalizing their massive training costs onto independent web operators, effectively taxing the independent web to build their proprietary models. 📉
@rauschma Some time ago did read a good blog post about auditing previously unknown codebases. Few of the aliases for Git commands were useful, so documented those to Just tasks, making it a bit easier to start figuring out new codebases. Just has autocomplete, making it useful for project-specific aliases.
https://github.com/d2s/dot/blob/master/justfile#L63 has several more aliases that could be useful for others too. For example:
# What are the most changed files during the whole project?
[group('Audit')]
audit-git-most-changes-since-beginning:
git log --format=format: --name-only | sort | uniq -c | sort -nr | head -20
2/ I’m curious where we’ll eventually end up with using LLMs for coding. I personally don’t find them helpful because writing code helps me think. But I’d consider using them as search engines for large code bases that I’m not familiar with.
1/ @KyleOrl: “AI coding agents generate more code, but not more software”
https://arstechnica.com/ai/2026/10/ai-coding-agents-generate-more-code-but-not-more-software/
Quote:
Any efficiency increased during the actual coding phase, the study authors find, is “absorbed by downstream constraints in the production process”; as “the code review process significantly increases in length, pull requests are more likely to require revisions, and reviewers leave more comments.”
I've warned before that any FOSS project incorporating AI output is doing so at their peril.
Previously people leaned on a federal circuit ruling that was *declined to be taken up by the supreme court* interpreting it as a free-for-all to LLM license-wash any project in translation, or really to incorporate any such materials and they would be public domain.
But that doesn't mean we have an answer! We've yet to see!
Annnnnnnnnd: I think we're likely to have that perspective upended soon.
The third circuit issued a recent ruling in the *opposite direction* of the previously well cited federal ruling, that AI training on copyrighted material is NOT fair use: https://www.courthousenews.com/ai-training-of-copyrighted-material-not-fair-use-third-circuit/
Annnnndddddd.... with a bunch of people trying to make LLM-generated decompilation replacements for Adobe's entire suite, we're likely to suddenly see corporations rear up angrily.
Just wait till someone tries to vibewash a Nintendo game decompilation. Hey, what do you think is gonna happen?