I haven't posted a crazy XSS vector for a while... Works on every browser

send this to your favorite security researcher

another funny: <div><b id=o>hi</div> <script> alert(o.innerHTML); (o.o).remove(); alert(o.innerHTML); </script>

<div> <i><b>bold</i> <i>also bold</i> </div> <b>also bold</b> <i>also bold</i>

↖ got trolled by quirks mode

Even more cool things are cooking!

meegodows phone

wikipedia speedrun but its clicking through 88x31s

i

the velocity of the text controls the pitch now

i wonder why firefox android feels so much slower than chrome android like on desktop i feel the two are fairly comparable and whichever one is faster/smoother depends on the specific website

ma einar kuuse tiktokis wtf 😭 (see video oli tegelt 2019 aasta striimist)

WHAT is this notification

hey, how've you been long time no see

So after 14 months(?) of work and a lot of frustration barely knowing what i was doing i think i made someting special (!) presenting: a Wine fork for Ableton Live 12 on Linux stable pixel perfect vst support 1st class gnome citizen device hotwire support low latency audio tell ur friends 🥹🥹

b2b? in this household we do t4t

THIS STUDIO MADE THE FAMOUS IDTECH ENGINE AND YOU'RE FORCING THEM TO USE FUCKING **UNREAL**??????????????????????????????????????????????????????????????????? FUCK YOU

it's "prep for interviews" time which means it's also "fiddle with portfolio" time the <abbr> tag is often neglected in HTML so I decided to give it a home on my site and make it expandable inline

The sudden sinking feeling when you're given a codebase to work on, then you notice the HTML tags are all written in uppercase, that there is no document declaration, and that there are conditional comments for Internet Explorer.

people telling me not to use chrome as if im not running multiple browsers in multiple vms at all times (+ vnc to a mac box)

so turns out you can *still* use ublock on chrome if you just inspect element it lmfao

til css physical units used to actually represent their real-word counterparts

kind of crazy how google's ai overview uses ai-generated articles based on my blogpost as sources, instead of, yknow, just using my original blogpost

CSS var syntax is verbose. Prefixes make it worse but they are critical for the future maintenance, ecosystem compatibility, and readability of your source code. A potential solution:

quick proof of concept of the leak idea though @pspaul95.bsky.social reminded me of their version of essentially the same thing (albeit with a bit different of an implementation): blog.pspaul.de/posts/bench-...

i think im cooking

i wish firefox mobile had the ability to zoom the page like ctrl +/- does on desktop it's the main reason i'm still using chrome for reading blogs and articles on my phone

now that i think about it, it may be possible to create a fontleak-like css text exfil tool entirely within css itself with no external fonts you can do some local font-face and element sizing shenanigans, and you can also have a cpu in css to process everything internally

a pattern i've noticed with various slopped summaries of my work is that ai tends to ignore new knowledge and stick to what it is already familiar with, completely ignoring the findings of my work in favour of a narrative that is easier to text autocomplete

some dumb 128 byte golf i wrote for when youre not allowed to use innerhtml (l=>l[y=`split`]`="`.map(r=>(a&&e.setAttribute(a,...r[y]`"`),a=r[y]` `.pop()),e=document.createElement(l[y]` `[a=0].slice(1)))&&e)(`<img src="pic.png" style="border 1px solid" foo="bar baz">`)

fediverse drama: instance admin tries to convince one of the biggest instances to ban gay porn, claims to stand for free speech and not be homophobic because their lgbt acquaintances don't like gay porn either, compares gay porn to gore half the replies are (cw'd!) queer nudes

When I asked a security engineer in my company if there should be some reaction to people adding "note taker bots" to internal calls, their response was that it requires a balanced approach. FFS.

I proposed this feature in 2023. Safari implemented in 2024. Chrome just shipped it too. This means that it's now a matter of time before it’s available for >88% of web users. Timeline: lea.verou.me/specs/#conti... “But standards are so slow!”

navigator.clipboard.read() can be inefficient if the clipboard contains multiple representations of the same data, some really big and which you don't need. We're fixing this in Chromium! Now the API lists the available formats first, and only reads data when you select one of them. Learn more ⬇️

i leave autoplay on after ONE sound effect video and suddenly im on colors youtube what the hell 😭😭

wondrous ui

thats not what i wanted thats just a github pages link that doesnt even exist and it took you 3 minutes to generate it

uh, i guess thats one way to do it

i got trolled by a fake screenshot :( so i deleted the post lol

in a decade pirates will be the only people who actually own anything

can Chrome not ship with a trimmed CLDR, it was so nice knowing that you can just grab language names through Intl.DisplayNames and not have to hardcode it

i keep my campaign promises! (pictured: klxpy before i released the s/i/x hack)

discord switched to klipy now, so here, new s/i/x hack from yours truly

fops = "🦊" fops.length // 2 [...fops][0] == fops // true i 🧡 javascript

til that ℃ is a single unicode character

🪨 Visual Basic on the PC w/Windows 3.1 🛠️ Apple wasn't the only company to yank a popular #visualprogramming tool from fans. I learn VB with a "teach yourself" book, get pedantic about Helvetica, and briefly muse about slop. #retrocomputing #windows #visualbasic stonetools.ghost.io/visualbasic-...

oh no, i thought today was friday, i specifically timed my post so that the employees in the US could still have a full workday to look at the post if there's anything they need to do about it but it's saturday...

so this was the MD5 hash for "le sexxxxy sex spam", which is the description reddit admins internally gave to a domain they blocked

new blogpost!! this one is about that one time i got a fun peek into the internals of reddit's anti-spam systems, and thus could learn a lot about how they deal with spam using spammit, spamurai, and other in-house tooling. have fun <3 lyra.horse/blog/2026/06...

OneShot steam sale six dollar store.steampowered.com/app/420530/O...