Nearly 5 years of work later, I've successfully closed the Node.js TLS fingerprinting issue: github.com/nodejs/node/.... As of Node 26.4.0, it's possible to match most common TLS fingerprints in Node directly. I've published a library to do all the hard work here: github.com/httptoolkit/...

Have you seen testserver.host/? As part of building HTTP Toolkit I often need a remote servers for testing edge cases, so I've built one! Now fairly mature & stable. It's httpbin.org plus badssl.com plus lots of extras.

Jeg er til det her oplæg, og der er stuvende fyldt. Det er konferencens fjerde dag, folk er trætte og kunne sove længe. Men folk kommer hele tiden ind. De sidder på gulvet og står nede bagved. Det her kommer til at kunne ses i journalistik rundt om i Europa i fremtiden 🥳

I'm speaking at @journalismarena.eu's Dataharvest conf in Belgium this weekend! I'll be teaching investigative journalists how to intercept, interpret & scrape mobile app network traffic, it's going to be a lot of fun 😀 Anybody else I know here attending? Would be great to meet up #dataharvest26

Staged publishing for npm! Finally 🙏 I'm only just starting to test it now, but in theory at least this + trusted publishing could very significantly tighten up the security posture for lots of packages. Would be fantastic to see the current wave of attacks slow down a bit.

Chrome shipped an LLM Prompt API to the web platform. At Mozilla, we oppose this API. Here's why:

Somewhere there's a CEO stuck in a meeting that's in desperate need of amazon gift cards, completely unable to get their team to answer their texts

So, Chrome's "web standard" Prompt API: Mozilla: Opposed WebKit: Opposed Microsoft: Several concerns W3C TAG: Several concerns Developers: Mostly negative Chrome: Ships anyway. A sad time for web standards. But, I guess someone at Google will get promoted, so 'every cloud…'

Tip: NEVER use a random number. A non deterministic "solution" is unworthy of the divine touch of a turing machine

I've been thinking about simonomi.dev/blog/color-c.... Whipped up a quick prototype for HTTP Toolkit's hex view - what do you think? Interesting and more useful than monochrome, or just visually noisy? See if you can guess what each file type is here - answers in the alt text 😀

Just created my first Azure account to migrate HTTP Toolkit from certs to Microsoft's new 'Artifact Signing' setup (azure.microsoft.com/en-us/produc...). The UI is eye opening... Flashback 10 years in UI, impossible navigation, endless "Please update from X"/"Did you know Y is now Z" banners, wow 😬

HTTP Toolkit is now on the @fsfe.org major donor list! fsfe.org/donate/thank... They're doing great work right now like fsfe.org/news/2026/ne... - if you're also keen on open platforms & interoperability do please donate to support them too ❤️

WebSerial has landed in Firefox Nightly !! 🎉 Enable it in about:config and it all just works as expected. Took a brand new ESP32 and had a new Bluetooth proxy added to Home Assistant within 2 minutes 👌

Two papers came out last week that suggest classical asymmetric cryptography might indeed be broken by quantum computers in just a few years. That means we need to ship post-quantum crypto now, with the tools we have: ML-KEM and ML-DSA. I didn't think PQ auth was so urgent until recently.

Damn I got this as well! Just assumed it was spam and ignored this (and the LinkedIn follow up) turns out I dodged a bullet 😅

Finally bit the bullet and bought more RAM! The rumours are true, the prices really are excruciating, more than 4x the price I paid for the other stick 18 months back 🥲

In case you want to understand your TLS clients in depth from Node.js, there's a new v2 release of read-tls-client-hello now live: github.com/httptoolkit/... Also now supported on testserver.host at testserver.host/tls/client-h..., so you can test & debug clients themselves directly.

I've been playing around with agent-powered HTTP debugging -there's a lot of potential here... Even just with minimal data, Claude gets a really good understanding of flows very quickly, amazing for exploring. A quick summary of overall traffic & state flow across ~160 requests & responses:

Mozilla Festival is coming back to Barcelona. 28–30 October 2026 at Recinte Fabra i Coats. Sign up to be first to know when tickets drop⚡ #MozFest mzl.la/47PLTG9

Do I know anybody at GitHub who can help me get HTTP Toolkit into the student pack? I'm happy to do free accounts for students, I've filled out the form a couple of times - they never reply, but students keep endlessly emailing me to ask me if it's included.

Node.js is moving to one major release per year starting with Node 27! 🚀 ✅ Simpler: Every release becomes LTS. ✅ Predictable: Version numbers now align with the year. ✅ New: A 6-month Alpha channel for early testing. https://bit.ly/4rnosLg

Continuing the epic battle to fix TLS fingerprinting in Node (bsky.app/profile/pimt...), I opened two more PRs this week enabling cert compression in Node (github.com/nodejs/node/...) and direct native access to OpenSSL for addons (github.com/nodejs/node/...). With that, it's basically there!

Wow, I sure am glad we have such diversity in the CSS world and that AIs consider all of the options fairly, instead of hypothetically being hyper focused on any specific library.

⚠️ LAST CALL TO WRITE TO CMA: 5pm TODAY ⚠️ Under the current proposal, Apple can keep iOS and iPhone functionality exclusive to its own apps and services. If you want fair access to APIs for competing apps and browsers email 📧 [email protected] See: open-web-advocacy.org/blog/apples-... 🧵👇️(1/5)

Magic link login is fine, session expiry is fine, but for the love of god please don't do both. If you have to re-auth every week, there is little more frustrating that blocking the process waiting for an email so I can click a button, over and over and over...

After implementing web streams in multiple runtimes, supporting them for years, talking with other implementers, dealing with issues... I think it's well past time we talked about something better blog.cloudflare.com/a-better-web...

This looks very exciting: endowment.dev

Everybody's favourite "save me from myself" git hook (github.com/pimterry/git...) has the first new major feature in nearly 5 years: it'll now validate and catch unintended git pushes too 😀

Wouldn't it be nice if HTTP compression suddenly got 90% better for a whole bunch of common web scenarios? Dictionary Compression is here to save the day: httptoolkit.com/blog/diction...

2026 is the year Bluesky and the Atmosphere really come alive here's what's next bsky.social/about/blog/0...

My AI code generation has decided it can generate an inline private key pair by itself, and I think we might be in trouble...

Happy Cloudflare is down once again to all who celebrate

A perfect CVSS 10 🧑🏻‍🍳💋 CVE-2025-55182: Unauthenticated remote code execution vulnerability in React Server Components The vuln is in versions 19.0, 19.1.0, 19.1.1, and 19.2.0: react-server-dom-webpack react-server-dom-parcel react-server-dom-turbopack Upgrade immediately!

Being hit by my first DDOS attack right now, it's all quite exciting!!!

Big milestone: HTTP Toolkit just crossed one million downloads! 🚀 Honestly I didn't think it'd ever get this far, I'm blown away. A huge thanks to all the users, contributors & supporters over the years ❤️. Onwards!

Europe has plenty of problems that need solving. But it’s surprising how the brain-virus of ‘Europe only produces regulations’ has taken root. In reality, EU exports are higher than the US and comparable to China’s. Or in supercomputing, Europe ranks 2nd in the world.

Just in case Shia-Hulud is making you paranoid as well, did you know you can link SSH keys to a Yubikey? ssh-keygen -t ed25519-sk -O resident -C "[email protected]" Requires a tap to confirm any git push. Even if malware steals your ssh key files, they're useless without the physical key.

cloudflare's on-duty IT staff bangs on the doors which I have padlocked from the inside as I calmly break open lava lamp after lava lamp and drink the contents

These AWS & Cloudflare mega-outages are honestly embarrassing as an industry. Eugh. What are we doing??? We have so many tools & processes for ensuring reliability, but somehow two vendors can each single-handledly wipe everything out anytime.

The latest npm attacks & changes have pushed me to set up Trusted Publishing via GitHub Actions, and honestly it's actually fantastic. Didn't realise how much hassle & friction manual publishing was. npm version + push --tags is incredibly convenient (and safer + more verifiable for everyone!)

I've basically been listening to this album on a loop for the last couple of weeks now, highly recommended. I definitely don't like all jazz, but sometimes it really can be spectacular: open.spotify.com/album/5whNm4...

Barcelona is the first city in the world to commit to the UN's #opensource principles: ajuntament.barcelona.cat/digital/en/a... (specifically, these: unite.un.org/en/news/osi-..., including OSS by default, open participation & interoperability) Glad to be building HTTP Toolkit here! Great city.

i write to you with solemn news. i am in paris, writing my life’s only masterwork. i spend my days drinking good espresso and smoking inexpensive cigarettes, writing clear and hard about what hurts. as such, i cannot ‘Log On’ - and friend - i will not attend your ‘laser-focused mesh network webinar’

It's time to make HTTPS the web's default, and reap the full security benefit from years worth of HTTPS adoption! security.googleblog.com/2025/10/http...

tired: it's always DNS inspired: ICANN feel it coming in the air tonight

Curious to see if after yesterday's AWS shitshow (a major outage, sure it happens, but also very poor communication & extremely slow recovery) anybody is considering alternatives? I'm honestly surprised by the level of dominance of AWS, there are plenty of other interesting options out there.

After the recent npm attacks, really feels like the wind is in the sails of passkeys. Unphishable auth suddenly seems like a core requirement! Currently going through providers to make sure I've got my yubikeys everywhere... Surprisingly limited options even in pure infra providers like @bunny.net.

Node v25 is here! github.com/nodejs/node/...

Another year of paying #opensource maintainers for their hard work 🦾 alongside the rest of the OpenSourcePledge.com#opensourcebusinesses, and to celebrate: we're back up on the NASDAQ tower in Times Square!