philo23

Yep, I was a little surprised about that too, seem like it is valid though https://developer.mozilla.org/en-US/docs/Web/HTML/Reference/...

The main use case I was thinking of is being able to use an inline SVG, but with external resources inside of it (like say a CSS background image using url(...)) in such a way that it ends up loading that embedded content in a cross-origin anonymous way and blocking all embedded scripts. That way someone can't make requests to CSRF exploitable URLs by setting an embedded images to something like example.com/my-submission/favourite

But also so that setting up a CSS transform: scale(10000) can't take over the entire viewport, it'd be constrained to an iframe-like boundary (exactly like an <img>) but still remain as an inline SVG, sort of like an <iframe srcdoc>. So scripts on the parent/host HTML document can still manipulate it like the rest of the DOM, but the inner <svg> elements are all "inert" for want of a better word.

Actually I don't know off the top of my head what happens with an SVG file inside of a <img> when it references external images (either cross-domain or not.) I know scripts and animations get disabled, so I'd take a guess and say some CSS gets blocked too.

Again I've not really thought terribly hard about it, or if it's actually useful at all, and I'm betting it'd be filled with even more foot-guns than there are right now. I'm just thinking out loud.

How can you prevent it from accessing a parent doc when its not a separate document.

By turning it into a document boundary when you use the sandbox attribute, kinda similar to loading an svg file inside of an <img> tag.

and yeah you could get 90% of the way there with an iframe srcdoc, but I was imagining some kind of cross between an <iframe> sandboxed into its own origin, and an <img> where it still has its own intrinsic size.

but it was mainly just a throw away thought, I've not really thought it through much deeper than that.

It'd be nice if there was a sandbox attribute you could add to inline <svg> tags, like the <iframe sandbox> attribute that'd let you opt out of all the potentially "dynamic" stuff inside of an SVG like scripts and event handlers, or even just literally sandbox the entire thing from accessing the "parent" HTML page's context/cookies/etc just like an iframe.

I'm sure it'd just open up a whole other can of worms though... not to mention having to wait for browsers to actually support it.

The real solution here is definitely CSP + basic sanitisation though.

Little bit of extra detail about static closures in PHP for anyone interested: https://www.php.net/manual/en/functions.anonymous.php#functi...

Just tried it on my Mac and sadly it doesn’t seem like it. I’m still on Sequoia, so possibly it does it on Tahoe, but probably unlikely. That’s a shame.

It’d be nice if someone on the Safari team added this though to match Chrome and Firefox!

It's not quite the same, but I've moved to using *.localhost for all my local web dev work. All modern browsers will resolve *.localhost to 127.0.0.1 internally. No need to setup any DNS resolvers or edit your hosts file.

But that only really helps you when you're dealing with websites in a browser, and when you want the address to resolve back to your local machine. So it wont help you with other programs like python/wget/etc or any calls you make to getaddrinfo()

Little bit saddened the sqlite provider doesn't use the SQLite archive format under the hood. Seems like it'd be a good fit for what they're trying to achieve + give you an easy way to create/extract the files out of the virtual file system.

The sqlar schema is missing some of the info thats being stored atm, but there's nothing stopping you from adding your own fields/tables on top of the format, if anything the docs encourage it. It is just a sqlite database at the end of the day.

https://www.sqlite.org/sqlar.html

I'm not sure why the Falkirk Wheel keeps getting posted to HN, but hey I'm not gonna complain!

I'll repost what I shared last time though, there's another much older boat lift on the canal network that solves a similar problem of transporting boats from the canal up and down to a river, but built with Victorian engineering instead (though it's been retrofitted a few times) called the Anderton Boat Lift, and it's worth a visit!

https://canalrivertrust.org.uk/things-to-do/museums-and-attr...

The UK's canal network as a whole is fantastic, and definitely worth a day out on if you've got the time.

Just a guess but why do I get the feeling it’s because someone who setup sei.co.jp in Azure Entra (aka Azure AD) some how managed to add/claim the domain “example.com” against their companies tenant.

It’s clearly not using the DNS records for discovery because they don’t exist, the only other option I can see is some weird fall through or hard coded value and it seems like an odd one to pick.

The relative date formats are super useful. It can get a bit confusing when there's timezones involved though.

https://www.php.net/manual/en/datetime.formats.php#datetime....

Yep, locally where I am there’s one postcode for all the houses on one side of the street (all the even numbered houses) and another for the opposite side (all the odd numbers.)

Presumably it helps a lot with validating the address is correct, kinda like a checksum, and also probably helps with how deliveries are organised by the local office before the postie is sent out with them all.

Kinda meta, but this is the first time in a long time where I've put only the first half of my postcode in expecting it not to work and been surprised. Most of these "find your nearest XYZ" site require the full postcode which is just unnecessary unless you're looking for a fairly precise location. A full postcode can narrow your location down to an individual street, so its nice not to give too much away if you can.

For anyone not in the know, UK postcodes are made up of two parts: a general area (the outward code) and then a more specific one (the inward code.) Generally speaking a postcode + house number will be good enough to get a letter delivered to the right place, though the sorting office might not be too happy with you...

The format [0] is roughly: AB12 3CD, though the number of letters/numbers on the left side can vary a bit. As far as I know the second set of numbers is always 1 digit though, so that's how you can easily split the two sides of it to format it nicely. There's a couple of special ones that break the rules though.

[0] https://en.wikipedia.org/wiki/Postcodes_in_the_United_Kingdo...

My favourite thing about these is that nearly everyone just kind of agreed on using that same pixel font for the text on the right side.

A long while ago I wrote a very simple static site generator for personal site, mainly just to play around with using GitHub/Cloudflare pages to host my personal site.

Then a couple of months ago I started comparing the big SSG tools after wanting something a bit less held together with duct tape... after a lot of experimenting I settled on 11ty at the time, but I really don't enjoy writing Liquid templates, and writing reusable components using Liquid felt very clumsy. I just wish it was much easier to use the JSX based templates with 11ty, but every step of the way feels like I'm working against the "proper" way to do things.

So over Christmas holiday I been playing around with NextJS SSG, and while it does basically everything I want (with some complicated caveats) I also can't help feel like I'm trying to use a oil rig to make a pilot hole when a drill would do just fine...

Anyone got any recommendations on something somewhere in between 11ty and NextJS? I'd love something that's structured similar to 11ty, but using JSX with SSG that then gets hydrated into full blown client side components.

The other thing I've been meaning to try is going back to something custom again, but built on top of something like Tempest [1] to do most the heavy lifting of generating static pages, but obviously that wouldn't help at all with client side components.

[1] https://tempestphp.com

My two favourite bits of git add -p that aren't mentioned here:

the / (search) command to search unstaged hunks for a specific keyword rather than having to jump through all the individual changes you've made when there's lots.

and the e (edit) command to manually split out two changes that end up in one hunk that I'd rather have in individual commits.

It's not exactly the same, but I definitely remember Microsoft releasing some kind of conversion tool around the start of Office 2007's life that could convert the newer XML based files into the older '03 compatible files. Or maybe it was the other way around... No idea if that tools still kicking around somewhere.

From that diff it looks to me that if ~/.mozilla exists OR if MOZ_LEGACY_HOME is set it uses ~/.mozilla, otherwise it uses the $XDG_CONFIG_HOME/.mozilla directory instead.

So no migration to the XDG directory, but also no throwing away your existing data either.

I believe that was part of the original plan for Proton, but with the success of the Steam Deck that got shelved and it moved to a focus purely on Linux.

I don't think it's ever likely to return any time soon, but it'd be cool if it did. Valve seemingly have very little interest in macOS at the moment.

CodeWeavers work closely with Valve and the Wine project to improve compatibility with games, and Apple's own Game Porting Toolkit is based on CodeWeavers work on Wine too. So all the pieces are there in theory.

Good to hear, that’s what I was hoping that it was doing.

Maybe this is a lack of understanding on my part, but this bit of the explanation sets off alarm bells for me:

Under the hood, we're building a client-sourced RAG for the DOM. An agent's first move on a page is to check a vector DB for a known "map." ... This creates a wild side-effect: the system is self-healing for everyone. One person's failed automation accidentally fixes it for the next hundred users.

I think I'd like to know exactly what kind of data is extracted from the DOM to build that shared map.

Yeah I had an official silicone iPhone case that was being used for about 8 months, replaced it with a third party leather one about a month ago and already within that time I noticed that the original one has gone all slimy just like those old plastics. There must be something about using it day to day that keeps it from breaking down.

I don't know why Fred keeps getting posted to HN, but I love it. and I'm glad more people get to see his work.

Something that might not be immediately obvious from this clip is that all the sound effects you're hearing of the planks bouncing and scraping off the bricks, the iron dogs being hammered into the brickwork or wind blowing etc, is all recreated and recorded after the fact in some BBC sound studio. There's no sound guy up there with a boom mic or even a lapel mic recording, yet all the sound effects are perfectly audible. Even the ones around the other side of the chimney. If they didn't dub them in afterwards the video recording from the ground level would be quite boring!

Though there are a couple of other recordings of Fred with a one-man camera crew up at the top once he's got the platform fully setup.

Besides, I suspect if he was mic'd up there'd be quite a bit more swearing than you'd be able to get away with on the BBC!

I can't say I miss Launchpad all that much, but I guess its nice to have a replacement for people who do. I've always used Spotlight via Cmd + Space to launch stuff.

The two things I always wished you could do in the old Launchpad (and would have made me hate it a lot less) are:

Configuring the size of the icon grid. Just give me the option to make it denser, the defaults were silly on external displays.

and the other is being able to completely exclude the nonsense apps like the 6 different Adobe Creative Cloud icons that would end up in there. Though it'd also be nice if Adobe didn't spew them all over the place in the first place...

It stands to reason that Apple wouldn't have developed this feature if they weren't using it. Where? We have no idea.

If I had to guess, probably in the iCloud settings inside of the Settings app. Also in the App Store/Music/TV account page (when you tap on your avatar in the top right of the app.) A bunch of those pages have quite well hidden web views pretending to be native ones, mainly loading things from the iTunes backend services (the give away is normally that you can long press <a> links and a web page preview pops up.) It's probably being used for the user guide inside of the Tips app as well.

That's where I'd be looking at least.

The first time I saw this technique was while trying to figure out how GitHub styled the keyword:value tokens in their search box. It's a very cool technique, and you've done a very nice job of integrating it with a markdown parser!

Only down side to it is that you cant apply any padding to the styled inline elements.

Genuine question, what kind of problems would using fibers help with?

To be clear, my point wasn’t that I think fibers are useless or that people shouldn’t use them. I think it was a great addition.

Just that they wouldn’t be directly useful to the average PHP dev, until they’re being used by frameworks/libraries/extensions, say for example: a HTTP library that can fire off multiple requests asynchronously.

Personally I've never come across any problem in PHP that I feel like Fibers would help me solve.

Having Fibers in PHP is a nice addition but it definitely feels more like plumbing for other PHP extensions/frameworks to use, rather than something the average dev would use themselves directly day to day.

A bit off topic, but on the copying issue with dashes, you can wrap the whole key in a span styled with “user-select: all” to improve the copying experience. Well, on the web at least!

I don't think quite the same kind of tech, but this kinda reminds me of the "3D" pixel art sprite editor thing in Smack Studio

https://youtu.be/sM3ss-lY1zU?t=10