Newslurp

<< Stories

Exploiting CSS 🔓, lessons from failed startups 🎓, GitHub Actions downsides 📉

TLDR Web Dev <dan@tldrnewsletter.com>

January 21, 12:08 pm

TLDR WebDev
GitHub Actions has limitations when used with a large monorepo and frequent deployments. A major issue is the difficulty of enforcing required checks ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌  ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ 

TLDR

 TLDR Web Dev 2025-01-21

🧑‍💻

Articles & Tutorials

Double-keyed Caching: How Browser Cache Partitioning Changed the Web (6 minute read)

Double-keyed caching changes how browsers store resources by partitioning cache entries based on both the top-level site and resource URL, preventing cross-site tracking and timing attacks. This is better for security, but it increases cache misses, bandwidth usage, and performance costs.
Build systems and bundlers (14 minute read)

This article explores the relationship between bundlers and build systems, arguing that bundlers can be viewed as build systems with additional task descriptions. It analyzes various build systems (Make, Excel, Bazel, and Shake) based on their schedulers (topological, restarting, and suspending) and rebuilders (dirty bit, verifying traces, and constructive traces). Bundlers are then examined through this lens, and the approaches in Webpack, Turbopack, Vite, and Rspack are compared. This comparison revealed that many lack features already present in established build systems. A path to having features like minimality, early cutoff, parallelism, and remote caching/execution is presented.
🧠

Opinions & Advice

I am (not) a Failure: Lessons Learned From Six (and a half) Failed Startup Attempts (23 minute read)

This author goes over lessons from his six-and-a-half failed startup attempts and a failed academic career. His initial foray into startups was after the Google IPO, where he was an early employee. These failures spanned various industries, from networking technology to private jet chartering and financial software, with challenges in execution, market dynamics, and securing funding. The author attributes their current happiness not to financial success, but to self-acceptance and the ability to persevere through repeated failures.
I'll think twice before using GitHub Actions again (5 minute read)

GitHub Actions has limitations when used with a large monorepo and frequent deployments. A major issue is the difficulty of enforcing required checks across multiple independent modules within the monorepo, requiring cumbersome workarounds. This author criticizes the lack of reusability and maintainability in GitHub Actions workflows, leading to complex YAML files and potential errors.
Will AI Eat The Browser? (8 minute read)

The browser, originally designed for document-centric navigation, is increasingly ill-suited for the emerging AI-driven, immersive web experience. Devices like Apple's Vision Pro show the limitations of traditional browsers, especially when integrated with AR, VR, and generative AI. The future of the browser will likely evolve into a more personalized, AI-centric system.
🚀

Launches & Tools

Master Next.js Metadata for SEO and Engagement (Sponsor)

Unlock the full potential of your Next.js app by customizing metadata to enhance SEO, strengthen branding, and boost user engagement. This guide solves common developer challenges like optimizing search visibility, managing dynamic content, and ensuring consistent metadata across pages. Learn practical techniques to elevate your projects effectively.
Searchlight (GitHub Repo)

Searchlight is a new, open-source macOS PostgreSQL client. It provides a streamlined interface for database management and query execution, focusing on efficiency and quick access to PostgreSQL databases. The application has features such as connection management, database browsing, data manipulation tools, and a query editor with autocomplete and syntax highlighting.
Repomix (GitHub Repo)

Repomix is a command-line tool and web app that packages entire code repositories into a single file. Optimized for use with LLMs, it supports various output formats (plain text, XML, and Markdown) and offers features like token counting, customizability, and security checks using Secretlint.
ARIA DevTools (Chrome Extension)

A Chrome extension to easily spot missing ARIA labels, misused ARIA roles, and incomplete keyboard support in your web app. With ARIA DevTools, you see your website the way screen readers present it to the blind users.
🎁

Miscellaneous

Reverse Engineering My #1 Hacker News Article (8 minute read)

This author's blog post unexpectedly went viral on Hacker News, receiving 100,000 reads and becoming a top-ranked article. The post's success was from several factors, including a genuinely curious and personally engaging topic (a "spot-the-difference" trick), a catchy and simple title ("I've acquired a new superpower"), and an engaging, personal writing style.
Reverse Engineering Call Of Duty Anti-Cheat (39 minute read)

Someone reverse-engineered the user-mode anti-cheat (TAC) in Call of Duty: Black Ops Cold War. TAC utilizes various protection methods, including Arxan obfuscation, runtime executable decryption, and pointer encryption, to hinder analysis and cheat attempts. This post describes TAC's detection mechanisms, such as API hook detection, debug register checks, and detection of external overlays and cheat logging techniques, along with its process termination methods.
The success of Interop 2024! (4 minute read)

Interop 2024, an annual collaboration between browser engine teams to improve the interoperability of web technology, achieved a major milestone, with 95% of tests passing across Chrome, Edge, Firefox, and Safari. Some of these advancements included full URL interoperability, 99.7% accessibility test pass rates, and the successful implementation of the font-size-adjust property.

Quick Links

Cascading Spy Sheets: Exploiting the Complexity of Modern CSS for Email and Browser Fingerprinting (Paper)

This paper explores how modern CSS features can be exploited for user fingerprinting, bypassing privacy measures in both browsers and email applications, even when JavaScript is disabled.
Ruff (GitHub Repo)

Ruff is a fast Python linter and code formatter written in Rust.
The testing pyramid is an outdated economic model (5 minute read)

The traditional testing pyramid model is outdated due to advancements in technology and development practices.
Kronotop (GitHub Repo)

Kronotop is an early-stage, Redis-compatible, distributed, transactional document database built on FoundationDB that offers features like ACID transactions, an MQL-like query language, and horizontal scalability.

Love TLDR? Tell your friends and get rewards!

Share your referral link below with friends to get free TLDR swag!
Track your referrals here.

Want to advertise in TLDR? 📰

If your company is interested in reaching an audience of web developers and engineering decision makers, you may want to advertise with us.

Want to work at TLDR? 💼

Apply here or send a friend's resume to jobs@tldr.tech and get $1k if we hire them!

If you have any comments or feedback, just respond to this email!

Thanks for reading,
Priyam Mohanty, Jenny Xu & Ceora Ford


Manage your subscriptions to our other newsletters on tech, startups, and programming. Or if TLDR Web Dev isn't for you, please unsubscribe.