'%20d='M69.364%2019.146c36.687%2027.806%2076.147%2084.186%2090.636%20114.439%2014.489-30.253%2053.948-86.633%2090.636-114.439C277.107-.917%20320-16.44%20320%2032.957c0%209.865-5.603%2082.875-8.889%2094.729-11.423%2041.208-53.045%2051.719-90.071%2045.357%2064.719%2011.12%2081.182%2047.953%2045.627%2084.785-80%2082.874-106.667-44.333-106.667-44.333s-26.667%20127.207-106.667%2044.333c-35.555-36.832-19.092-73.665%2045.627-84.785-37.026%206.362-78.648-4.149-90.071-45.357C5.603%20115.832%200%2042.822%200%2032.957%200-16.44%2042.893-.917%2069.364%2019.147Z'/%3e%3c/svg%3e)
I can't remember the last time a Safari release caused so much buzz in the web dev community. Half my feed seems to be excited posts about it. It's a good one!
December 13, 2025 at 8:17 AM UTC For crying out loud, Phil. You're British – use the spaced en dash like god intended.
December 12, 2025 at 9:13 PM UTC ECMA has just published the first edition of ECMA-429: the Minimum Common Web API, defining a baseline set of platform APIs for browser and JavaScript server runtimes. An important milestone. Well done to @jasnell.me and WinterTC for getting this across the line.
ecma-international.org
ECMA-429 - Ecma International
This Standard defines the 2025 snapshot of the Minimum common web API, a curated subset of APIs defined by web platform standards from W3C and WHATWG, which is intended to define a minimum set of capa...
They're much older than that. The code has been in there for years.
December 12, 2025 at 2:02 PM UTC I mean, you're right that it doesn't need an agent for this, but this is made by Cursor which is literally a coding agent company, so I'd forgive them for releasing a tool that uses one.
December 12, 2025 at 11:50 AM UTC He's stupid to not check, or more likely he does know who he is and is too stupid to care
December 12, 2025 at 9:05 AM UTC The agreement is to allow them to use copyrighted material in the *output* not the training. Unlike Chatgpt, Gemini has basically no guardrails against that right now
Annual reminder that Time Person of the Year isn't supposed to be the best person of the year, it's the person who influenced the events of the year "for better or worse". By that criterion, 2001 was the worst decision, and 1938 was correct.
December 12, 2025 at 8:45 AM UTC A chance to hire an Astro core maintainer! Yan would be an incredible hire for anyone who needs an Astro expert, or someone with experience leading a very active OSS community. He'll also track down every tiny error in grammar or punctuation in your docs. Those misused commas don't stand a chance.
December 12, 2025 at 6:41 AM UTC The @cloudflare.social threat intelligence team have published this great blog with a really detailed breakdown on the exploitation activity against React and Next.js. Some massive numbers of attempts, as well as confident attribution of the attacks as mostly coming from Chinese state actors.
blog.cloudflare.com
React2Shell and related RSC vulnerabilities threat brief- early exploitation activity and threat actor techniques
Early activity indicates that threat actors quickly integrated this vulnerability into their scanning and reconnaissance routines and targeted critical infrastructure including nuclear fuel, uranium a...
You know the drill: upgrade right now. These aren't as serious as last week's RCE, but they're still bad. Platforms are blocking these, but once again you shouldn't rely on it.
December 11, 2025 at 9:47 PM UTC Obviously billionaires shouldn't exist, and I've no idea where he sits on the Larry Ellison – Bill Gates axis of how to burn spare cash, but as vanity projects go building great open source software is better than a lot of alternatives
December 11, 2025 at 3:15 PM UTC "The monetization strategy is that my bank account has three commas mate"
They can sign off the end result – the architectural plans, the contract, the code. Those sorts of things should be able to be understood by an expert, even if they didn't create them.
December 11, 2025 at 4:14 AM UTC Ooh, I was looking for something that supported that recently. I was trying to get LLMs to give me recommendations based on my ratings of other books. I ended up doing a full export from Goodreads and uploaded it into context, which isn't ideal.
December 10, 2025 at 5:39 PM UTC Not the greatest example, considering what the 2024 Nobel Prize for chemistry was awarded for
December 9, 2025 at 10:24 PM UTC And those Japanese ones are little ones that fit perfectly on the side of a saucer
December 9, 2025 at 4:32 PM UTC My clever wife has written a book that's being published in the UK by Faber in April. As one of the few people who has already read it, I can say in a totally unbiased way that it's really good and interesting. Wolves and hares and will-o'-the-wisps! Pre-order it from your local bookshop! #booksky
December 9, 2025 at 4:03 PM UTC These, on the other hand, are amazing and taste exactly like a cup of tea
They taste exactly as you'd expect – a digestive with a bland, excessively sweet bit on top
December 9, 2025 at 12:27 PM UTC White chocolate digestive. Continuity – it's a variant on a classic. Dynamism – it's not the normal milk or dark. A suggestion of what's possible – maybe other sorts of chocolate on top?? Hopefulness – I hope there's proper milk chocolate too, because white chocolate is a bit bleh
December 9, 2025 at 12:13 PM UTC I think mainly it's just people don't think of it, because they don't use them. A lot of software make it easy to add a feed, but don't enable them by default. Often a quick nudge is enough to get them to enable it.
December 9, 2025 at 7:21 AM UTC Why yes, I did spend £50 to go to the cinema yesterday to watch a movie that's going to be on Netflix on Thursday. I have no regrets.
December 8, 2025 at 8:04 PM UTC Maybe not recently. I'm the last person to defend Meta or Vercel, but this is the first vulnerability of this severity that I know of from these frameworks. It's not like Drupal, where there was a serious CVE every few weeks when I used to work with it
December 8, 2025 at 7:46 PM UTC If it wasn't clear: large numbers of Next.js sites are being pwned right now by attackers. If you don't want every script kiddie, cyber criminal or nation state APT group with full access to your site, stop everything and upgrade right now. Then rotate all your secrets.
December 8, 2025 at 9:48 AM UTC And even if it's only accessible through a WAF you should still update, because attackers are actively trying to bypass the WAF rules, and no WAF is 100% effective. Don't be complacent! Upgrade right now!
December 8, 2025 at 9:45 AM UTC If you are running a vulnerable Next.js or RSC app behind Cloudflare or other WAF, but your origin is still accessible directly from the internet then you are not protected! Attackers are iterating IP addresses so you will probably be found. Upgrade right now!
December 8, 2025 at 9:42 AM UTC It's very different from those, and hard to describe if you haven't been.
December 8, 2025 at 8:51 AM UTC This is very true. Getting good at that has been massively useful for my career.
December 8, 2025 at 7:34 AM UTC It's worth persevering. It's a much more thoughtful critique than those bits might suggest. He doesn't try to claim that LLMs aren't useful. His criticism is based on the economics, and is one that I more agree than disagree with.
December 8, 2025 at 7:30 AM UTC Ok presumably you know about this but to answer my question for anyone like me who missed it when it was released, this is super interesting. A hybrid approach that uses ML for small scale stimulation, with a more traditional physics solver for large scale processes, but rewritten to run on GPUs.
research.google
Fast, accurate climate modeling with NeuralGCM
Architecturally are climate models similar to weather models? Could approaches like WeatherNext form the basis for new climate models?
December 8, 2025 at 7:12 AM UTC Please treat the WAF mitigations as temporary protection to give you time to upgrade. Attackers are actively trying different ways to bypass the protection rules.
December 6, 2025 at 8:08 AM UTC The original React2shell PoC is now public. This is as bad as it gets – full RCE. You must upgrade now. There are mitigations in place in CDNs including Cloudflare, Netlify, Vercel and AWS (and sites on Workers aren't vulnerable to this sort of attack), but there are variants in the wild now.
github.com
GitHub - lachlan2k/React2Shell-CVE-2025-55182-original-poc: Original Proof-of-Concept's for React2Shell CVE-2025-55182
Original Proof-of-Concept's for React2Shell CVE-2025-55182 - lachlan2k/React2Shell-CVE-2025-55182-original-poc
Cloudflare was down for half an hour this morning, and it was caused by work we were doing to try to mitigate the React CVE. (Seriously, people: upgrade Next.js/React Router etc right now)
x.com
Dane Knecht 🦭 on X: "We are aware of the issue impacting the availability of Cloudflare’s network. It was not an attack; root cause was disabling some logging to help mitigate this week’s React CVE. Will share full details in a blog post today. Sites should be back online now, but I understand the" / X
We are aware of the issue impacting the availability of Cloudflare’s network. It was not an attack; root cause was disabling some logging to help mitigate this week’s React CVE. Will share full details in a blog post today. Sites should be back online now, but I understand the
That surprises me! I don't think it *should* work right now. WHat did you override?
December 4, 2025 at 7:55 AM UTC The strange thing is that that doesn't look like a description of "Plan" at all. Or is it unrelated to plan mode?
November 30, 2025 at 7:18 AM UTC For me, it's when it's been created from scratch just by prompting, with little or no human review of the code. It's neutral to me, but implies disposable, single-use things that were never meant to be maintained, so would be derogatory if it was something meant for production.
November 30, 2025 at 12:56 AM UTC Instead of using low-paid gig economy workers, they're replacing humans with robots.
November 29, 2025 at 2:28 PM UTC When should we have stopped? When did we have exactly the right tools?
November 29, 2025 at 7:20 AM UTC Former professional chef here: every decent kitchen has a shelf of books. We used recipes all the time.
November 28, 2025 at 10:52 PM UTC Taking away benefits always polls well, unless it's from pensioners.
November 27, 2025 at 9:04 PM UTC The subject, her expression, the location, the composition. And it's a tell, not proof.
November 27, 2025 at 8:54 AM UTC They also did so much pitch-rolling that everyone was preemptively angry, regardless of what actually ended up in it.
November 27, 2025 at 7:57 AM UTC Asking Gemini is the only way, I think, and by all accounts even that is not hard to bypass. It catches the restaurant pic too. I like how here it clarifies that even though it's AI-generated, the recipe is good.
Honestly the closest thing to a tell is the subject. It looks like the stereotypical AI-generated "fantasy girlfriend" pic that engagement bait accounts share on Twitter, but just better quality.
November 27, 2025 at 7:36 AM UTC This fundamentally misunderstands the software development process. I can see if the code is good. A large part of my job is reviewing code written by other people. I review LLM code in the same way. It's not perfect, but nor is code written by humans. That's why we (imperfectly) review it all.
November 27, 2025 at 7:22 AM UTC Do you really think the correlation literally inverts if you change it to "used in the past week"?
November 27, 2025 at 6:50 AM UTC India and Nigeria, from those I've seen. Both countries with rich traditions of online scams
November 27, 2025 at 6:44 AM UTC Lots of different things! That's the point – it's useful in lots of different ways. For me the killer app is programming, but I also find it useful for research.
November 27, 2025 at 6:37 AM UTC I really think that's just a Bluesky thing, and not backed up by the data. Younger people use it more. www.pewresearch.org/short-reads/...
800 million people a week find chatgpt has utility for them, and tens of millions of those find it useful enough to pay for. It has a lot of weaknesses and drawbacks, but arguing that it's not useful is very hard to sustain.
November 27, 2025 at 6:07 AM UTC That article says that around 5% of users are paying, so about 40 million people
November 26, 2025 at 11:30 PM UTC I don't think we have anything public yet. We're still interviewing candidates at the moment. I expect we'll share more details next year after the first cohort are done.
November 26, 2025 at 8:46 PM UTC For 1, I really don't know, and it is a real concern. As for whether one person can be better than another at using an LLM: absolutely they can. It makes a huge difference, and I'd go so far asa to say that explains most of the difference in experience that people have with them.
November 26, 2025 at 3:13 PM UTC At Cloudflare we're massively increasing the number of interns we're hiring, in large part because they tend to be so good at using LLM tools.
blog.cloudflare.com
Help Build the Future: Announcing Cloudflare’s Goal to Hire 1,111 Interns in 2026
We are incredibly excited to announce our most ambitious intern program yet: Cloudflare aims to hire as many as 1,111 interns over the course of 2026.
Senior principal engineer here with 25 years of experience. It's true it doesn't replicate the full scope of my job. It does however make me massively more productive in the parts where it can help. I'm not vibe coding: I'm delegating or pairing with it, and reviewing its code like it's a junior dev
November 26, 2025 at 8:57 AM UTC Well done. I'm sure you're still aware of the concept of them. People have a hugely inaccurate idea of how much power AI uses. There's a lot of scolding for using AI that you don't get for things that use a lot more power, like video games.
November 23, 2025 at 7:24 PM UTC Loved BASIC and HyperCard as a kid but didn't know coding could be a job. Trained and worked as a pastry chef. Got 1st gen iMac and discovered web dev and PHP. Quit the chef job and founded a startup at the peak of the dotcom bubble.
November 23, 2025 at 8:44 AM UTC Good idea. In most cases I doubt they even copied and pasted: I think they just asked their LLM agent to open an issue or reply
November 21, 2025 at 6:57 AM UTC Yeah, using an LLM to write an issue is bad, but using one to write the comments is unforgivable.
November 21, 2025 at 6:41 AM UTC I'd be up for talking about Astro and the other stuff I'm building!
November 21, 2025 at 6:35 AM UTC I give my arguments here
github.com
Remove streaming support · withastro roadmap · Discussion #1247
Summary I propose removing support for streamed rendering in SSR, in order to improve performance and unlock a number of features. Background & Motivation Astro supports streams in on-demand render...
It's about perspective. If you want by the replies you get on here you'd think LLMs were uniquely bad for the environment, whereas both of those examples would use far more energy
November 20, 2025 at 5:22 AM UTC Do you ask this when people tell you they've played videogames or taken a non-essential drive in an EV?
November 19, 2025 at 10:09 PM UTC Whoa. This would be incredible for frameworks like Astro. Enough to make me reconsider my dream of removing streaming support.
November 19, 2025 at 6:09 PM UTC @philhawksworth.dev got accused of this too! Your voices are unrealistically pleasant.
November 19, 2025 at 1:24 PM UTC Try `test.only` and then run 1000 miles and never let it near your projects
November 19, 2025 at 12:06 PM UTC This is a great post mortem, and as someone who only joined Cloudflare last month it's a hell of a lot more understandable than our internal incident channel
November 19, 2025 at 8:54 AM UTC If there's anyone here who can read 19th century Farsi calligraphy, maybe then can see if it's true!
November 18, 2025 at 8:45 PM UTC Every time a new vision model comes out I test it with some photos like these of docs from my grandfather's papers, asking them to transcribe and translate them. They all lie and make shit up. Gemini 3 is the first one that gives a response that matches the context that I know about them.
cloudflare's on-duty IT staff bangs on the doors which I have padlocked from the inside as I calmly break open lava lamp after lava lamp and drink the contents
November 18, 2025 at 1:59 PM UTC The ignorance is about the specific numbers, not the fact that Britain was doing it. It's absolutely taught in schools, and there are memorials, museums, events, TV etc. The main difference is that there were never large numbers of enslaved people in the UK, so the legacy is buildings not people
November 17, 2025 at 7:29 AM UTC
We wrote a blog! If you're curious about how remote bindings work in Wrangler, give it a read: blog.cloudflare.com/connecting-t...
blog.cloudflare.com
Connecting to production: the architecture of remote bindings
Remote bindings allow you to connect your local Worker code to deployed Cloudflare resources like R2 and D1. Come along on the technical journey of how we built this feature to create a seamless local...
It's really shocking. I'm glad that in the UK it's all taught with phonics.
November 12, 2025 at 3:45 PM UTC I recently bought a new kettle, and every day since I first searched for one it now sends me one of these. A reasonable guess, but every day?
Side note to this – and this is a good article – but it's amazing that the VPN affiliate link business is so lucrative that TechRadar employs a "VPN Managing Editor" to write all these articles to rank on "best VPN" searches
November 12, 2025 at 9:50 AM UTC Claude has really taken my "don't bowlderise" custom instruction to heart and become surprisingly foul-mouthed when "annoyed". This one is in response to asking it to analyse an article about changes to salary sacrifice NI relief limits.
Maybe instead they could stop announcing things that increase the salience of their weakest issue
November 9, 2025 at 1:13 PM UTC Some of it, sure - but this is more flexible, and I prefer to approve each action individually
November 7, 2025 at 12:19 PM UTC I create quite a lot of libraries, and use a template repo for them., including a CLAUDE.͏͏md with instructions to set the repo up and then delete that section. My latest addition says to use the gh cli to configure repo settings and rules, including adding secrets from 1pass. It works great!
github.com
Yeah. I've had laptops with MDM before, but Cloudflare's endpoint security is next-level (as you would hope for a security company).
November 7, 2025 at 8:05 AM UTC The secret is the experimental Container API that @ematipico.xyz created. I've previously used that alongside jsdom for tests. The complicated bit here was getting scripts working.
November 7, 2025 at 8:02 AM UTC I actually already have a branch. I've opened a draft PR for it that I can merge when it works:
github.com
WIP: Vitest 4 preview integration (not working yet) by ascorbic · Pull Request #7 · ascorbic/vitest-browser-astro
Updated all imports and configuration to use Vitest 4 APIs: Changed imports from @vitest/browser/context to vitest/browser Changed @vitest/browser/utils to vitest/browser with utils export Updated...
Gecko: Intent to prototype and ship: Navigation API
groups.google.com
Gecko: Intent to prototype and ship: Navigation API
Gecko: Intent to prototype and ship: Navigation API
My headless Mac mini m1 has found a new life: screen sharing non-work stuff to my ultra locked-down work MBP. Work on my two external monitors, personal stuff fullscreen shared to the laptop monitor.
November 6, 2025 at 9:20 PM UTC Watching @jess.sh's Vitest browser mode talk at @viteconf.org immediately made me want to build an Astro renderer. Testing isolated Astro components in real browsers is a real prize. It took a bit of work, and still does't support Vitest 4, but I have I working package. Give it a try:
github.com
GitHub - ascorbic/vitest-browser-astro: Test Astro components in real browsers with Vitest Browser Mode
Test Astro components in real browsers with Vitest Browser Mode - ascorbic/vitest-browser-astro
