Firehose

I would love if in package.json we could configure aliases for scripts. For example, as an alternative to this:

"scripts": {
    "dev": "vite",
    "serve": "npm run dev"
}

We could write something like this where serve runs the dev script:

"scripts": {
    "dev": "vite",
    "serve": "script:dev"
}

Or alternatively, an approach more safely compatible and akin to the introduction of peerDependenciesMeta and bin:

{
	"scripts": {
		"dev": "vite"
	},
	"scriptAliases": {
		"serve": "dev"
	}
}

Having proper alias support avoids hard-coding use of a specific runtime, allows translation, permits people to use the invokers they prefer, helps in establishing conventional script names, and makes migrations in naming easier. Just ending the npm run dev vs npm run serve debate would be worth it.

Both the Magic Keyboard and Magic Mouse look very cohesive with the rest of Apple’s devices. The curves and gloss of the Magic Mouse are a tad deviation, but not garishly so. They both have that clean, considered and premium visual design that Apple is so known for. They both feel lovely.

The Magic Keyboard is perfectly cromulent and is taken straight from the MacBook. If you like the keyboards from recent MacBooks, then you’ll like the Magic Keyboard. I personally don’t see the gain from a wireless desktop keyboard. A battery just seems like an added cost and point of failure where a wire would do nobody any harm in a static setup. I prefer more substantial, mechanical keyboards if the form factor permits. Thin is fine on a MacBook for slimness, but a dedicated keyboard has no such limitation. This is purely preference, however. The real gain is the convenient Touch ID power button for Apple silicon devices. It is a shame that there are no other Touch ID solutions beyond this keyboard.

I’m a big fan of the Magic Mouse’s gesture-based Multi-Touch surface, even if just for the convenience of horizontal scrolling. macOS is very much designed for gesture interactions using the trackpad, so the ability to take advantage of that with a mouse is a welcome feature. I’ve previously really enjoyed Microsoft’s Arc Touch Mouse, though it didn’t have the same software accompaniment.

It is a tad heavy and doesn’t glide super well, which is a shame, though I don’t mind the general ergonomics of it. I find myself pushing it about with my thumb and pinky with my other fingers free to gesture, rather than gripping it as I and most others would a more typical mouse.

The Magic Mouse’s underside-situated charging port makes it completely inoperable while charging. The battery life is good enough that you needn’t charge it often, but if you’re caught out, then you’re temporarily stuck. It also means that once the battery can no longer hold a reasonable charge, the mouse will be useless. Replacing it requires prying the mouse apart and fighting against glue, so it isn’t particularly user-replaceable either.

The vane form over function is silly, especially when a more reasonable top placement wouldn’t have looked markedly worse.

Overall, they’re nice devices. I personally wouldn’t opt to purchase them, as they don’t align with what I want from a keyboard and mouse, but for the right person wanting an all-Apple setup, they’re a reasonable choice.

Starting in late September, large quantities of traffic purported to be referred from https://www.aocr.org/ began appearing in site analytics across the web. This is not traffic from the eponymous American Osteopathic College of Radiology but is instead of a more nefarious nature. Usually I see no note of bot traffic in my site analytics, but this specific case managed to get through many sites’ defences and muddy the data. Some investigations have been performed, but most are seemingly AI slop feeding off each other, so I’ve combed through logs, run my own tests, and conducted a small survey to get some traffic analytics from various people.

It is first important to note that a referrer is not a verified value in any way. Anyone can put anything in the Referer header with no need to prove that it is actually coming from the location specified. This suspicious traffic doesn’t appear to be scoped to a specific type of content, as I can find referrals in the analytics of seemingly completely unrelated websites.

With a small number of outliers, the traffic associated with the referrer has these identifiable properties:

extensionTiming
    forestResFrom
    forestResLoadStart

htmlPredictorHit

These properties have similarities with ByteSpider – the web crawler operated by Chinese company ByteDance – but it is not the same and is not entirely consistent. The browser in use is, however, almost certainly of ByteDance origin. ByteDance has a cloud computing arm called Volcano Engine (火huǒ山shān引yǐn擎qíng) which offers browser-as-a-service functionality within China. The global version is BytePlus, which I poked around to understand their browser. Most importantly, BytePlus’ browser is extraordinarily similar to the browser sending these aocr.org referral traffic. It is a full browser that executes JavaScript, which is generating this traffic, and not just performing a fetch. This is probably a large part of why it showed in so many sites’ analytics – it executed the analytics scripts.

As for the timing field values, forest most likely refers to a resource loader developed by ByteDance, which we can find mentioned in the code of the cross-platform framework Lynx, which is used for applications like TikTok. The exact forest strings are absent from BytePlus’ browser-as-a-service, which is the most glaring disparity, though ByteDance-specific fields are present. The Accept header is also distinctive. It is identical to stock Chromium’s with the exception of advertising image/heif support, which stock Chromium doesn’t. The only browser at time of writing to have support for the format is Safari, so it is odd for it to be included. This is further evidence suggesting that ByteDance’s Browser-as-a-service is in use. I’m inclined to believe this aocr.org traffic is using a newer version which is perhaps provided somewhere unknown to me. This age difference is corroborated by the Browser-as-a-service having a ClientHello message that is 512 bytes, X25519 only, while this aocr.org referrer is 1,722–1,818 bytes, PQ class, which is more in line with newer browsers.

Across all sites with traffic from aocr.org, I’ve found a small spike around October 27^th-30^th and a significant spike on November 5^th/6^th where the same pages were fetched multiple times. The majority of traffic is from United States IPs, with Brazil as a follow-up and a wide variety of countries beyond that. The IPs are from a wide array of data centres and residential addresses, though these are proxies and the browsers are almost certainly running in China due to that being the only region ByteDance’s browser-as-a-service supports.

There is no obfuscation or attempt to rotate the referrer. It is extremely predictable and consistent with the only thing that seems to change being the origin IP with occasional small variation in the user agent. A genuine page referral from a clicked link will also have a Sec-Fetch-Site of cross-site, not none as the spider provides. Having no referrer header would likely have seen the request blocked, though had they cycled referrers, many people probably wouldn’t have noticed.

I’m left with four questions I cannot answer to a satisfactory degree:

• Why choose aocr.org? Likely because it is an established, non-commercial, old domain (registered 1999) that seems innocuous at first glance? It is in the Majestic Million and Tranco lists, so it was probably chosen at random from there.
• Why not change referrers to avoid arousing suspicion? Unless the goal is to arouse suspicion for some purpose or to identify sites which fail to react and implement protections. Or it could have been a value mistakenly hard-coded, set as a variable, or forgotten as a default.
• Who is running this? Is it a single entity or are there many parties involved? Given the scope of the scraping and how many different servers and proxies are used, it seems unlikely to be more than a single controlling party.
• What is the purpose? I’m inclined to put forward AI scraping, as advertising fraud or traffic laundering don’t make sense. AOCR aren’t trying to get clicks from curious webmasters, and the affected sites haven’t paid to receive traffic.

ByteDance’s PaaS/IaaS/SaaS offerings, Volcano Engine (火huǒ山shān引yǐn擎qíng) and BytePlus, are both rather similar services under-the-hood, with the former serving domestic China and the latter the rest of the world. They both offer a range of services, including browser automation under Volcano Engine’s Function as a Service (veFaaS).

However, the Chromium they offer isn’t quite stock and instead has some modifications. Inspecting the logs, I found mention of this Docker image: enterprise-public-ap-southeast-1.cr.volces.com/vefaas-public/browser-pool:latest. Curious, I, of course, downloaded it and investigated.

As of writing, the latest version of this image is from September 5^th, 2025, and contains two browser versions. The first is a completely standard version of Chromium 136.0.7103.25 (/ms-playwright/chromium-1169/chrome-linux/chrome). However, alongside it and used by default is a version referred to as ‘enhanced’. This is Chromium 117.0.5938.60 (/opt/chromium.org/browser_use/chromium/chrome) and is chosen by enable_enhancement=true.

My interest is in what this ‘enhancement’ is, as I believe it extremely likely that this is an older version of the browser which powers ByteDance’s infamous ByteSpider web crawler/scraper. Comparing to ByteSpider, it matches the Accept header of the ByteSpider-matching subset, which advertises HEIF support not present in standard Chromium (text/html,application/xhtml+xml,application/xml;q=0.9,image/heif,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7).

Chromium 117 ‘enhancement’ contains these instrumentation strings: TTGlobalHeadless/TTHeadless, bytedance/loading, and probe. I assume the ‘TT’ refers to TikTok, which would make sense, as ByteDance is known to operate ‘TikTokSpider’ and uses ‘TT’ in the names of frameworks, APIs, SDKs, and other developer tools. It could also refer to 头tóu条tiáo.

If this is of the ByteSpider family, I take it to be an older version, as the TLS ClientHello record is 512 B and X25519 only, while ByteSpider’s has been observed to be 1,722–1,818 B and PQ class, which is in line with more modern versions of Chrome.

It is, of course, possible that this is merely how ByteDance modifies their browsers, and it has no association with ByteSpider at all. More testing is necessary to ascertain whether modern ByteSpider ever includes the forest timing fields seen with the suspicious aocr.org referring crawler/scraper.

A lot of people are doing a lot of writing about AI, safety, and the state of the world. Some people are thinking about how they can influence future AI models. Take Gwern’s You Should Write More Online, which argues that there is no better time to be writing. The thinking is that now is the time to publish and get into training data.

If you subscribe to this direction rather than retreating and putting up guards to stop bot blocking, then where should you host your material? Somewhere under your own control, most certainly. X (formerly Twitter) is certainly out, as they have a vested interest in training data being used for Grok. Reddit has specific deals and is cracking down hard on logged-out access.

Many other platforms have similar considerations. Either existing deals with specific AI companies such that your writing’s influence across models is diminished, or hard anti-scraping measures that you can’t opt out of. Yes, even protected material is like to be scraped somehow, but now you’re only rewarding scrapers that specifically bypass wishes. On your own site you can manage protections exactly as you wish, even specifically blocking a given lab from scraping if you feel it necessary. At the very least, it is worthy to consider mirroring content posted on walled sites.

Also, it has been found that LLMs prefer LLM writing, which is something I’m not sure about how to best approach. I imagine (though do not have any evidence) that AI companies filter out AI-generated material in training to avoid model collapse. Thus, AI-authored writing might be considered more positively and have more influence over models, but it also runs the risk of being filtered out. I’d opt for remaining with diligent human-authored content – especially as then you can ensure it has the influence you want.

Most famous for its use in Minecraft – particularly in enchanting tables – the Standard Galactic Alphabet originates from Commander Keen. It is not a separate language or anything of the sort. Instead, it is simply a substitution of Latin alphabet characters with bespoke symbols.

For the full and proper effect, you need a custom font, but here it is represented with Unicode symbols:

A sentence is ended with ._., but there are no other official punctuation or number symbols. Despite this, some people have taken it upon themselves to create these additional characters.

╎ℸ ╎ᓭ ⊣𝙹𝙹↸ ⎓𝙹∷ ᓭᒷᓵ∷ᒷℸ ᒲᒷᓭᓭᔑ⊣ᓭ._.

There is a common misconception that colour blindness means only seeing in greyscale. This can be the case with some forms of colour blindness, but is rare, and it is much more common to only have some colour perception impacted. Human eyes work with rod and cone cells. Rods largely handle peripheral vision and low-light vision, while cones handle vision in well-lit situations and colour perception.

Humans have three classes of cones (trichromacy), each of which is sensitive to a different wavelength of visible light. L-cones are most sensitive to green through yellow to red, M-cones to green through yellow, and S-cones to blue. There is overlap between what colour each cone sees – especially the M and L cones.

Below are demonstratory figures of the effects of various colour vision deficiencies. They do not represent all people’s experiences with colour blindness nor non-colour perceptual impacts and are representations only. Complete blindness (ending in -opia) is shown here, though partial cone dysfunction (ending in -omaly, like protanomaly or deuteranomaly) is not. The majority of people with colour blindness have only partial colour deficiency.

Achromatopsia and blue-cone monochromacy are both extremely rare and are paired with severe photosensitivity and reduced vision, which I haven’t shown above. Globally, it is estimated that ~4.5% of males and ~0.6% of females are colour blind. Ethnicity has a large influence on these figures. Red-green colour blindness is the most common by a significant margin (~95% of all colour blindness).

Remember, no two people’s eyes are exactly the same. Different people have different vision and might have colour vision deficiency paired with other conditions.

One of the worst symptoms of uvulitis is pain when swallowing due to the inflamed, swollen uvula dragging when swallowing. Remaining hydrated is one of the most important parts of recovery, but doing so can be difficult when water hurts to drink.

Water is actually a very poor choice of beverage when afflicted by uvulitis, because it has low viscosity and washes away saliva and mucus, which lubricate the area. A much better choice is something which offers a coating of its own and which stimulates salivary glands, causing more lubricating saliva.

Ideally you want something non-acidic, non-abrasive, and of a decent viscosity. As a bonus, if it is cold, it will numb your throat and reduce swelling. Smoothies are the absolute best I’ve found. Not only because they’re the most soothing, but also because you can use ingredients which offer some actual substance when it is otherwise difficult to consume solid foods.

Remember – reloading the page is always faster than waiting for GitHub’s custom routing.

The return of the glowing Apple logo has been bouncing around at the back of my mind. It is confirmed that the Apple logo’s brightness is tied to screen brightness and that the illumination can be disabled.

From this, I’m willing to make a prediction: it will be used as a status light for conveying information while the lid is closed.

Paired with optimisations to lid-closed audio, I think they’re priming the Mac for virtual assistant and AI functionality while closed. Apple are putting a focus on smart-home offerings presently (new HomePod Mini, HomeView), and the new MacBook is now also properly suited for that functionality. I would be unsurprised if they made Siri voice commands work smoothly with a closed MacBook.

MacBooks are very popular with the AI crowd, and there are common jokes about leaving the lid open just a bit so that agents can do their work. I think this will become a fairly major feature, especially as it ties into the investments Apple has been making into Siri AI as of late.

If Apple doesn’t do this and an API is exposed, a third party will certainly implement the functionality. If I had the money to splash on an (at minimum) $4,599 AUD computer so I could develop an app implementing the functionality, I’d certainly cash in on this opportunity.

Previous MacBooks with the glowing Apple logo achieved the effect by simply having a cutout that let the backlight of the LED display shine through. It used no extra power, however external light could shine through the logo, causing a bright spot on the MacBook’s display

However, the new 2026 MacBook Pro with PROLED XDR Display has an OLED screen as the name implies, which doesn’t have a separate blacklight. This means the logo will have to be illuminated independently. I wonder what the impacts are on power usage and if it will be controllable in macOS.

I am doing some serious CSS development right now (my computer is at 100°C and sounds like a jet engine).

If you know any web developers, then whenever they mention a year between 2010 and 2025 (sans 2018), you should say, ‘What? Like the WordPress theme?’.

They’ll look at you blankly while they compute what you said, then let out a groan. If you do it often enough, eventually you’ll get a broken nose.

Shout out to whoever ended up reading my post about my CSS reset from the Google search query ‘check parking brake system toyota avensis reset’. I hope you learnt something.

CSS-Tricks is back. Fully back. Back in action, and – more importantly – back in independent hands. Geoff Graham, longtime editor of the publication, has purchased the publication following DigitalOcean disrespectfully and unceremoniously dropping the site into limbo a few months ago.

I can’t think of any better steward for CSS-Tricks than Geoff and the team he has put together. There are few nicer and more genuine people in this world than those now at the helm of SS CSS-Tricks.

Even if nothing were to ever be published on the site ever again, just knowing its legacy is secure with people who care means so much. There is so much valuable content dating back to 2007 on the site that’d be terrible to have reproduced in any capacity.

I don’t know how much Geoff paid for it, but Chris Coyier floated a figure of $100,000 USD on Shoptalk Show (a far cry from the $4 million USD he sold it for in early 2022).

It is a really hard time for developer education given the impact of AI on the tech industry, so I really hope that deliberate, human-made content can prevail. I know that traffic to the site has been dwindling in recent years, and I don’t think we’ll see it return to its highs, but I do think there is desire for care and interest in human-authored writing. I know this is how Piccalilli repositioned themselves in early 2026.

Here is to many more years of CSS-Tricks!

Someone said my image had an alpha channel, but I couldn’t see it.

Just watched someone ask Claude Code for a Git diff.

We’re so doomed.

One of my favourite bands (‘If you want to call it a band, because it’s a one-man name’), is Lemon Demon. The musical creation of Neil Cicerega, Lemon Demon was most prolific during the 2000s. An era with CDs as the dominant music format, Neil would include a local web page (built with framesets) which could be accessed on a computer. They’d offer lovely graphical interfaces to listen to the album and to peruse bonus content, including the commentary, thanks, and lyrics.

The first album to receive a HTML accompaniment was 2005’s Damn Skippy. As with the rest of Lemon Demon’s first four albums, Damn Skippy is free online so you can check out the HTML yourself. This first version of the bonus is fairly simple, but it is a fun way to access and explore the album.

2006’s Dinosaurchestra takes things a bit further. On the insert of the CD it reads, ‘This record CD includes “online computers bonus virtual MP3 computers” material! Put it in your CD-rom drive and explore the contents!!!’. The special thanks has various alert()s with little messages and in-jokes too.

The final Lemon Demon album to include this bonus content was 2008’s View-Monster. Expanding on the alerts of Dinosaurchestra’s credits, throughout the various pages there is text that can be clicked to get extra tidbits, jokes, insights, and information in a popover.

Unfortunately there was no computer-exclusive accompaniment for Spirit Phone. I wish more bands did things like this. It reminds me of the charms of DVD menus and game console interfaces. A little something more that makes it more of an experience.

I despise the hideous 12-inch MacBook (also known as Retina MacBook or the new MacBook).

Apple are renowned for their fantastic design, but this series of laptops was a resounding misfire. The 12-inch MacBook is certainly the ugliest Mac and is in the running for one of the ugliest laptops in general. Especially in gold, it looked awful.

The keyboard is disgusting. To squish it onto a 12″ frame, Apple extended it right to the edges of the chassis, and it just looks haphazard. The Air’s minimum 13″ size allows for a slight border, which makes the whole device look so much nicer. That, of course, isn’t to mention the horrid functionality of the keyboard. To achieve the pointlessly thin design, Apple invented the ‘Butterfly Keyboard’ with a mechanism departing from the traditional scissor style. The design was flawed, and people were quick to experience issues due to heat and detritus.

Speaking of heat, that was a problem too. Also in pursuit of thinness, and despite the use of hot-running x86 Intel chips, the models were fanless. They naturally overheated and were incapable of anything even slightly strenuous. The compromise in desire for thinness didn’t cease there, however, for it continued into the sole USB-C port. Charging your laptop? Well, unless you’ve got a dongle, you won’t be able to plug in a mouse, drive, or external display. If you do have a bulky dongle, does it not defeat the sole value of such an unreasonably thin laptop?

I personally think this terrible Mac line set back Apple’s laptops by years. In typical Apple fashion, they refused to acknowledge their mistake and kept producing the computers for years, making only half-baked attempts to address the intrinsic problems. Apple didn’t manage to get things back on track until 2020 with Apple silicon. The cooler-running M series chips would ironically have made the 12-inch MacBook a not completely unreasonable proposition, but by the time it released, Apple had already canned the line.

The past day or two have been tumultuous in terms of cybersecurity. The major stories have been:

1. Unauthorised access to PingCAP, developers of the TiDB NewSQL database and purveyors of various services related to it. They’d only just had a security audit by NCC Group.
2. PHP suffered two major remote code execution (RCE) vulnerabilities. RCE via OOM corruption (CVE-2026-109618) and RCE via stale global state (CVE-2026-109619), both of 9.2 severity. The vulnerabilities were leaked early, too, leading to exploitation before a patch was even released. A lot of sites shut down simply to protect themselves.
3. Certificate authority eMudhra was found to have eight ludicrously poor private keys. One of them was just ‘4’.
4. Cloud provider Railway believes environment variables may have been accessed by an unauthorised third-party.
5. Several significant vulnerabilities were found in the Git forge GitLab, prompting a big security release.

These are five major cybersecurity events occurring together in close proximity, and they come after a range of AI intrusions in recent months, including the series of hacks perpetrated by OpenAI and a similar series of hacks by Anthropic. Capable LLMs are being used on a massive scale to penetrate systems and determine vulnerabilities in codebases. They’re persistent, unlike any human, and will continue until they run out of tokens.

This security onslaught isn’t going to stop. Assuming you have a bit of time and some money to spare, it is now trivial to run a penetration test. Previously a lot of AI-discovered vulnerabilities have been rather obvious on inspection. The sort of things that are caught by a different perspective rather than due to their complexity. Now a lot of the vulnerabilities being found seem to be extremely complex and obscure. I somewhat wonder if any human would realistically find some of the exploits being found, or if we’ve entered (or are entering) an age of LLM cybersecurity on a level beyond humans.

Like how the monoculture dissolved as means of distribution and creation became simpler and more accessible, I think AI will do the same for software. I think that people will use LLMs to reimplement breached technologies to avoid them, and, in doing so, will breed less secure software that survives through obscurity (until it doesn’t). I don’t know what scale this will happen at, but it will happen, and I imagine it already is happening.

I just adopted ‘Yellowish Orange’ on Colour Names.

David Aerne makes so much beautiful work so it only made sense to support him a bit.

ASMR has long been a go-to of mine when I’m having difficulty sleeping or am in need of relaxation. There is a bit of stigma surrounding ASMR due to its perceived cringeness and the inherent intimacy, but I honestly think most people would find a genre they enjoy if they were to try it.

I’m personally not a huge fan of mouth sounds, mukbangs, or similar and have a preference against roleplays but greatly enjoy deep in-ear sounds, brushing of the microphone, tapping, crinkling of objects, and other assorted sounds. If none of that is your style, there exist less conventional genres like horror or whatever the hell Emma’s Myspace is doing.

Over the past few years there have been marked improvements in the quality of ASMR content online. Many creators who started off in their bedrooms have now gotten the art down to an exact science – some have even established full professional studios. Some modern ASMR is recorded on equipment that costs more than most cars and is mastered to a standard rivalling music production studios. With zero background noise and extremely high-quality audio, it is amazing to hear with some quality audio equipment.

The creativity of some ‘ASMRtists’ is impressive – aluminium foil, misting bottles, and fizzing tablets to simulate rainstorms, or small assorted objects that one would never think would produce lovely sounds used for triggers. There are few greater ways to reduce stress and calm down than to enjoy human creativity and high-quality audio experiences tailor-made for the purpose. Jojo’s ASMR’s The Perfect ASMR Video is a great place to start.

My browser watching on in abject horror as I go to load the one-page version of the HTML spec to ‘quickly’ check something.

Every time I work away from the web I’m reminded how much I hate waiting for things to compile whenever I want to test anything.

xkcd 303 doesn’t hit quite the same when you’re working for yourself.

I’ve never seen this error before, but I think it is trying to tell me that something went wrong.