TLDR WEB DEV 2025-07-28

HOW WE ROOTED COPILOT

Eye Security researchers discovered a vulnerability in Microsoft's Copilot Enterprise that allowed code execution in a live Python sandbox. By exploiting the ability to run Jupyter Notebook commands, they got root access within the container by poisoning the `pgrep` command, but found limited ways to use this privilege due to security mitigations. They reported the issue to Microsoft, which fixed it as a moderate-severity vulnerability, and were acknowledged for their research.

PERFORMANCE AND TELEMETRY ANALYSIS OF TRAE IDE: A DEEP DIVE INTO BYTEDANCE'S VSCODE FORK

Trae IDE, a ByteDance fork of VSCode, has some issues. It consumes more resources than VSCode, with up to 6 times the memory usage and a much higher process count. Telemetry data is persistently transmitted to ByteDance servers, even when telemetry settings are disabled by the user, collecting granular system and usage information.

NEVER WRITE YOUR OWN DATE PARSING LIBRARY

The creator of Eleventy started replacing the Luxon date parsing library due to its large size. He explored alternatives like dayjs but found them inaccurate, leading him to create a new RFC 9557-compatible library called `@11ty/parse-date-strings`. This new library offers a smaller bundle size and prepares Eleventy for future native Temporal API support.

IT'S TIME FOR MODERN CSS TO KILL THE SPA

Modern CSS features like View Transitions and Speculation Rules have made Single Page Applications (SPAs) obsolete. SPAs were initially adopted to create smoother, app-like navigation, but they often result in performance issues and unnecessary complexity.

DO NOT DOWNLOAD THE APP, USE THE WEBSITE

Don't download apps when websites offer the same functionality. Apps can access contacts, location, microphone, and installed apps - information that websites struggle to obtain.

Schedule a demo to learn more

VANILLA JAVASCRIPT SUPPORT FOR TAILWIND PLUS

Tailwind Plus now offers full Vanilla JavaScript support for its UI blocks through a new library called `@tailwindplus/elements`. This library provides headless custom elements that handle complex UI behaviors without requiring a JavaScript framework.

ES-TOOLKIT

ES-Toolkit is a high-performance JavaScript utility library designed to replace lodash with better speed and smaller bundle size. It has various utility functions with modern implementations and supports tree shaking and TypeScript out of the box.

RUST RUNNING ON EVERY GPU

A Rust developer has created a demo allowing a single Rust codebase to run on various GPU platforms, including CUDA, SPIR-V, Metal, DirectX 12, WebGPU, and even CPU fallback. This removes the need for specialized shader languages, letting standard Rust code be directly compiled for GPU targets. The project uses Rust GPU, Rust CUDA, and Naga to bridge different graphics backends and compile kernels to appropriate device formats.

PROGRAMMING VEHICLES IN GAMES

Vehicle simulation can be broken down into three core components: the engine/gearbox, the tires, and the chassis. It's important to understand both the mechanical aspects and the desired driving experience. This article goes into the intricacies of tire modeling, including slip ratio, slip angle, and the friction circle, offering code examples and visual aids.

THE FUTURE IS NOT SELF-HOSTED

Relying on corporate cloud services means we don't truly own our digital content, but instead rent it. This dev built his own home server as an alternative, but realized self-hosting is impractical and isolating. Instead, he proposes community-hosted cloud services funded publicly.

FONT-SIZE-ADJUST IS USEFUL

The CSS `font-size-adjust` property with a fixed value normalizes font sizes across different fonts on a webpage.

MAKING POSTGRES 42,000X SLOWER BECAUSE I AM UNEMPLOYED

A web dev shows how they successfully made a Postgres database 42,000 times slower by tweaking configuration parameters in `postgresql.conf`, focusing on disabling caching, maximizing background processes, reducing WAL efficiency, essentially deleting indexes and forcing single-threaded I/O.

WINDSURF EMPLOYEE #2: I WAS GIVEN A PAYOUT OF ONLY 1% WHAT MY SHARES WERE WORTH

Prem Qu Nair explains his decision to join Cognition, the company that created AI software engineer Devin, despite a significant financial loss from forfeiting vested shares at his previous company, Windsurf, due to a time-sensitive offer from Google DeepMind.

THE MANY, MANY, MANY JAVASCRIPT RUNTIMES OF THE LAST DECADE

The JavaScript ecosystem has exploded in the last decade with numerous runtimes and engines optimized for environments like edge computing, microcontrollers, and native applications, reflecting a shift from browser-centricity to execution everywhere.