The browser platform, standards and web performance.
16 items
cfsolve claims to solve Cloudflare Turnstile with no headless browser. Reading its source offline shows it replays recordings of a real browser, and what that means for a site owner.
Node, .NET, curl and others each carry their own Brotli decoder. I counted the places on one Windows PC and tested which clients decode Brotli they never asked for.
I sent three AI user-agent strings to 66 sites and compared robots.txt with what the server did. Sephora allows them on paper and returns 403. BBC denies them and serves the page.
Pele claims to be 500x faster and 6x smaller than Mermaid.js. I ran both on 39 diagrams from this blog: the speed holds at about 100x, the size only with an opt-in import.
Go 1.27 now drains an unread HTTP/1 response body so the connection can be reused. I counted dials on Go 1.26 and 1.27, and found where the fix stops working.
Cloudflare launched an OHTTP gateway that hides IPs from app servers. The RFC and Cloudflare both say privacy depends on relay and gateway never sharing an operator, a rule no cryptography enforces.
Netlify replaced the lightweight sandbox running its edge functions with full virtual machines, and median latency dropped from about 30ms to 5 to 6ms.
Three companies shipped a standalone agent browser. One matched Windows to macOS day one. One took 83 days. One never got there, shut down, and retreated into an extension.
Umami is MIT-licensed, so the identification path is readable. Where, who and when turn out to be a CDN header, a hash that expires on the 1st, and a bucket quantized to the clock hour.
The web's oldest isolation guarantee is a string comparison. Put an agent inside the browser and it becomes a model's ability to resist a prompt injection.
Rendering is a separate, queued, stateless stage between crawling and indexing. Almost everything confusing about JavaScript and search comes from ignoring that.
ego lite and Aside are both browsers built for AI agents, but one has no agent of its own and the other ships with one. A guide to what each is, with the same page-reading test run on both.
A BFF gives each client its own server-side backend. This guide covers the problem it solves, a runnable demo with measured request counts and bytes, its security role, and when to skip it.
A reference for robots.txt: the syntax, how a crawler picks a group and a rule, what happens when the file fails to load, how to write rules for AI bots, and what it cannot enforce.
Four ways to build an API, compared on who decides the response shape, what the contract looks like, how errors and caching work, and how big the bytes are, with a size measurement you can rerun.
How the OAuth 2.0 authorization code grant works end to end: the request/response shapes, PKCE, refresh token rotation, error responses, and where RFC 10017 now says to actually store the tokens.