Then they followed up saying they would proceed with the registration, but that if I want the domains, I can register them first.
I'm just ignoring it because I don't care about `.cn` domains. But I'm curious whether this is legitimate or something else.
Is this a strategy to get people to buy domains, or maybe even a scam?
I received an email from a Chinese domain registry service saying that a Chinese company wants to register Ariakit domains with the `.cn` TLD. I responded that we have nothing to do with it.
So the Axios attack started with a video call with the maintainer.
I guess that’s the first time I’ve seen the upside of social anxiety. I’ll always try to get people to do things async before hopping on a call, and I’m fine with missing out otherwise.
Ways to mitigate npm supply chain attacks:
- Block all postinstall scripts unless necessary
- Use minimumReleaseAge
- Set up Trusted Publisher on npm/GitHub
- Disallow npm tokens
- Require 2FA for all org members
- Restrict PRs to collaborators only (sadly)
What else?
And the best of both worlds is this library that will never see the light of day.
Best thing about StyleX is that it’s fully atomic since the classes are compiled too. Worst thing is writing CSS as JS objects, imo.
Best thing about Tailwind is how convenient it is. Worst thing is that my brain can’t parse a bunch of strings without syntax highlighting.
8 months later, finally migrated to the .com 🎉
(we're still working on the new version)
Yes, I'm not against AI-generated PRs. In fact, I'm writing most PRs with AI nowadays. But there's a big difference between a PR made by someone who understands the project and one made by someone who doesn't.
And it's not just about quality or wasting time. It's also about security. Pull requests have become a common attack vector across many open-source projects.
Yes, that's one way.
A dark mode settings panel showing pull request permissions set to Collaborators only.
I'm considering this for all my open-source projects.
I prefer a detailed issue/discussion. I don't mind if it's AI-generated as long as it's valid and heads in the right direction.
High-quality PRs from external contributors are much rarer, whether they're from humans or AI.
Thanks for trusting. There will be a special price for India, btw.
I expect it'll take a few months. I had to rewrite a few things from scratch to improve performance, so that slowed things down.
A black and white pencil sketch of a young woman standing and hugging a dark electric guitar to her chest. She is dressed in a t-shirt reading LOVE ROCK under a fringed vest, plaid shorts, solid black tights, and ankle boots. A sketched, floating staircase curves behind her against a plain background.
That pose and outfit kind of remind me of this drawing I made 20 years ago haha.
A code diff summary showing 22,830 lines added and 48,919 lines removed.
Happy and sad in one image.
Nice! Has virtual focus (`aria-activedescendant`) been considered?
Two screenshots of a code editor's autocomplete menu for the class bg-. The top image, marked with a red X, shows the menu cluttered with every individual shade of amber like bg-amber-50 and bg-amber-100. The bottom image, marked with a green check, shows a much cleaner menu where all amber shades are grouped into a single line like bg-amber-100, 200, allowing other background utilities to be easily visible.
Tailwind autocomplete would be more useful if multiple related tokens were grouped under their parent token. It would make it much easier to discover and navigate between them.
A screenshot of a Twitter thread. The first tweet is from Adam Wathan on Jan 18, 2022. It reads: I think one of the biggest Tailwind anti-patterns I see pop up in GitHub issues all the time is trying to "extend" the behavior of an existing utility in some way, especially in combination with @apply. This output is correct but not what people doing this expect. Below this is an image showing two code blocks. The left is labeled Input and shows CSS classes like .my-page > div ~ .pointer-events-none, .profile-card, and .btn.outline-none using @apply with other utilities. The right is labeled Output and shows the resulting compiled CSS, which is unexpectedly long and repetitive. The second tweet is a reply from Haz (@diegohaz). It reads: Here's my use case for @apply: I have to write an external CSS file (first image) because it's going to be compiled and shown to the users as vanilla CSS (second image). Before Tailwind, we were writing normal CSS, but the DX was not great. Tailwind has greatly improved it. Below this is an image showing two panels. The left shows a .combobox CSS class utilizing @apply with many Tailwind utilities. The right shows a UI preview of an input field labeled Your favorite fruit above a code block displaying the compiled, vanilla CSS output for .combobox. The final tweet is a reply from Adam Wathan. It reads: Yeah and this is totally the type of use case I had in mind initially and I think something we would always want to support (thumbs up emoji). It's when people do the weird stuff I described above that it becomes this huge complicated mess of a maintenance burden I totally underestimated. The timestamp at the bottom is 10:09 PM, Jan 18, 2022.
Last I checked it was considered fine to use @apply for the use case I’m describing:
Private folders shouldn’t be downloaded by users without permission. The project should be designed to work without private files, either through optional dependencies or by keeping them out of public code.
GitHub needs private folders in public repos. Workarounds like submodules and git-crypt exist, but they’re painful and limited.
Nothing would change for maintainers. External contributors just wouldn’t see those files’ source or diffs in PRs.
That said³, there are still scenarios where a big custom @utility is faster, like when you're using several one-off arbitrary utilities. However, in that case, you probably won't even reach for @apply.
Good read: dev.to/yoskutik/is-...
That said², even though it’s way behind on features, Firefox handles this best. Stylo (Firefox’s CSS engine) is best in class.
Chrome is okay, but you can notice it.
Safari, especially on iOS, is the worst and basically unusable at the same point where Firefox is perfect.
That said, for a small project or simple custom utilities, this usually won’t be a problem. Just keep it in mind. If you see a big chunk of rendering time in the DevTools Performance tab, this might be why.
It’s a bummer because I was really excited to use the new @utility feature to build framework-agnostic components, but it doesn’t scale well.
Best approach is inline utilities as usual, plus a CVA-like library when you need reuse. I’m working on something to make that easier.
I've come to the sad conclusion that @apply in Tailwind is a big anti-pattern.
With enough complex utilities, your CSS can balloon to hundreds of kB, bloating the CSSOM and hurting runtime rendering performance, not just network.
cc @una.im might be interested in this.
@container style(--_ak-layer-parent-parity: even) { --_ak-layer-parent-parity: odd; --_ak-layer-parent-odd: var(--ak-layer); --ak-layer-parent: var(--_ak-layer-parent-even); } @container style(--_ak-layer-parent-parity: odd) { --_ak-layer-parent-parity: even; --_ak-layer-parent-even: var(--ak-layer); --ak-layer-parent: var(--_ak-layer-parent-odd); }
There’s a way to achieve `inherit()` with container style queries, but it’s a bit complicated.
You alternate between odd and even variables, use one, and set the other:
Yeah, I tried using border-shape to make a tab with inverted corners, but it wasn’t worth it. It took too many hacks, from oversized tabs to negative margins to keep them from taking up too much space. I ended up using pseudo-elements with radial gradient (or corner-shape).
Just saw it. Thanks!
I don't know if it's because I'm sleepy, but even though it mentions the issue I'm talking about ("especially given that backgrounds are not painted outside the border box"), it's still not clear to me how the proposed solution would fix it.
This makes the shape value more complicated as we have to add a bunch of calcs instead of just the top/right/bottom/left keywords. Also fake paddings. It feels pretty hacky.