csswizardry

Disclaimer: Ana is a very dear friend of mine and may well be the Best Person™. Ana, if you’re reading this, the live-coded karaoke talk you gave at State of the Browser was the best I’d seen in years.

All of my pals laugh at me for carrying a packing square with USB C–C, A–C, Lightning, EU adapters, and three-pin plugs. Until they need to borrow one.

I’m a web performance engineer — I help clients find and fix site speed issues — but recently I spotted what I thought might be a security/privacy issue. Security not being my specialism, I asked Fable to help me triage and, if necessary, raise the issue with my client.

It refused. It’s so so so adjacent to the work we’d already been doing, but the moment I asked it to help me understand what I thought I’d found, it left me high and dry!

> fun one first […] The recruiter died.

That took a turn!

My own (similar) advice from 2016: https://csswizardry.com/2016/06/speakers-checklist-before-an...

Complete side note: I’m on public wifi right now and the domain used to host the images in this article is, for some reason, blocked. But as the author (or whatever tool was used to generate the article) has taken time to write decent `alt` text, I can still get a good idea of what is going on. Kudos.

Way ahead of its time. Unfortunately.

I used to share this sentiment (and I’m a web performance consultant by profession so very few people care about performance as much as me!), but when you consider how much calculation we _happily_ let our JS do at runtime, I don’t think forcing CSS to be static/preprocessed is worth it. And that’s not even me taking a swipe at overly-JSsed front-end; I’m talking about any runtime work that JS picks up.

Is preprocessed CSS faster? Yes. Is it meaningfully faster? Probably not.

Please, no! https://csswizardry.com/2019/05/self-host-your-static-assets...

In light of Apple’s new Liquid Glass UI, this 2017 post/paper looks at creating realistic glass-like refraction on the web.

A firm here in my city once got all of their signage printed and installed _before_ securing the social media handles they’d put on them. The Instagram username they’d opted for was actually literally impossible to register as it contained a special character. That was about six years ago. The signs are still up.

Point 13, ironically, reminds me of one of the best bits of writing[1] I ever did. I somehow lost an entire near-complete draft[2] of an article, so I had to write it again from scratch. It came out much, much better than the original.

1. https://csswizardry.com/archive/

2. A fact I am embarrassed to admit in present company. I still can’t remember how it happened.

I’m on-site with a client in The Hague this week—the food and drink in this city is phenomenal, so these paintings definitely still ring true for me at least.

Amen!

My guess, as someone who doesn’t know the answer but works closely in this field, is that the potential downside (i.e. privacy/security) was much greater than the actualised benefit (i.e. performance).

Safari (who make a big deal about being privacy-conscious) was the first to introduce cache partitioning, looking into it as far back as 2013[1]; Chrome followed in 2020 and Firefox in 2021[3]. One thing I know, anecdotally, to be a strong motivator among browser vendors is ‘X is doing it, why aren’t we?’

1. https://bugs.webkit.org/show_bug.cgi?id=110269

2. https://developer.chrome.com/blog/http-cache-partitioning

3. https://blog.mozilla.org/security/2021/01/26/supercookie-pro...

You are correct that this is an optimisation only available to H2+, but optimising to the H/1.x use-case is a use-case not worth optimising for—if one cared about web performance that much, they wouldn’t be running H1/.x in the first place.

Most connections on the web nowadays are over H2+: https://almanac.httparchive.org/en/2024/http#http-version-ad...

I’ve been beating this drum for many, many years now: https://csswizardry.com/2019/05/self-host-your-static-assets...

https://csswizardry.com/csscv/!

I went canvassing for RSS feeds only yesterday! Some good stuff in here: https://bsky.app/profile/csswizardry.com/post/3lckq4qo6zs22

I vividly remember this happening. Firstly, because I was an affected customer and I had to cancel all of my debit/credit cards days before a two-week work trip to SF, but secondly…

I was approached by BA to tender for a web performance project. I was excited because, at the time, I had Gold status with BA and I used the site on a weekly basis—I knew exactly where and why it was slow simply through using it so much!

The RFP deadline was short—really short. So, I spent the bulk of a vacation in Croatia writing up my proposal. When I was meant to be lounging by the pool or chugging Malvasia, I was buried in my laptop putting together my pitch. I got it done in time, fired it over, only to be told ‘we are focusing on web security now; this project is on hold’. Then, a few days later, the news broke.

Hugely instrumental in my career. Landed me my first ever job (2008) and has been responsible for underpinning most of my consultancy career (2013–now): https://csswizardry.com/

As long as one sticks with it, I cannot overstate the power of a good personal website.

> Also I can't decide what to write about, and whether to make it more nerdy or more professional.

As with most decisions, just make one. You can always change your mind later.

Huge, huge improvements. I’ve been following this spec keenly.

1. https://compression-dictionary-transport-threejs-demo.glitch...

2. https://compression-dictionary-transport-shop-demo.glitch.me...

This, generally, is avoidable hand-over-fist. `NoScript` isn’t a plugin—it’s older than most web developers.

All three of your points are correct, so please don’t resent my response: Client-side A/B testing exists because ‘we should be able to do this without a deploy’. And they’re right.

Yes! Perfect scenario. This is a question of a slower but more trustable experience. I would always fight for both, however.

Honestly, I should add the point that client-side A/B testing is the devil and should be avoided in the first place.

Off-topic, but Meoweler is a goldmine—thank you!