![]() |
|
![]() |
| Is there a future where CSS’ expanding surface area leads to exploits and tracking? For instance, some time ago I saw an article about how font face rules can be used to fingerprint users |
![]() |
| https://developer.mozilla.org/en-US/docs/Web/CSS/Privacy_and...
They try to sandbox it. There are more clever ways now. Like... everything you interact with is a binary search into a projection of your (2^n-interaction) "guess"-ed/history. If you interact with it, then it is assumed that you can see it. Even detecting if the room is generally lit or not via the Ambient Light API can be paired with bright and dark elements to ping flashes off your face, in a dark room, to read whether or not elements were of that certain color. But lets scrap :Visited and use arcane browser implementations and user behaviors; even something as innocuous as zooming slightly in or out is a session-persistent signal. The browsers explicit and even _inferred_ zoom level can be leveraged. A few irrational numbers and difference in spec implementations and your zoom level on Compromised_Site_A can identify you exactly from Compromised_Site_B even without Javascript. But let's reset zoom between domains. Easy? sure. But something still has to get painted to the page, like images, that could be cached....depending on how long they have been visited, and from what domain, and from what order. And the timing between all those are almost certainly unique to few, and sensitive to all. If you load a thumbnail from Bad_site_a within 100ms in a country that blocked the original resource....thats a paddlin. Those are just the first few, I could go on. |
![]() |
|
CSS knows a lot, and it can send it back via image requests, triggered in states through animations, 'lazier'-loading, unqie font-choosing, etc.https://blog.sheddow.xyz/css-timing-attack/
Well, yes. The timing and unique request path make identifying possible. And CSS can be dropped in context by other users, crafted to refer to a different domain, so CSS worms can definitely ex-filtrate data without the webmaster being evil. |
![]() |
| I hope someone chimes in to correct me if this is wrong, but AFAIK CSS animations are not automatically disabled by toggling such a setting.
Original idea puts it under the authors control to add @prefers-reduced-motion media queries. Might be that some browsers do this anyway, otherwise it would be easy with a user script or user style sheet. This article argues for the spirit of the spec: https://css-tricks.com/nuking-motion-with-prefers-reduced-mo... > “animation isn’t unnecessary.” It has a point, intrusive animation's main bastions are not CSS-based anyway. For example, there seems to be a continuous (JS- and HTML-based) cat-and-mouse game that makes me require an ad blocker to disable autoplay videos on news sites, regardless of browser preferences. This part is like the DNT header all over again, incentives don't align. And the lesson should be that CSS is the most benign battle site for this issue, because it is customizable and not yet locked down behind anti-debugging and obfuscation techniques. |
![]() |
| Yes, but you define them with Javascript rather than in CSS which is a key difference since the syntax is more intuitive for some (myself included) |
![]() |
| No, it's not what we all are thinking.
Moving work from JS to the browser’s native, polished, tested implementation with optimized performance is the right thing to do. |
![]() |
| I think of them as effectively CSS variables with types and that can be animated.
By default CSS variables can't be animated since it has no idea what unit it's animating between |
![]() |
| CSS is becoming ever more like a programming language. But you cannot debug it. So why not use a programming language instead where you can do that, and can do pretty much anything you want. |
![]() |
| The big win for me has been that this feature let's you animate css variables. A place I used it a while back was a little experiment where I tweaked youtube's design to look "neon" -- eg all the lines and stuff were bright red and glowed. I designed it so the hue of the primary colour was controlled by a single css variable. I then thought why not make this extra insane and animate the hue slowly through the spectrum so that the colour of the page is changing slowly in the background! Apparently you can't animate a css variable without @property. So it's not just letting you use a css variable instead of a raw value, it's letting you animate the css variable -- and, in turn, all the places that css variable is referenced! So with one simple `@keyframes neon-flow { from { --dc-neon-hue: 0; } to { --dc-neon-hue: 360; } }`, I animate everything -- all the primary colours, all the box shadows, etc.
`inherits: false` lets you control how the property is inherited. For example, in normal css, the property `color: red` is inherited. If you set it on a div, all elements in the div will have `color:red` unless they specifically override it. But, say the property `display: flex` does not behave this way. If I set it on the div, only the div becomes display flex. This is exposing the ability to control how your custom property is inherited -- like `color` (`inherits: true`) or like `display` (`inherits: false`). I believe the type is there so that it can at static time know what to animate. Since a css variable can be anything, unlike a css property. E.g. `from { color: red } to {color: blue}` it knows the types because of the properties. With css variables, it needs to be told what the types are. Added fun fact: the type syntax is actually the same syntax you'll see on like mdn! https://developer.mozilla.org/en-US/docs/Web/CSS/color#forma... . So it's like exposing the internals of CSS as an API any developer can use :) |
![]() |
| Thank you. Why the article doesn't describe what @property does or how to use it is mind-boggling. It's completely obfuscated by the overly complex example. |
![]() |
| This seems like we will need some wrapper libraries around this. It's super cool, but also super complex, and I am not sure you want all this complexity in your codebase. |
![]() |
| I agree, God forbid a native do something better than a web app. Let's make web dev even more complicated, I was just saying how simple it is currently |
![]() |
| CSS has been very, very, very close.
I would had had, had - "has" not been had, expected sooner, but atlas. But the aforementioned ":has": : The :has() pseudo-class cannot be nested within another :has(). This is because many pseudo-elements exist conditionally based on the styling of their ancestors and allowing these to be queried by :has() can introduce cyclic querying.
Note the two limits, "cyclic querying" and self-referential parameters.The former is required for a basic computational model, the latter for one that supports recursive-ness and thus some optimizations .
This is just lambada calculus and has no tape movement - requires checkin boxes, still, and thinking about whether or not to halt - which actually kinda is its own asterisk (not the usual 'infinite tape' kind). Turing Machines would halt on some input; your calculator goes until the actual computer, you, halts, or stops actually checking(computing) the state for a HALT/desired state.You'd think someone woulda parasol'd the checkboxes and at least attempted to use :onHover with grid to require minimal mouse movement to trigger input instead. Or, a bounding box input state driven hack - like when your cursor is "in between" elements, changing every frame.
seems cool, actually. SASS repeats CSS exhaustively through HTML-encoded steps until a valid one is painted - that valid one being the HALT/output. You do have to specify the number of steps, though. You would have to know whether or not it halts, the answer, and how many steps it took to compute to functionally (heavy-lifting in this context) use it - or else it would have to reference itself....which would make it a higher grammar.But it can't: https://www.w3.org/TR/css-variables/#cycles
Very close. But you must beg the question (ie. know the answer) in both step count and thus the answer, else you'd have an infinite HTML page. Which is fine in math (HTML is a Type 2, can be infinite, no self-reference, no self-children, nor orphans), but not really much of a simulation/emulation though - if it can only produce valid machines at (essentially) compile time. |
![]() |
| What? Blue LEDs were much cooler! I even modified hardware to swap out green/red for blue (c1997) cause they were so awesome. I have to put a small V-drop cause they were so bright. |
![]() |
| Fancy CSS effects are slow to run, they use lots of CPU time just like Flash animations used to.
When I switch from this HN tab to the article page, Firefox's CPU usage goes from 2% to 26%. |
![]() |
| Drive around some of Vegas and say that all the old incandescent lights and neon are just pollution. Some of it, designed just for eyeballs and profit, actually ends up being beautiful. |
![]() |
| This seems like a bad path to go down. Even if ChatGPT were a perfect developer, being able to understand code would be important because communicating specs is hard |
![]() |
| As an aside, modern CSS would be useful in a non-web configuration language role too, but almost nobody seriously considers it --- instead preferring the usual ad-hoc mix of JSON, YAML, and TOML. |
I looked at the CSS for the first codepen example, and it looks like gibberish to me.
Should we really have a mini animations programming language in the styling system? This seems like a bit much. More than a bit much.
Can't this be done with Javascript? I get that a lot of people have a knee-jerk negative reaction to using JS for everything, but it's a programming language... this is kinda its job.