In 1992 Phillip Hallam-Baker and Tim Berners-Lee were developing HTTP. Phillip suggested a request header to record the URI of the linking-document, and "referer" (a spellcheck failure) was born. Servers now knew what site sent you their way.
In 1993 a young developer working on the Mosaic browser added support for inline images. Before this, images could only be linked from a page and viewed separately. Images from remote servers were supported as well, and requests for them would eventually include a referer header.
In 1994 Lou "solved" statelessness on the Web. Cookies could be set by a server, and would be returned to that server with future requests. Session IDs could move out of the URL path, and into a more convenient home. Like images and referer, cookies worked with third parties too.
In 1995 Netscape's Brendan Eich forever changed the Web by transforming the lowly browser into a robust development platform. Web Developers now had an easy-to-learn scripting language in the browser, and access to a growing wealth of APIs.
Each of these men forever changed the Web and World in many positive ways; we certainly owe them a great deal of gratitude for their incredible work.
But that isn't where the story ends…
There were unintended consequences. Tim, Phillip, Marc, Lou, and Brendan collectively created the potential for something sinister: Surveillance-Based Digital Advertising.
Ad Servers who have images loading across various domains could now effectively track visitors to those domains. Each image requested from the ad-server shared what website the user was visiting, as well as provided access to persisted, user-specific identifiers via cookies.
By 1996 the Web was witnessing the power of tracking-based digital advertising. John Danner's AdServer product could distinguish one user from another based on request headers, cookies, search terms, and more. NetGravity was soon purchased by an even hungrier competitor.
Kevin and Dwight formed DoubleClick in late 1995 and saw tremendous growth in 1996. Following their purchase of NetGravity, little stood in the way of continued growth. DoubleClick dominated the industry over the next decade until being bought by Google in 2007 for $3.1 billion.
The story doesn't end here, but this thread will. Suffice it to say, this is where the battle over our data starts to get heated. I am proud to work on @brave, which aims to put the user back in control of their data and privacy.
WordPress, for all the good it has done, simply cannot help but to screw up the simplest things.
<pre>\\.well-known</pre>
In walks WordPress, "Oh, let me quadruple those backslashes for you."
So I try \, which WordPress then converts into &#92;!
I just can't win here.
Yes, I know to make changes in the TEXT view, and not the Visual view. Tragically, that will give you all sorts of [other] problems, like randomly eating carriage-returns, or inserting a <br> here and there. This utility simply isn't cut-out for sharing code(-like) content.
Wait, wait—I got the formatting to stick, and the content to look the way I wanted.
Windows uses values 0D 0A to signify a line-break. Mac uses 0A.
TIL—Windows XP had a bug causing Notepad to insert 0D 0D 0A. It wouldn't save like that, but if you copied and pasted the contents elsewhere the bytes could be preserved to this day.
Reminded me how cool the comma operator is in JavaScript:
return Expr, …, Expr
Evaluates each expression, but returns result of last.
Ti be more clear, the return statement returns the result of the Expression (if any) to its right. Expressions can contain Expressions. So each of the expressions in a list are evaluated, but only the result of the final is returned.
I think I first read about this little detail in one of @rauschma's fantastic deep-dive posts, but I'm not sure which one.
Over the years there have been various ways to sniff the user's web history with CSS and JavaScript. For example, generating 10,000 links & checking their color (visited differs by default). These are now blocked, but I wonder how often advertisers and exchanges engaged in this.
Clever developers would adapt to these changes, turning their focus from the links to the style of adjacent elements with :visited + span, and then reading span's computedStyle to see how it looks. Background images could be used in a similar manner; listen for what loads.
Even when you lock-down CSS, developers would sniff your cache by using sensitive clocks in JS and seeing how quickly resources loads. If 2 similar resources load at very different rates, one could be inferred to have been loaded from cache (indicating user visited a given site).
TIL dangerouslySetInnerHTML is React's way of pushing back when developers wish to set innerHTML on an element.
Reminds me of toStaticHTML and execUnsafeLocalFunction from Windows 8 Apps.
jQuery wasn't compatible initially; I was able to contribute fixes.
jQuery had a cool HTML-cleanup routine. It would construct an ad-hoc DIV, pass HTML input into div.innerHTML, and then read it back out; it used the browser's parser to clean-up the user-provided source.
But when you'd include jQuery into your Windows 8 app, all sorts of alarms!
jQuery would also stand-up some internals tests for determining browser support, and these would use innerHTML too.
We were able to replace those tests with calls to createElement and appendChild, and for the sanitize function, I think we wrapped it in an unsafeLocalFunc call.