Font-display Swaps Can Shift Layout Through ch-Based Widths, Harness Shows

·3 views

A developer argues that font-display: swap is a three-phase timing contract rather than a single behavior, and that its layout impact can be larger than typically assumed. Using a test harness on a hero page with a 52ch-constrained paragraph, the author found that the paragraph's width jumped about 35.6% when the webfont replaced the fallback, because ch is recalculated from the active font's zero-glyph width. That width change reduced the paragraph from three lines to two, moving the button up 29px. Measured layout-shift values varied by display setting, with swap producing a cumulative layout shift of 0.00083 and a size-adjusted fallback reaching 0.00779. The author notes these figures come from a single controlled setup and states the limits of the test.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

DNApps proposes shipping app blueprints instead of source code

The author proposes DNApps, a format in which an app is described by a single capsule file that states its purpose, which decisions are fixed versus adaptable, and the build order. A coding agent such as Claude Code, Codex, or Cursor would then generate the actual app tailored to the recipient's language, operating system, devices, preferences, and hosting. The author's example, a 15 KB capsule named Plate, yields a 75 to 95 KB app, roughly five times larger, though results on bigger apps are unknown. The approach could support multiple levels of detail, and a retired app could be kept as a compact capsule and regenerated later. The author is seeking feedback on whether the format is useful or breaks down at scale, and the v0.1 spec is open for comment until January 10, 2027.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Node.js PDF encryption for property bundles: sending passwords out of band

The article explains how a Node.js service should encrypt finished PDF bundles, store them privately, and deliver the document reference and its password through two separate channels. It warns that sending both through the same email thread undermines the security benefit, and that passwords must never appear in logs. The recommended design splits the work so a thin Express handler accepts jobs while a worker handles encryption, using explicit state transitions such as encrypted, stored_private, and password_notified. Operators are advised to alert on bundles stuck in a half-delivered state rather than on individual request failures. The piece also covers the state record fields needed, the dangers of false completion signals, and a Go example showing careful API client behavior.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

HPE ArubaOS CVE-2026-79869 Prompts Patch and Segmentation Push Across Wireless Networks

CVE-2026-79869 affects HPE Networking ArubaOS AOS-10 systems across several release branches, with a CVSS rating of 9.6 and potential for privileged command execution. Administrators are advised to build a complete device inventory, including controllers, gateways and access points, and reconcile it against management and discovery records to find unmanaged units. Fixed versions are 10.8.1.2, 10.7.2.7 and 10.4.1.14, and each device should be mapped to the correct target rather than upgraded through a blanket order. Until patching is complete, HPE recommends restricting management interfaces to a dedicated VLAN and controlling access at layer 3 and above, with documented owners and removal conditions for any temporary containment. The vendor reported no known public exploit code at initial release, though the guidance stresses local evidence of patch state over public exposure data.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Why your cron job isn't running: eight common causes and how to check each

A cron job that silently does nothing usually traces back to one of eight causes, the article explains. The first step is confirming the cron daemon is actually running, since minimal container images often lack it entirely. Failures are hard to spot because cron mails output to a local user that most servers never configure, so the article recommends redirecting each job's output to its own log file. Other frequent culprits include a shorter PATH than the interactive shell uses, shell-specific syntax breaking under /bin/sh, unescaped percent signs, mismatched crontab formats, non-executable scripts or Windows line endings, and a server time zone that differs from the user's. Each cause comes with a one-line test to confirm it.

0 comments Read more at DEV Community