标签：#frontend

CSS just got its biggest quality-of-life upgrade since custom properties. For years, if you wanted reusable logic in CSS, you had two choices: wrestle with custom properties that couldn't do real computation, or reach for a preprocessor like Sass. That era just quietly ended. CSS now has native custom functions — and they're as powerful as you'd hope. 1. What Exactly Is @function ? Think of it exactly like a JavaScript function — but living inside your stylesheet. You give it a name (always prefixed with -- ), define some parameters, and write a result: descriptor that determines what it returns. /* BASIC SYNTAX */ /* Define it once */ @function --double ( --x ) { result : calc ( var ( --x ) * 2 ); } /* Call it anywhere */ .box { width : --double ( 20px ); /* → 40px */ height : --double ( 50px ); /* → 100px */ } No var() wrapper needed to call it. No build step. No Sass import. Just define and use — as many times as you like, across your entire stylesheet. Note: Unlike Sass, native CSS functions don't evaluate math automatically. You must wrap mathematical operations in calc() inside your result descriptor. 2. The Syntax in Full Detail Parameters with Default Values You can make parameters optional by giving them a fallback — the function still works even if you don't pass a value. @function --spacing ( --size : 16px ) { result : calc ( var ( --size ) * 1.5 ); } .card { padding : --spacing (); /* → 24px (uses default) */ margin : --spacing ( 20px ); /* → 30px */ } Type-Safe Parameters You can declare the expected type of each parameter — and the return type too. The browser will validate this at parse time, preventing weird cascading bugs. @function --fade ( --color < color > , --alpha < number > : 0.5 ) returns < color > { result : color-mix ( in srgb , var ( --color ), transparent calc ( var ( --alpha ) * 100% ) ); } .overlay { background : --fade ( royalblue , 0.3 ); /* 70% opaque blue */ } Logic Inside Functions This is where @function gets genuinely exciting. Y

How to build your professional network as a developer — authentic strategies Building a Genuine Professional Network in Tech: A Practical Guide for Introverts and Extroverts Networking in tech isn’t about collecting business cards or forcing yourself to “work the room.” It’s about building real relationships with people you can learn from, collaborate with, and support over the long term. Whether you’re an introvert who prefers deep one-on-one conversations or an extrovert who thrives in crowds, you can build an authentic network that opens doors to mentorship,Jobs, collaborations, and career growth. Redefine Networking: It’s About Relationships, Not Transactions Forget the image of awkward name tags and empty promises to “grab coffee sometime.” Real networking is: Swapping war stories about debugging nightmares Sharing a job posting with someone who’d be a great fit DMing a speaker to say their talk inspired you Helping someone solve a problem without expecting anything back Quality over quantity isn’t just a buzzword-it’s your career strategy. You need 5-10 real connections, not hundreds of superficial contacts. Leverage Twitter (X), LinkedIn, and Dev Communities Effectively Twitter/X for Developer Networking Dev Twitter is alive and vibrant. Use it to: Share what you’re learning (builds credibility) Comment thoughtfully on others’ posts (starts conversations) DM speakers after webinars to say you enjoyed their talk Join tech conversations using relevant hashtags (#100DaysOfCode, #BuildInPublic) LinkedIn Profile Optimization Write a clear headline that explains what you do and what you’re curious about Share project updates, lessons learned, or thoughtful commentary on industry trends Join niche developer groups related to your tech stack Send personalized connection requests mentioning something specific you admired about their work Developer Communities (Discord, GitHub, Open Source) Join Discord servers for your favorite languages/frameworks Contribute to open

<form action= "https://bank.com/transfer" method= "POST" > <input name= "to" value= "attacker" > <input name= "amount" value= "10000" > </form> <script> document . forms [ 0 ]. submit () </script> Five lines of HTML on a malicious page. When a user who's logged into bank.com in another tab visits this page, the browser auto-submits the form, attaches their session cookie, and ten thousand dollars leave their account. They didn't click anything. The malicious site didn't see their password. There was no XSS, no breach, no leak in the traditional sense. The browser did exactly what it was designed to do. That's CSRF — Cross-Site Request Forgery — and it's been the classic "confused deputy" attack on the web for two decades. Let's walk through what makes it work, why CORS doesn't help, and the one cookie flag that mostly killed it around 2020. Why the browser attaches your cookie to that request Cookies belong to a domain. When you log into bank.com , the bank sets a session cookie in your browser: Set-Cookie: session=abc123; HttpOnly From that point on, every single request your browser sends to bank.com carries that cookie. Every page load. Every API call. Every image fetch. The browser does it automatically, without asking, and regardless of who triggered the request. That last word is the door CSRF walks through. The browser attaches the cookie based on where the request is going , not where it came from . So when evil.com triggers a POST to bank.com/transfer , the browser sees a request destined for bank.com , looks up the cookies for bank.com , and attaches them. As far as the bank's server can tell, the request looks exactly like one the user submitted from inside the bank's own page. This is the "confused deputy" idea. Your browser is the deputy. It has authority on your behalf (your cookies). And it's been tricked into using that authority for someone else's benefit. The server has no way to tell the difference, because from its point of view, there isn't one.

How to handle production incidents — a step by step guide for engineers Incident Response Under Pressure When an outage hits, the goal is not to look smart in the moment; it is to restore service safely, keep people informed, and learn enough to prevent the next incident. The best teams follow a calm, repeatable process: prepare, detect and analyze, contain and recover, then review what happened afterward. Stay Calm First The first skill in incident response is emotional control. Panic makes people chase symptoms, jump between theories, and change too many things at once; calm responders slow the pace, stick to facts, and make the next action explicit. A useful rule is to pause long enough to ask: what changed, what is broken, what is the blast radius, and what is the safest next step. A simple reset phrase helps in the room: “Let’s gather signals, form one hypothesis, test it, and reassess.” That keeps the team from arguing about guesses and pushes everyone toward evidence-driven work. Debug Systematically Use a loop instead of improvisation. Start with symptoms, then check recent changes, then form a small set of likely causes, then test one hypothesis at a time, and finally verify recovery before declaring victory. During an outage, useful questions are: What is failing, and what is still working? When did it start? What changed right before it started? Is the problem isolated or widespread? What logs, metrics, traces, or user reports support each theory? Preserve evidence as you go. Avoid restarting systems, wiping logs, or making broad fixes before you understand the failure mode, because that can destroy the clues you need later. Communicate Clearly Stakeholder communication should be planned, not improvised. Good communication identifies who needs updates, what they need to know, how often they need it, and which channel you will use for each group. A practical outage update should cover four things: What happened in plain language. What the user impact is. W

How to approach hard problems — first principles thinking for engineers First principles thinking is a powerful engineering method for solving hard problems by stripping away assumptions, reducing a system to fundamental truths, and reasoning back up to a solution from those truths. In practice, it helps you avoid cargo-cult design, debug faster, and make architecture decisions based on invariants instead of habit. What it is First principles thinking means asking: what do we know for certain, what is merely assumed, and what must be true for this system to work? Instead of copying a known pattern because it worked somewhere else, you decompose the problem into constraints, facts, resources, and failure modes, then build the simplest solution that satisfies them. For engineers, this is especially useful when the problem is novel, the stakes are high, or the decision is hard to reverse. Core method Use this loop: Define the problem precisely. List facts and constraints. Separate assumptions from evidence. Reduce the system to fundamentals. Ask why repeatedly until you hit a root cause or invariant. Rebuild the solution from those fundamentals. Test the smallest thing that can prove or disprove your reasoning. A useful engineering question is: “What must be true for this to work?” because it forces you to identify invariants before picking tools or patterns. System design example Suppose you need to design a notification service. Start with fundamentals: What is the work? Deliver messages reliably. What are the entities? Users, notifications, delivery attempts. What changes over time? Notification status, retry count, recipient preferences. What must never break? A user should not receive duplicate critical alerts, and failed deliveries should be visible. What happens under load? Queueing, retries, and backpressure become essential. From there, the architecture follows the requirements rather than fashion. If the real constraint is reliable delivery under bursty traff

My Experience Using dnd-kit in React and Next.js For a long time, I avoided building drag-and-drop features in frontend projects 😅 Not because I did not need them. Mostly because drag and drop always felt unnecessarily complicated. When you think about implementing it, your brain immediately jumps to: animations sorting logic touch support accessibility performance state synchronization and suddenly a simple UI interaction feels like a massive feature. But recently, in one of my React and Next.js projects, I decided to finally try dnd-kit. Honestly, it changed my perspective completely. I used AI to help me with the initial setup and understanding some concepts like sortable contexts and drag events, but after that, working with the library felt surprisingly smooth. And that's what impressed me most. dnd-kit feels lightweight, modern, and flexible without becoming overwhelming. It gives you the tools you need without forcing a huge architecture or complicated patterns on your app. Things I Personally Liked About dnd-kit Very clean React-first API Lightweight and composable Works really well in React and Next.js projects Building sortable lists feels much simpler than expected Flexible enough for custom UI and interactions Good developer experience overall Something Interesting I Noticed When a library has a clean architecture and predictable patterns, AI becomes much more useful while learning it. The generated examples were easier to understand, easier to debug, and easier to customize compared to many older drag-and-drop solutions. If you are building things like: kanban boards sortable lists draggable cards dashboards reorderable tables I definitely recommend taking a look at dnd-kit. It ended up being much simpler and more enjoyable than I expected. Website https://dndkit.com/

The Redefinition of "Frontend Engineer" in 2026 The era of the frontend engineer as a purely visual specialist is over. In 2026, companies like Vercel, Linear, Figma, Shopify, and major FAANG divisions expect their frontend engineers to think in terms of systems, not just components. A modern frontend engineer must understand rendering pipelines, browser internals, network optimization, and component architecture at the same depth that a backend engineer understands database indexing or API design. This shift is reflected directly in how companies interview frontend candidates. If you walk into a 2026 frontend interview expecting to answer "what's the difference between let and const ," you will be humbled. This guide covers everything you need to know to pass a senior-level frontend interview at a top tech company. Core Web Vitals: The Mandatory Topic You Can't Skip Google's Core Web Vitals have become a standard lens through which senior frontend engineers are evaluated. Interviewers now routinely ask candidates to diagnose performance bottlenecks using CWV metrics. The three primary metrics are: LCP (Largest Contentful Paint): Measures perceived load speed. Target under 2.5 seconds. Optimized via image preloading, server-side rendering, and CDN caching. INP (Interaction to Next Paint): Replaced FID in 2024. Measures responsiveness. Optimized by breaking up long tasks, using web workers, and deferring non-critical JavaScript. CLS (Cumulative Layout Shift): Measures visual stability. Prevents jarring layout shifts by pre-defining dimensions for images, iframes, and dynamic content. Be prepared to walk through a real-world scenario: "Given an LCP score of 4.2s, what is your systematic debugging and optimization approach?" This is now a standard senior frontend interview question. React 19 and the Concurrent Rendering Model React 19 introduced a fully concurrent rendering model that fundamentally changes how components behave. Key concepts interviewers probe in 2026

Google shipped the Prompt API in Chrome 148 on May 5, 2026. Mozilla objected. Apple's WebKit team...