Thomas Steiner :chrome:

Developer Relations Engineer at Google, focused on Web AI, WebAssembly, and Project Fugu 🐡. Dad-of-3. Alum of Université de Lyon (Postdoc), Universitat Politècnica de Catalunya (PhD), Karlsruhe Institute of Technology (MA).

Blog: https://blog.tomayac.com
GitHub: https://github.com/tomayac
LinkedIn: https://www.linkedin.com/in/thomassteinerlinkedin/
Bluesky: https://bsky.app/profile/tomayac.com

Public Key

npub1cttl3rpqmwtcqes0pvh4c04qkt7mx5jcwwwn80e0t0akq6g0jhls2t3egd

NIP-05 Address

tomayac_at_toot.cafe@momostr.pink

Profile Code

nprofile1qqsv94lc3ssdh9uqvc8skt6u86st9ldn2fv888fnhuh4h7mqdy8etlcpz3mhxue69uhhyetvv9ujuerpd46hxtnfduqs6amnwvaz7tmwdaejumr0dswq0se6

Publishing to

relay.damus.io

nos.lol

Author Public Key

npub1cttl3rpqmwtcqes0pvh4c04qkt7mx5jcwwwn80e0t0akq6g0jhls2t3egd

Show more details

Last Notes

2026-04-15 21:12:06 UTC

Introducing a new spam policy for "back button hijacking": https://developers.google.com/search/blog/2026/04/back-button-hijacking. If you mess with the back 🔙 button, it's not the growth hack you think it is. I've seen unnamed news sites do this when you navigate to an article page, want to go back to where you came from, but then the back history gets hijacked and you're suddenly on the news site's main landing page.

2026-03-21 09:17:41 UTC

- reply

Yes, 100% this. But glad the company eventually gave in and listened.

2026-03-21 09:01:29 UTC

Haters gonna hate, but I personally think this keeping #Android truly open—and open anonymously—while balancing the threats we see in the real world is a _great_ compromise: https://android-developers.googleblog.com/2026/03/android-developer-verification.html. Think outside of the Mastodon bubble, almost none of us here is a typical user.

2026-03-10 07:57:51 UTC

- reply

We have a long-standing bug open for this (that I even commented on in the past, marked as "developer pain", but forgot about): https://issues.chromium.org/issues/40745354#comment14.

2026-03-09 21:54:51 UTC

- reply

I can reproduce and have asked internally if there's a solution. For some reason I vaguely recall `target="_blank"` was the fix, but it definitely doesn't work (any more?).

2026-03-09 13:19:19 UTC

- reply

That's right. There's this tester app that the team built, maybe one of the click behaviors is the one you want? https://googlechrome.github.io/samples/pwa-testing/octagonal-handsomely-burrito/ (It talks about the abandoned Declarative Link Capturing feature, ignore those bits, just try the various link variations.)

2026-03-09 12:57:28 UTC

- reply

We have two things here:
1) Linking into PWAs: https://developer.chrome.com/docs/capabilities/pwa-navigation-management
2) Linking out of PWAs: https://developer.mozilla.org/en-US/docs/Web/Progressive_web_apps/Manifest/Reference/scope and https://developer.mozilla.org/en-US/docs/Web/Progressive_web_apps/Manifest/Reference/scope_extensions

2026-03-06 09:11:52 UTC

👀 Intent to Prototype: HTML `toolbar` element
https://groups.google.com/a/chromium.org/g/blink-dev/c/jitI6P4LHzc/m/mTFnh2pVCAAJ!
Example from the Explainer (https://open-ui.org/components/toolbar.explainer):
```html
<toolbar aria-label="Main">
<button id="undoButton" aria-label="Undo"><img src="..." alt=""></button>
<button id="redoButton" aria-label="Redo"><img src="..." alt=""></button>
<input id="zoomSelect" list="zoom" aria-label="Zoom">
...
</toolbar>
<datalist id="zoom">
<option>Fit</option>
<option>50%</option>
...
</datalist>
```

2026-02-04 10:51:44 UTC

I've created a little #Mastodon 🐘 toot edit history viewer that lets you explore the history of a toot, edit by edit through the #MastodonAPI. Here's an example: https://tomayac.github.io/mastodon-edit-history/#https://mastodon.social/@firefoxwebdevs/116002119945073671. Source code: https://github.com/tomayac/mastodon-edit-history.

2026-01-16 07:05:24 UTC

- reply

I still far too often see a pattern like this:
<label for=checkbox>
Yes, I have read the
<a href=terms.html>
Terms & Conditions
</a>.
</label>
But it's right here: https://developer.mozilla.org/en-US/docs/Web/HTML/Reference/Elements/label#accessibility.

2025-11-25 17:47:59 UTC

WebGPU is now supported in major browsers: https://web.dev/blog/webgpu-supported-major-browsers. My colleague François Beaufort has all the details on why this matters, the detailed support table, and the ecosystem around it.

2025-11-18 10:25:30 UTC

Building a multi stage timetable with modern CSS using grid, subgrid, `round()`, and `mod()`: https://9elements.com/blog/building-a-multi-stage-timetable-with-modern-css-using-grid-subgrid-round-and-mod/. Can all conferences please just use this, and maybe add just a sprinkle of JavaScript to it, so that it scrolls to the current time's sessions?

2025-11-15 02:24:19 UTC

- reply

Try the Internet Archive, they have emulators online for almost everything. For example, here's James Pond on the C64: https://archive.org/details/jamespond_c64. Enjoy!

2025-11-15 01:20:21 UTC

Lovely Initiative by the search engine Kagi: small web, a hand-curated list of personal sites that the engine will boost in results: https://github.com/kagisearch/smallweb. Currently limited to English. "Do not submit your own site unless you also submit two other sites!"

2025-11-13 13:12:13 UTC

- reply

Ich habe wohl kein ADHS, aber die Fragen für den kostenlosen Soforttest sind sehr suggestiv. Wehr ADHS "haben möchte", weiß genau, was er/sie ankreuzen muss. Immerhin kann man den Soforttest ohne Anmeldung auswerten lassen.

2025-11-05 19:32:51 UTC

The Inner Workings of JavaScript Source Maps:
https://www.polarsignals.com/blog/posts/2025/11/04/javascript-source-maps-internals. This is a very fascinating dissect of a feature we tend to take for granted.

2025-11-01 15:56:14 UTC

- reply

Kindergarten: du, you're likely all the same-ish age group (very much an -ish, but the outliers want to belong, so easy). Cleaners, bakery staff, in general people you see frequently: I'd err on the side of sie. You usually don't address them by name, even if they have it visible on their name plate on their chest.

2025-11-01 15:41:47 UTC

- reply

Difficult. In such cases I'd start with "Guten Tag" and use sie and just avoid any gender-requiring formulations as hard as I can. In English, I use "Hi there". Also happens when you only know someone's email or social network handle.

2025-11-01 15:21:13 UTC

- reply

Mind explaining? I recall being honored when teachers started with the sie when all of us turned 18, but also remember feeling old when I was in my 20ies and the kids started addressing me with sie. Now in my 40ies it's just no matter what and I'm glad if they don't offer me a seat in the bus yet. 😂

2025-11-01 15:13:37 UTC

- reply

For work emails, my rule would be: you address them by their first name ("Hallo Sara"), you say du, you address them by their last name ("Hallo Frau Joy"), you say sie.

2025-11-01 15:09:43 UTC

- reply

All of those imply you don't know them. Err on the side of "Sie" if you are the first to make contact, but often you can just wait and see what they do. Like in a restaurant, if they ask you "Was darf ich dir bringen?", you already know they are fine with du. With uppercase/lowercase: easy. The orthographic rule was to uppercase the Sie, for example, in letters, but now you just may lowercase everything and have the Duden on your side. #GermanAsAService

2025-10-21 21:48:43 UTC

Interesting DOM localization proposal by Mozilla: https://github.com/mozilla/explainers/blob/main/dom-localization.md.
In your HTML:
`<link rel="localization" src="resource.mf" />`
In the `resource.mf` file:
`greeting = Welcome, {$userName}.`
In your: HTML:
`<h1 l10n-id="greeting" l10n-args="userName: John"></h1>`
Rendered DOM:
`<h1 l10n-id="greeting" l10n-args="userName: John">Welcome, John</h1>`

2025-10-18 05:09:49 UTC

A native way of having more than one thumb on a range slider in HTML:
https://utilitybend.com/blog/a-native-way-of-having-more-than-one-thumb-on-a-range-slider-in-html. Cool proposal by @npub16zz…2ugy for a `<rangegroup>`element. I gave feedback already that this could maybe be generalized to an `<inputgroup>` element so you could define radio groups less awkwardly (i.e., not by making them share the same `name` attribute.

2025-10-03 08:59:52 UTC

We're soon letting you localize your manifest, so your PWA can have different names in different languages: https://groups.google.com/a/chromium.org/d/msgid/blink-dev/17f99c87-4953-4c9e-a767-f0fb2f7617ban%40chromium.org.
```json
{
"lang": "en",
"dir": "ltr",
"name": "Color Picker",
"name_localized": {
"de": "Farbwähler",
"fr": {"value": "Sélecteur de couleur", "lang": "fr-CA", "dir": "ltr"},
"ar": {"value": "منتقي الألوان", "dir": "rtl"}
}
}
```
Search the spec https://w3c.github.io/manifest/ for "member is a localizable member".

2025-10-03 06:39:13 UTC

Quiet UI, a really well-made standard Web component library: https://quietui.org/. Source code on GitHub: https://github.com/quietui/quiet. It's from @npub15q9…6cmc, whom you may know from Shoelace, and this is why he decided to create Quiet UI: https://quietui.org/about#a-message-from-the-creator.

2025-09-12 07:08:53 UTC

- reply

The more common term in English seems to be client politics or clientelism: https://en.wikipedia.org/wiki/Clientelism.

2025-09-12 06:29:04 UTC

The German government, @npub1s6p…uzkk is active here, great 👏. It's hilarious to read the Fediverse's responses to their recent few toots where they announce their nonsense clientele politics. The #Fediverse is alright! It's an alright bubble, unfortunately.

2025-09-08 20:14:30 UTC

Good writeup of the recent npm package compromises: https://www.aikido.dev/blog/npm-debug-and-chalk-packages-compromised. It's dangerous out there, folks!

2025-08-10 16:08:08 UTC

Disclaimer: https://xkcd.com/3126/.

2025-07-25 20:55:19 UTC

📢 New blog post: What a diff'rence a semicolon makes: https://blog.tomayac.com/2025/07/26/what-a-difference-a-semicolon-makes/. Hat tip to @andre@jaenis.ch and @npub1t0w…zgs2 for pointing me at (André) and creating (Chris) the Web Development Merit Badges that I'm mentioning in the post.

2025-06-25 08:44:25 UTC

Very exciting Intent to Prototype for "Fetch retry": https://groups.google.com/a/chromium.org/d/msgid/blink-dev/CACPC1r6QFoqcmdoEMeG4JKJXGLqvGW%2BMr-UZj%2Br6HrQ%3DTNqKYQ%40mail.gmail.com. This explainer gas all details: https://github.com/explainers-by-googlers/fetch-retry/tree/main.
```js
fetch("/api/logging, {
method: "POST",
body: data,
keepalive: true, // Essential for retryAfterUnload: true
retryOptions: {
maxAttempts: 5, // Max 5 retries (6 total attempts)
retryNonIdempotent: true // Required to allow retrying POST
// Use default value for the retry delay etc.
}
});
```

2025-06-23 13:54:25 UTC

- reply

Happy to change the title to just "JSON modules". Whatever causes the least confusion.

2025-06-20 06:26:23 UTC

- reply

It's also mentioned under that name (aka.) in the web-features repo: https://github.com/web-platform-dx/web-features/blob/d87eb3bc663e73dd9d10c7066911bc6328cd8056/features/json-modules.yml#L2. Agree that "JSON modules" rolls a bit better off the tongue.

2025-06-19 13:27:48 UTC

- reply

That's what the HTML spec calls them: https://html.spec.whatwg.org/#json-module-script.

2025-06-19 07:37:15 UTC

JSON module scripts are now Baseline Newly available: https://web.dev/blog/json-imports-baseline-newly-available.
```js
import astronomyPictureOfTheDay from "./apod.json" with { type: "json" };
const {explanation, title, url} = astronomyPictureOfTheDay;
```
🚀

2025-06-14 06:14:46 UTC

- reply

Bin selbst bei fraenk. Super simpler Tarif: 10€ und das war's. Netz ist Telekom.de und die App ist schlicht und einfach.

2025-06-04 06:49:45 UTC

"We found that native Android apps—including Facebook, Instagram, and several Yandex apps including Maps and Browser—silently listen on fixed local ports for tracking purposes.
These native Android apps receive browsers' metadata, cookies and commands from the Meta Pixel and Yandex Metrica scripts embedded on thousands of web sites."—https://localmess.github.io/
This proposal is related: https://github.com/explainers-by-googlers/local-network-access. You can also replace native apps with PWAs that don't have the power to open servers.

2025-05-27 15:54:40 UTC

- reply

Hah, that's me asking for this in 2023: https://bugs.webkit.org/show_bug.cgi?id=254726.

2025-05-10 21:07:20 UTC

- reply

Smultron means strawberry 🤯. Hence the icon: https://www.peterborgapps.com/smultron/. I was using this editor for many years before making the switch to VS Code.

2025-05-03 22:07:42 UTC

Staged proposals at the WHATWG: https://blog.whatwg.org/staged-proposals-at-the-whatwg. Informative write-up by @npub1ctu…29ks on the optional stages process for proposing new features at the WHATWG.

2025-03-27 09:28:44 UTC

📢 New post by Andreas Rossberg on the #WebAssembly site in which he announces the #Wasm community's adoption of #SpecTec 📄, a domain-specific language and toolchain that facilitates both the Wasm specification and the generation of artifacts necessary to standardize new features: https://webassembly.org/news/2025-03-27-spectec/.

2025-03-26 07:30:03 UTC

There's now a CSS way to style find-in-page highlights: `::search-text` and `::search-text:current`: https://blogs.igalia.com/schenney/find-in-page-highlight-styling/. 🔎

2025-03-20 07:22:38 UTC

As of last December, release 2.0 of the #Wasm specification is “official”! Read Andreas Rossberg's post, which happens to be the first real post on the #WebAssembly website's new News 🗞️ section: https://webassembly.org/news/2025-03-20-wasm-2.0/.

2025-03-11 19:22:56 UTC

- reply

I'm the Wasm police at work who would always correct this in docs. I also fix wrong character casing of JavaScript. 🫡

2025-02-28 07:15:17 UTC

- reply

Great post! (Tiny thing in 5.2: your example is called `math.ts`, but you probably want to call it something like `string.ts`.)

2025-02-14 03:37:12 UTC

How Google Search uses speculation rules: https://developer.chrome.com/blog/search-speculation-rules. Probably the most impactful speculation rules deployment explained by @npub1tcq…8yp7 and Oleksiy Busaryev.

2025-01-29 07:38:09 UTC

- reply

This is a fantastic post, thank you! Any chance for GitHub to open-source this as a custom element?

2025-01-25 10:14:09 UTC

A #WebAssembly compiler that fits in a tweet: https://wasmgroundup.com/blog/wasm-compiler-in-a-tweet/. This was a fun read on both #Wasm and JavaScript code golfing ⛳.

2025-01-19 08:36:17 UTC

- reply

This escalated quickly 😨. #11ty #Eleventy
https://assets.toot.cafe/media_attachments/files/113/854/099/832/108/316/original/8819c858d072c787.png

2025-01-14 13:14:29 UTC

👋 Sent my final tweet: https://x.com/tomayac/status/1879153249305129412.

2024-12-27 14:58:34 UTC

- reply

(You're missing Dart, which means everyone writing Flutter apps for the Web.)

2024-12-14 07:28:37 UTC

- reply

Hang in there. The single-most hated but also after a while the most-helping thing I've learned about kids is: Es ist alles nur eine Phase.

2024-12-12 11:18:09 UTC

wasm-vips is libvips for the browser and Node.js, compiled to #WebAssembly with #Emscripten: https://github.com/kleisauke/wasm-vips. There's a cool playground to test it: https://wasm-vips.kleisauke.nl/playground/.

2024-12-11 08:59:23 UTC

- reply

It is widely used: https://webdatacommons.org/structureddata/#results-2023-1.

2024-12-03 13:41:27 UTC

- reply

Check if a canonical link exists, and only when it doesn't, fall back to `location.href`.

2024-11-30 23:09:13 UTC

- reply

Titanic has you covered then: https://www.titanic-magazin.de/news/wirtschaftswende-deutschland-die-outtakes-14487/. It's like a German version of The Onion. With all the misery, sometimes this is needed to cheer yourself up. There's some good stuff in there: https://www.titanic-magazin.de/postkarten/kategorie/aktuelle-kartenstartcartoons/.

2024-11-30 22:27:05 UTC

- reply

Yeah, this is one of the better SPIEGEL online articles (but the ads are really putting me off). The international "Germany" section (https://www.spiegel.de/international/germany/) doesn't cover a lot of the things people talk about in a _timely_ manner (by pure nature the print magazine doesn't either), like this absolute shitshow #FCKFDP D-Day disaster (https://www.fdp.de/media/6739/download [PDF]), which is why I combine SPIEGEL (as PDF) with more realtime Tagesschau.

2024-11-30 09:44:46 UTC

git2txt: Neat little utility by @npub1e4d…6ctp to unroll a GitHub repo to one flat file, so you can throw it at an LLM to make sense of: https://github.com/addyosmani/git2txt.

2024-11-29 23:42:42 UTC

- reply

I proactively read https://tagesschau.de (Web or also via the app) and SPIEGEL (only the PDF, never https://spiegel.de). None of them are secret tips or anything, but mostly decent journalism. The browser's built-in translation feature (that you can enable by default for certain pages/languages) should help. Also, I use long-tap and then "Define" a lot when I'm reading news in other languages. I rely on Mastodon a lot for random reactive reads. Happy to help with flowery language.

2024-11-21 18:23:48 UTC

Global Privacy Control (GCP) is now in First Public Working Draft stage: https://www.w3.org/TR/gpc/. It's as easy as sending an HTTP header with your requests:
```
Sec-GCP: 1
```
Sites can query it with JavaScript
```js
navigator.globalPrivacyControl;
```
And this thing isn't a toothless paper tiger as the German expression goes, this thing has actual legal consequences if you set it: https://www.w3.org/TR/gpc/#legal-effects. Hoping for browsers to adopt this preference and make it available in settings. 👀

2024-11-11 13:34:46 UTC

- reply

Don't forget about the Chromium-based browsers. For example, a popular player is Samsung Internet. They're often a couple of versions behind.

2024-11-08 07:35:20 UTC

Finally more options for styling the `<details>` element, for example, to animate its opening. @npub159n…rz7e's article has all the details: https://developer.chrome.com/blog/styling-details. 🪗

2024-11-03 21:28:19 UTC

- reply

It's simply a thing I got used to doing from my earliest blogging days. I don't really post frequently enough for it to make a lot of sense to be honest, but it sure is adequate for frequent bloggers like @npub1x59…gect: https://shkspr.mobi/blog/2024/10/.

2024-11-02 22:49:01 UTC

📢 If your blog is #BuiltWith11ty and you use a classic `/yyyy/mm/dd/title` URL structure, I have a new blog post for you: #Eleventy (#11ty) year, year-month, and year-month-day indexes: https://blog.tomayac.com/2024/11/02/eleventy-11ty-year-year-month-and-year-month-day-indexes/. Who doesn't like hackable 🪓 URLs?
`/yyyy/mm/dd/title`
`/yyyy/mm/dd/`
`/yyyy/mm/`
`/yyyy/`
Thanks to @npub19vz…zmql for @npub1f8f…ed9x and the ecosystem like the image plugin around it!

2024-11-02 09:41:13 UTC

Safari 18.2 adds #WebAssembly Garbage Collection 🗑️ support: https://developer.apple.com/documentation/safari-release-notes/safari-18_2-release-notes. This is a big deal because #WasmGC (https://developer.chrome.com/blog/wasmgc) allows for managed languages to come to the Web more efficiently, which enables use cases like compiling Java to #Wasm, as used by Google Sheets' 📈 calc worker: https://web.dev/case-studies/google-sheets-wasmgc.

2024-11-01 10:29:43 UTC

- reply

I think what you describe could actually happen, even if it's probably more of a hypothetical case. I asked about the core browser set: https://github.com/web-platform-dx/web-features/issues/2133.

2024-10-29 07:47:18 UTC

Wow, Flock is a fork of Flutter: https://flutterfoundation.dev/blog/posts/we-are-forking-flutter-this-is-why/. 12,592 open Issues on https://github.com/flutter/flutter/issues. 😲
(via @npub1yew…xuft)

2024-10-19 17:17:52 UTC

- reply

You mean https://webstatus.dev/ maybe? The Igalia dashboard you were linked to in another response has a different granularity than the one I linked you to now. Hopefully one of the two will do. Hah. It rhymes.

2024-10-07 07:52:28 UTC

- reply

Oh, I'm 100% not reading this as "let's stop evolving JS" either. Quite the opposite. What I was trying to say is that current me is fine with what's in JS now without having to use tooling, but future me might dislike having to use tooling for using something amazing they add to exclusively the JSSugar layer that I can't imagine today.

2024-10-07 07:29:19 UTC

- reply

I feel like "JavaScript is already quite good", too, but I wonder if I'm limited by my imagination of what might be coming next, and that then would not necessarily be usable without tooling. But the arguments in the slides make sense to me as well, but then I'm not an engine implementor, so I have to (and do) believe them when they say it's a challenge to keep up.

2024-10-06 09:05:38 UTC

From the agenda for the 104th meeting of Ecma #TC39 (https://github.com/tc39/agendas/blob/main/2024/10.md#agenda-items). Longer or open-ended discussions: JSSugar/JS0: https://docs.google.com/presentation/d/1ylROTu3N6MyHzNzWJXQAc7Bo1O0FHO3lNKfQMfPOA4o/mobilepresent?slide=id.g30432c5cd9c_0_688. Slide 40 onward 👀:
Let's standardize as the ecosystem uses it:
JS0: the language implemented by the engines
JSSugar: features that must be compiled by tools to JS0
For developers, JS = #JS0 + #JSSugar

2024-10-02 07:01:42 UTC

- reply

Why would they? Same logic as the German "löchrig", but I agree now, it looks weird.

2024-09-26 22:46:36 UTC

Don't sleep on `AbortController`: https://kettanaito.com/blog/dont-sleep-on-abort-controller. Very solid post about the versatile ways you can use `AbortController` in JavaScript.

2024-09-16 20:27:25 UTC

- reply

Probably you're referring to @npub133e…rqrd's https://scottjehl.com/sandbox/htmlimportfun/html-import-slot.html?!

2024-09-16 06:10:44 UTC

A proposal for a new HTTP QUERY Method: https://www.ietf.org/archive/id/draft-ietf-httpbis-safe-method-w-body-05.html. "The QUERY method provides a solution that spans the gap between the use of GET and POST. As with POST, the input to the query operation is passed along within the content of the request rather than as part of the request URI. Unlike POST, however, the method is explicitly safe and idempotent, allowing functions like caching and automatic retries to operate."

2024-09-06 12:56:56 UTC

Wow, that's super cool! DOM-aware physics. Screenshot the page, trace the elements to an SVG path, and then use this information with a physics engine: https://threadreaderapp.com/thread/1831783365483360539.html. Here's a live demo: https://codesandbox.io/p/sandbox/dom-aware-physics-3jqdsv. 🎊

2024-08-30 08:15:06 UTC

The WebKit team at Apple are growing their DevRel presence: https://jobs.apple.com/en-us/details/200565512/web-technologies-evangelist-safari-webkit. Signal-boosting this job ad because that's good news for the Web! (According to @npub130l…n5e6, it's only for people willing to live in the Bay Area.)

2024-08-30 07:33:57 UTC

- reply

Not so in Germany 🙃: https://www.opel.de/fahrzeuge/frontera/frontera/uebersicht.html.
https://assets.toot.cafe/media_attachments/files/113/049/801/393/628/950/original/4b00f585e1b71c36.png

2024-08-27 16:25:58 UTC

I'm always amazed by the various improvements the Chrome engineering teams are busy with. One that's recently landed is around storage optimization for IndexedDB 🛢️, which, who knew, internally stores its data in LevelDB: https://developer.chrome.com/docs/chromium/indexeddb-storage-improvements.

2024-08-24 20:11:35 UTC

- reply

Yes, I saw this. It's pretty incredible indeed. 👏

2024-08-13 13:44:40 UTC

Looks like the Firefox team is considering taking a fresh look at (Progressive) Web Apps: https://connect.mozilla.org/t5/discussions/how-can-firefox-create-the-best-support-for-web-apps-on-the/m-p/60561#M21220 👀 #PWA

2024-08-03 08:36:08 UTC

Nice job 👏: we now have script integrity support for ES modules in Chrome and WebKit: https://shopify.engineering/shipping-support-for-module-script-integrity-in-chrome-safari. You tell the browser about the script integrity in an import map and can then rely on the integrity check to happen even for dynamic `import()`.
```html
<script type="importmap">
{
"imports": {
"square": "./module/shapes/square.js"
},
"integrity": {
"./module/shapes/square.js": "sha384-oqVuAfXRKap7fdgcCY5uykM6+R9GqQ8K/uxy9rx7HNQlGYl1kPzQho1wx4JwY8wC"
}
}
</script>
```

2024-08-01 08:21:20 UTC

- reply

Gotta love the conclusion they draw from this: "embrace JavaScript". Well… 🤷‍♂️