Nostr notes by Rebane

the recording for my "CSS Clicker Training: Making games in a ...

2026-05-11T23:27:15Z

the recording for my "CSS Clicker Training: Making games in a “styling” language" talk i gave at meets style sheets is out now!

https://www.youtube.com/watch?v=4GzHqfAQQb4&list=PLxQqv_fazRs1VlMEbqC0Jlw6VFd97UpT2

Nostr event nevent1qqs0yc6ftqed6m5wue83ns7h398360w05q3svl24zvuy3cs7dzqtdgqzyzfh2f6rth0fndevusnjmyltl6qcd0gtun05jd9kqzdeqdt4wegxvht3rxa

2026-05-11T00:07:27Z

In reply to nevent1q…zgz0
_________________________

https://www.youtube.com/watch?v=f2qsNd1nhV0&list=PLiO3Rmoio16YJu0Pyha7QKr5O0uvXzLOs&index=3

this is from some old set i made: Sonic Adventure 2 - Space Trip ...

2026-05-10T23:00:33Z

In reply to nevent1q…eg2x
_________________________

this is from some old set i made:
Sonic Adventure 2 - Space Trip Steps (Meteor Herd)
trndytrndy - minimal beat
Composerily - HOW TO SOUND LIKE PORTER ROBINSON

mac vs pc visualizer ...

2026-05-10T22:58:54Z

mac vs pc visualizer

audacity visualizer ...

2026-05-10T22:23:01Z

audacity visualizer

i set up a new vps at some weird provider and they sent me an ...

2026-05-03T14:25:32Z

i set up a new vps at some weird provider and they sent me an e-mail with my vps credentials

the root password said N/A, so you'd think that there's no root password by default. BUT NO! THE ROOT PASSWORD IS LITERALLY "N/A"!! AND SSHD IS EXPOSED ON PUBLIC IPV4?? THE FUCK ??

i'll be giving my css clicker training talk at smashing meets ...

2026-05-03T08:23:51Z

i'll be giving my css clicker training talk at smashing meets next wednesday!

it's a free online event! check it out here:
https://smashingconf.com/meets-style-sheets

i love my wife so much i edit /shorts/ to /watch?v= before ...

2026-04-29T17:47:47Z

i love my wife so much i edit /shorts/ to /watch?v= before sending it a yt link

btw y'all should* write cracks for software you use, even ...

2026-04-20T16:32:11Z

btw y'all should* write cracks for software you use, even (and especially) if you paid for it

it's a good reversing exercise and you'll thank yourself when the licensing server has an outage or some company doesn't like your new motherboard

(*only if you can do it legally)

135tb ram bitches ...

2026-04-17T13:48:34Z

135tb ram bitches

"gotcha"ing an autistic person into eating something with ...

2026-04-10T19:17:46Z

"gotcha"ing an autistic person into eating something with an ingredient they don't like to prove they can't tell is like me spitting in your drink to prove you can't tell that you've just drank my spit

did you know? the google forms share icon has a stray pixel in ...

2026-04-06T11:15:30Z

did you know? the google forms share icon has a stray pixel in its corner

why? because the icon spritesheet has a massive black triangle overlapping the icons

what is that triangle? it's a giant out-of-bounds hat!

had to check my archive to make sure this was in fact the ...

2026-03-28T18:28:47Z

had to check my archive to make sure this was in fact the original thumbnail

the new image-animation css property is so cool wtf i don't ...

2026-03-23T09:04:31Z

the new image-animation css property is so cool wtf

i don't think you've ever been able to pause GIFs on the web before, this is such an accessibility win!!

https://github.com/w3c/csswg-drafts/issues/1615#issuecomment-2652101726
https://drafts.csswg.org/css-image-animation-1/

we're finishing a game of sudoku that's been going on for ...

2026-03-22T23:09:15Z

we're finishing a game of sudoku that's been going on for 16 years

hii! if you're someone learning webdev and specifically css, ...

2026-03-20T14:09:02Z

hii! if you're someone learning webdev and specifically css, what are some difficult or hard to understand/grasp parts for you?

i wanna make some beginner-friendly tutorial stuff and it would be good to know what i should focus on the most

in linux you can use the evil bird emoticon (:>) to destroy ...

2026-03-17T10:40:55Z

in linux you can use the evil bird emoticon (:>) to destroy files, eg `:> important_document.txt`

the bird will eat the file and leave it completely empty!

somebody took my repo, reuploaded it with an ai-slopped README, ...

2026-03-15T15:48:04Z

somebody took my repo, reuploaded it with an ai-slopped README, and then added a zip file with lua malware in it??

yay i got my 10th chrome cve!! i wrote a pretty fun patch for ...

2026-03-12T12:08:01Z

yay i got my 10th chrome cve!!
i wrote a pretty fun patch for this one too
https://chromereleases.googleblog.com/2026/03/stable-channel-update-for-desktop_10.html

did you know that SSH has a little-known secret menu? i wrote a ...

2026-03-09T15:59:47Z

did you know that SSH has a little-known secret menu?

i wrote a post about this on cohost a while back, but since that site shut down i'm posting it here too

fun linux fact: the `if` shell built-in just executes the command ...

2026-03-09T15:46:42Z

fun linux fact:
the `if` shell built-in just executes the command you give it and looks at its exit code

so how can you do stuff like `if [ $a -gt 10 ]`?

well, [ is just a program usually in /bin/[ that takes the arguments ($a, -gt, 10, ]) and returns an exit code accordingly

this is also why you need the spaces between everything as well as quoting - they're ordinary arguments and need to be provided as such

also note that many shells do actually have similar shell built-ins such as [[ ]] and (( )), which are not stand-alone programs like [ is

it performs decss in HOW MANY LINES?? ...

2026-03-02T09:20:10Z

it performs decss in HOW MANY LINES??

i just got a notification for my own project? ...

2026-02-26T16:35:02Z

i just got a notification for my own project?

i built an entire x86 CPU emulator in CSS (no javascript) you can ...

2026-02-24T02:23:52Z

i built an entire x86 CPU emulator in CSS (no javascript)

you can write programs in C, compile them to x86 machine code with GCC, and run them inside CSS

https://lyra.horse/x86css/

self-hosting my S3 bucket the right way ...

2026-02-19T21:50:17Z

self-hosting my S3 bucket the right way

turns out tied up legs work great as a steam deck stand ...

2026-02-18T17:08:45Z

turns out tied up legs work great as a steam deck stand

slides for my disobey talk out now!! slide #54 onwards is all new ...

2026-02-16T18:15:45Z

slides for my disobey talk out now!!

slide #54 onwards is all new content, showing a real google pay attack/vulnerability through SVG filters, as well as a visualization on how the SVG filter QR code generator works

https://lyra.horse/slides/?#2026-disobey

the joke of "cool feature, can't wait to be able to use ...

2026-02-12T14:21:48Z

the joke of "cool feature, can't wait to be able to use it in 5 years" is now baseline widely available

what real inclusivity looks like ...

2026-02-12T06:32:03Z

what real inclusivity looks like

Xikipedia, the Wikipedia doomscrolling "app", is now ...

2026-02-06T18:10:38Z

Xikipedia, the Wikipedia doomscrolling "app", is now available as an actual app (PWA)!

Also:
- fully available offline
- algorithm saving/persistence (optional)
- multiple profiles
- light theme (optional)
- full english wikipedia links (optional)
- statistics screen

have fun!!

https://xikipedia.org/?2

"dont use a blue light filter there are no studies that prove ...

2026-02-05T00:26:52Z

"dont use a blue light filter there are no studies that prove it works"

shut up it makes my eyes not bleed its fucking great, whenever i need to pull an all-nighter i make sure my f.lux is set to solid red

did you know? if you're a paying adobe user, you can message ...

2026-02-03T17:40:27Z

did you know? if you're a paying adobe user, you can message the support and ask for offline installers for the software you pay for

why would you do that? if they ever were to discontinue one of their products (*cough* animate), you could still install and activate it

and while i do not publicly endorse piracy (for obvious reasons), i do want to note that installations made with these offline installers have way safer methods of patching them than downloading a pirated copy that's potentially malicious

all i'm saying is, those installers are kind of annoying to get these days. if you pay for the software, ask for the installers and make backups of them.

oh and last - you can ask for older versions too! even older than what the CC app shows you

so annoyed at apple for making ios impossible to make websites ...

2026-02-02T05:42:09Z

so annoyed at apple for making ios impossible to make websites for

like how am i supposed to test the fact that my site crashes random iphones? it works fine on my iphone.. i can't emulate other iphones on my computer..

and then they don't allow you to use any other web browser

one of the things i lowkey hate is when people talk about my ...

2026-02-02T04:39:12Z

one of the things i lowkey hate is when people talk about my projects and say that they could never do anything like that themselves

like, half the reason i make stuff is to inspire people! i don't obfuscate or minify my code, i want you to view-source it!! create cool stuff!!

i made a version of wikipedia you can doomscroll ...

2026-02-01T23:42:50Z

i made a version of wikipedia you can doomscroll
https://xikipedia.org/

i think it would be fun to make an ios horror game where you only ...

2026-01-25T14:04:13Z

i think it would be fun to make an ios horror game where you only see the monsters or whatever on screenshots you take

ios lets you do overlays that appear on screenshots, but not on the screen, so this would be pretty doable

ugh!! i was working on a NEW viral mobile game idea where you ...

2026-01-22T15:06:16Z

ugh!! i was working on a NEW viral mobile game idea where you throw your phone like a basket ball and ended up breaking my screen when it bounced off my sofa onto the floor ☹️

i made an archery game that uses your charging cable as the ...

2026-01-21T16:10:10Z

i made an archery game that uses your charging cable as the controller

hey fedi, im looking for some advice on masks so sometimes ...

2026-01-15T16:05:37Z

hey fedi, im looking for some advice on masks

so sometimes i'd like to (or have to) wear a mask, but every time i do so for more than a few minutes it gets kinda bad - my nose clogs up, my face is covered in sweat, and my lips become chapped - and its pretty terrible for me sensory-wise

i've only ever tried disposable or basic masks though, so my question would be - are there any specific masks i should try out (i'm thinking maybe ones with a valve would be better), and are there any other ways to remediate the issues i'm having?

i don't like *need* a mask, but it would be nice if i had one with me i could comfortably wear if i want to

its so cold im using chrome instead of firefox to read news on my ...

2026-01-06T10:51:37Z

its so cold im using chrome instead of firefox to read news on my phone cuz i need the ads to warm up my phone and hands

i made a flappy bird clone that uses your folding phone as the ...

2026-01-02T21:12:29Z

i made a flappy bird clone that uses your folding phone as the controller

https://lyra.horse/fun/foldy-bird/

CSS-only livesplit recreation (made in ~45 min) ...

2025-12-25T14:20:58Z

CSS-only livesplit recreation (made in ~45 min)
https://lyra.horse/fun/livecssplit.html

my #39C3 talk's at 21:05 on saturday in the ground room! ...

2025-12-19T21:57:25Z

my #39C3 talk's at 21:05 on saturday in the ground room!

i'm still working on the slides, so if you have any CSS crimes or techniques you'd like to see explained please let me know! it can be both cohost and general CSS crimes & stuff!

see you there!!

Nostr event nevent1qqsd0yjjm4vlhftzxycnk80r65c3prey0lm2hk0kyu24fxrnzd0gdmqzyzfh2f6rth0fndevusnjmyltl6qcd0gtun05jd9kqzdeqdt4wegxveayg57

2025-12-05T10:16:26Z

calling svgs an attack vector is a diabolical pun

my new blogpost is out!! this one talks about a new web ...

2025-12-04T14:03:39Z

my new blogpost is out!!

this one talks about a new web vulnerability class i discovered that allows for complex interactive cross-origin attacks and data exfiltration

and i've already used it to get a google docs bounty ^^

have fun <3

https://lyra.horse/blog/2025/12/svg-clickjacking/

if ur wondering how it works ill be dropping the code in a blog ...

2025-12-01T20:46:23Z

In reply to nevent1q…raej
_________________________

if ur wondering how it works ill be dropping the code in a blog post this week

did u know the 'qr' in qr codes is pronounced as ...

2025-12-01T19:21:21Z

did u know the 'qr' in qr codes is pronounced as 'queer'

would u believe this queer made a qr code generator inside an svg ...

2025-12-01T18:56:44Z

would u believe this queer made a qr code generator inside an svg filter

pretty fun stuff in here :) ...

2025-11-19T17:45:14Z

pretty fun stuff in here :)
https://hackaday.com/2025/11/18/congratulations-to-the-2025-component-abuse-challenge-winners/

my #39c3 talk got accepted!! see you at @npub15qj…3kl0 in ...

2025-11-04T14:35:42Z

my #39c3 talk got accepted!!

see you at CCC (npub15qj…3kl0) in december ^^

(yes, it will be livestreamed and recorded)

idk if i've ever posted here about my bliss keyboard the ...

2025-10-21T16:43:35Z

idk if i've ever posted here about my bliss keyboard

the keyboard itself is a WASD V3, but the keycap design is something fully custom i did myself

btw WASD Keyboards no longer exists, so that makes mine a bit more special

> You can make webapps without WebAssembly, without ...

2025-10-03T08:56:38Z

In reply to nevent1q…pljc
_________________________

> You can make webapps without WebAssembly, without ECMAScript, or even without CSS. But you absolutely need HTML

You don't actually need HTML to make a webapp, even an interactive one. HTTP, CSS, and Firefox is enough.

Try this on Firefox: https://lyra.horse/fun/tic-tac-nohtml/

View-source for that page should give you an empty 0b file.

(and you can't argue about the browser creating a DOM anyways, because in that case you cannot have a webapp without CSS since the browser always applies its own agent stylesheets)

i can finally share the google docs attack poc from my slides!! ...

2025-09-25T13:58:31Z

i can finally share the google docs attack poc from my slides!!

blogpost coming later

(video 1/2 - the attack)

reviewing this hotel i'm staying at pros: - gigabit internet ...

2025-09-08T05:52:47Z

reviewing this hotel i'm staying at

pros:
- gigabit internet
- personal wifi router
cons:
- can't leave the room

somehow i still keep learning new stuff about css today i ...

2025-08-24T09:39:00Z

somehow i still keep learning new stuff about css

today i discovered that `font-family: monospace;` causes the text to become smaller!

you can get around this by doing `font-family: monospace, monospace;`

love my cross-platform oomfs ...

2025-08-11T07:07:49Z

love my cross-platform oomfs

i kinda hate minification on the web, i think learning from ...

2025-08-04T07:22:29Z

i kinda hate minification on the web, i think learning from others is a lot more accessible if the view-source of a page is fully readable

it also doesn't save as much data as people often assume, gzip gets pretty close to the minified size and yr images make it neglible anyways

using government traffic cams for free selfies ^_^ ...

2025-07-11T18:03:11Z

using government traffic cams for free selfies ^_^

i love css 💖 also shoutout to @Fastmail for rolling out fixes ...

2025-06-25T05:32:44Z

i love css 💖

also shoutout to @Fastmail for rolling out fixes for both reports in <48h
https://www.fastmail.com/bug-bounty/

yay my first 2025 chrome cve!! ...

2025-06-24T18:36:37Z

yay my first 2025 chrome cve!!

https://chromereleases.googleblog.com/2025/06/stable-channel-update-for-desktop_24.html

this seems fun https://www.fixbrowser.org/blog/fixproxy

2025-04-27T16:32:24Z

this seems fun
https://www.fixbrowser.org/blog/fixproxy

did they like, write this article with an ai that hallucinated a ...

2025-04-16T05:27:18Z

did they like, write this article with an ai that hallucinated a completely random first name for me??

somebody broke into 4chan's servers, posted pics of the admin ...

2025-04-15T09:05:23Z

somebody broke into 4chan's servers, posted pics of the admin views and phpmyadmin page, and leaked partial source code and the posts from the jannie (mod) board

seems like the attacker had shell access on the server, so this might not be all

site itself is down right now

quote from: https://gekk.info/articles/traceroute.htm

2025-03-30T09:48:47Z

In reply to nevent1q…v5y8
_________________________

quote from: https://gekk.info/articles/traceroute.htm

this is pretty much all the computer art i make ...

2025-03-30T09:48:26Z

this is pretty much all the computer art i make

i made a video about cohost css crimes!! ...

2024-12-29T17:58:13Z

i made a video about cohost css crimes!!
https://www.youtube.com/watch?v=LkMtiwitg-w

yes, you should also submit links on the wayback machine no, you ...

2024-10-20T13:28:59Z

In reply to nevent1q…r0x7
_________________________

yes, you should also submit links on the wayback machine
no, you shouldn't rely on it

to save websites: https://archivebox.io
to save videos (small scale): https://cobalt.tools
to save videos (large scale): https://github.com/rebane2001/sensible-yt-dlp-archive-scripts

please ctrl+s what you care about

i wish it didn't take internet archive getting hacked for ppl ...

2024-10-20T13:23:56Z

i wish it didn't take internet archive getting hacked for ppl to realize you really do need to save stuff yourself and not rely on anyone else....

new blogpost time!! this one's a fun writeup on a ...

2024-09-19T06:28:52Z

new blogpost time!!

this one's a fun writeup on a vulnerability chain i found across multiple google services that earned me a $4133.70 bounty

lots of fun css as usual! i had to recreate a bunch of drive/docs/gmail/youtube UIs c:

have fun!

https://lyra.horse/blog/2024/09/using-youtube-to-steal-your-files/