Welcome to Web Technology News (WTN), my weekly newsletter tracking what's next on the web. As usual, I'm using the following three categories:

1. Web platform
2. Open social web
3. Web + AI

Web Platform

"Should we remove XSLT from the web platform?" That question was asked by Google engineer Mason Freed on the WHATWG GitHub account a few weeks ago. "Its role within the web browser has been largely superseded by JavaScript-based technologies such as JSON+React," explained Freed, adding that it's now a big security risk in browsers.

Judging by the comments, one of the primary uses of XSLT (Extensible Stylesheet Language Transformations) is for "displaying RSS feeds pleasantly." Another commenter added that "XSLT is extensively used by podcast hosting companies to beautify their raw feeds." The discussion around this got heated, so the thread was locked to non-collaborators. A second thread also got locked.

In other news, Mozilla has launched a new front end for MDN: "We've intentionally targeted Baseline "Widely available" features when deciding on which ones to use, and polyfilling or progressively enhancing when using anything Baseline "Newly available"."

Staying with Mozilla, its newly hired Web Dev Relations Lead, Jake Archibald, took to Mastodon to promote Firefox v142. I like the video explanations.

Post by @jaffathecake@mastodon.social
View on Mastodon

Let's get crazy now... I stumbled upon a couple of 'out there' ideas this week.

Hyperclay is a new product pitching itself as "Google Docs for interactive code." The site further explains:

"What if web apps were as simple to edit as documents? Hyperclay makes it possible: UI, logic, and data live in one self-modifying HTML file."

There's an excellent discussion about this on Hacker News. Hyperclay's developer, panphora, has also created a Markdown editor called Overtype.

I liked this web dev head-mash by Chris Shank: "This may look like my personal website, but it's not served via a traditional web server. Rather it's served from a service worker that proxies all network requests to a locally cloned git repository (stored in-browser)!"
Chris Shank's service worker webpage.

Open Social Web

It's great to see Bluesky starting to have alternative servers (i.e. ones not owned and run by the Bluesky company). As reported by Laurens Hof in his Connected Places blog:

"Blacksky is taking further steps towards their own community platform within the ATmosphere, and have started inviting community members on their own Blacksky PDS servers. Blacksky has their own PDS migration tooling, Tektike, to help users transfer their account to a new PDS."

On the fedi side of the open social pond, Sean Tilley has written a roundup of the recent FediCon event in Canada. I was pleased to see this note from Sean:

"...there's some legitimately interesting developments happening with paying server admins, artists, and developers. I've written a bit about what Bandwagon and CrowdBucks are doing, and hopeful some collaboration can emerge between projects."

CrowdBucks is fairly new to me, but the following thread told me that Charles Iliya Krempeaux — a.k.a. reiver — is behind it (Charles also organized FediCon and is an active fediverse developer).

Post by @crowdbucks@mastodon.social
View on Mastodon

Another cool-sounding open web app I came across this week:

Post by @pkirn@mastodon.social
View on Mastodon

In Mastodon news, quote-posts are officially coming:

Post by @renchap@oisaur.com
View on Mastodon

Finally in this section, you might be interested in my blog post this week outlining my experiences with Ghost, Substack, Eleventy and WordPress. I focus in particular on Ghost's federation (I use Ghost to publish this newsletter).

Web + AI

Vercel is proposing a convention to include instructions to an LLM directly in HTML responses as <script type="text/llms.txt">. But standards be damned...in classic 'Marc Andreessen and the <img> tag' fashion, Vercel encourages its users to just go ahead and do it anyway: "[it] doesn't need to be a formal standard. You can just start using it now."

For my post on The New Stack this week, I interviewed the two creators of MCP-UI, an open source project that creates React or web components for agents. The technology is just 3 months old, but is already being used by Shopify and others. One of the founders, Ido Salomon, explained to me why it's using the HTML <iframe> element to ferry UI components to agents:

"I think MCP-UI, at its core, is fairly simple. It basically takes the building blocks of MCP [the parent protocol] — MCP has a way to respond not just with text, but with an embedded resource that can be anything. So the idea was, how do I take something like an embedded resource, get some consensus around when this embedded resource contains something. Then the host — you know, ChatGPT, whatever — can render it. And how does it run basically arbitrary code, that is unsafe, without harming the users. Iframe is kind of the only way to do that. And sandbox iframe in particular gives you an extra edge."

Web UIs in agents — it's a trend to watch. I have another post coming up early next week about MCP-UI, based on an interview with two Shopify engineers.

Meanwhile, Paul Kinlan from Google is calling for experimentation with hyperlinks in the AI age:

"LLMs also offer the practical tools to finally realize the promise of hypertext on the web itself. They are the enabling technology that can upgrade the humble <a> tag and make it truly “hyper.”"

Launched this week: Tidewave Web for Rails and Phoenix, "a coding agent that runs directly in the browser alongside your web application, in your own development environment, with full page and code context." (via Hacker News)

One More Thing

What's the point of vibe coding if...

Post by @PastaThief@indiepocalypse.social
View on Mastodon

Thanks for reading, and if you have any suggestions on news sources for Web Technology News, leave me a comment on Mastodon or Bluesky. And don't forget, you can follow WTN on those platforms too: search "@feed@webtechnology.news" on Mastodon or click here to follow on Bluesky.

You can also get the full content via email (the form is on the WTN homepage) or RSS. A benefit of signing up via email is that it allows you to post good ol' fashioned comments on the URL where this post lives: i.e. on the Web.

Until next week, keep on surfing!

ansuz / ऐरन

2025-08-15 06:10:34

chrome developers: we are thinking of dropping support for rendering RSS feeds as something other than garbage code. does anyone have any reasons not to do this?

developers from many different backgrounds: yes, I rely on normal people being able to understand RSS for my business. dropping support will be disastrous for me because I can't rely on people to have some random extension installed.

chrome devs: OK well we're probably going to do it anyway because we can't be bothered to support web standards. uwu google is only a teensy wee company uwu

github.com/whatwg/html/issues/…

#xslt #standards #openWeb

Should we remove XSLT from the web platform?

What is the issue with the HTML Standard? XSLT v1.0, which all browsers adhere to, was standardized in 1999. In the meantime, XSLT has evolved to v2.0 and v3.0, adding features, and growing apart f...

^{mfreed7 (GitHub)}

Welcome to Web Technology News (WTN), my weekly newsletter tracking what's next on the web. This week I look at some of the moves Cloudflare has been making to help web publishers and content creators deal with AI companies that "leverage" (to put it politely) open web content. I spoke to a Cloudflare exec for a reported story on The New Stack, and I was somewhat surprised to learn the company is also heavily pushing AI technology onto its customers — specifically this week, in the article I wrote, a new NLWeb feature (NLWeb is Microsoft's brand new open protocol for integrating AI chat into your website).

Now, I like the sound of NLWeb and — as a Cloudflare user myself — I intend to try it out on my internet history website, Cybercultural. I do find it interesting that Cloudflare is attempting to position itself as both an AI police force and an AI booster (at least in its own products). I think that's clever, because I too have mixed feelings about AI, as I described last week. AI is a threat to web publishers, but it's also an intriguing technology when matched up with the web platform. Cloudflare understands that a delicate balance is required.

Let's get to the web tech news...

Web Platform

🌐 The big news this week was Google avoiding the harshest penalties in a US government monopoly case against them. Reports the New York Times (this is a gift link, so anyone can open it to read the full article):

"Google must hand over its search results and some data to rival companies but does not need to break itself up by selling its Chrome web browser, a federal judge ruled on Tuesday."

I'm no legal expert, but I am glad Google wasn't forced to sell Chrome. By and large, Google has been a good steward of web technology innovation over the years, and it would've felt unfair to strip them of a groundbreaking web product they invented and built. Also, I would much rather Google owned Chrome than the likes of OpenAI or Perplexity!

All that said, I continue to feel queezy about the massive power Google has in the web search market — clickthroughs from Google search results continue to decrease in the AI Overview era.

🌐 If you've been following the drama around XSLT, you'll want to read my TNS colleague Mary Branscombe's in-depth report on it. As well as noting that the original request to remove XSLT from the web platform came from Firefox, not Google, Mary spoke to a number of experts about the history of XSLT, its implications for the web over the years, and where this may net out. It's a great read, although you'll need to block off a bit of time as it's over 5,000 words. (disclosure: I edited this piece)

Although you should read the whole post, I do want to call attention to one part. Mary rightly focuses on XLST for much of the article, but near the end she raises the bigger issue of web governance:

"...it’s also impossible to ignore the outsized impact that Google funding so much of it [i.e. the web platform], directly or indirectly, has on choices all the browsers make about prioritizing features — especially the ones that don’t fit into current development fashion and hype, whether that’s XSLT or SVG or MathML."

🌐 Meanwhile, Microsoft browser engineer Alex Russell continues his series on browser competition in typical no-punches-pulled style:

"Apple has done violence to the founding ethos of internet and web standards development. Instead of honourably withdrawing from those groups, Apple has maintained a charade of engagement, and gaslights other participants while actively sabotaging the principle of voluntary adoption that internet standards are predicated on."

🌐 Possibly related, there's a long discussion thread on Mastodon about browsers and web standards, introduced by Jen Simmons, a Web evangelist at Apple. She ran a poll that asked (in summary):

"Should [a certain] technology be considered A Web Standard — when 1 or 2 browsers implement & ship, while 1 or 2 browsers Formally Object and say no?"

12% responded yes, it's a web standard; 88% said no.

🌐 ‪In lighter news, Thomas Steiner — who works on the Chrome team — just wants to register his new washing machine: "Don't make me talk to people! They could still offer to register the machine by telephone as an alternative, but in 2025, the default for such things should just be the Web." 💯

Open Social Web

🦋 This week I came across Leaflet, described as "a social publishing platform for blogs / newsletters — like Substack, but more open, and frankly just nicer to use." It's being built on the AT Protocol, the same protocol powering Bluesky. One to watch. (hat-tip Boris Mann)

🧵 Meta's Threads has a new leader: Connor Hayes. In an introductory thread, Hayes said he wanted to make Threads "the most culturally relevant place for sharing perspectives and ideas on the internet." What wasn't mentioned in his thread? The fediverse, which Threads is supposedly a part of. 🤔

🦣 In actual fediverse news, WordPress has updated its ActivityPub plugin. Fairly minor updates, but as Jeff Sikes pointed out, "quite intriguing to see tooling to monitor the progress of a self destruct request." (I've had issues with deleting content via a WP AP plugin before, although I will say the main developer, Matthias Pfefferle, has always been incredibly helpful.)

🚶 Not news, but this week I discovered the concept of "internet walks", explained here by Kristoffer Tjalve in Lullaby Magazine:

"These internet walks invite people to start exploring again, which in the 90s was a real profession. You'd employ a professional surfer. Before you had search engines, you had directories and people who tried to find as many links as possible and group them. That's why you have all these terms like Safari and Netscape, inviting people to explore, though we don’t use the same words now. It feels more gated."

See also: Taking an Internet Walk, by Spencer Chang & Kristoffer Tjalve.

Web + AI

🤖 This week for The New Stack, I talked to a Cloudflare VP about its implementation of NLWeb, Microsoft's new open protocol for AI chat in websites. I also got an update on the private beta of Cloudflare's "pay-per-crawl" project, which aims to get AI companies to pay up for using the content of web publishers.

Elsewhere, Matthew Prince (CEO of Cloudflare) talked to Fred Vogelstein about building a wider scale marketplace for content:

"And so you could imagine a world in which you actually have each LLM company getting kind of a preview of content, having an algorithm score how valuable it is and then tell the writer how much he’ll get for it. And the payment isn’t based on how many words you write, just by how much you are actually adding to the knowledge base."

Prince noted that he wants to get Google onside for this idea, because that will prompt (no pun intended) the likes of OpenAI to get on board too. 🤞

🤖 CNBC: Atlassian has agreed to buy The Browser Co., which is behind the Arc and Dia web browsers. CEO Mike Cannon-Brookes seemed to suggest he wanted to build a new type of enterprise-focused work browser:

"Whatever it is that you’re actually doing in your browser is not particularly well served by a browser that was built in the name to browse. It’s not built to work, it’s not built to act, it’s not built to do."

Note: I profiled Dia when it launched as an invite-only beta in June. I was impressed with its ability to interrogate the content of a web page, but it also didn't blow my socks off. So we'll see what Atlassian builds with it.

🤖 Sarah Perez: WordPress launches an "experimental" new AI vibe coding tool for creating Gutenberg blocks, called Telex.

🤖 Food for thought from Scott Rosenberg, writing about the web's bot-versus-bot future: "Service providers and large organizations are already preparing to roll out two different versions of each website or app they support: one for people and the other for AI agents and bots."

One More Thing

🎈 I really liked this blog post by Sia Karamalegos, about "how to grow your tech career by engaging and contributing to tech communities through writing, speaking, open source, and more." Sia organizes Eleventy community meetups on Zoom, which I've popped into a few times. I'm usually having dinner when they happen, due to my time zone, so I lurk rather than participate! But I learn a lot and really appreciate Sia bringing the 11ty community together like this. Web communities are more important than ever in this era of bigco dominance.

Thanks for reading, and if you have any suggestions on news sources for Web Technology News, leave me a comment on Mastodon or Bluesky. And don't forget, you can follow WTN on those platforms too: search "@feed@webtechnology.news" on Mastodon or click here to follow on Bluesky.

You can also get the full content via email (the form is on the WTN homepage) or RSS. A benefit of signing up via email is that it allows you to post good ol' fashioned comments on the URL where this post lives: i.e. on the Web.

Until next week, keep on blogging!

Leveraging tech communities for your career

Learn how to grow your tech career by engaging and contributing to tech communities through writing, speaking, open source, and more

^{Sia Karamalegos (sia.codes)}

Jen Simmons

2025-09-03 21:35:56

Web developers,

I have a question for you. Imagine an idea for a new web technology is proposed. But at least of the browser makers formally objects because of privacy concerns or other reasons. They say "No, we object to this proposal. We will never ship this. Let’s redesign it without these problems." But the other browser disagrees & ships anyway.

Should that technology be considered A Web Standard — when 1 or 2 browsers implement & ship, while 1 or 2 browsers Formally Object and say no?

Happy Monday!

Or, how I call today: Happy Ghost 6 Day 🎉

Ghost has released v6.0.0 around 2 hours ago:

Release 6.0.0 · TryGhost/Ghost
✨ Added native Web Analytics with Tinybird - Hannah Wolfe ✨ Federated Ghost sites over ActivityPub (Social web) - Hannah Wolfe 🎨 Ensured owner user is created with an ObjectID (#24088) - Michael Ba…
GitHubTryGhost

It comes with two big new features, that have been heavily beta-tested on Magic Pages as well:

👥 Social Web connects your Ghost site to the Fediverse
📊 Traffic Analytics brings native first-party analytics to your Ghost site

The preparations on my side in the last few weeks paid off. With all the infrastructure beta-tested (thanks to everyone involved!), this was just another update.

Ghost 6 is now rolled out on all customer sites on Magic Pages 🎉

If you want to learn more about the new features, have a look here:

Ghost 6 on Magic Pages
Simple, fast, and reliable Ghost CMS hosting.
Magic PagesJannis Fedoruk-Betschki

So, Happy Ghost 6 Day! If you have questions or want to know more, just send me an email to help@magicpages.co or use the live chat.

Jannis

“What does the government know about you?”

A few weeks ago, Tangle staff member Russell Nystrom brought up this question in a team meeting. How much? How little? Where do they get the information and what, possibly, could they do with it?

It’s an evocative question and the truth was, I only had a rough idea of the answer. Russell wanted to explore it for a story and I encouraged him to do so — and then he enlisted help from two editors on our team, Lindsey Knuth and Audrey Moorehead.

Today, I’m proud to share the piece that came out of Russell’s question, which offers a series of eye-opening and thought-provoking answers.

— Isaac

In 2022, two university researchers set out on a routine search for security vulnerabilities in Android apps when they stumbled across a strange line of code.

It was malware, collecting location data on users regardless of the permission they granted it, allowing whomever had access to the data the ability to map out relationships between people, places, and devices. The discovery kicked off an investigation that traced the personal data of millions of users of common apps, like Muslim prayer apps and QR-code scanners, to a Panamanian data-harvesting company called Measurement Systems. Looking deeper, the researchers found one more strange connection — The Panamanian malware company collecting the data shared an internet domain with another business: a Virginia defense contractor specializing in U.S. cyberintelligence operations.

Later that year, a report from the Georgetown Law Center on Privacy & Technology revealed that Immigration and Customs Enforcement (ICE) was sidestepping subpoena requirements and buying up large swathes of Americans’ utility records. According to report coauthor Nina Wang, the data — which included license plates, property records, and employment records — captured a “360-degree view” of the lives of “almost every American.”

While both cases prompted some immediate action (Google banned the apps that stored the offending code, and major utility companies agreed to stop sharing data with ICE), incidents like these persist, and they’re emblematic of two intrusive and legally questionable methods of gathering information on citizens: 1) The government use of surveillance technologies to passively “drag” the internet and 2) The government purchase of massive amounts of data through commercial data brokers.

That got us thinking: What else does the government know about us? We spoke to several experts in data collection, privacy, and government practices to learn all the information we expect the government to know, as well as what we don’t expect our federal agencies to learn. Today, Tangle staff member Russell Nystrom will also share his thoughts on the government’s most recent data-collection practices and what they portend for the future.

What you tell the government about yourself.

You probably expect the government to know some things about you, like your driver’s license and Social Security numbers. This is personally identifying information that the government has provided for you, and that you’ve probably entered into countless forms. You also might expect certain agencies, like the Internal Revenue Service (IRS) or the Department of Education, to have access to your employment data or student loan records, since you’ve volunteered that information yourself to take advantage of those offices’ services.

Upon reflection, you might realize the government knows quite a lot about you. Every U.S. citizen born since 1933 has had a birth certificate issued by their state government, and since 1946, all live births have been tracked federally by the National Vital Statistics System (NVSS). While each state issues its own unique birth certificates, the federal government requires some basic information to be recorded for statistical purposes, including the location of the birth, the baby’s sex, and (of course) the baby’s full legal name. Additionally, each U.S. citizen is given a Social Security number (SSN) that is permanently tied to their personal identity in federal databases. When you go through a major life event like marriage, you give your updated personal information to your state government, which is required to submit statistical information on marriages and deaths to the NVSS.

The government also collects biometric data on U.S. citizens — and noncitizens — through means that require less explicit forms of consent. This data is collected at ports of entry, in airports, or when someone is apprehended or applying for government documents; the government doesn’t explicitly ask permission to collect the data, but we effectively consent to it by, say, navigating a security checkpoint at an airport. The Transportation Security Administration (TSA), for example, requires individuals who want to opt into its TSA Pre-Check program to provide biometric data, and the agency recently implemented a facial recognition program at security checkpoints within 250 airports (which travelers can opt out of, though federal reports suggest opt-outs are rare — mostly because travelers don’t know they have this option or don’t want to slow the security process down).

The most notable biometric data-collection program is the Automated Biometric Identification System, or IDENT, run by the Office of Biometric Identity Management within the Department of Homeland Security (DHS), which collects the biometric data of individuals crossing the U.S. border, without explicitly asking for consent to the collection. Additionally, the U.S. Citizenship and Immigration Services (USCIS) collects biometric data on asylum seekers already in the U.S.; in this case, though, asylum seekers consent to the data collection as a condition to continue their asylum application.

Additionally, government programs like Medicare and Medicaid maintain databases of citizens’ insurance and medical needs, while the IRS keeps tax records — including employment information, SSNs, and addresses — in its databases.

The government’s collection methods range from innocuous to intrusive, with no clear set of laws governing citizen data privacy. However, federal agencies are explicitly barred from sharing personal data with each other by the Privacy Act of 1974 (with exceptions for special circumstances, like criminal investigations). Additionally, the Privacy Act requires government agencies that collect large “systems of records” to declare what records they keep and allow citizens to request and amend that data.

While the government discloses a lot of the data it collects on American citizens, there are still some areas where we can’t be sure exactly what is known. For example, the operations of the National Security Agency (NSA) are still largely secretive, even after the efforts of former defense contractor Edward Snowden and other whistleblowers.

That said, the federal government is not a monolith. Our data spans the physical and digital spaces of over 400 federal agencies, departments, and subagencies — not to mention the mountains of records held at the state and local levels. Each federal agency is its own data-aggregating entity, often with their own strict regulations on how that data can be shared across agencies.

Naturally, this creates some friction in the system. For example, the NSA can’t access IRS data except in cases of active criminal investigations. Internet-law specialist and Electronic Frontier Foundation Executive Director Cindy Cohn said this friction in the data-sharing process can “prevent misuse and protect [the] privacy” of Americans’ data. But this friction comes at the expense of government efficiency — and these concerns about efficiency have led the Trump administration to seek to reduce some of this friction with new efforts to increase data sharing. In short, this means the information you give the TSA through Pre-Check might become readily available to the NSA, with or without a criminal investigation.

What the government learns about you.

We give a lot of data to the government voluntarily, but much of it is taken — either scraped from the internet or bought without our knowledge or consent.

This post is for subscribers only

Become a member to get access to all content
Subscribe now

What does the government actually know about you?

A deep dive into all the information the government has about all of us.

^{Russell Nystrom (Tangle)}