Bram.us

Following the link in your readme to davywtf's twitter post, I saw this comment by dade:

>I remember last year, and probably the year before that, and probably the year before that still, people continually rediscover CSS keylogging. Glad to see something more interesting this time. Good work.

Following up on this, I found an article[0] claiming that it isn't really an issue since a pure CSS keylogger can only catch one character. It seems to me like your method of pseudo-refreshing the page by making old elements hidden and delivering new elements to replace them might be able to overcome this impediment, which would make your on-screen keyboard unnecessary; if I understand correctly, you could just keep capturing whatever the user types in a field, and deliver a new field that already has whatever they've typed already as the default value with autofocus on. Do I understand correctly? Is there something I'm missing, like autofocus not playing well with continuous chunks of data being delivered? I'm not saying you should put in the additional effort to do this for your beautiful-horrible-clusterfuck of a project, I'm just curious about the feasibility and thought you might already know the answer.

[0]: https://www.bram.us/2018/02/21/css-keylogger-and-why-you-shouldnt-worry-about-it/

(Hi, author of the post/article here)

> This solves one tiny aspect of the larger problem in a non-scalable way that will inevitably lead to bloat and inflexibility. It's a really a naive approach that hasn't taken into account design at scale, nor the future of where design is heading.

Note that `light-dark()` isn’t the end goal here. As discussed within the CSS WG, the end goal is to have a generic function `schemed-value()` to give you what you want.

I realize this wasn’t included in the post, so I’ve added a new section to the post with this information: https://www.bram.us/2023/10/09/the-future-of-css-easy-light-dark-mode-color-switching-with-light-dark/#schemed-value

I hope this addresses your concern. If not, feel free to let me (or the CSS WG for that matter) know.

As I read I wondered about the possibility of its abuse as a payload system, then I reached this linked post[1]:

> What happens when you combine the fact that part after the : for CSS Custom Properties doesn’t need to be valid CSS with window.getComputedStyle()? You get a way of passing data – including Arrays, Objects, and even JSON – from CSS to JavaScript.

The first article proposes the possibility of sending updated variables via a CDN, and the linked one shows a CSS variable being parsed as JSON and then executed by the Javascript engine.

There's probably some fun and high jinks to be had there…

[1] https://www.bram.us/2020/03/30/pass-data-from-css-to-javascript-with-css-variables/

This point of view always confuses me, because web developers already need to deal with platform differences. Especially if your app app also runs in a browser, like Slack and Discord — at that point, what issues do the differing system webviews cause that you don't need to deal with anyway just targeting browsers?

It's also funny to me as someone who's been building websites for 20+ years at this point, because the platform differences used to be much, much worse. Coincidentally, I just saw this article, which makes the case nicely: https://www.bram.us/2026/06/21/do-websites-need-to-function-exactly-the-same-on-every-platform/

There is a lot of CSS now…but so many of the recent additions have been useful. Really useful. Like, solves real-world problems, easy to understand, on their way to being very well-supported.

For example…

…Container Queries. (https://www.smashingmagazine.com/2021/05/complete-guide-css-container-queries/)

…Cascade Layers. (https://css-tricks.com/css-cascade-layers/#browser-support-and-fallbacks)

…the :has() selector. (https://www.bram.us/2021/12/21/the-css-has-selector-is-way-more-than-a-parent-selector/)