Blog | Enea Zani
27 posts on web development, design systems, accessibility, security and photography, written by Enea Zani. RSS available.
- why does every website i see suck? — in italy almost everything is a wordpress site, and a lot of it is genuinely bad. but the version of this complaint that turns into "italians cannot design" is wrong, and i think it is worth separating the two...
- my minecraft mod shipped telemetry to a webhook with no limits on it — i added anonymous usage reporting to a java mod and pointed it at a webhook. no rate limit, no consent, no authentication. within days the channel was flooded with thousands of identical reports from every client at once...
- my portfolio is 42 repositories and it says nothing — 15 of them are forks, 12 have no description, and there are 14 stars in total. a profile page answers "what exists". a portfolio has to answer "why". i built this site because i ran out of ways to answer the second question with a list.
- privacy is a list, not an adjective: what this site actually sends — i was going to write that this site sends nothing anywhere. then i opened the network panel and counted. four requests, four parties, and two of them exist only to work out where i am. the honest version of the claim is a list, so here it is.
- the bug that taught me what is not a bug — clicking "blog" changed the url and left the page on the screen. i deleted three things at once, one of which was the culprit, and i never found out which. here is the mechanism, the three suspects, and why the answer was not "animatepresence".
- 0 lines of javascript for a crawler: the 1,416 bytes of html bing reads instead of my react app — this site is one index.html and 539 urls, all served the same document. to a crawler that does not run javascript, the body used to be an empty div. the fix is 33 lines of html inside #root that react deletes on mount. here is what it fixes, what it quietly does not, and the two bugs in the layer above it.
- i wrote a honeypot in go that answers ssh, ftp and http without speaking any of them — 200 lines of go, three hardcoded ports and two fake banners. it never completes a handshake, never sees a password, and the readme tells you to grant a linux capability the code never uses. here is what it actually catches, and the two bugs i would fix before trusting it.
- i wrote a packet sniffer to learn protocols, then lied about what it detects — sniffcli counts packets to port 22 and calls it ssh brute-force detection. it cannot see a password, because ssh is encrypted. here is what it really does, and what building it taught me about reading my own code.
- material 3 in a personal site: what survived, what did not — i shipped this site on the material 3 design system. six palette schemes, a real token layer, and the shape scale. here is what actually made it in, what i threw out, and the one thing that never worked at all.
- i found a 20 kb font, shipped the 2 mb one anyway — a variable font was downloading 1.9 mb to render latin text. there was a 20 kb subset sitting in the same folder. i measured both, and then i shipped the big one on purpose.
- the internet made me weirdly good at knowing useless things — i never set out to learn the difference between init unit types, or how to identify a country from a flag that has been cropped in half. and yet here...
- one artist quietly changed how i listen to music — i make music as rxenea. rage, trap, a bit of noise, things that are loud on purpose. and i thought i knew exactly what i liked, which is a dangerous...
- i turned off motion on my own site and felt nothing — i spent a week making this site move. springs, ripples, sliding panels, everything. and then i spent one evening using it with motion disabled, which...
- i wrote a post about leaving vercel for cloudflare. i was already on firebase. — the post i wrote about moving this site to cloudflare pages was wrong. i never moved it. it has been on firebase hosting the whole time, and here is what that actually means...
- your data is not on the internet. it is on someone else's computer. — the phrase "the cloud" is doing an enormous amount of marketing work. what it actually means is: a computer, in a building, owned by a company, that...
- i cleaned up my linux setup and immediately broke it — every few months i do this to myself: i look at my desktop, decide it is a mess, and reorganise. i have never once been satisfied with the result....
- the site redesign, and what i got wrong the first time — i rebuilt the front of this site and, for the first time in my life, started from the design system instead of from a screenshot. google's material 3...
- search on the web got worse, so i wrote my own — i used search to find things. now i use search to be mildly annoyed. the problems are not new, they just got better funded: so i built search into...
- the linux theming rabbit hole, and how i got out — if you have ever spent a full evening making a status bar pixel-perfect against a screenshot of someone else's status bar, this one is for you. the...
- i made a gui for the one linux command i used every day — every linux machine i touched used the same command: update the system. it is powerful, it is long, and i could never remember the flags in the right...
- the phone i actually bought, and why the spec sheet lied to me — i do not review phones professionally. i bought one, used it for two months, and am writing about the gap between the number and the experience. the...
- i used arch for years and i moved to ubuntu — this is a post i did not expect to write. for years i was one of those people who explains arch to anyone who stands still long enough. and then,...
- the internet is getting dumber and i think i know why — not dead. worse in a specific way: automated, and nobody noticing. here is the loop i have watched for the past year: the result is content optimised...
- what i actually think about using ai to build things — i use ai tools. i have opinions about that. here they are, without the part where i pretend to be balanced. i use it the way i use a reference...
- nothing has gone down in a year. here is why that is not luck — one of the projects i maintain has been up continuously for over a year. people keep asking if i got lucky. partly i did. but mostly it is three...
- the reason i open source things is not kindness — people assume open source is generosity. it is not. for me it is self-interest with better branding. it is not a strategy. i have no interest in a...
- why i take security seriously as a designer — most people in my field treat security as the part someone else handles. the brief says make it beautiful, another document says make it safe, and...
- how i actually got into security without a degree — i am italian, i did not study computer science, and for a long time i thought security was something other people were allowed to do. it is not. here...