Kartikeya Raocolophon

How this site works

the parts you don't see

Every page is plain HTML, generated ahead of time with Astro. There's no framework in the browser. The site's own JavaScript is about 2 KB and only adds small things: the theme switch, copy buttons, spoilers, the clock. Pages read fine with it turned off.

Speed

  • CSS is inlined into each page, so one request renders it. The only other files are two self-hosted fonts.
  • When you hover a link, Chromium browsers start rendering the next page in the background through the Speculation Rules API. By the time you click, it's usually ready.
  • Moving between pages uses native cross-document view transitions. A post's title glides from the list into place, with no JavaScript involved.

Type

Text is set in Atkinson Hyperlegible Next, code and metadata in Atkinson Hyperlegible Mono. The Braille Institute designed the family so similar characters are easy to tell apart. Il1| andO0o look different from each other, which matters when you're reading hashes, tokens and payloads where one wrong character changes everything.

Code blocks

Highlighting happens at build time with Shiki, the engine behind VS Code, which covers more than 200 languages. Both the light and dark palettes are in the HTML, so switching themes costs nothing. The copy button is pickier than usual:

  • In terminal sessions, it copies only the commands, without the $ prompts or the output.
  • In diffs, it copies the code as it reads after the change, without the removed lines.
  • Prompts, line numbers and diff markers can't be selected, so copying by hand stays clean too.

Redactions

CTF flags and spoilers sit behind a bar that you . Findings still under embargo are different: the redacted words never reach the HTML. The build writes a bar the same length as the word and nothing else. The words appear only after the embargo date passes and the site is rebuilt.

Privacy

No analytics, no cookies, no third-party requests. The theme choice is the only thing stored, in your browser's local storage. Each post ends with a revision: the first seven characters of the SHA-256 of its source. If a post changes after publishing, so does that string.

Reporting a vulnerability

If you find a security issue on this site, security.txt has the contact details.