AdMap; XSLT RIP; Featured Free Font: Obel Mono [Masked]

Before we get to the resources for today, I just want to take a mo’ and thank all the US-ians who voted and made this a pretty unforgettable week. It’s not historic, since none of this matters until the folks that have been entrusted to bring about the changes we’ve collectively demanded actually do something besides take money from the same donors as the opposition. If they do get a clue, then we have some real history to talk about.

Also a solid thanks to non-US-ians who have been providing moral and other support through all this. I’m sorry our country has been so horrible, but perhaps we’ll be at least a little less horrible moving forward?

Update: we covered Awesome Bash Aliases back in August, but the site and repo got a pretty solid re-org and facelift, so if you haven’t poked at it in a while, def give it a go.

AdMap

AdMap is a browsable archive of American political video ads spanning 1952 to 2026. The layout is very straightforward to navigate: just pick an election year on the bottom timeline (1952, 54, 56 … 2026), pick an office up top (President, Senate, Governor, House, State & local), then look at the map. Each state is shaded by how many ads exist for that race; the key runs 1–4, 5–19, 20–49, 50+, “none found” (race exists, no ads), “no race” (nothing on the ballot). Tap a state and you get the race page.

Said race page lists every ad for that seat, with filters by sponsor (“Paid for by”) and by candidate. Each entry shows the ad’s title, who paid, length, when it ran, and — where known — the spend on Google. Open any of them and you get a player, plus a details block: original title, AdMap ID (e.g., 2026.S.936), medium, video platform, and which archive the copy came from. Videos load from YouTube, Vimeo, or the Internet Archive. Search covers both candidates and ads across all years.

I poked around quite a bit (since there is no repo to popke at) and saw that 2026 has 2,408 House ads across 305 races, 1,627 Governor ads across 35 races, 1,333 Senate ads across 32 races, and 455 state/local ads. The 2024 president race holds 1,506 ads (Harris 187, Trump 80, Biden 166 in the primaries, Kennedy 51). This is a serious contrast to the 1952 race for president, which had a mere 78, but the page is quick to note that “Eisenhower Answers America” series were the first TV spots in a POTUS race.

Sources are named on a dedicated page: the Julian P. Kanter Political Commercial Archive at Oklahoma, the Internet Archive’s Political TV Ad Archive, Washburn’s Kansas Institute for Politics, and Google’s Ads Transparency Center. Race data comes from the FEC and state records, district lines from the Census. The site is built by Panagiotis Vorvolakos; it has no account system (it’s an Astro static site), and the privacy page notes that embedded players can see your IP and set cookies.

If you just want the data, open up Developer Tools, refresh, and you’ll quickly figure out the URL pattern for the various JSON files.

Since I continue to ACK the feels towards “AI” by some readers, I did wget mirror the site and poked around a bit more at unminimized sources. There are some usual “tells” when someone has “Claude” (et al.) make something: Tailwind, excessive design tokens and meta tags, wanton use of !important, CSS print styles (and more) which do not appear anywhere in this site. Also, parts of the CSS show some serious “craft fingerprints” that generally only a human (or an agent with a bonkers good set of skills) would use.

XSLT RIP

Chromium is (for reals this time) deprecating and removing XSLT to eliminate (potential) significant security vulnerabilities (i.e., reduce Chromium’s attack surface). This browser feature relies on libxslt, an aging C library prone to memory-safety exploits like buffer overflows. Because modern JavaScript frameworks have largely superseded client-side XSLT, the security risk to folks using Chromium-based browsers now outweighs the utility for the tiny fraction of sites (roughly 0.05% of page loads) that still use it.

The rollout has been following a fairly cautious timeline. XSLT will be disabled by default in M158 and completely removed by M176 (I’m using a Chromium-based browser that sits at 155.0.8059.84). To mitigate breakage for enterprise and government sites, Chromium is providing a long migration window, Enterprise/Group Policies, and a JavaScript polyfill.

I learned about this deprecation/removal via XSLT RIP, a site that is hard on the eyes, but absolutely not AI-generated. In fact, it was written by a very clever human since the page you load is, initially, just:

<?xml version="1.0" encoding="UTF-8"?>
<?xml-stylesheet href="/index.xsl" type="text/xsl"?>
<html>
  <head>
    <title>XSLT.RIP</title>
  </head>
  <body>
    <h1>If you're reading this, XSLT was killed by Google.</h1>
    <p>Thoughts and prayers.</p>
    <p>Rest in peace.</p>
  </body>
</html>

So, that’s all you’ll see when your browser eventually stops supporting this tech (so make sure to grab a copy of the .xsl file and have a look beyond what’s in the section header).

Featured Free Font: Obel Mono [Masked]

Obel Mono Masked is a font that “redacts” API keys at render time. Just paste a key into any app on screen, and it renders as dots without the need for a plugin, browser extension, or custom browser app. The typeface meets the needs of a specific threat model: involuntary exposure via screen share, call recording, screenshot in a bug report, or (sigh) an agent reading your screen.

Longtime readers know that a font is actually a program, which is a big reason most operating systems still render them in the kernel for maximum speed. In “regular” fonts, the system’s shaper reads the font’s rules and may swap some glyphs (e.g., the machinery that fuses f + i into a ligature). Nothing requires those rules to be about typography, so the rules can pattern-match secret prefixes and substitute a dot glyph.

Text arrives one character at a time. Waiting for a complete key means the key is legible first and then vanishes, which causes some visible flicker, and every frame before the swap leaks. Since that’s not a great UX, every rule in this font reads only backward. Once a cell is drawn, it is final.

This backward-only approach creates a second problem: shapers have no memory, so a character can’t know it’s mid-key. The fix is bonkers clever and amounts to a smuggling trick using two different glyphs with identical drawings. On seeing ghp_ (or the = in TOKEN=), the underscore is swapped for its twin. That twin means “a key starts here” and is invisible to you. Then three additional rules are applied:

• Note: marks the start.
• Window: next four characters stay readable so you can still tell keys apart.
• Dots: a character becomes a dot if there is a note plus four characters behind it, or another dot immediately behind. Each dot depends solely on already-drawn pixels.

The typeface covers 205 key prefixes across 82 issuers, plus 691 context patterns, such as GITHUB_TOKEN=, "password": ", Authorization: Bearer, --api-key=. The landing page has a live searchable list per category: AI, cloud, code & CI, payments, messaging, registries, data & ops.

At this point, I feel compelled to make it clear that this font changed pixels, not text. This is fine for hiding stuff from screen shares, recordings and streams, bug-report screenshots, and screen-reading agents. It DOES NOT hide anything from copy-paste, the file on disk, shell history, or any program that reads the text. If you copy a masked line, the whole key comes back.

There are two ways to use it:

• If you use Obel Mono Masked, the feature is always on, which is handy for apps with no font settings
• For Obel Mono, masking is opt-in via stylistic set ss01, for apps that expose one, such as Ghostty, VS Code, Zed. The download page has per-app settings.

For apps that don’t shape text at all (like Alacritty) they can’t run any font rule and show keys as typed.

The idea is super clever, but I fear it may encourage some truly bad habits. Use with caution!

FIN

Remember, you can follow and interact with the full text of The Daily Drop’s free posts on:

• Mastodon via @dailydrop.hrbrmstr.dev@dailydrop.hrbrmstr.dev
• Bluesky via <https://bsky.app/profile/dailydrop.hrbrmstr.dev.web.brid.gy>

☮️