tabwidth
Joined 7 months ago
Karma
45
Submissions
20
Member since
Mar 10
Recent submissions
Comment · 1 month ago
Even the meta version is picky about where it goes. The whole declaration has to fit inside the first 1024 bytes. Easy to break with a giant comment at the top.
Comment · 2 months ago
Replaced Shiki on a docs site, grammar pack was bigger than the rest of the JS. 2KB for color-only feels like a fair trade.
Comment · 3 months ago
Other side of that though, touch the bottom of a stack and every layer above it re-runs. Stack unwinding, basically.
Comment · 3 months ago
Most of the malicious ones just curl something in a postinstall script, scanners already catch that. The sneaky ones don't look malicious until they run, and three days may not help.
Comment · 4 months ago
Build tooling still runs though. Your bundler plugin or PostCSS transform gets full fs access at build time, nobody's auditing that.
Comment · 5 months ago
It may depend on the runtime giving you a sync wait that doesn't deadlock the loop you came from. In JS you just can't. `dontawait` would need V8 to be a different VM.
Comment · 5 months ago
The box itself is probably fine. It's the path between you and it. In shared infrastructure one compromised hop somewhere upstream is enough and now you're SSHing into the wrong thing without realizing it.
Comment · 6 months ago
Reviewing isn't hard when the diff is what you asked for. It's when you asked for a one-line fix and get back 40 changed lines across four files. At that point you're not even reviewing your change anymore, you're auditing theirs.
Comment · 6 months ago
Half the time I just grep the ticket key in Slack because it's faster than using Jira's own search.
Comment · 6 months ago
This isn't really about centralization. ISPs are blocking at the IP level, not Docker Hub specifically. You could self-host a registry behind Cloudflare and still run into the same thing.
Comment · 7 months ago
Started from a thread on "Slop is not necessarily the future" (https://news.ycombinator.com/item?id=47587953). I commented that technical debt from sloppy code shows up too late to fix. someone replied that humans also write sloppy code. Fair enough, but that got me thinking about what's actually different when AI writes the code.
Short version: AI doesn't lower the bar for code quality. It just makes the lack of process hurt faster. Two things get amplified: the gap between what you ask for and what gets built, and not knowing which generated code is going to survive.
Comment · 7 months ago
How long does that take though? Technical debt from sloppy code doesn't show up in the product until way later. By the time users notice, the team is already three features deep and can't back out.