jdkoeck

Code is not the only thing the agent could exfiltrate, what about API keys for instance? I agree sandboxing for security in depth is good, but it’s not sufficient and can lull you into a false sense of security.

But even then, the agent can still exfiltrate anything from the sandbox, using curl. Sandboxing is not enough when you deal with agents that can run arbitrary commands.

It is completely vibe coded. The author himself says he doesn't check the code.

https://x.com/Hesamation/status/2016712942545240203

Can't believe people are giving it full access to their MacOS user session. It's a giant vulnerability waiting to happen.

Sending an email with prompt injection is all it takes.

https://x.com/Mkukkk/status/2015951362270310879

A tale as old as time: hubris. A successful system is destined to either stop growing or morph into a monstrosity by taking on too many responsibilities. It's hard to know when to stop.

React lost me when it stopped being a rendering library and became a "runtime" instead. What do you know, when a runtime starts collapsing rendering, data fetching, caching, authorization boundaries, server and client into a single abstraction, the blast radius of any mistake becomes enormous.

Alas, that’s a common misconception! You’re confusing properties with attributes. Attributes are set through HTML and are stringly typed, but litjs properties can be any js value.

For instance, I have a project with a small web component that displays data from a duckdb wasm connection. The connection object is passed as a property and it works flawlessly.

There’s a puzzling contradiction between your claim that developers are the problem, on one hand, and then your own anecdote on the other, not to mention the article that very convincingly debunks the idea that housing shortage is the fault of developers. I must be missing something, because frankly this isn’t making any sense.

Your own example seems to show that the culprit lies with local governance, not developers, wouldn’t you agree?

I wish they had more influence, then they’d be able to build more and prices would go down.

Have you tried getting back into cardio with a softer method like biking? Maybe that combined with some strength exercices could toughen up your body enough that you can start running again! Anyway, best wishes.

Honestly, I think the Claude Code integration in VS Code is very close to the « nothing » part of the spectrum!

I'm highly skeptical, do you have a concrete example?

Which is good, right? I don’t think we want actual censorship.

On the contrary, I think this a very practical escape hatch that will let frameworks insert optimisations where they need to.

I don’t know if React really Just Works these days, the VDOM has real overhead and developing with React feels like playing whack-a-mole with rerenders these days.

Just a quick answer to a point that jumped at me: for an array of signals, you wouldn’t need to map them, you’d use a specialised directive that directly takes an array of signals and binds them to the DOM, the same way lit uses the repeat() directive to optimise the rendering of arrays.

https://lit.dev/docs/templates/lists/#the-repeat-directive

I still think you’re misunderstanding what React is optimizing for. When you say "React has to force you into making everything an expression", you’re describing its core philosophy, not a constraint. JSX is built around the idea that rendering is just data transformation. It's UI as a function of state. That’s why using map() is idiomatic here. You’re building trees, not iterating imperatively.

Also, it bears repeating that React isn’t just slightly dominant. 82% of JS developers have used it according to the 2024 State of JS survey, and for good reason. It shaped the modern frontend mindset in a way that Vue or Angular haven’t, despite their own merits. For instance, many frameworks came up with their own version of hooks. It's telling that most new frontend frameworks are aiming for the "better React" position.

I realize we just have different interpretations of what "winning" means in a fragmented ecosystem, but it’s worth acknowledging how much React has set the tone for modern web development. UI as a function of state (and using map() a lot...) is here to stay.

It’s not an insult, if you think for loops are commonplace in modern JavaScript and React isn’t the dominant frontend framework by far (twice more used than the next in line, vue), you’re out of touch, it’s just a statement.

How can you not realize that producing a string or a tree of elements is a purely functional operation? There’s no side effect here. Are you familiar with the concepts of functional programming?

It’s good you ended on the one thing JSX got right: everything is an expression. It’s that simple. There’s nothing imperative about evaluating a template, it’s entirely covered by functional programming techniques. You’re just producing a value.

And yes, modern JavaScript uses tons of concept from functional programming, where it is understood that mutating values and triggering side effects should be a last resort. This is why a good js programmer uses ten times more maps then he uses for loops.

Maybe you don’t know how dominant React is today? Two third of JavaScript developers use React at work (https://2024.stateofjs.com/en-US/libraries/front-end-framewo...).

It feels like you’re out of touch, have you used JavaScript lately?

You just discovered the concept of male expendability.

https://en.m.wikipedia.org/wiki/Male_expendability

The difference is that JSX is using control flow from an actual programming language, whereas Vue is shoehorning control flow into declarative markup. This is the single reason React won the frontend framework market: they got the templating right.

PS: in modern JavaScript, using map rather than for loops is more idiomatic!

> Hard not to laugh out loud at "We know what good syntax for templating looks like."

First of all, it's not very nice to laugh in the face of someone advocating for progress on the web platform, which benefits everyone.

Second of all, yes we do now know what good syntax for templating is, it's basically jsx (and I'm saying this as someone who's really not a fan of React). It took the whole web by storm, it's been adapted for all kinds of frameworks, and it's undeniable that all js templating systems converged towards common attributes: templates-as-expressions, composition via nesting and control flow with just javascript (instead of specific template syntax).

Is there really a proliferation? At this point it’s 90% React.

> Instead of having your ORM's objects, to be converted to JSON, sent, parsed, and finally manipulated to your UIs needs, you skip the whole "convert to JSON" part. You can go straight from your ORM objects (best for data operations) to UI (best for rendering) and skip having to think about how the heck you'll serialize this to be serialized over the wire.

I can't let go of the fact that you get the exact same thing if you just render html on the server. It's driving me crazy. We've really gone full circle, and I'm not sure for what benefit.

One of the things I love most about AI coding tools is how they make it easier than ever to move away from complex, fragile abstractions like ORMs. The main reason we’ve often avoided writing raw SQL repositories by hand is that it’s tedious, but now, much of that boilerplate can be generated by AI.

More broadly, wherever you might have relied on a heavyweight dependency, you can often replace it with AI-generated code tailored to the task at hand. You might think this would increase the maintenance burden, but au contraire: reviewing and taking ownership of AI-generated code is often simpler and more sustainable in the long term than dealing with complex libraries you don’t fully control.

I wouldn’t call this a particularly crazy hack, it’s also called string interning and I reckon that’s what every language runtime does when strings are immutable (which includes javascript runtimes, also this isn’t required by the language specification).

Git is still event sourced, it’s just there is only one kind of event (a commit), and its payload is the whole state ¯\_(ツ)_/¯

There are very few Chinese speaking English, actually. Go there and you’ll see.

I don't doubt you mean well, but you still spread FUD, right off the bat. And went on to give ok advice, I'll give you that, but still. You start off with "running/exercising is inefficient and will fuck up your joints", I'm saying do a run-walk-run and know that exercise helps adherence to a good diet. What do you think is the better advice?

For other readers: disregard the FUD above regarding running and exercising. Exercising generally curbs hunger, boosts mood and helps solidify adherence to good eating habits. It won't fuck up your joints if you very gradually increase your total exercising volume. For instance, start alternatively walking and running for half an hour three times a week (never getting winded in the process, stop running and start walking every time you start breathing hard), and from there add ten minutes of exercise per week. You'll do fine.

You hit the nail on the head. The market of mobile platforms is in a state of "market failure": no real competition, because mobile platforms are not "homogeneous" (that is, it's hard for a buyer to change platforms). The market of mobile platforms being thus "monopolised", you need regulation to enforce proper competition.

It actually is, there are plenty of services where you can pay 30% less if you go through their site instead of Apple's app store.