jph

Want to add a link to your work to the architecture decision record repo? I maintain it.

https://github.com/architecture-decision-record/architecture...

I maintain a coordinated vulnerability disclosure repo: it explains how to do it well, why it matters to discovers and companies, and links to some relevant concepts.

Coordinated vulnerability disclosure is especially relevant right now because of the PHP disclosure affecting so many people.

Constructive feedback welcome. Free open source. Written by me by hand. Translated into many languages by Sonnet.

I use Loco extensively on many projects and it's great. The creators are very responsive to ideas and questions. Loco feels like it's a perfect halfway point between Axum and Rails.

On my wishlist is batteries-included command-line setup support for database access using Diesel instead of SeaORM because I like formal types, and security tokens using PASETO instead of JWT because I like specific algorithms.

I'm doing this attack surface tactic with Vix IDE, a terminal text editor that helps novices get comfortable with vi, emacs, git, jj, sql, commands, and more.

The prompt I used was "Goal: rework to reduce the attack surface. Process: move features into feature-flag Rust crates. Output: build a minimal version. Questions: Ask me anything."

https://github.com/vixide/vix

This past weekend, Claude Fable/Opus/Sonnet together successfully refactored the whole Vix IDE codebase into many separate Rust crates and Cargo features.

This refactor enables a security-oriented user to pick and choose, and also makes it easier for a security auditor to look at one capability at a time.

If you're curious you can see the commit messages by Claude Sonnet. IMHO they're reasonably good.

The simple command is:

  sv@next migrate sveltekit-3

I'm upgrading hundreds of projects right now and it's going great so far. Here's the shell script I'm using; adjust as you like.

  find ~/git -path '*/.*' -prune \
  -o -path '\*/node_modules' -prune \
  -o -type f -name 'svelte.config.js' -exec dirname {} \; |
  while read -r x; do
    cd "$x"
    echo "y" | 
    pnpx sv@next migrate sveltekit-3 \
    --tasks all \
    --confirm \
    --install pnpm < /dev/null
  done

I start with these rules, then adjust as I want...

EMPHASIZE:

- *Summary.* First paragraph like newspaper (who, what, where, when, how, why).

- *Benefits.* Focus on the benefits for the reader.

- *Why this matters* Focus on what it adds to the reader.

NO:

- *No tech stack.* Do not say the tech implementation; covered elsewhere.

- *No counts.* Do not say page counts, part counts, chapter counts, etc.

- *No special formatting.* Do not bold, not italic, not bullet lists.

- *No "if".* Do not say "If you do X then Y"; instead use positive.

- *No run-on sentences.* Do not use many clauses nor too many words.

- *No passive voice.* Do not use passive, or non-subject, sentences.

Good article on Rust's strengths with types. If you like this, you may be curious how you might build your own parse capabilities. I like the Rust crates Winnow and Nom, and also the Rust traits From and Into.

Jujutsu is a better smarter git. It's a great convergence of better UX, plus more expressive, plus easier to use.

If you haven't tried jj yet, take it for a spin and see how you like it.

If you like Arthur, you may be surprised that some scholars think he wasn't English, but rather he was Cymro/Welsh: https://www.wales.com/about/history-and-heritage/welsh-tradi...

Seconded. Ben, you have a great teaching style, thank you for sharing this.

Thanks! Added. What is your donate link?

https://tangled.org/joelparkerhenderson.com/architecture-dec...

https://tangled.org/joelparkerhenderson.com/ways-of-working

https://tangled.org/joelparkerhenderson.com/coordinated-vuln...

Can you suggest a viable infrastructure alternative?

My wishlist: free for open source and paid for closed source, able to do simple projects that are handwritten and also complex projects including AI LLM code that needs CI/CD/auditing, and hosting in the UK or EU.

Aside, I donate money to Codeberg because I think Codeberg is a wonderful service with strong commitment to free open source, and because I host some larger projects and AI projects that are for public welfare social good.

Help encourage alternatives by trying Gitlab.com or Codeberg.org or Tangled.org or others, and please star some projects there to help motivate more options.

Self-promo links below if you would like to star a few of mine good for developers.

https://gitlab.com/architecture-decision-record

https://gitlab.com/ways-of-working

https://gitlab.com/coordinated-vulnerability-disclosure

Yes in some senses, but no from a compliance perspective. This is AFAIK and IANAL and YMMV etc.

For example: The standard FHIR $export operation can support extensions that take de-identification config details as additional parameters. The standard openEHR can query then return non-id fields. The standard SNOMED codes can be rolled up e.g. high-specificity codes can be aggregated into a low-specificity code.

But: for compliance/legal/auditing reasons, all organizations that I know of personally do not rely exclusively on these protocols for de-identification. Instead, the organizations place their de-indentification processes in a kind of "clean room" that does many more kinds of cleansing, redacting, aggregating, chaffing, filtering, and the like.

Worldwide medical standards implementations with Rust for FHIR, openEHR, SNOMED, etc. Official specifications work well with Claude Fable, test automation, and storage using relational databases.

Fast Healthcare Interoperability Resources (FHIR) using Rust:

https://github.com/fhir-rust/fhir-rust

Open Electronic Patient Record (openEHR) using Rust:

https://github.com/openehr-rust/openehr-rust

Systematised Nomenclature of Medicine (SNOMED) using Rust:

https://github.com/snomed-rust/snomed-rust

I have work in progress creating stores for PostgreSQL, SQLite, MySQL, MariaDB, MSSQL, Oracle.

Great username :-) I'm a happy longtime Fastmail customer and I'm migrating to the new EU area.

I'm experimenting with large-ish software projects using Claude Fable. The results are surprising to me.

- Project portfolio management software. Good results so far. This is unguided experimentation: Fable researches feature ideas and plans them, then Opus 5 implements them, without me in the loop. The features include things such as an auth server, full-text search, audit logging, resource leveling, HA/DR, IaC, and more.

- FHIR & SNOMED medical software experimentation in demo-only environments. This has mixed results so far. This is guided experimentation: the FHIR specifications and SNOMED specifications are thorough and I'm in the loop. Fable plans OK, but Opus 5 is thrashing a lot, going down many rabbit holes.

Lots of errors. Opus 5 is also giving me many more hallucinations, including things that aren't even in the right territory. It's also telling me that it's making many mistakes, and the language feels off-kilter as if it's not using typical clear phrases.

> Anywhere you need direct database access outside your application, CipherStash Proxy provides a secure escape hatch.

This sounds like a back door. Is it?

To me, the whole article feels super-unclear about what exactly is involved.

Can HN folks who know more weigh in?

Queueing theory introduction for software developers:

http://github.com/joelparkerhenderson/queueing-theory

I'm building Lily Design System as a response to Shadcn and similar systems not yet being available directly for multiple stacks including Svelte, Angular, Nunchucks. It's all free open source. If you want to send me your feedback, suggestions, etc. I can easily add things to Lily.

https://lilydesignsystem.github.io

Good work. I signed up @joelparkerhenderson. It's unclear to me how to start using Pieces because the site says I'm awaiting approvals.

I understand the point of that for unknown accounts; perhaps you could consider faster FTUX by leveraging my other existing social accounts? E.g. GitHub, GitLab, Codeberg, LinkedIn, Reddit, etc. And/or enable me to browse public accounts or example content in the meantime?

If you want more open UI, I lead Lily Design System (https://lilydesignsystem.github.io) which has hundreds of components for Svelte, React, Vue, Blazor, Nunjuks, and HTML. The focus on semantics helps AI generators, and there are many prebuilt themes, locales, and examples. I'm using Fable right now to improve it.

If anyone from OpenUI would like to connect with me to add Lily, please do, joel@joelparkerhenderson.com.

Yes and the word you want isn't "flexible" it's "proportional".

A gate is best when it's proportional to what goes through it. Small project? The business case is "Pam thinks it's could be a good idea". Large project? The business case is a formal study. The word "proportional" makes it much easier for all the participants to understand that the gate is a sliding scale.

> there are two separate personas that you need to “create”: The user persona and the buyer persona.

Even more important: stop using personas, start using actual people. I've experienced many startups make unforced errors by conflating people into personas. A better way is to tag people with attributes, such as specific interests, explicit concerns, tasks to be done, usage goals, learning preferences, and the like.

When you switch from personas to actual people, it opens up many more product experiments-- many of which are surprising and may even feel counter-intuitive to founders. Increase your startup chances of success by carefully connecting with your actual users.

By describing it as a senior doctor teaching a junior doctor.

#1 thing helping me with GUI Rust is sccache for crate compilation caching. and #2 is building independent-compilable subcrates. This improves build times by 10x.

Also shoutout to ratatui because even though it's technically a TUI not GUI, it's superb.

I'm the author and the patient. Ask me anything here or email me joel@joelparkerhenderson.com.

Because of so many GitHub problems, I'm adding GitLab.com and Codeberg.org.

Setup is simply 3 steps:

1. Sign up on each service, ideally with the same username.

2. For each repo you want to share, create the same repo name as a blank repo; do not automatically create a README.

3. Edit your local file .git/config to add push URLs, then push as usual.

Example:

    [remote "origin"]
        url = git@github.com:foo/bar.git
        pushurl = git@codeberg.org:foo/bar.git
        pushurl = git@github.com:foo/bar.git
        pushurl = git@gitlab.com:foo/bar.git
        fetch = +refs/heads/*:refs/remotes/origin/*

Asserts in my Rust code use a custom runtime macro "assert_eq_as_result" which does what the article is describing, by returning Rust Ok or Rust Error.

The Rust crate: https://crates.io/crates/assertables

All the macros have forms for different outcomes:

    assert_gt!(1, 2) // panic
    assert_gt_as_result!(1, 2) return Result (Ok or Error)
    debug_assert_gt!(a, b) // panic when running in debug mode

If anyone here wants to help me port it to Zig, I'm happy to do it.