moebrowne

source?

> Every time I started Chrome, it was a breath of fresh air. Everything was just slightly faster to react

Are you opening "several windows with a dozen tabs each" in Chrome? If not, then it's hardly a fair comparison.

Yup, or open dev tools and enable "disable cache". This applies only while dev tools is open

If you want a list of posts simply ordered by upvotes: https://news.ycombinator.com/best

At least they give you a choice

The "local" were talking about is a path on the same machine. The article uses the remote `/home/user/bares/cani.git`

The removal was discussed here: https://news.ycombinator.com/item?id=45873434

No need to imagine a polyfil, they already exist: https://github.com/mfreed7/xslt_polyfill

They are:

> The ampersand character (&) and the left angle bracket (<) MUST NOT appear in their literal form, except when used as markup delimiters, or within a comment, a processing instruction, or a CDATA section. If they are needed elsewhere, they MUST be escaped using either numeric character references or the strings " &amp; " and " &lt; " respectively. The right angle bracket (>) may be represented using the string " &gt; ", and MUST, for compatibility, be escaped using either " &gt; " or a character reference when it appears in the string " ]]> " in content, when that string is not marking the end of a CDATA section.

> In the content of elements, character data is any string of characters which does not contain the start-delimiter of any markup and does not include the CDATA-section-close delimiter, " ]]> ". In a CDATA section, character data is any string of characters not including the CDATA-section-close delimiter, " ]]> ".

> To allow attribute values to contain both single and double quotes, the apostrophe or single-quote character (') may be represented as " &apos; ", and the double-quote character (") as " &quot; ".

https://www.w3.org/TR/xml/#syntax

Internal discussions here: https://externals.io/message/130816

Full changelog here: https://github.com/composer/composer/releases/tag/2.10.0

Official manual including install instructions: https://markqvist.github.io/Reticulum/manual/

I appreciate Composers slower but deliberate, well thought out approach to supply chain attack mitigations.

Better title: Flatpak is thinking about depending on Systemd

> It’s important to note that everything discussed during the talk is planning, and not a single line of code has been written yet

For anyone wondering the number in the second example isn't just some random big number it's: PHP_INT_MAX + 1

This changed 6 years ago in 8.0, a major version change.

Once again showing how out of date peoples hate for PHP is

> Paid my share of dealing with those problems with PHP 5 and 6

Hard to take this seriously when there was no PHP 6.

https://ma.ttias.be/php6-missing-version-number/

Also set PHP_CLI_SERVER_WORKERS=10 to enable multiple threads

> I've encountered multiple sites that now use authenticatorAttachment options to force you to use a platform bound Passkey. In other words, they force you into Microsoft, Google or Apple. No password manager, no security key, no choices.

https://fy.blackhats.net.au/blog/2025-12-17-yep-passkeys-sti...

and more discussion here: https://news.ycombinator.com/item?id=46301585

Not the OP, but I'd assume they are talking about 'direct' attestation mode creating vendor lock-in

Or don't mount the Docker socket into containers

> Defeated by such argument, I deleted my account.

I'd bet your account wasn't actually deleted, just marked as deleted or inactive.

I agree with the overall sentiment of this post but I'm not sure about this:

> A codebase that is easy to maintain becomes easier to optimize.

I think optimization and maintainability are often at odds. The only example which comes to mind is loop unrolling, increases performance, decreases maintainability.

OK, so what are the alternatives, what can developers use instead?

For anyone who is running an out-of-support version of Ubuntu (Ubuntu 20 and lower) I highly recommend Ubuntu Pro it gives access to updates and is free for personal use

> If everyone starts waiting a week, their exploits will wait 2 weeks

It's much easier to break into an NPM/Github account and push malicious commits in the few hours a maintainer is sleeping than it is to push something out and not have it noticed for 2 weeks.

There are lists of attacks which had an exposure window which was much shorter than 2 weeks:

https://daniakash.com/posts/simplest-supply-chain-defense/ https://blog.yossarian.net/2025/11/21/We-should-all-be-using...

By default the dev server is single threaded, but since PHP 7.4 you can add more with an env: `PHP_CLI_SERVER_WORKERS`

> Non-static closures are turned into static ones if they are guaranteed not to make use of $this.

> Stateless closures, i.e. those that are static, don't capture any variables and don't declare any static variables, are cached between uses.

I assume they are trying to enable Reader mode which is Ctrl+Alt+R

TOTP isn't phishing resistant