segphault

The install footprint from npm is 302 packages weighing in at 504mb. It includes a lot of superfluous debris, with packages containing single functions like "is-string" and multiple polyfills for functions like object.assign. That's a very large attack surface considering the poor security practices in the npm ecosystem[0] and the growing frequency of attacks on transitive dependencies[1].

[0]: https://www.bleepingcomputer.com/news/security/52-percent-of... [1]: https://news.ycombinator.com/item?id=28962168

Cloudflare Pages locks you into git-based deployment, which isn't always practical, especially for sites that are heavy with images and other non-text static assets. I don't want to use git to manage the images for my website and I don't want to have to pay Github every month for Git LFS storage and bandwidth costs.

The way $ref resolution works is hideously complicated, to the point where many JSON Schema implementations just don't even bother supporting external $refs. It really should be a totally separate concern from validation, especially since how you store and compose schemas may end up being specific to a given use case.

TSMC is building a $12b manufacturing facility in Arizona that will be able to produce the 5nm chips used in Apple products. They are fully aware of the geopolitical risks and are taking responsible steps to mitigate them.

To the extent that the higher unit prices help them cover those investments, I'm more than happy to pay whatever portion of the increase gets passed on to consumers.

I have been really impressed with esbuild. It is lightning fast and trivially easy to configure. Instead of using a crappy React boilerplate that stitches together a thousand fragile, poorly-maintained npm packages, you just install one tiny binary implemented in performant, reliable Go.

Over the past decade, Mozilla has capitulated over and over again on critical issues. They failed their users and the ecosystem by not standing up to industry pressure for h.264 and EME. They also ended up following rather than leading on key privacy issues like third-party cookie behavior.

In every case, they defended these decisions by saying that they couldn't risk losing users, arguing that these issues weren't hills worth dying on. And now, because Mozilla didn't choose a hill to die on, they are going to die on no hill at all.

When they aren't the browser that is standing up for interoperability and the freedom and privacy of their users, they have no way to differentiate themselves. Firefox is just another browser, and it's one that is architecturally dated and under-resourced compared to its rivals.

I had assumed that when Mozilla had nothing left to lose as Firefox marketshare crashed, they would go back to being the scrappy underdog who advocates for the right thing. The fact that they've chosen to focus on revenue instead says everything you need to know about how far Mozilla has fallen.

The npm ecosystem needs something like the distinction between Ubuntu's "main" and "universe" repositories, so that you have a smaller subset of known-good packages with harmonized transitive dependencies, stronger centralized curation, a lot more direct scrutiny, tighter control over versioning, and some party that is responsible for addressing vulnerabilities and ensuring appropriate maintainership.

As a venture-backed startup, the company behind npm needed the number of packages and the number of downloads to constantly trend upward in order to justify their valuation. This led to extremely poor policy and prevented them from taking strong steps to remedy the deterioration of the ecosystem. Now that it's owned by Microsoft, there's an opportunity to fix this.

Linux distributions have decades of experience solving these problems, there's no excuse for the JavaScript community to continue ignoring the longstanding precedents and best practices that have emerged from that experience.

It's not just an open source problem. It's fairly trivial to scrape the keys out of a lot of closed source applications. When Twitter first mandated OAuth, I was able to grep a key right out of the apk of their native Android client.

OAuth with client secrets is fundamentally unsuitable for desktop and mobile applications, but that hasn't stopped virtually every major implementor from using it that way. The people who wrote the spec were too busy congratulating each other and downplaying concerns to seriously engage with this issue until it was much too late to do anything about it.

It remains a deeply broken standard, and the people who were responsible for it at an early stage are entirely to blame. Several of them have removed their names from the spec, but I'll not forget the role they played in shouting down critics who raised concerns about this very issue.

Web MIDI is really cool. I recently bought a new MIDI keyboard controller from Novation and was really impressed when I learned that the configuration tool can run entirely in the browser without requiring local installation. In Chrome, it displays a permission prompt.

What the npm ecosystem really needs is something like the distinction between Ubuntu's "main" and "universe" repositories, so that you have a smaller subset of known-good packages with harmonized transitive dependencies, stronger centralized curation, a lot more direct scrutiny, tighter control over versioning, and some party that is responsible for addressing vulnerabilities and ensuring appropriate maintainership. If you could rely on that for core functionality and only needed to go outside of it for the long tail of more specialized things, it would be a lot cleaner and safer than what we do today.

Linux distros have many, many years of experience curating packages at scale. It is crazy to me that the node community just totally disregards all of the best practices learned by the Linux distros in favor of practices that are lazy and unambiguously dangerous.

I've been hoping that somebody would do this for quite some time. I previously experimented with using CloudFront logs in GoAccess for awhile for my personal blog in order to avoid invasive JavaScript-based tracking, but it was too much trouble to maintain.

I really like the idea of the CDN provider offering this as a service that requires no effort and provides a nice interactive dashboard.

The pricing on this is unfortunately too much for me to justify using it for my personal site, but I'd happily use it for anything more substantive.

What's funny about this is that Oracle has a long and colorful history of doing the exact same thing[1] that they are accusing AWS of doing in this case. It feels like Oracle is just unhappy that they got outmaneuvered at a game they practically invented.

[1]: https://www.latimes.com/archives/la-xpm-2002-may-04-me-oracl...

Those who are interested in this might also want to check out Kni, an interactive fiction language implemented in JavaScript: https://github.com/kriskowal/kni

Oh yeah, those were fantastic little devices. It's a shame that it wasn't popular enough to warrant successors. The OpenMoko people did some really innovative stuff back in the day, but hardware is tough.

This comment is spot on. UWP apps feel gratuitously non-native on Windows, have terrible keyboard accessibility, and exhibit a ton of interoperability issues with third-party utilities like xkeymacs that hook into platform functionality. Even Electron apps that use standard buttons and text inputs end up feeling more native.

The lack of good keyboard accessibility is particularly frustrating, because the ribbon paradigm and even the menu accelerators in old-school Win32 apps both had outstanding, highly discoverable keyboard control.

I had a somewhat kafka-esque experience trying to install the Docker client on Windows recently. I just wanted the standalone executable so I could connect to Docker running on a headless Linux server on the local network. They don't make that available anymore for the latest version and force you to install Docker Desktop, which required two reboots and enabling Hyper-V, none of which should actually be necessary if all you are doing is connecting to a Linux box. It was a garbage experience. While I was trying, unsuccessfully, to figure out how to get the standalone binary, I noticed that the Docker website has been completely taken over by really low-signal marketing crap, and all of the actual technical substance is now hidden away in the documentation. The way that Docker is flailing around as it desperately seeks some kind of enterprise traction is really a huge turn off to their core audience.

Really hope that the "full window manager" item leads to good things. Having proper tiling window management with extensive keyboard control would be so awesome.

For those who are interested in this topic, I highly recommend checking out VCV Rack, an open source application that lets you build Eurorack-style virtual modular synthesizers: https://vcvrack.com/

I've been going down this rabbit hole lately and it's really fascinating.

My career as a technical writer began 15 years ago with an article that I wrote for Linux Journal. I'm glad that they were able to work out their financial issues and find new sponsorship to sustain them.

Looking at the source code, this appears to be a UWP wrapper around the xterm JavaScript library loaded in a system web view. It uses a WebSocket connection to facilitate communication between the embedded web environment and the application. I’m not sure how comfortable I am with that from a security standpoint.

At this point, ES6 support is sufficiently widespread that I don't really have a problem using it natively. Major features like the const, classes, template literals, and async functions are all at least at 90% market penetration.

I can get away with not supporting Internet Explorer, though I understand that it's not a trade-off that everybody is comfortable making.

I use rollup with an extremely minimal configuration. No transpilers at all, just standards-based JavaScript.

This solution pulls in 155 packages from npm, including multiple versions of bullshit packages like "kind-of" that it can't deduplicate. One of the direct dependencies is a library that renders a loading spinner in command line interfaces, which itself pulls in over 20 transitive dependencies.

The reason that JavaScript build tooling is so complex and introduces so much overhead is that the ecosystem's culture is fundamentally broken. Every single one of these tools is a raging dumpster fire because it's built on top of all of these layers of low-quality interdependent crap.

I'm increasingly moving towards module-type script tags and standard ES modules everywhere, with no build step during development. It's still challenging to use node-targeted modules in this fashion, so I really do appreciate that people are working on finding ways to make it work. I just wish that we could do it without pulling in so much third-party code and the large surface area for failure and security problems that go with it.

> I just hate programming in windows and haven't touched one of these that are powerful enough to run Ubuntu in a VM in a reasonable fashion.

I have a hard time understanding where this sentiment comes from. WSL is categorically better than using Homebrew on macOS. It is basically an Ubuntu userspace with apt, running directly on the Windows kernel. Using Ubuntu in a VM seems pretty superfluous when all the useful parts are already there with fully native performance. As a longtime Linux user, I am increasingly convinced that Windows is the best desktop Linux distribution.

Yup. Another prominent example is Amazon’s inability to sell books in the Kindle application on iOS, which has the same anticompetitive undertones given that Apple sells ebooks to users of its platform.

> Underneath the rhetoric, Spotify’s aim is to make more money off others’ work. And it’s not just the App Store that they’re trying to squeeze — it’s also artists, musicians and songwriters.

Uh, I seem to recall Apple being forced to reverse some brazenly greedy policies for their music service when a high-profile artist called them out and withheld content in protest. For Apple to characterize itself as a champion of exploited artists is pretty disingenuous.

The site has slowed to a crawl as the HN audience hugs it to death. Unfortunate that they didn't anticipate the increased interest and allocate more capacity accordingly.

I have a Rift, but I've never purchased any content from Facebook's marketplace. I use Steam, because that's where my gaming library lives. As long as the headset is tethered to a computer, Valve is going to capture the content distribution revenue. Facebook had to make a standalone device, because they never had a chance of monetizing anything other than the hardware itself on the desktop. I think this is a point that is often overlooked.

Given the Facebook's generally poor history of ecosystem stewardship, I don't see why any gaming enthusiast would even want them to be the arbiter of VR content distribution. Valve is far from perfect, but I'd much rather give my money to them than Facebook.

I have no problem with somebody deciding that a shareware or dual-licensing model are the best choice for their business. But it's incredibly toxic for the people pursuing those models to muddy and contort the accepted definition of "open" in order to misrepresent what they are doing.

It's deeply disingenuous for this blog post to use the word "bullying" to describe the community's rejection of software distributed under undesirable or ill-considered terms. You can ship your code under whatever terms you want, but don't act like users and contributors have an obligation to support you when you make choices that don't serve their interests.

There are huge American banks that rely on SMS as a form of 2FA. It's totally unacceptable for AT&T to happily hand over a SIM activated against somebody's phone number without performing basic identity verification checks, especially since AT&T committed to addressing these failures under the terms of a 2015 settlement with the FCC.

Frankly, I'd be delighted to see AT&T get thrown under the bus for this and have to start paying out damages when it can be shown that the company failed to conform with its own documented security policies.