HNHacker News
TopNewBestAskShowJobs

tln

1,736 karma · joined November 26, 2012

tony@lownds.com

[ my public key: https://keybase.io/tln; my proof: https://keybase.io/tln/sigs/WJQuZkWZ70PJpTL4s7xBiwRSOuS5mfzF1oGG4jgyRAg ]

submissionscomments
tln··on Mini Shai-Hulud Strikes Again: 314 npm Packages Compromised
pre- and post- install scripts should just be abolished. It should require a special dispensation from npm to even publish one.

Yes, I choose to use pnpm but opt-in safety isn't going to get the developer community to herd immunity.

tln··on Mini Shai-Hulud Strikes Again: 314 npm Packages Compromised
Thanks for that!

So, back to the GP post - TC39 should make a bigger stdlib.

Lets say timeago.js is warranted (as a polyfill and terser API) AND TC39 is taking action.

On slice.js, TC39 took action AND usage is unwarranted since the functionality is widely available. Maybe a stride.js would be needed.

There are 2 modules where npm's culture of "tiny modules because the stdlib is impoverished" holds - but the issue isn't TC39 really. There are 312 modules that aren't related to npm's culture of "tiny modules because the stdlib is impoverished".

tln··on Mini Shai-Hulud Strikes Again: 314 npm Packages Compromised
I'm not sure any of the packages here would be part of a "better standard library".

Do any language standard libraries have a "3 hours ago" formatter? Thats what timeago.js does

Maybe slice.js, which just does python-style indexing with negative numbers. TC39 already made array.at() and array.slice() handle negative numbers.

tln··on Tesla Solar Roof is on life support as it pivot to panels
I thought the IFC International Fire Codes were a bit more ubiquitous than they are. Apparently whole roof is possible in a few EU countries. Probably not a good idea for the stick-built houses prevalent in US though

Thanks for sharing

tln··on We stopped AI bot spam in our GitHub repo using Git's –author flag
Thats a really elegant solution.

How does the website trigger the CI script? Through GH rest API?

tln··on Tesla Solar Roof is on life support as it pivot to panels
Don't you need fire setbacks? I didn't think full roof racks were possible
tln··on Claude for Legal
On (1), what if the law firm hosts the AI chat?

It seems like local AI could be valuable for law firms for reasons of (2) as well

tln··on Rewrite Bun in Rust has been merged
Seems like Zig Bun had 3 pointer types that map neatly to existing Rust pointer types. The other 7-8 needed types to be created.

Is that the conspiracy?

bun_collections doesn't look much older than the porting guide.

tln··on Rewrite Bun in Rust has been merged
Now that Bun can leverage Rust do you think some of this code will get disaggregated? Eg, Bun could use swc crates
tln··on Bun's experimental Rust rewrite hits 99.8% test compatibility on Linux x64 glibc
> And now like a winey baby they LLM rewrite to Rust.

I didn't see any whining from Jarred, this seems like misplaced sentiment

> It’s purely politics-based

The linked twitter thread gives clear technical justifications

tln··on Accelerating Gemma 4: faster inference with multi-token prediction drafters
Taalas. A sibling comment of yours posted the chat demo URL -

https://chatjimmy.ai/

tln··on California to begin ticketing driverless cars that violate traffic laws
Yes that is in the law.

Fleet reductions, new limitations on operating areas/conditions, fines, permit suspension or revocation

tln··on VS Code inserting 'Co-Authored-by Copilot' into commits regardless of usage
I should have been clearer, the hidden addition is never ok.

If I ask Claude to write a commit message, it will inserted a co-author line (and an ad), but I can see it and disapprove, add a counter instruction to CLAUDE.md etc

tln··on VS Code inserting 'Co-Authored-by Copilot' into commits regardless of usage
The sneaky commit modification is triggered by very modest usage of AI such as auto-completion.

Look, if an agent writes the code and the commit message then adding a Co-authored-by by default is ok. Not even showing it before the commit is made is not, and adding the message when AI was just completing code is not.

tln··on VS Code inserting 'Co-Authored-by Copilot' into commits regardless of usage
Absolutely, messing with commits is more invasive than messages. It gets worse:

"Sent from my iPhone" appears in the authoring view, and you can delete it.

Co-authored-by: NEVER appears in the commit message UI - it is added without the user even seeing it.

tln··on Mozilla's opposition to Chrome's Prompt API
> Does anyone understand this well enough to do that with confidence?

Pretty sure Chrome wouldn't ship if they weren't confident. And Firefox would object based on security grounds if they saw such an issue

tln··on Qwen3.6-27B: Flagship-Level Coding in a 27B Dense Model
The dragon image has issues like one eye, weird tail etc, but the pelican is imo perfect -- the best I've seen!
tln··on Cloudflare's AI Platform: an inference layer designed for agents
I think you should look at OpenRouter. It has budget controls
tln··on Artifacts: Versioned storage that speaks Git
Hmm, I'd expect to be able to actually access the contents of the git repo...

Docced Features: clone repos init new repos import repos

Missing features: list branches and tags list objects list commit history create new commits read raw git objects merge branches or repos read git object by path

tln··on Artifacts: Versioned storage that speaks Git
Ooh, this looks great!

The usage costs are rather high compared to S3 - 30x higher PUT/POST. It looks like batching operations is going to be vital.

tln··on Claude wrote a full FreeBSD remote kernel RCE with root shell
Or even better, the blog post.

https://blog.calif.io/p/mad-bugs-claude-wrote-a-full-freebsd

But I found the exploit writeup pretty interesting

tln··on GitHub's Historic Uptime
The article provides a way to do just that - click breakdown then you can deselect any product areas.

Just the Git operations show way more instability post acquisition.

tln··on My MacBook keyboard is broken and it's insanely expensive to fix
That jumped out at me as well.

It is not hard to spec a Macbook Pro to $4000+ though

I'm a little skeptical of the top case cost - iFixit has these ranging from $90 to $160 usually. The most expensive I found was $299.

Maybe the author meant the entire repair would cost €780.

tln··on The Finger and the Moon
God is the name of the blanket we put over mystery to give it shape
tln··on Everett shuts down Flock camera network after judge rules footage public record
If notice of the infractions is a envelope delivered days later and sitting on on end table for a week, typical drivers are going to rack up 4 strikes before seeing the first one!

Perfect enforcement has to come with immediate feedback

tln··on Simplenote is no longer in active development
I don't think even Simplenote was native on Windows (despite what noteapps.info says), there is no simplenote-windows repo and all signs point to simplenote-electron
tln··on Sqldef: Idempotent schema management tool for MySQL, PostgreSQL, SQLite
I like how Drizzle provides several options for the migrations.

1. DB is source of truth, generate TS from DB 2. TS to DB direct sync, no migration files 3. TS source, Drizzle generates and applies SQL 4. TS source, Drizzle generates SQL, runtime application 5. TS source, Drizzle generates SQL, manual application 6. TS source, Drizzle outputs SQL, Atlas application

tln··on Videogame stocks slide after Google's Project Genie AI model release
Take Two has 13 years of sunk costs they need to recoup.

They will almost certainly do well with GTA 6, but maybe a game that can compete with GTA 6 will be coming out a lot sooner now.

We are a year away from GTA 6, presuming the HQ boiler explosion causes a delay.

tln··on Deep dive into Turso, the “SQLite rewrite in Rust”
Where is the "networked mode" in Turso? Turso's readme and docs do not mention anything like this
tln··on What has Docker become?
Thanks for chiming in, I was questioning that assertion myself.

I think the problem was giving up on swarm TBH. At some point it was clear k8s would be dominant, but there was still room for that streamlined and integrated experience.

← PreviousPage 2 of 23Next →