abhisek

11 ms·

61.
Ask HN: HN: Why do we code review?
2 points by abhisek 1y ago|2 comments
62.
The PostgreSQL Locking Trap That Killed Our Production API (and How We Fixed It)(root.sigsegv.in)
2 points by abhisek 1y ago|0 comments
63.
Show HN: Xbom – Generate AI and SaaS-Aware SBOMs from Code Using Static Analysis(github.com)
3 points by abhisek 1y ago|0 comments
64.
by abhisek 1y ago
Vibe “migrated” our docs portal to another framework the other day. Looked awesome. Only when I decided to do a quick review before switchover did I found all subtle hallucinations. Not sure what would be faster. Manually reviewing and fixi
65.
Vet MCP: Software Composition Analysis for AI Code Editors(github.com)
1 points by abhisek 1y ago|0 comments
66.
by abhisek 1y ago
Seems like a bit forced scenario to me. I have never seen anyone auto-merge Dependabot PR automatically using GitHub Action. Also pull_request_target is a big red flag in any GHA and even highlighted in GHA docs. It’s like running untrusted
67.
Catching the Silent Threat: How Dynamic Analysis Revealed an NPM Attack Chain(safedep.io)
2 points by abhisek 1y ago|0 comments
68.
by abhisek 1y ago
Hmm. Not sure if discovery and connection will solve the root cause of the problem that you highlighted. I think it’s more to do with dopamine rush from social media and decreasing ability for people to people IRL connection.
69.
by abhisek 1y ago
Tried playing with SDR a while back. Back then, biggest challenge was to find an appropriate hardware that can receive at various frequencies and also compatible with my Linux box.
70.
Kubernetes Limits Links to Third Party Projects(github.com)
2 points by abhisek 1y ago|0 comments
71.
by abhisek 1y ago
I am really looking forward to “version bumps” without breaking the dependency tree at the very least, something which Dependabot almost gets right. From a security use-case perspective, it will be great if it can bump libs that fixes most
72.
by abhisek 1y ago
The closest I can think of is Devise for Ruby on Rails ecosystem. While these solution provides great developer experience to get started, IMHO there are solid reasons to have separate identity providers like Auth0 or if you like to self-ho
73.
by abhisek 1y ago
Not sure about the impact of WSL because personally did not use it but I do know couple of friends who stopped spinning up Kali VM because of WSL.
74.
by abhisek 1y ago
What’s the long term goal of this project beyond learning? Building a browser to support the modern web is a humongous work IMHO.
75.
by abhisek 1y ago
I think it’s a trade off between depth and breadth. Thinking is hard and painful. But the insights achieved through deep thinking IMHO is worth because of the mental models that we develop. Not just how it compares now with an LLM generated
76.
by abhisek 1y ago
This is poor design. Multi-tenant data model design must have a tenant or segment ID for every tenant segmented tables. While it may not be a problem initially but as the business grows, you may need to move tenant data to separate DBs or e
77.
Sneaky Malware Hidden in Transitive Dependency of ESLint-config-Airbnb-compat(root.sigsegv.in)
3 points by abhisek 1y ago|0 comments
78.
by abhisek 1y ago
I think getting the initial domain modeling, structure and opinions that build up a code base is more of an art than science. It’s highly opinionated. Sure you have SOLID but in my experience no one follows it to the book. Once the code bas
79.
PMG: Wraps Package Managers to Prevent Installation of Malicious OSS Packages(github.com)
6 points by abhisek 1y ago|0 comments
80.
by abhisek 1y ago
Build in public really. Just talk about what we are building, get feedback, bug reports etc. from users. When major security issues happen related to our domain e.g. xz or tj-actions/changed-files, we either write about how our tool ca
81.
by abhisek 1y ago
We felt that OSV schema is designed with security tooling and automation as primary design goal. Specifically for our use-case, it captures the package name and versions using standardised schema. Also we saw adoption of OSV by package ecos
82.
by abhisek 1y ago
Not sure if it’s relevant because you specifically mentioned about B2C. For cyber security product, we took the open source route. We build our core technology in public as open source project. https://github.com/safedep&#x2
83.
by abhisek 1y ago
This solves the problem of provenance and possibly build integrity. Given an artifact, it will allow identifying exact source from which each components are built. But it still implicitly assumes that the source is secure and trusted. This
84.
by abhisek 1y ago
> AI gives us speed. Talent gives us empathy Not sure if this is the primary reason. It just seems to me their AI adoption was unable to meet the baseline effectiveness of their human agents.
85.
Why Build Software Frameworks(root.sigsegv.in)
2 points by abhisek 1y ago|0 comments
86.
by abhisek 1y ago
Wow. Reminds of the old BBS era.
87.
by abhisek 1y ago
Totally agree. Micro services unnecessarily makes thing complicated for small teams. IMHO it solves the problem of velocity ONLY when a large engineering team is slowed down due to too much release & cross cutting dependencies on a mono
88.
by abhisek 1y ago
GitHub Actions by default provide isolated VM with root privilege to a workflow. Don’t think job level privilege isolation is in its threat model currently. Although it does allow job level scopes for the default GitHub token. Also the secr
89.
by abhisek 1y ago
How will you define a good PM? I have been looking for this definition for a while. In my startup experience, it seems to me the best PMs are the CTO and the early engineers who has near infinite business and user context.
90.
by abhisek 1y ago
So true. I have tried building from scratch so many times for specific use-cases with my own opinionated experience only to recreate the bloat over time. That’s actually good. The alternative was building something based on momentary spark

More ›