efortis

9 ms·

91.
by efortis 10mo ago
IDK. I usually notice it when it breaks the install
92.
by efortis 10mo ago
Yes, it can break deps, some will not install. Puppeteer is a good example because it installs binaries. But it also shows an error with the cmd needed to complete the installation. Why it is allowed by default? > it’s npm’s belief that
93.
by efortis 10mo ago
fs and net can be mitigated with `--permission` https://nodejs.org/api/permissions.html Regardless, it’s worth using `--ignore-scripts=true` because that’s the common vector these supply chain attacks target. Consider
94.
by efortis 10mo ago
Mitigate this attack vector by adding: ignore-scripts=true to your .npmrc https://blog.uxtly.com/getting-rid-of-npm-scripts
95.
by efortis 11mo ago
npm audit and npm audit --fix Or if you want to know the version of a package you have installed: npm ls some-pkg
96.
by efortis 11mo ago
Yes, if the malware is injected in the application code this doesn’t prevent it. But in some cases it could help for that. For instance, if the package runs in the browser and the payload requires file-system access, etc., then the attack c
97.
by efortis 11mo ago
Mitigate this attack vector by adding: ignore-scripts=true to your .npmrc https://blog.uxtly.com/getting-rid-of-npm-scripts
98.
by efortis 11mo ago
https://github.com/ericfortis/download-http-requests-browser...
99.
by efortis 11mo ago
If it's HTTP you can create the fixtures and serve them with a mock server. I'm a frontend dev, so backend APIs are like 3rd parties to me. I use a browser extension for scraping actual backend responses, which downloads them with
100.
by efortis 11mo ago
Although the OP created it for SSR, these libraries are handy for SPAs as well. Rendering the whole DOM tree (instead of VDOMs) is a fast process. The slow part is attaching (committing) elements to the doc. e.g., I have a test of 20,000 el
101.
by efortis 11mo ago
To me, Nginx. I remember seeing this file structure and saying: "ohh, that's how it should be done" src/os/win32/ngx_alloc.c src/os/unix/ngx_alloc.c --- A few years later I stumbled
102.
by efortis 11mo ago
Mockaton. An HTTP Mock Server with a dashboard UI for changing mock variants on the fly. For example, for testing retries. https://github.com/ericfortis/mockaton
103.
by efortis 11mo ago
What do you use Linux for?
104.
by efortis 11mo ago
I seldom use it, but for filtering https://hn.algolia.com does a good job. On the other hand, I wonder if there's some AI tool for tagging posts and building custom feeds.
105.
by efortis 11mo ago
> But it doesn't really matter. What's important here is that for the data fetching process to trigger, JavaScript needs to be downloaded, compiled, and executed. Not true. In SPAs, APIs can be prefetched before the JavaScript
106.
by efortis 1y ago
> Something hackable like … I've been thinking and experimenting with re-rendering the whole DOM[1]. I'm aware there are libraries for merging DOM trees, but I'm limiting the project to native APIs. I'm following Reac
107.
by efortis 1y ago
Thank you!
108.
by efortis 1y ago
If you don't mind, could you help me debug this issue by testing the direct link to the video: https://uxtly.com/media/intro-PFXcRizx7hGieOVj96nDdBRNEDo.mp...
109.
by efortis 1y ago
Thank you for checking it out. In the past it had an auto-layout and app mode, but I removed all the graphic and layout design features in favor of "Copy for AI". Your "Driving Game" mockup got me thinking about indicati
110.
by efortis 1y ago
~2008 a friend at a consulting co. showed me how they drafted UIs in Excel. Having seen that, in 2015 I began working on a UI drafting software for that kind of technical designers. We ended up getting rid of the layout thinking overhead wh
111.
by efortis 1y ago
If you liked that video you'll like this one too, which explains that mechanical and electrical parallel but in the other direction. Prof. Malcolm C. Smith had an electrical circuit and made its mechanical equivalent. His invention (th
112.
by efortis 1y ago
where can I follow you? blog, x?
113.
by efortis 1y ago
Show them this Ken Thompson paper of 1984: "Reflections on Trusting Trust" https://www.cs.cmu.edu/~rdriley/487/papers/Thompson_1984_Ref... And then hardware compromises… I don't mean install an
114.
by efortis 1y ago
I partially agree, but that does mitigate it. The report says the attacker injected a `postinstall` script, which is common. On the other hand, yes, an attack at code level, or a legit bug wouldn't be prevented.
115.
by efortis 1y ago
Yes, at the end of that blog there are two options for that: npm install --ignore-scripts=false package-i-trust Or, trigger the installation script: node node_modules/puppeteer/install.js
116.
by efortis 1y ago
React is fine, React Hooks isn't. It's cryptic, convoluted, and adds noise. Yes, both have overhead but they let you mutate refs when you need 120fps feedback. IMO, the best competitor is its legacy API. Want reactive shared state
117.
by efortis 1y ago
Mitigate it with: echo "ignore-scripts=true" >> ~/.npmrc https://blog.uxtly.com/getting-rid-of-npm-scripts
118.
by efortis 1y ago
me neither function coin_change(change) { const coins = [25, 10, 5, 1] for (const coin of coins) { const n = change / coin | 0 change -= n * coin console.log(coin, n) } } coin_change(25+10+5+1)
119.
by efortis 1y ago
Three tips: Record the interactions (you, and with test subjects too). You’ll see more things. Study competing UIs. Consciously reverse engineer their UIs. Don't know what you like but get the idea: - PhotoShop vs Gimp - Maya vs
120.
by efortis 1y ago
Given that post, this is what ChatGPT-5 said: "… But achieving AGI purely by scaling current architectures might not happen. The field may need conceptual shifts—new structures or paradigms—rather than just bigger models." I don’t

More ›