eranation

7 ms·

61.
by eranation 4mo ago
<3
62.
by eranation 4mo ago
Thank you so much for writing this!
63.
by eranation 4mo ago
Just skimmed it. But I think all math / physics concepts should be taught like this. Thank you for doing this. Ok, after a few steps, it feels a bit like the meme of how to draw an owl :) (eg some steps are left to be desired, especial
64.
by eranation 4mo ago
Thanks for using it and thanks for the feedback! Would you mind opening an issue here with the steps you did (including OS / method of installing) I’ll do my best to fix it. https://github.com/arnica/depsguard&#x2F
65.
by eranation 4mo ago
Exactly.
66.
by eranation 4mo ago
It's a tradeoff, and I don't have hard data, but the cases where a reachable, exploitable, zero day CVE that requires an urgent immediate patch (usually unintentional vulnerability) vs complete dev machine / CI/CD takeov
67.
Show HN: DepsGuard – One command to harden NPM/pnpm/yarn/bun/uv configs(github.com)
40 points by eranation 4mo ago|7 comments
68.
by eranation 4mo ago
I don't agree that nobody is adopting them. Can you please elaborate? - Most companies I know have a 24 hours (at least) cooldown via their Artifactory / Nexus. They have ways to bypass it for urgent CVEs - pnpm just adopted 24 ho
69.
by eranation 4mo ago
That group of people is the loosely affiliated people called "vibe coders". Even to get them to install depsguard is a challenge. I just ask them to point Claude to depsguard or cooldowns and follow the instructions (to save the t
70.
by eranation 4mo ago
In most cases yes, but really depends on which package manager and what command, if you use npm ci, it uses the package-lock.json values, if you use npm install, it can use any levels of freedom in the package.json. So if you lock package.j
71.
by eranation 4mo ago
I wish that was the case. Asking people to do something simple, doesn't matter how simple it is, depends on how simple they view it. Changing your own car's oil is actually not that hard, once you know how to do it, most people do
72.
by eranation 4mo ago
Hope it's ok I hijack this thread again about setting up cooldowns... (copy pasting my last comment when tanstack was compromised): I know people have opinions about cooldowns, but they would have saved you from axios, tanstack, (+ @re
73.
by eranation 5mo ago
Love it. One nitpick. >npm config set registry https://npm.internal >Pointing npm to the company's internal registry mirror as required by onboarding docs It claimed this is safe and I was 50/50 on it but eventua
74.
by eranation 5mo ago
So infuriating. Seems there is a gofundme link deep in there. I hope this gets him and his family back what he deserves + lawyer fees so he can get justice. Someone needs to do a movie about this. If anyone from Disney or Lego is here, thi
75.
by eranation 5mo ago
Sad to hear. I was at AWS between 2016 and 2021 and had a much different experience. Side note, and unpopular opinion ahead: while it takes a lot of courage to write things like this and I respect it, but being fired and writing negatively
76.
by eranation 5mo ago
You don’t really intentionally build a skynet, a skynet builds itself.
77.
by eranation 5mo ago
I’ve been on and off and on the bandwagon on this. My current verdict. When used properly, and if you actually read the code, pushback when needed and don’t get approval fatigue, and also practice hand coding here and there, you can definit
78.
by eranation 5mo ago
What do you mean? it's a local config in your .npmrc (min-release-age=days or minimum-release-age=minutes for pnpm compatibility, although pnpm has 1 day by default if you have the latest...)
79.
Ask HN: Why aren't more people worried about AI impersonation in code reviews?
2 points by eranation 5mo ago|1 comments
80.
by eranation 5mo ago
Yeah, I mean, there are companies out there, that (for the goodness of heart or marketing or both, and I prefer if they did it for marketing because that would make it sustainable) who drink the milk as soon as it hits the shelf, and immedi
81.
by eranation 5mo ago
I really appreciate your reply, and no apology needed! And all in all I am taking this as a lesson in: - editing comments more transparently - err on always disclosing vs not Thanks again for the reply. <3
82.
by eranation 5mo ago
I’m sure you mean well but I re-added it and kept it :) (It was re-added inline, right after the link. It says “I’m the maintainer”. I never re-removed it). I shouldn’t have removed it in the first place, and I re-added it right when someon
83.
by eranation 5mo ago
There are some companies that specialize in detecting those, they do it for free (and get lots of marketing for it…)
84.
by eranation 5mo ago
These get detected almost immediately, and removed by npm within hours (axios, tanstack at least)
85.
by eranation 5mo ago
I agree, but in most recent cases a 1 day cooldown would have been enough. I added a “how to bypass if you have to patch a zero day CVE” section to depsguard for all supported package managers.
86.
by eranation 5mo ago
Interesting idea, but there are so many cases of solo maintainers. I think that npm can have its own cooldown and automated security scan. Socket.dev, StepSecurity both close a gap here by spending tokens to scan new popular packages. Wheth
87.
by eranation 5mo ago
More akin to letting astronauts stay in quarantine for a day in case they caught space bugs. If every other week I would notice the FDA recalls a popular brand that would have taken over my brain and transmit my bank password and SSN to a s
88.
by eranation 5mo ago
Yikes. You are correct. Honest truth, I got a few downvotes (after a few more upvotes), thought this was the cause, but you’re right. Didn’t think that it matters much, I’ll add it back. Had no idea anyone noticed. Fair enough, thanks for k
89.
by eranation 5mo ago
I know people have opinions about cooldowns, but they would have saved you from axios, tanstack, and many other recent npm supply chain attacks. If you have Artifactory / Nexus, you probably already have cooldowns, but it's easy t
90.
by eranation 5mo ago
I signed, but let’s be honest. A pie chart showing the times I used the wayback machine to read an old NYT article vs the times I visited it due to a highly upvoted top HN comment linking to a relatively new article so we all can bypass the

More ›