eranation

8 ms·

91.
by eranation 5mo ago
I used to write code by hand. I still do, but I used to, too.
92.
by eranation 5mo ago
Like coding, if you get inspired by AI for a novel idea, and can reproduce the same result independently (could code the same thing by hand) or at least understand and check every single argument (self review your code, test on your machine
93.
by eranation 5mo ago
Two of these laws I see being violated repeatedly, but it’s not always as obvious as one would hope. Claude Code, Cursor, Codex etc impersonate your GitHub user. Either via CLI or MCP or using your git credentials. It’s perfectly reasonable
94.
by eranation 6mo ago
There are many problems we will need to address in the future. A programming language that is easy for machines to write but hard for humans to read isn’t one of them.
95.
by eranation 6mo ago
Yeah, I really wanted to avoid anything "| bash"... appreciate you noticed! (although downloading any binary is also risky, I think just making this a standalone python script would be a better idea for the next version)
96.
by eranation 6mo ago
Just spent 20 minutes of my life, I don't want them back, was worth every second.
97.
by eranation 6mo ago
Very beautiful, and very sad.
98.
by eranation 6mo ago
So, silly question, does this mean I will be able to get OpenAI models via Bedrock soon?
99.
by eranation 6mo ago
Nope but that’s a good idea
100.
by eranation 6mo ago
Yes but it has nothing to do with the language, and everything to do with the ecosystem (npm tried to make thing such as mandatory MFA etc, npmjs is so big maintainers pushed back) TypeScript on its own is a great language, with a very inte
101.
by eranation 6mo ago
Yep yep, hence the ask, expected for containers, wondering if also for build from source.
102.
by eranation 6mo ago
It is! It’s a tough problem to balance. The good news is that you can always override for specific cases. Linking to my other reply here: https://news.ycombinator.com/item?id=47880149
103.
by eranation 6mo ago
It's a hard decision, I would say a cooldown by default in the last few months would have prevented more attacks than not upgrading to the latest version due to an immediate RCE, zero-click, EPSS 100%, CVSS 10.0, KEV mentioned Zero Day
104.
by eranation 6mo ago
Well, luckily, those who find the malicious activity are usually companies who do this proactively (for the good of the community, and understandably also for marketing). There are several who seem to be trying to be the first to announce,
105.
by eranation 6mo ago
Yep, depsguard has support for renovate and dependabot cooldown settings too.
106.
by eranation 6mo ago
Build from source is a great idea, I assume you provide SLSA/sigstore like provenance as well?
107.
by eranation 6mo ago
Yep! depsguard sets trustPolicy: "no-downgrade" where applicable.
108.
by eranation 6mo ago
Yep, that's the main argument against cooldowns, but there are ways to override them. I'll update the docs soon.
109.
by eranation 6mo ago
I agree, even without project glasswing (that Microsoft is part of) even with cheaper models, and Microsoft's compute (Azure, OpenAI collaboration), it makes no sense that private companies needs to scan new package releases and find m
110.
by eranation 6mo ago
How to prevent it? tl;dr - https://cooldowns.dev - https://depsguard.com (disclaimer: I maintain the 2nd one, if I knew of the first, I wouldn't have released it, just didn't find something at that time, th
111.
by eranation 6mo ago
Love it, I'll link to it!
112.
by eranation 6mo ago
Anyone know of a better way to protect yourself than setting a min release age on npm/pnpm/yarn/bun/uv (and anything else that supports it)? Setting min-release-age=7 in .npmrc (needs npm 11.10+) would have protected the
113.
by eranation 6mo ago
Exactly this. For anyone who wants to do it for various package managers: ~/.npmrc: min-release-age=7 (npm 11.10+) ~/Library/Preferences/pnpm/rc: minimum-release-age=10080 (minutes) ~/.bunfig.to
114.
by eranation 6mo ago
I echo your recommendation.
115.
by eranation 6mo ago
I chuckled, but in all seriousness, thankfully those individuals and companies who often discover these attacks listen in on every new npm push and analyze it relatively fast. The time to detect is sometimes in minutes in recent months, les
116.
by eranation 6mo ago
They used a GitHub action with a floating tag (I guess @latest or non SHA pinned e.g. @v4) that I’m assuming in turn had its latest version bringing latest axios. That GitHub action used to sign their Mac apps. So they assume the certificat
117.
by eranation 6mo ago
I believe you understand correctly. And yes, it’s both a bad practice and shifting blame. But it’s not an uncommon practice sadly. They mention it toward the end: > The root cause of this incident was a misconfiguration in the GitHub Act
118.
by eranation 6mo ago
You can add your own wrapper but if you're building a whole auth/retry/logging layer, axios is probably better for that. For most other use cases a small wrapper will do the job. Didn't mean it as an ad btw, the supply c
119.
by eranation 6mo ago
As others said, no one should be using axios in 2026, fetch has been available in node v18 (experimental) in 2022 [0], stable since v21 in 2023 [1], although Claude Code sometimes will suggest it, probably worth adding a rule. Side note. I&
120.
by eranation 6mo ago
Good list. Missing for me - NIH - GIGO - Rule of 3

More ›