mnahkies

8 ms·

61.
by mnahkies 10mo ago
I've moved to storing my keys in my password manager, using it as an ssh agent. Means clicking authorize a bit, but also means I'm running a command I'm expecting to use a key then being prompted to authorize (and if it ever
62.
by mnahkies 10mo ago
I'd hate this, slack is an extension of my memory and it being long lived and searchable can be a super power - you don't have to remember all the details of everything, just enough of the who, what, when to find the rest.
63.
Distributed ID formats are architectural commitments, not just data types(piljoong.dev)
38 points by mnahkies 10mo ago|9 comments
64.
by mnahkies 10mo ago
I'd be interested to see a comparison with https://piscinajs.dev/ - does this achieve more efficient data passing for example? Lack of easy shared memory has always felt like a problem to me in this space, as often the
65.
by mnahkies 11mo ago
I think backwards compatibility is desirable, but really the bigger problem is the way that stores like steam essentially force auto updates. If you could pick the time to update, after you've read the patch notes and/or waited fo
66.
by mnahkies 1y ago
Tbf the new trusted publishers goes a long way to improving this (not used by this package by the look of it). I migrated a few of my packages to it, and now: - publishing with an API token is forbidden, must use the specified workflow w&#x
67.
by mnahkies 1y ago
They do seem to leave otherwise useless comments for itself. Eg: on the level of // Return the result return result; I find this quite frustrating when reading/reviewing code generated by AI, but have started to appreciate th
68.
by mnahkies 1y ago
My work laptop (Mac) needed an OS upgrade recently, top of the release notes was "added 8 emojis" - what? Why is this an OS level feature worth calling out
69.
by mnahkies 1y ago
Sorry I worded that poorly - I was trying to make the point that citizens prove their right to work using passport/birth certificate, and until recently visa holders used a physical BRP, and now a digital system (which oddly enough use
70.
by mnahkies 1y ago
The nuance is that you can have a NI number, then have your visa lapse for whatever reason - you still have the NI number. Hence the requirement to prove your right to work through another means. Previously you could use proof of British na
71.
by mnahkies 1y ago
On the ReDos aspect, I find the current CVSS rating system lacking. Availability is important, but following secure coding principles (fail closed) I'd much rather my system go down than have integrity/confidentiality compromised.
72.
by mnahkies 1y ago
I agree but there's a bit of nuance here. Today scanning steps typically happen post install, which is wild but the status quo. Therefore preventing anything from running during install is desirable. I'd like to see the ability to
73.
by mnahkies 1y ago
We have a terraform monorepo with many small workspaces (ie: state files). The amount of disk space used by the .terraform directories on a fully inited clone is wild
74.
by mnahkies 1y ago
Eh we got confused implementing this today. Basically we severed connection to the public npm registry completely earlier in the week whilst this worm plays out. Unfortunately there wasn't a way to do this without taking our cached &qu
75.
by mnahkies 1y ago
Completely agree tbh, and that would be one of my preferred approaches should npm be the actor to implement a solution. I also think it makes sense for GitHub to implement the ability to mark a workflow as sensitive and requiring "sudo
76.
by mnahkies 1y ago
I think the point around incorporating MFA into the automated publishing flow isn't getting enough attention. I've got no problem with doing an MFA prompt to confirm publish by a CI workflow - but last I looked this was a convolut
77.
by mnahkies 1y ago
> Really wish the norm was that companies hosted their own registries for their own usage Is this not the norm? I've never worked anywhere that didn't use/host their own registry - both for hosting private packages, but al
78.
by mnahkies 1y ago
Another advantage of this would be for CI/CD - MFA can be a pain for this. If I could have a publish token / oidc Auth in CI that required an additional manual approve in the web UI before it was actually published I could imagine
79.
by mnahkies 1y ago
> make complexity manageable: strict isolation between components, explicit timing constraints, and simple, well-defined interfaces. Maybe I'm missing something, but those simple well defined interfaces are the types? I've work
80.
by mnahkies 1y ago
For me the issue is at work with 16gb of ram, I'm basically always running into swap and having things grind to a halt. My personal workstation has 64gb and the only time I experience issues is when something's leaking memory
81.
by mnahkies 1y ago
I'm a relative layman in this area, but from my understanding, fundamentally there has to be some trust somewhere, and I think confidential computing aims to provide a way to both distribute that trust (split the responsibility between
82.
by mnahkies 1y ago
The slides were an interesting read, I'd enjoy seeing the talk if it was recorded. They finish mentioning in "2023" though, we're in the back half of 2025 now - has anything changed significantly in the past couple of ye
83.
by mnahkies 1y ago
I saw what I thought was a nice talk a couple of years ago at fosdem introducing the topic https://archive.fosdem.org/2024/schedule/event/fosdem-2024-1... Even when running on bare metal I think the concept o
84.
by mnahkies 1y ago
+1 - I used GOG for the first time the other week to get a copy of Morrowind so I could see how https://openmw.org/ was these days, and it was a really good experience. I did have to use some obscure tool to extract it bein
85.
by mnahkies 1y ago
We were talking about standup last week, and someone commented that we sometimes get a bit off track / into the weeds. My response was that I'd much prefer we did this (talk about the surprises we're facing, or some interesti
86.
by mnahkies 1y ago
I've wondered this as well - it would sure be nice if there was a standard --completion or something that common argument parsing libraries could automatically implement for us (much like they often implement automatic help text)
87.
by mnahkies 1y ago
As another commentator said, temporal is quite tricky to self host/scale in a cost effective manner. This is also reflected in their cloud pricing (which should've been the warning sign to us tbh) Overall it's a pretty heavy&
88.
by mnahkies 1y ago
A basic way to head off most of the security issues is throwing it behind a VPN (eg: wireguard) - no need to put stuff on the public internet if it's just for your own consumption. You can still include your mobile devices etc. Separat
89.
by mnahkies 1y ago
Ha, I got that same book from the public library in my early teens. I never completed it at the time either, though it created a foundation that enabled me to learn action script (Adobe flash) with relative ease and ultimately go on to comp
90.
by mnahkies 1y ago
Related https://github.com/microsoft/TypeScript/issues/54925 My specific use case is pattern matching http status codes to an expected response type, and today I'm able to work around it with this kind o

More ›