woodruffw

5 ms·

61.
by woodruffw 3mo ago
RubyGems actually adopted Trusted Publishing before both npm and crates.io. To my recollection, they were second after PyPI. (I have no opinion about the overall security posture of these indices.)
62.
by woodruffw 3mo ago
That would be extremely surprising, given the number and severity of federal crimes involved. (I also dare say: many of these attackers demonstrate a better in-depth understanding of packaging ecosystems than supply chain security vendors d
63.
by woodruffw 3mo ago
Defense in depth is the “meat and potatoes” of security. In other words: people should be auditing their software, but we should also design systems and schemes that provide varying degrees of defense and protection when people invariably
64.
by woodruffw 3mo ago
Yep. This post is really old, I probably broke the CSS for these older posts a long time ago and never noticed it. I can try and fix it later today.
65.
by woodruffw 3mo ago
It’s funny to see this on HN. I wrote this 11 years ago as an undergraduate. The afternotes at the end of the post are worth reading; people have sent me various qualifications and corrections over the years.
66.
by woodruffw 3mo ago
Sure, I don't disagree. It's just not clear to me that developers actually index that heavily on hot reloading to begin with.
67.
by woodruffw 3mo ago
Rust has an incremental compiler. And TMU SwiftUI’s live preview is essentially a very rough approximation of what the actual build would produce; it’s not a suitable replacement for a real build when developing a non-trivial UI.
68.
by woodruffw 3mo ago
Yeah, I mean more for the iteration half -- YMMV, but I find that I make the LLMs most productive when I have them design the typestates first, ensure they compile, and then work on tests after that (rather than stacking tests through the p
69.
by woodruffw 3mo ago
Is it? An immense amount of the world’s graphical software is written for native graphical targets like SwiftUI, where the iteration cycle is similarly bound to build times. It’s certainly painful, but I don’t think it’s a non-starter.
70.
by woodruffw 3mo ago
You probably already know this, but I figure it bears repeating: most people should be running `cargo check` during development, not `cargo build`. The latter is only necessary when you actually need the built binary; the former is sufficie
71.
by woodruffw 3mo ago
Anecdotally: I disabled Zed’s AI features, but I use LLMs more extensively than ever outside of my IDE. So the numbers may not paint a clear story here.
72.
by woodruffw 3mo ago
Is there a categorical division between “library builders” and “ordinary code”? That’s not one I’ve heard before. (I’m aware of the difference between application and library code, but every large codebase I’ve ever worked in is a mixture o
73.
by woodruffw 3mo ago
I don’t think that’s a parsimonious explanation in a post-COVID world. It seems equally if not more likely that talent is more distributed, and people find fewer reasons to relocate into the Bay Area (in terms of career progression, etc.) (
74.
by woodruffw 3mo ago
For me, honestly not much.
75.
by woodruffw 3mo ago
WDYM by madness? I know what the flag is (and what it does), but people have strong opinions in opposite directions about what Python packaging should do around system environments.
76.
by woodruffw 3mo ago
It’s widely used, and there are still a lot of workflows that we hear about from users where they want/need to manually twiddle environments rather than having the “declarative” layer do it for them.
77.
by woodruffw 3mo ago
This is our first breaking release since March. We’re happy to answer any questions folks have about it.
78.
by woodruffw 3mo ago
Interesting that there’s no primary evidence. But your point about importing heavy material is mislaid: the blocks are intentionally heavy, because they (apocryphally) served as ballast.
79.
by woodruffw 3mo ago
You’re probably referring to the Oven of Akhnai: https://voices.sefaria.org/sheets/144163?lang=bi (Talmudic interpretation doesn’t stress this story because it shows how much Jews love to argue, or because they can win
80.
by woodruffw 3mo ago
That wasn't clear to me :-). But even still: the eruv is a rabbinical interpretation, not something attributed to God.
81.
by woodruffw 3mo ago
It's happening for Actions security, at least. I don't know about their other services.
82.
by woodruffw 3mo ago
> PyPi and similar package managers should start publishing security warnings about the hosts of projects. That in turn can eventually lead to bans of packages from generally insecure places. Maybe if we start seeing 'WARNING: proje
83.
by woodruffw 3mo ago
GitHub's response time on malicious repositories is often lackluster. However, from conversations with folks at GitHub, my suspicion is that this is because they're being starved for resources, not incompetency or maliciousness. T
84.
by woodruffw 3mo ago
If you're referring to the Belgian blocks[1], I don't think they're actually from Belgium specifically, just Europe in general. Although some might be from Belgium! [1]: https://sohobroadway.org/soho-broadway-
85.
by woodruffw 3mo ago
You can look it up if you don’t believe me. Orthodox Judaism doesn’t have a supreme religious authority; it’s a general classification for ~hundreds of distinct sects and movements. (Each movement has its own beis din, but there is not “hig
86.
by woodruffw 3mo ago
AFAIK the eruvim are not dictated by “high courts” (there is no “high court” at all), but are instead constructed and maintained by various Orthodox groups. Not all Orthodox groups agree about their propriety either, so the presence of an e
87.
by woodruffw 3mo ago
> Religious infighting with 2 fundamentalist sects that somehow boiled down to some people digging a tunnel connecting 2 buildings because of... reasons? The very short version is that both groups claim ownership of that building, and on
88.
by woodruffw 3mo ago
Python uses PEP 440 versioning, which isn’t semver. Semver is de facto common, however, and can be expressed as a subset of PEP 440. I’m not sure what you mean by “change in dependencies”: every release has zero or more distributions (“fi
89.
by woodruffw 3mo ago
There are a lot of misconceptions here: 1. “Wheel” signatures (e.g. RECORD.jws) were specified but never actually implemented in any major packaging installer, to the best of my knowledge. In that sense it’s not really meaningful to ask whe
90.
by woodruffw 3mo ago
It doesn’t. It’s really only relevant if you use version-specific APIs/ABIs in wheels containing machine code. Pure Python wheels don’t generally need this.

More ›