lol why would Glendale Community College have any info about me whatsoever??? I've never attended, applied, lived near it, or been to Glendale. this is the most confusing @haveibeenpwned.com email i've gotten yet

npm v12 is now generally available. npm install now makes install scripts, Git, and remote-URL dependencies opt-in by default. We're also retiring npm 2FA-bypass GAT: no account management (early Aug 2026), no direct publishing (~Jan 2027). More info at github.blog/changelog/20...

You shouldn’t trust Trusted Publishing https://blog.yossarian.net/2026/07/07/You-shouldnt-trust-trusted-publishing #python #security #oss

can someone please tell *every bank* that if a "secure messaging system" goes to my email address, then it's basically not possible for it to be more secure than my email account itself?

Aesop: I TOLD YOU

please be student patient driver

@tantek.com.web.brid.gy (ง’̀-‘́)ง

I got really tired of having to manually track down whether a package ships its own types, or has a DefinitelyTyped package, or how that changes over time. so, I made npmjs.com/dt-clean - `npx dt-clean -u` and you'll have the right version of the right DT packages!

ok i know i'm a couple months late, but wtaf is this new "Marathon" game? it seems like it has precisely nothing to do with actual Marathon lore, and is just a (potentially fun but) entirely unrelated game with the title slapped on top.

it is oddly satisfying watching ferrier content on the reels

nvm.sh v0.40.5 is out, with some CVE fixes: github.com/nvm-sh/nvm/r... Be sure to update!

what happened to the kiki bouba labeler??

oh no, i don't use the ai for <thing that i am paid to do> it's terrible at that. it's great for <thing you are paid to do> though.

Today is a big day for @socket.dev. We raised a $60M Series C at a $1B valuation, led by Thrive Capital. 20,000+ orgs, 1.5M repos protected, 1,000+ supply chain attacks blocked per week. 3/5 FAANG companies are customers. We're just getting started.

Clutching pearls about how many PURLs are in your application is just FUD and nonsense. The only thing that matters is, how many humans can put code into it. (ie all your engineers + every linux dev + every OSS maintainer etc)

PSA: add `export GH_TELEMETRY=false` and `export DO_NOT_TRACK=true` to your shell profile files to opt out of @github.com's on-by-default `gh` telemetry.

oof, who do i complain to about the name of git 2.54's "history" command? git does not have a history, it has a changelog, and the conceptual difference is very important for having the proper mental model :-(

I was pretty happy with my surroundings while discussing supply chain security today.

The thing people may not realize is that the best way to secure the supply chain is to secure the maintainers. And the best way to secure the maintainers is to pay them and give them a laptop, health insurance, and maybe even a desk to sit at.

so what i am learning from github.com/axios/axios/... is that you should simply never join a Microsoft Teams call for any reason --- because of security

🚨 New Investigation: Attackers are hunting the maintainers behind Lodash, Fastify, buffer, Pino, mocha, Express, and #Nodejs core, because compromising one of them means write access to packages downloaded billions of times a week. socket.dev/blog/attacke...

tldr; if you used @vlt.sh as your package manager, then you were protected the minute @socket.dev flagged the malicious packages in the `axios` attack yesterday. The best time to switch your package manager was 48hrs ago, the next best time is right now. More below: blog.vlt.sh/blog/vlt-build

🧨 Axios only needed to be resolved somewhere in your dependency graph to affect you. Semver + transitive deps + runtime installs = hidden blast radius. If you only checked your project’s lockfile, you may still not know. socket.dev/blog/hidden-... #nodejs #javascript

ECMAScript Euphoria! 🎉 We don't always post when a single proposal advances, but when we do, it's Temporal -> Stage 4. Just days shy of 9 years from Stage 1, a herculean effort on the part of many champions, delegates, invited experts, and contributors, past and present. Thank you all! 🙌

ECMAScript excitement 😉 Congrats to @jordan.har.band on advancing Error.prototype.stack to Stage 2.7 at TC39 today 🎉 This proposal seeks to standardize the existence of the accessor in the JS spec. github.com/tc39/proposa...

did you know claude code has _weekly_ usage limits? i didn't

Finally found a plane with a device holder that can fit an iPad Pro

i hadn’t hit Claude’s limits once since upgrading to the 10x max plan, but it took me less than 24 hours to hit the limits on the free open source 20x max plan (－‸ლ)

Your mission, should you choose to accept it

minimatch patched 3 high-severity ReDoS vulnerabilities that can stall the Node.js event loop. Because it's pulled into nearly every corner of the #NodeJS ecosystem (~472M weekly downloads), we're releasing free Certified Patches for all three. socket.dev/blog/minimat... #JavaScript

We're excited to announce that Socket is joining the @openjsf.org! Proud to support the #JavaScript ecosystem alongside so many great projects and contributors. socket.dev/blog/socket-...

🎉 We’re thrilled to welcome @socket.dev as our newest Silver member. Socket is doing critical work to secure the JavaScript ecosystem by helping developers identify and prevent supply chain risks. We're excited to collaborate and make open source safer for everyone! 🛡️💻 openjsf.org/blog/socket-...

when you're publishing a CVE, please think about the good actor/bad actor cohorts (especially governments) that will be awake and responsive to deal with it to be clear, evening pacific time is a very poor choice.

here’s a fun fact - the vast majority of the conspiracy theorists are still very wrong even when they get it right that said, they should probably be buying lottery tickets, because wtaf

me at 17: a secret conspiracy of billionaires shapes global events me at 35: class interest creates emergent outcomes and aligned behavior, but there’s no smoky room where plutocrats plot to shape global events me at 41: a secret conspiracy of billionaire perverts shapes global events

You can test new tech ideas using the Seinfeld Test Would the product eliminate the plot of an episode? (Google maps, cell phones, paypal, battery packs) Good tech. Would the product inspire new Seinfeld plots? (NFTs, AI chatbots, crypto currency, blindboxes, metaverse land sales) Bad tech.

"Security work is emotionally expensive and invisible, and sharing it makes it sustainable." - @ulisesgascon.com Many thanks to @jddalton.bsky.social, @jordan.har.band, and @ulisesgascon.com for their insights on maintaining Lodash and all the hard work put into reviving the project. 💚

2006: Less is more, don’t repeat yourself 2016: Beautiful code prevents technical debt 2026: trillions of lines of generated spaghetti code that generate other spaghetti code will save us

nvm.sh users: please upgrade to github.com/nvm-sh/nvm/r... if you're using `wget` on your system, to fix a medium vulnerability (github.com/nvm-sh/nvm/s...).

@marthawells.com is there any way i can preorder the _paperback_ for murderbot 8? it's the only format i like but i don't want to have to wait forever to get in line

oof, is timercap dead? it was such a useful product

formats over apps

I made a new thing! like the semver package, but for PURLs: www.npmjs.com/package/purl `npx purl $specifier` or `npx purl $purl` will validate, normalize, and provide parse info. add `--check` & it'll contact the relevant registry & verify the package and version exist (you can import it too)

I made something new: an eslint plugin to validate your npm ecosystem lockfiles! It supports npm, pnpm, yarn, bun, and vlt, and it's already helped find a supply chain security attack vector inside a fortune 500 tech company. www.npmjs.com/package/esli...

ran into my first webpage using developer.mozilla.org/en-US/docs/W... today, and i do NOT like it

having to `npm login` for the first time in a decade, and then promptly 2FA *again* to publish, is immediately very annoying, multiple times a day :-(

wow, literally never seen the "settle down, buddy" page before on @github.com guess it's time to take a break

“You shouldn’t care if JavaScript builtins are modified, just let things break when someone does dumb things!” enter react2shell.com

It is beyond frustrating to be in a position to see this coming, trying to do the work to make folks aware of it, and then also to be on the incident response to the impact of it happening again. Y'all I am tired.

ECMAScript excitement 😉 Congrats to @bridgear.bsky.social @jordan.har.band on advancing Object.keysLength to Stage 2 at TC39 today 🎉 let count = Object.keysLength(o) It counts the string-keyed own properties on an object. This avoids the cost of the intermediate array in Object.keys(o).length