here’s a fun fact - the vast majority of the conspiracy theorists are still very wrong even when they get it right that said, they should probably be buying lottery tickets, because wtaf

me at 17: a secret conspiracy of billionaires shapes global events me at 35: class interest creates emergent outcomes and aligned behavior, but there’s no smoky room where plutocrats plot to shape global events me at 41: a secret conspiracy of billionaire perverts shapes global events

You can test new tech ideas using the Seinfeld Test Would the product eliminate the plot of an episode? (Google maps, cell phones, paypal, battery packs) Good tech. Would the product inspire new Seinfeld plots? (NFTs, AI chatbots, crypto currency, blindboxes, metaverse land sales) Bad tech.

"Security work is emotionally expensive and invisible, and sharing it makes it sustainable." - @ulisesgascon.com Many thanks to @jddalton.bsky.social, @jordan.har.band, and @ulisesgascon.com for their insights on maintaining Lodash and all the hard work put into reviving the project. 💚

2006: Less is more, don’t repeat yourself 2016: Beautiful code prevents technical debt 2026: trillions of lines of generated spaghetti code that generate other spaghetti code will save us

nvm.sh users: please upgrade to github.com/nvm-sh/nvm/r... if you're using `wget` on your system, to fix a medium vulnerability (github.com/nvm-sh/nvm/s...).

@marthawells.com is there any way i can preorder the _paperback_ for murderbot 8? it's the only format i like but i don't want to have to wait forever to get in line

oof, is timercap dead? it was such a useful product

formats over apps

I made a new thing! like the semver package, but for PURLs: www.npmjs.com/package/purl `npx purl $specifier` or `npx purl $purl` will validate, normalize, and provide parse info. add `--check` & it'll contact the relevant registry & verify the package and version exist (you can import it too)

I made something new: an eslint plugin to validate your npm ecosystem lockfiles! It supports npm, pnpm, yarn, bun, and vlt, and it's already helped find a supply chain security attack vector inside a fortune 500 tech company. www.npmjs.com/package/esli...

ran into my first webpage using developer.mozilla.org/en-US/docs/W... today, and i do NOT like it

having to `npm login` for the first time in a decade, and then promptly 2FA *again* to publish, is immediately very annoying, multiple times a day :-(

wow, literally never seen the "settle down, buddy" page before on @github.com guess it's time to take a break

“You shouldn’t care if JavaScript builtins are modified, just let things break when someone does dumb things!” enter react2shell.com

It is beyond frustrating to be in a position to see this coming, trying to do the work to make folks aware of it, and then also to be on the incident response to the impact of it happening again. Y'all I am tired.

ECMAScript excitement 😉 Congrats to @bridgear.bsky.social @jordan.har.band on advancing Object.keysLength to Stage 2 at TC39 today 🎉 let count = Object.keysLength(o) It counts the string-keyed own properties on an object. This avoids the cost of the intermediate array in Object.keys(o).length

Guess where the elevator is? The intentionally functional and elegant design of things i find in Japan is always impressive.

With npm supply chain attacks on the rise, secure publishing practices are becoming a pressing concern for anyone maintaining npm packages. ⚠️ We've released updated guidance to help maintainers reduce exposure, strengthen release processes, and protect the ecosystem: openjsf.org/blog/publish...

My welcome to Kyoto meal, and the resident kitty’s too

welcome to bluesky. if the word "mapquest" means anything to you and/or you used it as a verb, you're in the right place

Guide: what body part does that look like? Group, collectively: … um Guide: Buddha’s finger! Group, guiltily: ahhhhhh, yes (Hang Sửng Sốt / Surprising Cave, Ha Long Bay, Vietnam) (the surprise is the size of the 2nd and 3rd caverns, you pervs)

My first advice to junior contributors is to STOP using vibe coding for PRs. OSS is always about people more than about code. We don't need more code generated by LLM, we need more people who care.

God, just once I wish someone would remember the second half of that idiom about bad apples

Excited to announce I've joined @socket.dev as an Open Source Architect :-)

OH at @github.com Universe day 0, in a session on “beyond the bus factor”, discussing accidental leadership: “you didn’t choose the maintainer life…”

I left @hero.dev earlier this month. It's a wonderful thing to be able to truthfully say it's the best job I've ever had (not even the first time I've gotten to say that!). I love the entire team & the culture… leaving is bittersweet. I'll announce my new gig in a week or three.

The future of Lodash fosstodon.org/@ulisesgascon blog.ulisesgascon.com/the-future-o... #ECMAScript #JavaScript

Lodash still runs half the web and now it’s getting the love it deserves. 🥹 ICYMI: Thanks to investment from the @sovereign.tech, Lodash is moving into community governance and long-term sustainability. Read up: 🧠 blog.ulisesgascon.com/the-future-o... 🏛️ openjsf.org/blog/sta-inv...

This is correct. It’s VCs who spend their time doing drugs and inventing weird religions, executives who have boners about firing workers, and non-technical hucksters who are pushing this stuff. The vast majority of people doing actual technical work on the ground feel the way this piece describes

i’m starting to get that “this word is weird now” feeling from hearing so many sentences like “releasers releasing releases” at the @nodejs.org collab summit

PSA: if you’re giving a talk with a terminal or code demo, use light mode (or at least high contrast mode) so we can all see it :-)

the funniest thing about this is that those of us who grew up in the divide all have a bunch of pre-cell phone numbers memorized and almost none afterwards I know the home phone numbers of two of my childhood best friends from thirty years ago and none of the cell numbers of my college friends

Don’t worry, this is going to involve dropping lots of no-longer-needed APIs :-D

Lodash is entering a new chapter 📖 With investment from @sovereign.tech the project is getting key updates for security, modernization, and community-led governance. Details: hubs.la/Q03NrdfR0

⚡️ All set up for #JSConf ! Stop by to talk with the @vlt.sh team if you’re around!

😅👀💦

to everyone asking foss maintainers to finally publish a new version: as a teenager, have you ever been asked by someone to clean your room after you decided to do it yourself? 😇

Why are @github.com tokens allowed to have no expiry but @npmjs.bsky.social are about to make every IT team's lives a living hell? This is just more security theatre. Think harder @microsoft.com.

A cruel irony of coding agents is that everyone who blew off automated testing for the past 20 years is now telling the AI to do TDD all the time. But because LLMs were trained on decades of their shitty tests, the agents are also terrible at testing.

> It is 2025 BC. I am a soldier from one of the outlying provinces called to defend the pyramid in Memphis > It is 2025 AD. I am a soldier from one of the outlying provinces called to defend the pyramid in Memphis

As economic growth continues to falter, the civic council of Omelas debates adding a third child

i wish there was a socially acceptable, polite way to let an old person know they’ve drastically overused their perfume/cologne.

IBM has chosen HeroDevs to secure enterprises running on EOL frameworks like Spring & Struts. Now IBM customers can run legacy apps securely, with drop-in fixes + compliance coverage—modernizing on their terms. Learn more: www.herodevs.com/blog-posts/w... #IBM #HeroDevs #EOL #Cybersecurity

The maintainer of one of our dependencies, debug, was the target of a phishing attack resulting in the release of [email protected] with malware. Supply chain security is all of our responsibilities. Be careful out there, and for today don't update your deps. socket.dev/blog/npm-aut...

The Register wrote a story about a single maintainer open source project, I think it's shameful and upsetting So I wrote a blog post about it An absolutely ridiculous amount of open source is one person projects. I have the data to prove it opensourcesecurity.io/2025/08-oss-...

can't believe i only just encountered this article today www.redhat.com/en/blog/dont... "Don't Lick the Cookie!", for example, don't assign issues in open source :-)

🦈 my 6 year old’s “shark teeth”