npmx.dev 🤍

Impulse buy

mood

I sometimes wonder how many "local" containerized services are accidentally exposed to the internet because of this. See also: docs.docker.com/engine/netwo...

A SUCCULENT MAINTENANCE DAY???

I just got one of the most poorly designed messages in a game ever.

I would kill or die for Larry

My precious.

The way is shut.

∧＿∧ （｡･ω･｡)つ━☆・*。 ⊂　　 ノ 　 　・hack゜+. しーＪ　　　°。+ *'¨) 　　　　　　　　.· '¸.·the*'¨) ¸.·*¨) 　　　　　　　　　(¸.·' planet(¸.·'*

I just realized it's called Silicon Valley because they do silly cons.

My PR isn’t a ”buggy mess”! It’s a postmodernist masterpiece, free from the shackles of authorial intent!

You and me both, buddy.

in retrospect we probably encouraged too many kids to be the change they wanted to see in the world

FINALLY - dashare.zone ADMIN

Did some optimizations today. Now it doesn't work AND it's very fast 🔥🔥🔥

We interrupt our regularly scheduled programming to bring you this important message.

Hm, github.com/facebook/react now redirects to github.com/react/react.

MOVE - dashare.zone ADMIN

Yesterday one of my HackerOne reports bounced, because the included PoC sent the HTTP payload to a demo server running on localhost. So the h1 analyst declared that it was "self-sabotage" and thus not valid. This took them a month. Ow my head.

I suspect this might be the best photo I ever take

Today in the work chat: “All tech debt is settled in death.” 🫡

Hey, psst: every line of code is still a liability. That part hasn't changed.

Playing the classics!

Is it just me, or do LLMs seem to love the word "shape"? "Shape of the problem." "Shape of the solution." Program architecture and data flow? "Code shape." Bug report structure? "Issue shape." One of those "once you see it, you can't unsee it" sort of shapes in life, I shappose.

Instead of doing more, let’s do better.

Whee! Published @badrap/valita v0.5.2 using both trusted & staged publishing just now insert party emoji here

Speeding up the JS ecosystem OXC edition 🚀 We made both oxfmt and oxlint 50% faster on projects with >50k directories. marvinh.dev/blog/speedin...

Deno’s FormData, URLSearchParams + Headers show O(n²) behavior in .set()/.delete() when many repeated keys are present. Example: FormData.delete("_") on ~1MB of _=&_=&_=&... Node: ~4ms Deno: ~74s Could turn otherwise reasonable cleanup of untrusted request data into a potential DoS vector. 1/3

7 months to go

More companies, governmental organizations and community projects should adopt the security.txt convention/proposal: securitytxt.org Making security contact discovery as easy as possible is good for everyone. Yes, even within the context of the recent AI vulnerability report slopocalypse.

Quadratic blowups are like the sun: stare at one long enough and you start seeing them everywhere. I’m very good at similes.

What if there was a man in the middle attack but the man in the middle was like, really chill. What if he was basically a chill guy who didn't mind if you sent a secret or whatever

This started as an off-hand joke, but it made more sense the more we thought about it 😅

me when i get shot

Switched @badrap/valita to ESM-only, pretty cool how @npmx.dev celebrates the package size reduction 🎉 npmx.dev/package/@bad...

Some personal news:

Announcing the general availability of Schrödinger's Pull Requests

There's highly personalized phishing, and then there's this.

Sometimes notifications can be delightful.

This is what going on the internet used to feel like

A career highlight for sure!

"Days of arguing about exploitability can save minutes of fixing the bug." -- Socrates, on vulnerability disclosure

A gentle reminder that while `pnpm install` (or `bun install`) doesn't run the lifecycle scripts of the dependencies by default, it *does* run them from the repo's own package.json. Let's be mindful when cloning and exploring all those new & exciting projects on our local machines.

What a demo! Razor 1911 celebrating their 40 years of activity on the scene. www.youtube.com/watch?v=2Anb...

”FATHER WHY MUST I EXIST”

GitHub's auto-suggest using the display names instead of the account names isn't really doing us any favors. The latter "Dependabot" here is our beloved, and very fake, depenbadot.

brb gonna update some actoins github.com/acticns/setu...