🚨 Open source supply chain attacks are exploding. Starting today, that ends. We’re releasing Socket Firewall — FREE, zero-config, CLI that blocks malware before it lands on your laptop or CI. Just run: npm i -g sfw sfw npm install lodash Works for: npm, yarn, pnpm, pip, uv, and cargo.

I feel like reading my own company blog gets me more on average interesting tidbits than most blogs these days. Nice to have that feeling.

ORMS are harder to debug and often more verbose than SQL with safe prepared statements.

assert(str.length === 1) Today I noticed that capitalization doesn't alway preserve length: str.toUpperCase().length === 2 Question: How to map the char position of str to the char position of str.toUpperCase() in a sanely efficient way

innerText is brutal to mix with Range

I'm looking for senior devs to join our UI Infra team in New York to work on the Bloomberg Terminal 🗽 This is building frontend toolkits using JS/Web in embedded Chromium. It's not app development. Experience with non-Web UI helps. DM me if you prefer "building React" to "using React" 🔥

Got hit with blog.dwac.dev/posts/html-w... ; fun with CSS custom highlights affected due to how Range differs (textContent based) from innerText (what Copy/Paste* does)

Things that are impossible to detect / really set custom highlights (either NIH <span> or Custom Highlights spec) on: * ::before/::after * <textarea>/<input> * shadow dom * <img alt=copyable> What am I missing?

People came for the JS but now they get the Database Admin.

I feel like folks are sleeping on the fact that Node.js now has sqlite built in.

650Million row table needs a complete table data migration; not terrible but doing so will take planning happily we can improve things due to having to do a complete migration which will make things even better

The average is really 2 but we all become friends with Tom from Myspace back in the day and skewed the results.

I love to step back and ask WHO, WHAT, WHERE, WHY, WHEN, HOW, WHICH, ... If you can build something for a customer try to take care of answering as many of those questions as possible and give the most relevant answers up front. Same for programming libraries.

How many query plans & WHEN does it make sense for them? Want to manually do it every time? WITH o AS ( SELECT * FROM org as o WHERE o.active ) SELECT t .* FROM tasks as t JOIN o ON o .id = t .org WHERE t.status = 'ERR' Always ask WHAT, HOW, and WHY docs.google.com/presentation...

Gift link, www.nytimes.com/interactive/...

ETOOMUCHDATA => 10x speed improvement in a spike? launch weeks are weird

Super excited to share what I've been working on lately. Socket can now automagically fix security alerts with an autopilot mode ⚡🪄📦

🔥 Launch Day 5: We’re so excited to launch socket fix — a CLI tool that automatically upgrades vulnerable dependencies, runs your tests, and even auto-merges safe updates in CI. From alert to merged fix. Zero friction.

Auto merge and test checker is soo vital for reducing friction; asking customers what they use Socket for and security teams are always trying to both reduce friction and speed up fixes.

🔥 Launch Week Day 4: Historical Analytics is now in beta! This is a massive upgrade to Socket’s visibility and reporting capabilities. Socket now retains 30 days of daily scan data, giving you powerful new insight into how your supply chain risks evolve over time.

I helped build this and came up with a thing called the "rainbow chart" (the main thing you see on that screenshot). It's like a half donut chart with two layers, the inner arc is a breakdown of the outer arc. Also looks like a speedometer.

I feel like a lot of people don't know about `content-visibility: hidden` If your framework updates the DOM fast enough, you might be able to just use one line of CSS to save all the rendering work you need for hidden DOM. As always, measure.

At GoDaddy we had a use case to show 10k+ rows in a table; starting to think that was easy mode.

Had a fun and simple little programming problem that probably has a better solution than what I found but might be fun for others: pts = unordered_points(4) bb = ordered_bounding_box_pts(pts) // pair points such that the sum of distance between pairings // is minimized bestfit_pairs = pair(pts, bb)

Bad ideas inspired by current events Reciprocal PR tariff license: for every line of code using this library (even indirectly) you must PR and upstream maintenance fixes of the same number of lines. Removing lines of code means you have a deficit. You cannot land the PR until lines are added

Is there some sneaky way in CSS to fire a beacon off if a rule is triggered? Maybe using background-image?

I consistently test what AI art can do & it is getting closer to that awkward point were I think many people can rely on it (like wikipedia) etc. that don't propagate to original author. I do think having it get too good is awkward even for reference as using it just for pose ref seems possible.

#FreeJavaScript update: Oracle has just filed more on their motion to dismiss the Fraud claim. Here's a summary of where the case stands: deno.com/blog/deno-v-...

Reading some kids books in the dark is a great reminder of how high a11y should be in our priorities. Interesting in this one, there are some pages where they switched to white text. I always wonder what threshold they used to leave half the pages with such a contrast ratio.

I need examples of vulnerabilities reported against npm packages that maintainers of the package or another package depending on it were annoyed by. Doesn't have to be fresh, last 5 years is ok. Respond with ghsa link or package+version - I can look it up myself. (repost for reach a lot please)

My engagement farming anti-talent strikes again, I post the thing I need to reach far on a first Friday of spring... 🤦‍♂️

SQL needs to work on its debuggability story something fierce. Great for what it does but arcane in checking all the edge cases.

@naugtur.pl Is github.com/naugtur/trus... going to be something like github.com/mozilla/carg... or github.com/crev-dev/crev/ ? Sounds interesting none the less!

More global registries for the registry god!

🚀 Big news for TypeScript! Microsoft is porting the TypeScript compiler to Go, delivering 10x faster builds, lower memory usage, and snappier editor performance. A huge leap forward for developers! socket.dev/blog/typescr... #golang #TypeScript

Sometimes when I'm looking at the codebases I forget which one I'm reading. It's actually very disorienting at times.

Me staring at all the Math.randoms() in the codebase after a benchmark and that they are all used for boolean branching jsbench.me/num81zruz5/1

Big launch from the Opengrep team this week! This open source project has a lot of momentum. It is well organized and is establishing itself as a serious, sustainable alternative in the #SAST ecosystem, not just a reactive fork. socket.dev/blog/opengre...

Lazy imports, next we should make lazy props v8.github.io/api/head/cla... class Foo { // only calc id once observed defer id = uuid(); constructor() { // accessor when reflection used Object.define(this, 'aid', { get() { Object.defineProperty(this, 'aid', {value: ... }} }) } }

The big win from Node's SEA feature isn't that it is one file necessarily; it's that if it runs on one machine it won't be affected by outside things like what version of Node the consumer is running. - new/experimental features are ok - bug reproducibility - signing to verify code that ran

What you think software engineering is going to be: red-black trees, Bloom filters, O(n log n) in-place sorting algorithms What it actually is: we need one user, *one* *single* *user*, to concretely tell us what they were doing when this crash occurred

Mmmm how would I partition utf8 sanely only for ID_Start

The first JSSugar has been found

Anyone know of a good / pleasant DNS+DHCP combo that I can run on my home guest network as a gateway

The @vlt.sh team launched "reproduce" today, an #OSS tool that verifies if npm packages match their source code. With recent supply chain attacks exposing provenance limitations, this approach is already showing better adoption rates than traditional methods. ➳ socket.dev/blog/vlt-lau... #JavaScript

One nice thing about this is it moves a bunch of cache problems and code signing of mallicious source issues into actual actionable states if going down this route. Happy to see more things move this way.

You can read a deeper dive about this & the motivation on the @vlt.sh blog here: blog.vlt.sh/blog/reprodu...

🚀 We just launched `$ npx reproduce <pkg>`

As always for this stuff; comparison is expected to be linear. Might be interesting to provide a grouped matcher though; to get sublinear you probably can still: m=new Map m.set(#[0], 0) m.set(#[1], 1) m.set(#[2], 2) // instead of linear searching entries get some trick speed ups? m.get(#[2])

(Boosts encouraged!) Hi! 👋 I’m Kat. I’ve been a professional dev for over 15 years. I maintained the NPM CLI for 5 of those. I sat in TC39. I work at Microsoft. I’m self taught w/a film degree and no formal CS edu. Are you new to tech? What do you wish you could ask some1 like me? Literally AMA