Tomuus

6 ms·

1.
by Tomuus 8mo ago
Object capabilities, like capnweb/capnproto?
2.
by Tomuus 10mo ago
The vulnerable code exists inside of the React Flight wire protocol that is used by Next.js but also Vite, Parcel, Waku and any other custom RSC implementation that exists. Your comment was accurate circa 2019 but not since React released s
3.
by Tomuus 10mo ago
This POC is not realistic and doesn't work against production builds of Next.js. It requires explicit exposure of gadgets by the user (eg. vm.runInContext) so is invalid as noted on https://react2shell.com
4.
by Tomuus 10mo ago
The React Server Components wire format (Flight) is relatively novel and very new (it has existed in React stable for just a year). This is not a simple JSON parsing bug.
5.
by Tomuus 1y ago
Record types are now "on protocol", you resolve them via a similar mechanism as in the article. https://atproto.com/specs/lexicon#lexicon-publication-and-re...
6.
by Tomuus 1y ago
And Vercel's "compute units"
7.
by Tomuus 3y ago
ZigBee is a mesh network, this is very important in many situations eg. battery powered or large area
8.
by Tomuus 3y ago
1.0.0 means the API and semantics are stable, not that there are no bugs.
9.
by Tomuus 3y ago
Observables and Generators (iterators) are fundamentally different. Observables are push-based (like a promise) whereas iterators are pull-based (like a function). Glossing over this fact leads to a flawed understanding, not a deeper one.
10.
by Tomuus 4y ago
Things mostly just work. Remember Node.js is mostly APIs on top of JS the language. If those tools compile to JS in the browser, they can compile to Deno. Deno is a more stabdards-based runtime than Node, it's closer to how the browser
11.
by Tomuus 4y ago
I don't think Firefox was reading any QR codes, but instead was recrawling the link in the "Recents" list on a new tab or bookmarks screen. This is in no way a problem. There is precedent for browsers eagerly loading links, i
12.
by Tomuus 4y ago
Using the Web Platform and using React are not opposites, you can do both. See: Remix as a framework that bakes in these ideas, but using the platform is easily achievable yourself too. Making this distinction between HTML <form>s and
13.
by Tomuus 4y ago
Platforms. Google sucks at building platforms. https://vm.tiktok.com/ZMNmnGgfV/?k=1
14.
by Tomuus 4y ago
I wouldn't agree that Deno showed that, as I said many companies are making a lot of money from non-Node JS runtimes. The players I mention have built their own runtime, they're mostly all built on V8 isolates (including Deno Depl
15.
by Tomuus 4y ago
Deno isn't the only company offering a not-Node JS server runtime. Cloudflare, Shopify, Fastify, AWS, and probably more all have skin in this game.
16.
by Tomuus 5y ago
Unsafe does not turn off the borrow checker https://steveklabnik.com/writing/you-can-t-turn-off-the-borr...
17.
by Tomuus 5y ago
Me too, as to do so you'd need to solve P == NP - we can split the $1million 50/50 if you like.
18.
by Tomuus 5y ago
One of my favourite things about Remix, and where it beats Next IMO, is that you can deploy it anywhere. Bring your own server. Whereas trying to deploy Next.js anywhere other than Vercel is a nightmare.
19.
by Tomuus 5y ago
We'll be saying this in a few years about all other forms of algabreic effects too.
20.
by Tomuus 5y ago
You're asking for opaque types. This is kinda possible in typescript but you can only approximate it unfortunately. You may also want to consider a branded type, which can be useful but a little less strict.
21.
by Tomuus 5y ago
I think this article skips over many nuances of the declarative model. For a real "ground up" approach of explaining those I'd recommend this article series: https://acko.net/blog/climbing-mt-effect/
22.
by Tomuus 5y ago
It's a common phrase in East Anglia in my experience.