ashishb

6 ms·

1.
by ashishb 6d ago
React native is broadly an inferior option. LLMs made it way worse https://ashishb.net/tech/react-native/
2.
by ashishb 2mo ago
The archaic model where every tool gets full access to your home directory was never designed for the scenario where a single npm install will install and execute 100s of packages written by various authors. One should sandbox all npm comma
3.
by ashishb 2mo ago
This is true for all CLI tools on Mac and Linux (and other operating systems from that era). Historically, everything you ran was trustworthy. Android and iOS were invented in an era that does not allow this because the risks became evident
4.
by ashishb 2mo ago
> The repo you’re working on, sure. But all files? Yes, any tool, including any coding agent, has access to all files $USER has access to. Sandbox it explicitly to give access to only the current directory - https://github.com
5.
by ashishb 2mo ago
> That every other vowel letter also can is English's low level of phoneticism The level of phoneticism between English language and its latin script is not evenly spread. For example, the letter "c" might mean /s&#x2
6.
by ashishb 2mo ago
> It's Ram, not Rama, it's yog, not yoga'... And they have no idea what schwa deletion is. It is neither. The fundamental issue is that there is no way to represent the schwa sound in English[1]. All of a,e,i,o,u have been
7.
Find What SaaS Tools Competitors Use via Sub-Processors(ashishb.net)
8 points by ashishb 2mo ago|0 comments
8.
by ashishb 2mo ago
Many of my friends are surprised that I purchase mp3s and store them in Google Drive instead of listening on Spotify or YouTube. Heck, I even wrote a player for this [1] The problem is that licensed media like this are always going to becom
9.
by ashishb 2mo ago
> Are you actually claiming English isn't a mother tongue to anyone? I gave a specific example where neither the coffee wholesaler nor the buyer probably operates day to day in English. But they would still use English for the offic
10.
by ashishb 2mo ago
> Sanskrit was widely spoken and understood just like Latin or Avestan, in its heyday. Otherwise it wouldn’t be part of the liturgical traditions of Buddhism, Jainism and Nastika traditions. I think, and it is just my speculation, that f
11.
by ashishb 2mo ago
> What about Prakrit and Punjabi? There is no official "Prakrit", by definition of the term itself. "Prakrit" just means "natural" and the way I understand it, was the term for all colloquial dialects/l
12.
by ashishb 2mo ago
Fun fact: the famous "Sentosa" island in Singapore is a spelling variation of the same word.
13.
by ashishb 2mo ago
I think most organizations don't want to increase their Java usage. And the reason is not technical. Technically, it is a great language. Legally, it feels risky to most.
14.
by ashishb 2mo ago
Languages do matter. And I think the only sensible backend languages when starting a new for-profit project is Python, Go, and Rust for 99% use-cases. In other cases, third-party packages, tooling, integrations, and telemetry starts to suff
15.
by ashishb 2mo ago
> Because I'm confident nothing will happen if it does Well, best of luck. 1. Amazon has shipped backdoored packages - https://aws.amazon.com/security/security-bulletins/AWS-2025-... 2. Scanners like Trivy
16.
by ashishb 2mo ago
> But in this particular case isn't the problem that it's sending everything in the sandbox? If a CLI is touching certain files, they are likely to be leaked one way or the other. Why not reduce the attack surface? When does so
17.
by ashishb 2mo ago
And I run most of them inside sandbox now. Why would you let a markdown linter access your ssh keys?
18.
by ashishb 2mo ago
There is a reason I run all such CLIs inside a sandbox [1] giving limited directory access. Imagine if the CLI pulled your SSH keys or other sensitive information by mistake? Programmers do make such mistakes all the time. I don't want
19.
EMF and Kids(ashishb.net)
2 points by ashishb 2mo ago|0 comments
20.
by ashishb 3mo ago
Listen to any on the Elon Musk interviews, he knows more technical intricacies of his 1000+ employee companies than your average startup founder with 10 employees.
21.
by ashishb 3mo ago
> 1. Docker (or any Linux container runtime, for that matter) is not intended for, designed for, or effective as a security boundary. This has been discussed in detail earlier - https://news.ycombinator.com/item?id=476127
22.
by ashishb 3mo ago
I wonder what percentage of pull requests are cascading updates caused by dependabot and multiple code review bots reviewing those PRs. My belief is it is likely 1% or more. And likely coming in as an avalanche.
23.
by ashishb 3mo ago
Right now, not. Eventually, they will. You can pass your favorite rootless Docker image using `--custom-docker-image` CLI parameter.
24.
by ashishb 3mo ago
> I should be able to install this module in such a way where file operations and process operations are not available to it. That's the definition of a sandbox, isn't it?
25.
by ashishb 3mo ago
> The ability for npm to run scripts on any level should be removed. Even Python has that ability now. Also, `npm run dev` is running the script with full disk access. Heck, Vscode/Cursor will auto-execute code if you open a project
26.
by ashishb 3mo ago
That's exactly what I started with. It gets unwieldy quickly enough as you need to mount a lot of directories that these you uses as cache. So, amazing-sandbox at its core is nothing but a glorified docker command generator (in defaul
27.
by ashishb 3mo ago
I have some ideas around it. And indeed that's one likely direction of this project in the future.
28.
by ashishb 3mo ago
This has been responded to in the past by another HN poster: https://news.ycombinator.com/item?id=47612726 Furthermore, you can use native sandboxing on macOS if you prefer. If neither looks serious to you, then please educ
29.
by ashishb 3mo ago
Nobody should do 'npm install' or 'pip install' on their machine. Using a proper sandboxing( https://github.com/ashishb/amazing-sandbox ) regularly will drastically limit the blast radius of these att
30.
by ashishb 3mo ago
I have been targeted with this attack in the wild where '.vscode/tasks.json' had the auto-run code. I smelled something fishy and never ran it though. https://news.ycombinator.com/item?id=48127469

More ›