bakkoting

10 ms·

1.
by bakkoting 18d ago
A while back I ported htdemucs (the same thing this uses) to onnx/wasm/webgpu so you can do it in browser (though I only bothered with the 4-stem version): https://bakkot.github.io/demucs-js/
2.
by bakkoting 29d ago
I dunno, lots of companies seem pretty happy to build large portions of their business on top of unvetted single-maintainer open source projects. Don't see why they'd stop doing so now. (Anyway, I don't care so much about wha
3.
by bakkoting 2mo ago
Depends on exactly where you draw the line at "breakthrough", but there's been at least a few novel and interesting results coming from outside mathematicians. Recently for example there were https://old.reddit.com
4.
by bakkoting 3mo ago
They didn't open a PR against zig either, the compiler concurrency work they did was also only ever in their own fork.
5.
by bakkoting 3mo ago
In case anyone missed it, this PR is based on that: > This is an implementation of the design Filip Pizlo published in 2017: "Concurrent JavaScript: It Can Work!".
6.
by bakkoting 3mo ago
This used to be more common but the pattern these days is to have the binaries split into optionalDependencies which declare their supported CPU etc, one per supported platform. Then npm will install just the matching one (optionalDependenc
7.
by bakkoting 4mo ago
I have; you specify one optional dependency per platform and set the requirements in each package. It works fine. A bunch of packages do this (e.g. esbuild). I don't know what your complaint is or what you're asking for.
8.
by bakkoting 4mo ago
They have taken action as of very recently. The latest version [1] of npm warns when there are install scripts and tells you they will be disabled by default in a future version, with a per-dependency opt in mechanism [2]. [1] https:/
9.
by bakkoting 4mo ago
The proposal used to do more thing and we didn't change the URL after we ultimately arrived at this set of APIs.
10.
by bakkoting 4mo ago
There's an RFC for this: https://github.com/npm/rfcs/pull/868
11.
by bakkoting 4mo ago
> most people use pre-built distributions (wheels) for their architecture from PyPI, so don't execute arbitrary code to install packages Technically true, but wheels can include a `.pth` which will run arbitrary code as soon as Pyth
12.
by bakkoting 4mo ago
These things are usually caught by tools specifically scanning npm or by the maintainers noticing their account is compromised, not by people auditing their own installed packages.
13.
by bakkoting 4mo ago
2fa being enabled for people on the team is different from 2fa being required for publishing. It is not current possible to enforce (or use) 2fa for publishing with trusted publishing.
14.
by bakkoting 5mo ago
> type safety without having to transpile code from another language (so no build processes that rival C++ in complexity just to still have interpreted code at the end) All major server-side JS runtimes are capable of executing TypeScrip
15.
by bakkoting 5mo ago
Ehhhhh basically none of those exploits generalize beyond one very specific engine and set of conditions, and half of them are things to do with interactions between JIT tiers and can't be reliably triggered.
16.
by bakkoting 5mo ago
I agree that the original cancellation discussion was bad. I don't agree that these threads reflect the same disfunction. They're a new effort (from me). No one was working on it previously because browsers have said that they wer
17.
by bakkoting 5mo ago
Browsers have said that they are unwilling to ship any new cancelation mechanisms given that AbortSignal already exists, so we can't ship a different CancelToken. But I think there's a path to standardizing a subset of the existin
18.
by bakkoting 6mo ago
We haven't refused, it just takes time! There was an update at the meeting two weeks ago [1]. There's a lot of other machinery which needs to be specified and implemented before module declarations will work but it's coming a
19.
by bakkoting 6mo ago
Python and Rust have such a thing, but not e.g. Java, Go, C#. And I can't find any libraries on npm which do this. That seems like a very niche need, not actually the sort of thing whose absence causes people to have lots of npm depend
20.
by bakkoting 7mo ago
Observables has moved to WHATWG [1] and been implemented in Chrome, although I don't know if the other browsers have expressed any interest (and there's still some issues [2] to be worked through). But Observables really do not so
21.
by bakkoting 8mo ago
Neat! I wonder how slow this would be running in wasm. In my dream world it would also use WebGPU but that's a much bigger lift.
22.
by bakkoting 8mo ago
You're thinking of a previous report from a month ago, #897 or #481, or the one from two weeks ago, #728. There's a new one from a week ago, #205, which is genuinely novel, although it is still a relatively "shallow" res
23.
by bakkoting 9mo ago
Formally JavaScript is specified as having TCO as of ES6, although for unfortunate and painful reasons this is spec fiction - Safari implements it, but Firefox and Chrome do not. Neither did QuickJS last I checked and I don't think thi
24.
by bakkoting 9mo ago
Have you seen the YoWASP toolchain for VSCode [1]? It sounds pretty similar. [1] https://github.com/YoWASP/vscode
25.
by bakkoting 9mo ago
And there's an open issue for that already: https://github.com/bearcove/arborium/issues/62
26.
by bakkoting 10mo ago
Yes. I'm on TC39 as well, and I've talked to Jordan about this topic. It's true that there are a few people who publish packages on npm including polyfills, Jordan among them. But these are a very small fraction of all packag
27.
by bakkoting 10mo ago
This hasn't been true since version 5.4.2, released in 2017. `npm install` will always use the versions listed in package-lock.json unless your package.json has been edited to list newer versions than are present in package-lock.json.
28.
by bakkoting 10mo ago
Very few packages published on npm include polyfills, especially packages you'd use when doing local scripting.
29.
by bakkoting 10mo ago
If you look at the list of compromised packages, very few of them could reasonably be included in a standard library. It's mostly project-specific stuff like `@asyncapi/specs` or `@zapier/zapier-sdk`. The most popular generic
30.
by bakkoting 10mo ago
I don't think there's literally any conforming implementations of modern ECMAScript by that definition.

More ›