jonchurch_

5 ms·

1.
by jonchurch_ 16d ago
caffeinate -is -t 7200 claude --remote-control then Control + Command + Q ftw (keep system from sleeping if plugged in, keep system from going idle even if not plugged in, for 2 hours, start claude code w/ remote control enabled, lock
2.
by jonchurch_ 1mo ago
npm v12 released last month also defaults into blocking them by default
3.
by jonchurch_ 2mo ago
Im curious OP, what was the specific callsite (not overall category) that made you write this library? What did the code look like before/after you used this library? And in that callsite, what were you doing with the resolved value?
4.
by jonchurch_ 2mo ago
Came to say this, ICANN says: “This status code is set by your domain's Registry Operator. Your domain is not activated in the DNS.” Also the serverDeleteProhibited status is active, which ICANN also admits is a weird and rare one: “Th
5.
by jonchurch_ 3mo ago
Edit: I didnt even notice until someone pointed out this was on the Nex-n2 repo not the rio one, now I understand the OP’s confusion! It wasnt framed as an issue which is the norm breakage I think you’re reacting to, as in they didnt ask th
6.
by jonchurch_ 3mo ago
(2021)
7.
by jonchurch_ 4mo ago
I am so incredibly stoked to see this! It is the piece which can FINALLY make it so Trusted Publishing can be safely used. This releases a lot of pressure on maintainers, who until now needed to be experts in securing CI infrastructure in o
8.
Staged Publishing for NPM Packages(docs.npmjs.com)
4 points by jonchurch_ 4mo ago|1 comments
9.
by jonchurch_ 4mo ago
The compromised action here was using pnpm. They poisoned the github action cache, which was caching the pnpm store. The chain required pull_request_target on the job to check bundle size, which had cache access and poisoned the main repo’s
10.
by jonchurch_ 4mo ago
Not to beat the dead horse, but ths floored me when I realized it so I keep trying to shout it at the top of my lungs. There is no gate you can put on a Trusted Publisher setup in github which requires 2fa to remove. Full stop. 2fa on githu
11.
by jonchurch_ 4mo ago
I agree with you that TP is an improvement over long lived npm tokens in CI. However, the threat Im most afraid of still does involve dev environment compromise. Because if your repo admin gets their token stolen from their gh cli, they can
12.
by jonchurch_ 4mo ago
I tested approving a deployment via API last week w/ my gh cli token (well, had claude do it while I watched). Again, I really want to be wrong about this, but my testing showed that it is indeed trivial to use the default token from m
13.
by jonchurch_ 4mo ago
I have not read that blog post. But unfortunately (and I'd love to be wrong!) it doesn't matter for if a repo admin's token gets exfiled, because if you put your gates within Github, an admin repo token is sufficient to defan
14.
by jonchurch_ 4mo ago
its so wild to have seen this advice reverse course over the past year. it used to be that projects that pinned deps were called out as being less secure due to not being able to receive updates without a publish. different times, different
15.
by jonchurch_ 4mo ago
It is unfortunate, but this is evidence (IMO) that Trusted Publishing is still ~~not secure~~ not enough by itself to securely publish from CI, as an attacker inside your CI pipeline or with stolen repo admin creds can easily publish. This
16.
by jonchurch_ 5mo ago
> So when Becker asked ChatGPT (at the time of writing his book, it has been updated since)
17.
by jonchurch_ 7mo ago
Instead HN has human moderators, who often make changes in response to these kinds of things being pointed out. Which is quite a luxury these days!
18.
by jonchurch_ 7mo ago
Thats what the second chance pool is for The guidelines talk about primary sources and story about a story submisisons https://news.ycombinator.com/newsguidelines.html Creating a new URL with effectively the same info but f
19.
by jonchurch_ 7mo ago
This article only rehashes primary sources that have already been submitted to HN (including the original researcher’s). The story itself is almost a month old now, and this article reveals nothing new. The researcher who first reported the
20.
by jonchurch_ 7mo ago
Hey, thank you kind strangers who sent me some money. I appreciate it! <3
21.
by jonchurch_ 7mo ago
> How many total developers does that cover? 100? I love these questions bc they both can be answered with some slight heuristics, and they are quite surprising! As of January 2026, there were > 13k npm packages w/ more than 1 Mi
22.
by jonchurch_ 7mo ago
ETH address 0x60F9CC1b97C78D8E8337Ef991a34bd8D9e600420 ¯\_(ツ)_/¯
23.
by jonchurch_ 7mo ago
I currently pay them $200/month out of my own pocket for this already, so for me it is not a free trial but subsizing my usage. Agreed that $200 USD would be preferable (credits dont pay rent). My comment is directed at the strong word
24.
by jonchurch_ 7mo ago
I dont want to misrepresent, I am not the original author of any of these projects. I am not JDD of lodash (who is still involved and part of the TC) nor TJ Holowaychuk of express. I dont know what the future will look like, but IMO open so
25.
by jonchurch_ 7mo ago
Folks saying this offer is in bad faith or not generous enough dont seem to understand how low the bar is here for rewarding maintainers. I maintain Express.js and Lodash, as well as a number of express direct deps (as a TC member of both E
26.
by jonchurch_ 11mo ago
Wow very cool, theyve now closed 150 bugs identified via ai assistance/static analysis! For ref, here is the post from Joshua Rogers about their investigation into the tooling landscape which yielded those findings https://j
27.
by jonchurch_ 11mo ago
Daniel Stenberg of curl gave a talk about some of what theyve been experiencing, mostly on the security beg bounty side. A bit hyperbolic, and his opinion is clear from the title, but I think a lot of maintainers feel similarly. “AI Slop at
28.
by jonchurch_ 11mo ago
You can churn this stuff out in about an hour these days though, seriously. Thats part of the problem, the asymmetry of time to create vs time to review. If I can write 8 9k line PRs everyday and open them against open source projects, even
29.
by jonchurch_ 11mo ago
We are seeing a lot more drive by PRs in well known open source projects lately. Here is how I responded to a 1k line PR most recently before closing and locking. For context, it was (IMO) a well intentioned PR. It purported to implement a
30.
by jonchurch_ 1y ago
The author has run into the same problem that anyone who wants to do analysis on the NPM registry runs into, there's just no good first party API for this stuff anymore. It seems this was their first time going down this rabbit hole, s

More ›