nulltrace

5 ms·

31.
by nulltrace 5mo ago
Yeah same thing happens with lockfiles and CI configs. You end up filtering out half the list before it tells you anything useful.
32.
by nulltrace 5mo ago
Biggest reason is usually the toolchain. Debuggers, sanitizers, profilers all just work when your target is C. Go through LLVM and you get similar optimization but now you own the backend. With C, gcc and clang handle that part.
33.
by nulltrace 6mo ago
Open source runtime, not the orchestration layer on top.
34.
by nulltrace 6mo ago
We added Actions for CI in 2020. A year later realized our entire deploy pipeline just assumed it would be up. Webhook doesn't fire, nothing errors out, and you find out when someone asks why staging hasn't moved in two days.
35.
by nulltrace 6mo ago
Spent yesterday pruning dependencies in a project. Cut half of them and everything still worked. Makes you wonder how much stuff we pull in without thinking about it. Same thing with AI-generated PRs honestly, one bad suggestion and it ship
36.
by nulltrace 6mo ago
Coroutines went through the same cycle. Standardized in C++20, and I still hit compiler-specific differences in how symmetric transfer gets lowered.
37.
by nulltrace 6mo ago
Scanners catch most of these within hours. The cooldown just buys them time to run, not waiting for some other dev to get hit first.
38.
by nulltrace 6mo ago
Right, good to know.
39.
by nulltrace 6mo ago
Switch is fine until you hit five or six states with cleanup in each branch. Then it's just a worse version of what coroutines give you for free.
40.
by nulltrace 6mo ago
Operating at -40 is one thing, charging at -40 is another.
41.
by nulltrace 6mo ago
Just a dev who's built the stuff I talk about. Pretty sure you already know that though, buddy.
42.
by nulltrace 6mo ago
Yeah the composability buys you a lot of room. One central store with events, inject it into each feature, and they stay decoupled without painting yourself in.
43.
by nulltrace 6mo ago
The ref pinning part is almost worse than no pinning. You can pin the action itself to a commit SHA, sure. But half the actions out there clone other repos, curl binaries, or run install scripts internally. Basically none of that is covered
44.
by nulltrace 6mo ago
The LEA-vs-shift thread here kind of proves the point. Compilers are insanely good at that stuff now. Where they completely fall short is data layout. I had a message parser using `std::map<int, std::string>` for field lookup and the
45.
by nulltrace 6mo ago
Tried moving a monorepo off Node once. The runtime swap was the easy part. What killed us was the 50-odd package.json files with node-specific stuff baked in. Conditional exports, postinstall scripts, engine constraints, pnpm overrides. Bun
46.
by nulltrace 6mo ago
Yeah the algorithmic fix is doing most of the work here. But call that parser hundreds of times on tiny streaming chunks and the WASM boundary cost per call adds up fast. Same thing would happen with C++ compiled to WASM.
47.
by nulltrace 6mo ago
Fair point, I was counting what lands in node_modules rather than direct deps. And most of those are brianc's monorepo packages so the trust surface is way smaller. Bad example on my part.
48.
by nulltrace 6mo ago
The zero-config part is where it gets tricky in practice. I spent a while getting mDNS-based discovery working across different home networks and it's a mess. Half the consumer routers silently drop multicast between subnets, some just
49.
by nulltrace 6mo ago
Awesome-lists are low stakes though. The scarier version is bots opening PRs on actual packages, tweaking a build script, CI passes, maintainer merges from their phone. No one's adding prompt injection checks to every repo.
50.
by nulltrace 6mo ago
The FUSE angle is what got me. Our monorepo takes about 90 seconds just to clone in CI, and most jobs only touch two or three packages. Shallow clone helps with history but you basically still pull the entire working tree. Something that co
51.
by nulltrace 6mo ago
I publish a package with zero deps and people still pull in a pile of transitive stuff from their lockfile. "pg" has 13 dependencies and nobody even blinks. One gets compromised and suddenly every Node backend using Postgres is in
52.
by nulltrace 6mo ago
The key rollover part is what kills me about DNSSEC. I deal with key rotation in other contexts and it's already annoying, but at least if I mess up a TLS cert renewal the worst case is a browser warning. DNSSEC KSK rotation goes wrong
53.
by nulltrace 6mo ago
Grepping your own source for variation selectors is the easy part. The problem is nobody's doing that on what they install. A compromised upstream package lands those characters in your node_modules and your CI never looks twice. `npm
54.
by nulltrace 6mo ago
Grepping works when you wrote the code. Not so much when someone else installs your package and has no idea which export is public API. We added a one-page markdown saying "use these, ignore the rest" and the wrong-import issues m
55.
by nulltrace 6mo ago
Seen this happen with Terraform. One team tears down a stack, bucket gets deleted, but another stack still has the name hardcoded in an output. Next CI run uploads artifacts to a bucket name that's now up for grabs. You only notice whe
56.
by nulltrace 6mo ago
I've seen something similar across Claude versions. With 4.0 I'd give it the exact context and even point to where I thought the bug was. It would acknowledge it, then go investigate its own theory anyway and get lost after a few
57.
by nulltrace 6mo ago
The serialization thing is real but I don't think OOP vs functional is the actual issue here. JSON has no date type, period. You JSON.stringify a Date, get an ISO string, and hope whoever's parsing remembers to reconstruct it. Tem
58.
by nulltrace 6mo ago
Those three flags cover most of it. One gotcha: -fno-exceptions makes `new` return nullptr instead of throwing, so if any library code expects exceptions you get silent corruption. We added -fcheck-new to catch that. Also -nostdlib means no