tabwidth

6 ms·

1.
by tabwidth 8d ago
Even the meta version is picky about where it goes. The whole declaration has to fit inside the first 1024 bytes. Easy to break with a giant comment at the top.
2.
by tabwidth 28d ago
Replaced Shiki on a docs site, grammar pack was bigger than the rest of the JS. 2KB for color-only feels like a fair trade.
3.
by tabwidth 2mo ago
Other side of that though, touch the bottom of a stack and every layer above it re-runs. Stack unwinding, basically.
4.
by tabwidth 2mo ago
Most of the malicious ones just curl something in a postinstall script, scanners already catch that. The sneaky ones don't look malicious until they run, and three days may not help.
5.
by tabwidth 3mo ago
Build tooling still runs though. Your bundler plugin or PostCSS transform gets full fs access at build time, nobody's auditing that.
6.
by tabwidth 4mo ago
It may depend on the runtime giving you a sync wait that doesn't deadlock the loop you came from. In JS you just can't. `dontawait` would need V8 to be a different VM.
7.
by tabwidth 4mo ago
The box itself is probably fine. It's the path between you and it. In shared infrastructure one compromised hop somewhere upstream is enough and now you're SSHing into the wrong thing without realizing it.
8.
by tabwidth 5mo ago
Reviewing isn't hard when the diff is what you asked for. It's when you asked for a one-line fix and get back 40 changed lines across four files. At that point you're not even reviewing your change anymore, you're auditi
9.
by tabwidth 5mo ago
Half the time I just grep the ticket key in Slack because it's faster than using Jira's own search.
10.
by tabwidth 5mo ago
This isn't really about centralization. ISPs are blocking at the IP level, not Docker Hub specifically. You could self-host a registry behind Cloudflare and still run into the same thing.
11.
Why AI Code Needs the Same Rigor We Should've Been Using All Along(whetlan.substack.com)
2 points by tabwidth 6mo ago|2 comments
12.
by tabwidth 6mo ago
Started from a thread on "Slop is not necessarily the future" ( https://news.ycombinator.com/item?id=47587953 ). I commented that technical debt from sloppy code shows up too late to fix. someone replied that humans
13.
by tabwidth 6mo ago
How long does that take though? Technical debt from sloppy code doesn't show up in the product until way later. By the time users notice, the team is already three features deep and can't back out.
14.
by tabwidth 6mo ago
The intention part is right but the bottleneck is review. AI is really good at turning your clean semantic functions into pragmatic ones without you noticing. You ask for a feature, it slips a side effect into something that was pure, tests
15.
by tabwidth 6mo ago
Yeah the raw parse speed comparison is almost a red herring at this point. The real cost with JSON is when you have a 200MB manifest or build artifact and you need exactly two fields out of it. You're still loading the whole thing into
16.
by tabwidth 6mo ago
The part that gets me is when it passes lint, passes tests, and the logic is technically correct, but it quietly changed how something gets called. Rename a parameter. Wrap a return value in a Promise that wasn't there before. Add some
17.
by tabwidth 6mo ago
The worst version of this I've seen is when every layer is like four lines long. You step into a function expecting some logic and it's just calling another function with slightly different args. Do that six times and you forgot w