twistedpair

14 ms·

1.
by twistedpair 1mo ago
GitHub simply isn't an agent code building platform. They're a RoR git host from 2008 running on an ancient MySQL setup that by some miracle continues to stay up, some of the time. Their APIs are garbage from an agentic perspectiv
2.
by twistedpair 1mo ago
Lack of a local runner is my biggest peeve. Any novel GHA workflow creation results in a PR with 100 commits, until you can finally sort out all the non-obvious idiosyncrasies. For any modestly complex workflow, I move everything to a bash
3.
by twistedpair 1mo ago
My repos and PRs have gone from throwing 500 errors, to now all being 404. Not trending in the right direction here...
4.
by twistedpair 1mo ago
Since upgrading to Cloud Enterprise... why didn't my GH uptime get any better? Guess on-prem GHE server is the only way to do that.
5.
by twistedpair 1mo ago
They _are_ the LLM coding agent vendor, and are _owned_ by MS, the ~majority~ biggest shareholder of OpenAI. How can you NOT consider that 20x+ scaling in your capacity roadmap projections, where you are trying to get everyone to use these
6.
by twistedpair 1mo ago
2,523 and counting
7.
by twistedpair 1mo ago
Ah, I see your problem there > This requirement will be progressively enforced over time.
8.
by twistedpair 6mo ago
The last several years have been monotonically busier for me, year over year, and I've been a principal contributor in this game for many years. Sure, I can push out 1000 PRs a year by riding 4 concurrent agent hoards, but at some poin
9.
by twistedpair 6mo ago
I got a new boiler installed recently. $20K. I looked up the _retail_ price for the components/fittings/consumables, ~$6K. Even with overhead, that plumber made a good take for 2 days work. I'm only half kidding when I sugges
10.
by twistedpair 6mo ago
Honestly, Copilot is the worst of the AI tools at this point. IDK how they lost that lead so handily.
11.
by twistedpair 6mo ago
I don't think everyone will easily make the jump to coding at warp speed. Pushing 6 agentic sessions at once, while seeing a half dozen new features/fixes out to prod is more mental gymnastics. If you're the "add a butto
12.
by twistedpair 7mo ago
This is part of why we help defend Israel, to constrain wars to conventional means. In the first Gulf War, we placed the Patriot batteries around Israel, as they said that if an Iraqi biological or chemical SCUD attack hit Tel Aviv, they wo
13.
by twistedpair 7mo ago
> could the military use Anthropic’s Claude AI system to help shoot it down? What a joke. I suggest folks read up on the very poor performance of US ICBM interceptor systems. They're barely a coin flip, in ideal conditions. How is C
14.
by twistedpair 7mo ago
I cannot approve PRs because the JSON API is returning HTML error pages. Something is really hosed over there.
15.
by twistedpair 7mo ago
In the age of Claude Code et al, my honest biggest bottleneck is GH downtime. I've got a dozen PRs I'm working on, but it's all frozen up, daily, with GH outages. Are the other providers offering much better uptime GitLab, Ci
16.
by twistedpair 8mo ago
K8s absolutely reduced labor. I used to have a sysadmin who ensured all our AMI images were up to date and maintained, and who maintained a mountain of bespoke bash scripts to handle startup, teardown, and upgrade of our backeneds. Enter K8
17.
by twistedpair 10mo ago
That one stumped me. Why not just encrypt with a hardcoded public key, then only the attacker can get the creds. The simple B64 encoding didn't hide these creds from anyone, so every vendor out there's security team can collect th
18.
by twistedpair 10mo ago
You're right. PNPM disables all install scripts by default. I was just noting one example.
19.
by twistedpair 10mo ago
I think it's a `pnpm-workspace.yaml` setting, for now, but PNPM has been pretty aggressive with expanding this feature set [1]. [1] https://pnpm.io/supply-chain-security
20.
by twistedpair 10mo ago
Good point, but until many popular packages stop requiring install.sh to operate, you'll still need to allowlist some of them. That is built into the PNPM tooling, luckily :)
21.
by twistedpair 10mo ago
I'm struggling to understand why Trusted Publishers is any better. Let's say you have a limited life, package specific scoped, IP CIDR bound publishing key, running on a private GH workflow runner. That key only exists in a truste
22.
by twistedpair 10mo ago
This is built in NPM. You can get an email on every pkg publishing. Sure, it might be a little bit of noise, but if you get a notice @ 3am of an unexpected publishing, you can jump on unpublishing it.
23.
by twistedpair 10mo ago
ProTip: use PNPM, not NPM. PNPM 10.x shutdown a lot of these attack vectors. 1. Does not default to running post-install scripts (must manually approve each) 2. Let's you set a min age for new releases before `pnpm install` will pull t
24.
by twistedpair 11mo ago
Services like SES Inbound are only available in 2x US regions. AWS isn't great about making all services available in all regions :/
25.
by twistedpair 11mo ago
I just saw services that were up since 545AM ET go down around 12:30PM ET. Seems AWS has broken Lambda again in their efforts to fix things.
26.
by twistedpair 11mo ago
Wow, about 9 hours later and 21 of 24 Atlassian services are still showing up as impacted on their status page. Even @ 9:30am ET this morning, after this supposedly was clearing up, my doctor's office's practice management softwar
27.
by twistedpair 1y ago
It feels like the root of the issue is the scoping design of JS itself, which makes tracking TDZ more costly for the interpreter, and the fact that JS is JIT rather than AOT compiled. I laud the recent efforts to remove the JS from JS tools
28.
by twistedpair 1y ago
Identical, highly obfuscated (and thus suspicious looking) payload was inserted into 22+ packages from the same author (many dormant for a while) simultaneously and published. What kind of crazy AI could possible have noticed that on the NP
29.
by twistedpair 2y ago
Mabl | US/India | Software Engineer | ONSITE / REMOTE We need your help to scale up our cloud based, AI testing software startup and put our 40M Series C raise to work. We’re a 100% serverless operation built on Google Cloud Platf
30.
by twistedpair 3y ago
Should API access keys be stored in plain text such that they can easily be recovered from backups or clones to data warehouses? Best practice would be to store such keys in an encrypted state, to prevent such breaches from non-production d

More ›