Viewing profile — jonchurch_

npm v12 released last month also defaults into blocking them by default

Im curious OP, what was the specific callsite (not overall category) that made you write this library? What did the code look like before/after you used this library? And in that c…

Came to say this, ICANN says: “This status code is set by your domain's Registry Operator. Your domain is not activated in the DNS.” Also the serverDeleteProhibited status is activ…

Edit: I didnt even notice until someone pointed out this was on the Nex-n2 repo not the rio one, now I understand the OP’s confusion! It wasnt framed as an issue which is the norm …

(2021)

I am so incredibly stoked to see this! It is the piece which can FINALLY make it so Trusted Publishing can be safely used. This releases a lot of pressure on maintainers, who until…

The compromised action here was using pnpm. They poisoned the github action cache, which was caching the pnpm store. The chain required pull_request_target on the job to check bund…

Not to beat the dead horse, but ths floored me when I realized it so I keep trying to shout it at the top of my lungs. There is no gate you can put on a Trusted Publisher setup in …

I agree with you that TP is an improvement over long lived npm tokens in CI. However, the threat Im most afraid of still does involve dev environment compromise. Because if your re…

I tested approving a deployment via API last week w/ my gh cli token (well, had claude do it while I watched). Again, I really want to be wrong about this, but my testing showed th…

I have not read that blog post. But unfortunately (and I'd love to be wrong!) it doesn't matter for if a repo admin's token gets exfiled, because if you put your gates within Githu…

its so wild to have seen this advice reverse course over the past year. it used to be that projects that pinned deps were called out as being less secure due to not being able to r…

It is unfortunate, but this is evidence (IMO) that Trusted Publishing is still ~~not secure~~ not enough by itself to securely publish from CI, as an attacker inside your CI pipeli…

> So when Becker asked ChatGPT (at the time of writing his book, it has been updated since)

Instead HN has human moderators, who often make changes in response to these kinds of things being pointed out. Which is quite a luxury these days!

Thats what the second chance pool is for The guidelines talk about primary sources and story about a story submisisons https://news.ycombinator.com/newsguidelines.html Creating a n…

This article only rehashes primary sources that have already been submitted to HN (including the original researcher’s). The story itself is almost a month old now, and this articl…

Hey, thank you kind strangers who sent me some money. I appreciate it! <3

> How many total developers does that cover? 100? I love these questions bc they both can be answered with some slight heuristics, and they are quite surprising! As of January 2026…

ETH address 0x60F9CC1b97C78D8E8337Ef991a34bd8D9e600420 ¯\_(ツ)_/¯

I currently pay them $200/month out of my own pocket for this already, so for me it is not a free trial but subsizing my usage. Agreed that $200 USD would be preferable (credits do…

I dont want to misrepresent, I am not the original author of any of these projects. I am not JDD of lodash (who is still involved and part of the TC) nor TJ Holowaychuk of express.…

Folks saying this offer is in bad faith or not generous enough dont seem to understand how low the bar is here for rewarding maintainers. I maintain Express.js and Lodash, as well …

Wow very cool, theyve now closed 150 bugs identified via ai assistance/static analysis! For ref, here is the post from Joshua Rogers about their investigation into the tooling land…