Viewing profile — twistedpair

2,523 and counting

Ah, I see your problem there > This requirement will be progressively enforced over time.

The last several years have been monotonically busier for me, year over year, and I've been a principal contributor in this game for many years. Sure, I can push out 1000 PRs a yea…

I got a new boiler installed recently. $20K. I looked up the _retail_ price for the components/fittings/consumables, ~$6K. Even with overhead, that plumber made a good take for 2 d…

Honestly, Copilot is the worst of the AI tools at this point. IDK how they lost that lead so handily.

I don't think everyone will easily make the jump to coding at warp speed. Pushing 6 agentic sessions at once, while seeing a half dozen new features/fixes out to prod is more menta…

This is part of why we help defend Israel, to constrain wars to conventional means. In the first Gulf War, we placed the Patriot batteries around Israel, as they said that if an Ir…

> could the military use Anthropic’s Claude AI system to help shoot it down? What a joke. I suggest folks read up on the very poor performance of US ICBM interceptor systems. They'…

I cannot approve PRs because the JSON API is returning HTML error pages. Something is really hosed over there.

In the age of Claude Code et al, my honest biggest bottleneck is GH downtime. I've got a dozen PRs I'm working on, but it's all frozen up, daily, with GH outages. Are the other pro…

K8s absolutely reduced labor. I used to have a sysadmin who ensured all our AMI images were up to date and maintained, and who maintained a mountain of bespoke bash scripts to hand…

That one stumped me. Why not just encrypt with a hardcoded public key, then only the attacker can get the creds. The simple B64 encoding didn't hide these creds from anyone, so eve…

You're right. PNPM disables all install scripts by default. I was just noting one example.

I think it's a `pnpm-workspace.yaml` setting, for now, but PNPM has been pretty aggressive with expanding this feature set [1]. [1] https://pnpm.io/supply-chain-security

Good point, but until many popular packages stop requiring install.sh to operate, you'll still need to allowlist some of them. That is built into the PNPM tooling, luckily :)

I'm struggling to understand why Trusted Publishers is any better. Let's say you have a limited life, package specific scoped, IP CIDR bound publishing key, running on a private GH…

This is built in NPM. You can get an email on every pkg publishing. Sure, it might be a little bit of noise, but if you get a notice @ 3am of an unexpected publishing, you can jump…

ProTip: use PNPM, not NPM. PNPM 10.x shutdown a lot of these attack vectors. 1. Does not default to running post-install scripts (must manually approve each) 2. Let's you set a min…

Services like SES Inbound are only available in 2x US regions. AWS isn't great about making all services available in all regions :/

I just saw services that were up since 545AM ET go down around 12:30PM ET. Seems AWS has broken Lambda again in their efforts to fix things.

Wow, about 9 hours later and 21 of 24 Atlassian services are still showing up as impacted on their status page. Even @ 9:30am ET this morning, after this supposedly was clearing up…

It feels like the root of the issue is the scoping design of JS itself, which makes tracking TDZ more costly for the interpreter, and the fact that JS is JIT rather than AOT compil…

Identical, highly obfuscated (and thus suspicious looking) payload was inserted into 22+ packages from the same author (many dormant for a while) simultaneously and published. What…

Mabl | US/India | Software Engineer | ONSITE / REMOTE We need your help to scale up our cloud based, AI testing software startup and put our 40M Series C raise to work. We’re a 100…

Should API access keys be stored in plain text such that they can easily be recovered from backups or clones to data warehouses? Best practice would be to store such keys in an enc…