Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cursed Knowledge

immich.app

Post reply on HN
Print view View original

141–150 of 165 posts

Re: Cursed Knowledge

#141

Post by motorest »

whilenot-dev wrote: post #128
motorest wrote: post #121

Earlier quoted context omitted.

> Are you serious here? I am. If you check the definition of polyfill, you'll eventually arrive at something like the following: > A polyfill is a piece of code (usually JavaScript on the Web) used to provide modern functionality on older browsers that do not natively support it. https://developer.mozilla.org/en-US/docs/Glossary/Polyfill I think we would agree that foreach fits the definition, happy path, and whole p…

> I think we would agree that foreach fits the definition, happy path, and whole purpose of a polyfill I think you got that all wrong and strongly misinterpret "modern functionality" as some generic library here... Runtimes are developed against a certain spec, in this case ECMAScript, and "modern functionality" is meant as addition to iterations of such a spec. As it happens, iterations of specifications and runtime…

> I think you got that all wrong and strongly misinterpret "modern functionality" as some generic library here...

I didn't. I am telling you exactly why polyfills exist, and why people use them.

More importantly, I am explaining to you why this scheme is successful.

You don't need to write any wall of text that adds nothing. Read the facts I laid out, and use that to either understand how things work, or don't. It's your choice.

Re: Cursed Knowledge

#142

Post by phreack »

Love this. I seem to find a new one every day maintaining an Android app with millions of users. We like to call them "what will we tell the kids" moments. It's a great idea to write them down, I'll probably start doing it!

Re: Cursed Knowledge

#143

Post by whilenot-dev »

motorest wrote: post #141
whilenot-dev wrote: post #128

Earlier quoted context omitted.

> I think we would agree that foreach fits the definition, happy path, and whole purpose of a polyfill I think you got that all wrong and strongly misinterpret "modern functionality" as some generic library here... Runtimes are developed against a certain spec, in this case ECMAScript, and "modern functionality" is meant as addition to iterations of such a spec. As it happens, iterations of specifications and runtime…

> I think you got that all wrong and strongly misinterpret "modern functionality" as some generic library here... I didn't. I am telling you exactly why polyfills exist, and why people use them. More importantly, I am explaining to you why this scheme is successful. You don't need to write any wall of text that adds nothing. Read the facts I laid out, and use that to either understand how things work, or don't. It's…

I did just explain to you why this "scheme" in the "for-each"[0] package has nothing to do with the forEach method in the Array object[1] - method VS function for once, doesn't implement a spec'ed feature secondly.

More generously, I am explaining to you why your definition of a "polyfill" "is [NOT] successful" and isn't how it's commonly understood.

But you do you, it's fine.

[0]: https://www.npmjs.com/package/for-each

[1]: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Refe...

Re: Cursed Knowledge

#144

Post by Izkata »

chrismorgan wrote: post #54
Izkata wrote: post #17

Earlier quoted context omitted.

It's the US short form, matching the word-month order we always use for regular dates: "August 7, 2025". Note the slashes are important, we don't use dots or dashes with this order. That's what GP was getting at.

> It's the US short form, matching the word-month order we always use for regular dates: "August 7, 2025". Counterexample: US Independence Day is called the “Fourth of July”. I would agree that, for dates with named months, the US mostly writes “August 8, 2025” and says “August eighth, 2025” (or sometimes “August eight, 2025”, I think?), and other countries mostly write “8 August 2025” and say “the eighth of August,…

Not really a counterexample, that's a holiday, not a regular date.

Re: Cursed Knowledge

#145

Post by nullc »

Centigonal wrote: post #3
treve wrote: post #2

The '50 extra packages' one is wild. The author of those packages has racked up a fuckload of downloads. What a waste of total bandwidth and disk space everywhere. I wonder if it's for clout.

It's probably a clout thing, or just a weird guy (Hanlon's Razor), but a particularly paranoid interpretation is that this person is setting up for a massive, multi-pronged software supplychain attack.

> is setting up for a massive, multi-pronged software supplychain attack

The problem with this view is that the JS ecosystem is already doing that all on its own without that particular contributor. (as has the rust ecosystem, which slavishly copied JS' bad practices).

Eliminate the one guy and JS is still pervasively vulnerable to these attacks. The polyfills are the least of it, because at least they should be completely stable and could just be copied into projects. Other dependencies not so much.

Re: Cursed Knowledge

#146

Post by BobaFloutist »

motorest wrote: post #96
delusional wrote: post #90

Earlier quoted context omitted.

I agree, I usually put this sort of information in the commit message itself. That way it's right there if anybody ever comes across the line and wonders "why did he write this terrible code, can't you just ___".

As a side note, it's becoming increasingly important to write down this info in places where LLMs can access it with the right context. Unfortunately commit history is not one of those spots.

That sounds like work someone should get paid to do.

Re: Cursed Knowledge

#147

Post by goriv »

karel-3d wrote: post #72
sunaookami wrote: post #67

Earlier quoted context omitted.

Wow that's some deep rabbit hole. This guy gets paid per XY npm downloads and games the system through this. Awful.

There is apparently a tool, that you can upload your package.json and it will show you how much dependencies are controlled by ljharb https://voldephobia.rschristian.dev/

Damn, I just checked a random express project I built and there are a lot of things underlined in red there. I think the most amazing one is https://www.npmjs.com/package/is-number-object, which has a stupidly large dependency tree.

Re: Cursed Knowledge

#148

Post by motorest »

daveguy wrote: post #124
motorest wrote: post #117

Earlier quoted context omitted.

> There's no reason that an LLM couldn't (or isn't) being trained on commit messages. You are arguing that it could. Hypotheticals. But getting back to reality, today no coding assistant supports building system prompts from commit history. This means it doesn't. This is a statement of fact, not an hypothetical. If you post context in commit messages, it is not used. If you dump a markdown file in the repo, it is use…

You seem to be confusing the construction of system prompts with "training". Prompts do not change a model's weights or train them in any way. Yes they influence output, but only in the same way different questions to LLMs (user prompts) influence output. Just because it's not available in current user interfaces to use commit messages as a prompt does not mean the model wasn't trained with them. It would be a huge f…

> You seem to be confusing the construction of system prompts with "training".

I'm not. What part are you having a hard time following?

Re: Cursed Knowledge

#149

Post by zzo38computer »

> Zitadel is cursed because its custom scripting feature is executed with a JS engine that doesn't support regex named capture groups.

I think sufficiently old version of JavaScript will not have it. It does not work on my computer either. (You should (if you had not already) report this to whoever maintains that program, in order to fix this, if you require that feature.)

> Git can be configured to automatically convert LF to CRLF on checkout and CRLF breaks bash scripts.

Can you tell git that the bash script is a binary file and therefore should not automatically convert the contents of the file?

> Fetch requests in Cloudflare Workers use http by default, even if you explicitly specify https, which can often cause redirect loops.

Is that a bug in Cloudflare? That way of working does not make sense; it should use the protocol you specify. (I also think that HTTP servers should not generally automatically redirect to HTTPS, but that is a different problem. Still, since it does that it means that this bug is more easily found.) (Also, X.509 should be used for authentication, which avoids the problem of accidentally authenticating with an insecure service (or with the wrong service), since that would make it impossible to do.)

> There is a user in the JavaScript community who goes around adding "backwards compatibility" to projects. They do this by adding 50 extra package dependencies to your project, which are maintained by them.

It is a bad idea to add too many dependencies to your project, regardless of that specific case.

> The bcrypt implementation only uses the first 72 bytes of a string. Any characters after that are ignored.

There is a good reason to have a maximum password length (to avoid excessive processing due to a too long password), although the maximum length should still be sufficiently long (maybe 127 bytes is good?), and it should be documented and would be better if it should be known when you try to set the password.

> Some web features like the clipboard API only work in "secure contexts" (ie. https or localhost)

I think that "secure contexts" is a bad idea. I also think that these features should be controlled by user settings instead, to be able to disable and otherwise configure them.

Re: Cursed Knowledge

#150

Post by karel-3d »

dvfjsdhgfv wrote: post #106
karel-3d wrote: post #72

Earlier quoted context omitted.

There is apparently a tool, that you can upload your package.json and it will show you how much dependencies are controlled by ljharb https://voldephobia.rschristian.dev/

It looks like if I wanted to install a particular piece of software on many modern websites and I didn't have enough resources to hack node itself, talking to this guy would be a logical choice.

Eh, as much as I think this guy has very weird opinions; if he wanted to cause harm, he would do it many years ago. When I started looking him up, he DOES do a lot of good work in the ecosystem. Which makes this more complex issue.

But, also, he does this "backwards compatibility forever" insanity. I think it's his crusade.

Post reply on HN