Readit News logoReadit News
glennericksen commented on Shai-Hulud malware attack: Tinycolor and over 40 NPM packages compromised   socket.dev/blog/ongoing-s... · Posted by u/jamesberthoty
kelnos · 3 months ago
As a user of npm-hosted packages in my own projects, I'm not really sure what to do to protect myself. It's not feasible for me to audit every single one of my dependencies, and every one of my dependencies' dependencies, and so on. Even if I had the time to do that, I'm not a typescript/javascript expert, and I'm certain there are a lot of obfuscated things that an attacker could do that I wouldn't realize was embedded malware.

One thing I was thinking of was sort of a "delayed" mode to updating my own dependencies. The idea is that when I want to update my dependencies, instead of updating to the absolute latest version available of everything, it updates to versions that were released no more than some configurable amount of time ago. As a maintainer, I could decide that a package that's been out in the wild for at least 6 weeks is less likely to have unnoticed malware in it than one that was released just yesterday.

Obviously this is not a perfect fix, as there's no guarantee that the delay time I specify is enough for any particular package. And I'd want the tool to present me with options sometimes: e.g. if my current version of a dep has a vulnerability, and the fix for it came out a few days ago, I might choose to update to it (better eliminate the known vulnerability than refuse to update for fear of an unknown one) rather than wait until it's older than my threshold.

glennericksen · 3 months ago
You can switch to the mentioned "delayed" mode if you're using pnpm. A few days ago, pnpm 10.16 introduced a minimumReleaseAge setting that delays the installation of newly released dependencies by a configurable amount of time.

https://pnpm.io/blog/releases/10.16

glennericksen commented on How to create value objects in Ruby – the idiomatic way   allaboutcoding.ghinda.com... · Posted by u/unripe_syntax
glennericksen · 9 months ago
I don't usually think of Data when grouping values together in Ruby. Seems like I should. Lucian puts forth a good explainer of when and why they are helpful.

To summarize, Data became available a few years ago in Ruby 3.2. You can create value objects by subclassing the Data class with Data.define. Data objects are immutable, comparable and easily greppable. They are constrained in ways Struct, Hash and Class are not. The shorthand removes boilerplate and the constraints create the utility.

Measure = Data.define(:amount, :unit) weight = Measure.new(amount: 50, unit: 'kg')

glennericksen commented on Trust as a bottleneck to growing teams quickly   benkuhn.net/trust/... · Posted by u/surprisetalk
glennericksen · a year ago
"Business moves at the speed of trust."

This is a good post exemplifying this axiom. It is one thing for a leader to be trustworthy. It's a different challenge to cultivate trust within an organization in the midst of rapid change. Enjoyed reading this account of Anthropic's adventures scaling trust.

glennericksen commented on My (Neo)Vim workflow   seniormars.com/posts/neov... · Posted by u/Hadi7546
MegaDeKay · a year ago
Similar to this, Typecraft on YouTube has an excellent "Neovim for Newbs" course that is really great. He starts with vanilla Neovim and basically turns it into an IDE. He uses some of the same plugins as this article does, but also goes into depth for "the new hotness" (as this article calls it). What is quite nice is he breaks the different functions up into separate lua scripts rather than putting it all into one big config file.

https://www.youtube.com/watch?v=zHTeCSVAFNY&list=PLsz00TDipI...

There is a separate playlist that shows how to smoothly integrate Tmux with Nvim so you can do things like Ctrl H/J/K/L between Neovim splits and Tmux splits seamlessly.

glennericksen · a year ago
+1 to Typecraft for reworking your Neovim setup. As a longtime Vim user, I adopted Neovim with my Vim .vimrc in order to use Copilot. With Typecrafts guidance, I switched to Lua config, and really happy with where I ended up. Haven’t touched VSCode in months.
glennericksen commented on Slack AI Training with Customer Data   slack.com/trust/data-mana... · Posted by u/mlhpdx
creativeSlumber · 2 years ago
what is the difference between "will not" and "cannot" in legalese?
glennericksen · 2 years ago
"Will not" allows the existence of a bridge but it's not on your route and you say you're not going to go over it. "Cannot" is the absence of a bridge or the ability to cross it.
glennericksen commented on My time with Rails is up (2016)   solnic.codes/2016/05/22/m... · Posted by u/Palmik
atomicnumber3 · 2 years ago
Interesting. My own biggest gripe with rails is, by far and large, that any project that even so much as lightly touched the js ecosystem will become unbuildable within about 2 months if you don't tweak things. And for Rails, a huge driver of this is the sass compiler, which (afaict) will download a hosted binary component for recent enough versions but will fall back to building it if it's too old. And "too old" appears to be measured in months. But it's far from the only thing that breaks it.
glennericksen · 2 years ago
Rapid ecosystem churn is my gripe with Javascript. I've generally found Rails and popular Ruby gems to be very durable over time.
glennericksen commented on Turn your backyard into a biodiversity hotspot   wired.com/story/you-can-t... · Posted by u/sohkamyung
glennericksen · 3 years ago
There's was a story in Smithsonian magazine a few years ago (https://www.smithsonianmag.com/science-nature/meet-ecologist...) about an ecologist who more or less did what this article proposes, increasing the biodiversity in his backyard. He called his project a "Homegrown National Park".

Tallamy's Suggestions:

1. Shrink your lawn (replace grass with plants that create habitat)

2. Remove invasive plants (native plants support more animal biodiversity)

3. Create no-mow zones around trees (accommodates insect life cycle)

4. Equip outdoor lights with motion sensors (lights can disturb animal behavior)

glennericksen commented on So what’s next (personal news from developer of popular CoreJS polyfill)   github.com/zloirock/core-... · Posted by u/nailer
glennericksen · 3 years ago
A long post, but the final paragraphs sum up both the problem and the ask:

"This was the last attempt to keep core-js as a free open-source project with a proper quality and functionality level. It was the last attempt to convey that there are real people on the other side of open-source with families to feed and problems to solve.

If you or your company use core-js in one way or another and are interested in the quality of your supply chain, support the project."

glennericksen commented on The founder of Teenage Engineering opens up to his creative space   scandinavianmind.com/feat... · Posted by u/glennericksen
glennericksen · 3 years ago
“What’s so beautiful about creating products is that saying it in a poetic way, if you have that passion it naturally starts waves and those waves connect people. Then you don’t know where it’s going to end up, anything can happen, but if you don’t do anything, if you don’t write that text, if you don’t draw that picture or design that object, you can’t expect anything to happen. You need to start that chain reaction in life.” - Jesper Kouthoofd, founder of Teenage Engineering

u/glennericksen

KarmaCake day1028February 20, 2012
About
CTO & cofounder of FaithStreet

@glennericksen https://www.faithstreet.com

View Original