Skip Navigation

Kissaki

@ Kissaki @programming.dev

Posts

225
Comments

1465
Joined

3 yr. ago

@GitHub, website

Moderating

Nushell programming.dev

2mo ago

Meta gave React its own foundation. But it's not letting go just yet.
Jump
Kissaki @programming.dev 2mo ago

A meta analysis is an interesting reaction to, or should I say founded in, the post title. But we better let go.

2mo ago

You can use newline characters in URLs

Jump

Kissaki @programming.dev 2mo ago

2mo ago

OpenAI Is Developing an Alternative To GitHub

Jump

Kissaki @programming.dev 2mo ago

"early stages", "could not verify", "company did not respond", "considers making available for purchase"

That's neither solid news, nor a real or full GitHub alternative.

2mo ago

We Overhauled Our Terms of Service and Privacy Policy - Another VC funded bait and switch

Jump

Kissaki @programming.dev 2mo ago

The CLA can never override the code license. It handles the transition of your code into their code, and what they can do with it. But once it's published as AGPL, you or anyone else can fork it and work with it as AGPL anyway. The CLA can allow them to change the license to something different. But the AGPL published code remains published and usable under AGPL.

I'm usually fine with contributing under CLA. A CLA often make sense. Because the alternative is a hassle and lock-in to current constructs. Which can have its own set of disadvantages.

A FOSS license and CLA combination can offer reasonable good to both parties: You can be sure your contribution is published as FOSS, and they know they can continue to maintain the project with some autonomy and choices. (Choices can be better or worse for others, of course.)

2mo ago

Breaking Down CVE-2026-25049: How TypeScript Types Failed n8n's Security

Jump

Kissaki @programming.dev 2mo ago

Seems like TypeScript could be generating JavaScript code that does these type checks on function entry - with a runtime cost of course.

Is there no such setting, general or conditional toggle on functions or types?

2mo ago

Breaking Down CVE-2026-25049: How TypeScript Types Failed n8n's Security

Jump

Kissaki @programming.dev 2mo ago

Sanitizer logic: Skips execution (wrong type)

But why? Why does it "skip" when there's logic there? That doesn't make sense.

If someone passes an object with a length property, this works. If they pass an array, it works.

This later example explains how it can work for some logic. But it doesn't correlate to the actual exploitation or code in question.

2mo ago

I Audited the Privacy of Popular Free Dev Tools — The Results Are Terrifying

Jump

Kissaki @programming.dev 2mo ago

That /unsaved/{id} path with a unique server-assigned identifier means your diff content was transmitted to and stored on their servers.

Not necessarily. URLs can be changed client-side, within the browser, through JavaScript. The fact that the URL changed to unsaved alone is no proof. It could very well be browser-local, labeled unsaved and held in session store for example, ready to be saved.

With the other indications, you can of course make a guess and/or consider it a strong indication.

It should be pretty obvious/observable when observing interaction and network requests within the browser. A network request with the content as body would be much better proof.

2mo ago

I Audited the Privacy of Popular Free Dev Tools — The Results Are Terrifying

Jump

Kissaki @programming.dev 2mo ago

It's in the name after all. 1 regex, 0 other stuff, and 1 com.

2mo ago

Yes, and...

Jump

Kissaki @programming.dev 2mo ago

I'm a bit confused by them publishing their personal essays on their htmx project page. This essay certainly doesn't have anything to do with htmx directly. Either way, valuable content and possibly their strategy to get people to htmx, or reuse a domain and website they already have.

2mo ago

Deno 2.7: Temporal API, Windows ARM, and npm overrides | Deno

Jump

Kissaki @programming.dev 2mo ago

I totally get the focus on avoiding "layers", it's something I'm very mindful of too.

Thank you for the insight, I'll have a closer look into it, although I'm a little bit skeptical about having to integrate additional extensions and workflows, which is it's own bag of worms for maintainability, longevity, and complexity in general.

2mo ago

Deno 2.7: Temporal API, Windows ARM, and npm overrides | Deno

Jump

Kissaki @programming.dev 2mo ago

11ty = Eleventy? Are you familiar with Hugo? Do you have an opinion or experience between the two systems?

I'm somewhat dissatisfied with Hugo, which I have used for many years, but whenever I checked alternatives, nothing really spoke to me as a clear improvement worth the learning barrier and migration investment If I can use deno, a js static site generator could be viable too - something I traditionally avoided 🤔

2mo ago

Popover API or Dialog API: Which to Choose?

Jump

Kissaki @programming.dev 2mo ago

Glad to see them mention dialog is in proposal for improvements. If popover covers more accessibility than dialog, that seems like a significant, surprising, and obvious shortcoming. Surely there's technical and/or historical reasons for that, but still.

2mo ago

Nobody knows how the whole system works

Jump

Kissaki @programming.dev 2mo ago

abstracting away determinism /s

2mo ago

Open source devs consider making hogs pay for every Git pull

Jump

Kissaki @programming.dev 2mo ago

This part from the article supports this sentiment:

In a pleasant surprise, reactions have been positive. Throttled organizations were "surprised and apologetic," mistaking issues for malice rather than "ignorance, unawareness."

2mo ago

Open source devs consider making hogs pay for every Git pull

Jump

Kissaki @programming.dev 2mo ago

I sneakily changed our pipeline to pull from the in-house docker registry, and for pipelines to require pulling from package repos only when locks changed. Our CI is faster than every other team, but nobody noticed.
So yeah, charge the companies! Please!

How come this is not an obvious improvement opportunity that materializes in other teams too, and visibly so, rather than "sneakily" hidden?

Isn't it better not only for performance but also for reliability?

2mo ago

Uiua — an extremely terse programming langauge

Jump

Kissaki @programming.dev 2mo ago

Yeah, I was quite irritated copying that for the quoting 😅

2mo ago

Which is better, Unity or Godot?

Jump

Kissaki @programming.dev 2mo ago

The article doesn't even mention this critical risk and history. Huge gap.

2mo ago

Is it a bad practice to replace compiler warnings with a bunch of TODO notes?

Jump

Kissaki @programming.dev 2mo ago

Think about whether TODOs will be revisited, and how you can guarantee that. What do you gain and lose by replacing warnings with TODOs.

In my projects and work projects, I advocate for:

Warnings and TODOs are fine only in initial development before release/stability and in feature branches during development
TODOs are almost never revisited, so document state and information instead of hypotheticals; document opportunities over TODOs, document known shortcomings and risks, etc
If there is good reason to keep and ignore warnings, document the reasoning, and we can update our CI/Jenkins quality gate to a new baseline of accepted warnings instead of suppressing them (this pretty much never happens)

Dotnet warning suppression attributes have a Justification property. Editorconfig severity, disabling, suppression can have a comment.

If it's your own project and you know when and how you will revisit, what do you gain by dropping the warning? A no-warning, but then you have TODOs with the same uncertainties?

2mo ago

3D Printer Reviewers: Being honest in this industry will put you out of a job.

Jump

Kissaki @programming.dev 2mo ago

I do. But I'm very selective and critical in choosing and trusting the right ones. They're also not my only source.

I don't think YouTube reviews are any worse than other forms of reviews. There are plenty of bad text reviews out there, too.

2mo ago

Welcoming the Open Source Endowment

Jump

Kissaki @programming.dev 2mo ago

It's a fund you donate to; they invest the money, then fund open source with the investment gains.

I posted a comment on this other post that summarizes the most relevant (because it wasn't clear to me either, and as a note/explanation to myself too).