alexghr

I think (hope?) our industry will reach some equilibrium between fully agentic development and reviewing/hand tuning the code.

Personally for my job I struggle to justify writing code by hand. Agents are much better at typing the code, reading the code, finding patterns and discovering bugs. They don't have my knowledge and my background so the current models still miss things or overcomplicate the code. I don't know if that's going to be true of the next generation of models (or the one after that).

With current models, I cannot fully give in to the vibes. I _have_ to look at code (maybe not 100% of it but at least a majority of the lines). I _have_ to grill the agent to make sure it writes the best code that I deem possible for the problem at hand. This isn't the fastest way to do agentic development, but AI agents have already made us significantly faster than we were in the pre-AI era. I don't want to squeeze every ounce of 'development speed' if that comes at a cost to code quality, maintainability or debuggability.

For my side projects, things are different: either I only care about the outcome (and I give in to the 'vibes') or I care about the journey just as much as the destination in which case the agents are extremely advanced search engines, code reviewers and mentors but they don't get to write any of the code.

Yeah, I guess I personally fall on the whole spectrum: for side projects I'm at the extremes but for my professional work I fall somewhere in the middle.

Proper ZK proofs don’t work that way. N different proofs will not be linked to each other unless the circuits are written to emit a stable identifier.

Obviously if you see a bunch of proofs for known circuits coming from the same IP address then yeah, you can infer a bunch of info from that metadata.

Are the current LTS node versions (iirc 22, 24, 26) going to update the bundled npm to v12 to benefit from these security fixes? All come with npm v11 now

I've built a stacked-PR tool for myself, it's just a simple wrapper around git commands. State stored locally in .git/config - https://github.com/alexghr/graphene

Lots of small dashboards/log investigations deployed to private Github Pages for $WORK. This has been a great way to share insights.

I'm currently working on a tool to control my tmux sessions from my phone. Specifically all the codex panes so I can remote control my running sessions from my phone while I'm away from my desk while also keeping them in sync with tmux for when I'm back at my computer. On this one I'm using Codex as a helper, it's not allowed to write any code so it's going along a lot slower :)

> So keep the technical talk to your peers, unless the client explicitly asks for it.

This! Adapt the message to the target audience. The code we write is an abstraction, it takes some input and produces an output. For many it's a black box or can be thought of as a black box. Start high and go lower and lower until you reach the right level of detail for the person you're communicating with.

This is great to hear and I hope it will mean more people give Firefox a decent try! We need more people on alternative browsers in order to keep healthy competition between rendering engines.

Firefox also handles lots of tabs really well and its Tab Containers plugin enables perfect separation of work tabs and personal tabs (I've got 1.4k tabs split across personal/work containers. I've got a problem, I know)

I was curious if the various projects that used data from the HN 'personal blogs' thread had a noticeable effect on my website. I looked through my nginx logs and saw that it's now getting a tonne of requests to the RSS feed (atm about 1.5k req/day compared to... 0/day prior)

Sure, here's mine: https://www.alexghr.me/.

I've been running this site since ~2015 (same CSS for at least 8 years now) but there's not a lot of content on it. I've been trying to get more into it recently though and I'm posting TIL-style content :)

It started out as a site built out of Mustache templates with plain CSS for styling. A few months ago I migrated it to Astro so that I don't have to maintain a build script written in bash but the CSS and site layout stayed the same.

Just raising this since people might not know about it, but this is a Web standard now https://www.w3.org/annotation/. There are a couple of companies which have created browser plugins for this.

This is super cool and I'm definitely bookmarking it for later use :)

I'd suggest moving the "copy css/figma/link" buttons to the right panel or at least making them more obvious (maybe by increasing contrast?) as I had trouble figuring out how to export the shadow I made.

I think what the article tries to say is that OpenAI have already scraped Reddit for training data and with the recent API changes and subreddits going dark, new competitors in the AI space won't have it as easy to get the same training set.

My bad, my past experience/bias got the better of me here. I only got exposed to CommonJS as a part of Nodejs but it does look like CommonJS was started independently of Node.

I agree, bundling isn't going anywhere for sure, but the web isn't all single-page-apps built with perfect engineering and top-notch frameworks.

Plenty of websites are just server-side rendered and just need to sprinkle some client side JS. For them it's perfect to be able to drop in a script and not have to worry about bundling or polluting the `window` object while loading external scripts.

I disagree.

What we gained is a native module system that works the same everywhere (Nodejs, browsers, deno, Bun) vs CommonJS which was really only built for Nodejs (with compatibility layers for others).

We have a specification for this system and any changes done to it have to follow the same process as any other change done to the language (for better or worse).

We have top-level async support that works across import boundaries. This is less useful on the server, but in the browser? With just a `import thing from "https://example.com/foo.js"` I get a fully intialised library even if does async requests as part of its initialisation.

What we lost is just this

``` const someInitializedModule = require("module-name")(someOptions); ```

The `app.use()` example can be replicated with an async `import()`. Maybe it's not as elegant as before.

There's going to be a lot pain of transitioning a big ecosystem like Javascript's to ESM but is that really a reason to not evolve the language?

I've been using PurelyMail[1] (it's been on hacker news a couple of times already) for about a year now and haven't had any issues with it. It uses consumption-based pricing so for my use (with two domains set up) it comes out to about $0.5/month. I think it's a small team (maybe just one person?) that maintains it.

[1]: https://purelymail.com/

Well, if nothing else, at least Vercel's new integrations have put new things on my map of free things to use in side-projects (I had never heard of Upstash before now) :))

Really fun concept. I'd suggest changing the color of the "Submit" button because (at least on Firefox) to my eyes it looks like it's disabled.

It took me 4 tries to get today's game. I remember playing it a lot as a kid on a clone of NES that was really popular in Eastern Europe at the time :)

Aside: why are .game domains sooo expensive? I'd love to get one for a game I'm working on but I can't stomach paying £300/year to register the domain :/

Maybe the author should've opened David Wadhwani LinkedIn profile instead of just linking to it. He worked for Adobe for 13 years until 2015 and rejoined in 2021.

PS: not defending the purchase or Adobe but this statement in the article is factually wrong ¯\_(ツ)_/¯

NixOS's virtualisation module can use either Docker or Podman and if Podman is enabled it has a Docker compatiblity mode (via `virtualisation.podman.dockerCompat = true`) that puts symlinks in all the right places (`docker` binary, `docker.sock`) so that software doesn't even know it's not running vanilla Docker :)

I'll quote my comment from the duplicate thread because I think it's important people audit their authorized applications on Github

  > This is probably a good time to remind people to check their authorized OAuth applications on Github[1] and make sure that any unused apps have their access revoked.
  >
  > [1]: https://github.com/settings/applications

This is probably a good time to remind people to check their authorized OAuth applications on Github[1] and make sure that any unused apps have their access revoked.

[1]: https://github.com/settings/applications

I use Nix to manage: - a desktop running NixOS (primary work machine) - a Macbook (secondary/travel work machine) - a Linux VM on WSL - two servers (a raspberrypi in my closet and a Hetzner vps)

I keep my config on Github (latest branch https://github.com/alexghr/nix/tree/host/vader). I'm still new to this so a lot of my config is duplicated across different hosts but I want to refactor it to eliminate duplication.

If you haven't yet, I'd recommend giving Nix/NixOS a try. There's a bit of a learning curve but it's very powerful.

I'm going to add my N=1 anecdata if no one minds:

I've been running full Btrfs on my workstation since December 2021 with 0 issues (kernel 5.10). It survived multiple hard reboots and power offs, Ryzen 5000 CPUs seems to lose power every now and then on Linux (it's a known issue for years now that no one has figured out yet).

Having compression is great. compsize reports I've saved 33GB on my /home subvolume so far (https://github.com/kilobyte/compsize). I don't use snapshots, I just backup the whole thing.

Obviously this doesn't mean that in the future Btrfs won't eat my data, but so far it hasn't and I'm happy.

I've been running the (relatively) well known EdgeRouter-X (aka ERX) + Unifi AC Lite setup for a couple of years at this point and I haven't had any issues with it.

The ERX is tiny, sips power and can route traffic with QoS turned on at ~100-120Mbps (without QoS it routes at 1Gbps). The wireless access point provides good 5Ghz coverage for an average two bedroom flat (placed centrally in the flat).

Both devices support Ubiquiti's old PoE standard and the ERX has a PoE passthrough port so I power both with a single PoE injector.

The QoS feature of the ERX was a life saver in our old flat where the best connection we could get was DSL (~16Mbps). Without it we couldn't have worked from home during lockdown (two developers constantly in meetings and pulling/pushing Docker images and npm packages :)

Now we've got fibre but I'm still running the same setup because it worked so well in the past (with the ISP's fibre modem in front of the ERX).

While I agree that Node's ecosystem is not the best, it's what we have in the frontend world.

If you're working on a Node-based service or React app, you already have to deal with Node and its package ecosystem. Adding a couple of extra MB (or even KB, depending on package reuse) on top of your existing chain of dependencies is a tiny con to the huge benefit of not having to do logic in Bash :)

Maybe, but the main advantage of `zx` (at least for me) is that I don't have to manage another language environment. I can keep everything contained within Node :)

I think they could replace XSRF tokens, but until all major browsers support the headers (Safari 11 seems to be missing support, see other comments) you can't really block requests that don't have the new Sec-Fetch-* headers.

Yep, I don't know why my first thought was that malicious actors could just bypass this by using external HTTP clients (like curl) when in fact this spec is meant to augment CORS: browsers _will_ send these headers to the server and the server can choose to honour them or not (well, in the CORS case the browser will block the request if the response headers are incorrect).

It's defense in depth :D

Reading the documentation on MDN[1] it looks like it sends more data than just the Origin of the request. Metadata headers include if the user initiated the request (e.g. navigation or click events?) and how the data is meant to be used (e.g. as audio data for <audio> or a top-level document).

This spec seems really powerful, provided all browser support it :)

[1]: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers#fe...

The two are not mutually exclusive. You can still run a Matrix server (or pay Element for one) and donate a few $ to Signal. Competition is good.