anishgupta

just on the basis of narrow jailbreak window? At this point it may be all for marketing, an opus 4.8 would be more powerful for specialized task than vanilla fable5

at this point the way AI throughput is considered, we've to use AI to review. devil's advocate agent

The main thing why I started using it too late was the slop. it's in the end AI generated, yes it can take your tasks but i never felt in my personal use case how it can help me when it's just generating slop. I used claude cowork more than openclaw after trying once that too in a cloud container since I'm afraid of its security

GitHub CEO also raised 60M for 'entire' to bring agent context to git. The dust is yet to settle here as it's difficult to bring a paridgm shift from today's git workflows

building because its always the dopamine from the coding agents than the problem getting solved. Github contribution graph is rigged because higher number of commits doesnt make you a better engineer. We needed this blog, ty

yep joining here late but docker images are not affected as we saw on twitter

afaik the trivy attack was first in the news on March 19th for the github actions and for docker images it was on March 23rd

I'd be interested to know how this verification is happening, user transparency would be helpful

isn't a similar thing done by entire cli? the startup which raised $60M seed recently

same thought, we've been using smartphones since 2 decades now, and not just we dont have a problem with qwerty, but anything new will be requiring more cycles to get accustomed to

awesome, does it also show if its stuck somewhere like auth or requires human in the loop?

meanwhile me adding to the .md file, "you're not a LLM and instead a super intelligent agent to help me find HN trends"

I've been trying to avoid this since 2022 (wish i knew this before that), def concerning how coffee shops still encourage this, we need a new revolution for something which can make cups for one time use but also not toxic like plastic

Nice, for data is there an available API out there?

Some thoughts on a simple UI fix, show readme on top. Possible opportinuty to make it default and customizable both

I've seen hugh abroad's videos and they are genuinely interesting as he explores south asia. Overall there's an interest element since people in west are accustomed to a baseline luxury and when they try difficult things like "walking in peak chaos while trying spicy food", it gathers attention from the same countries which represent almost ~25% of world population

This is cool! looking forward to the android app

You just earned yourself a customer. I love simple apps like this. And anything which can help to reduce friction here can be translated to a DAW and added effects for a real production

Great idea overall. I'm sure you'll reach 100 users soon (android user here) Do you index all repos in a cadence and then let users swipe from a pool, or is it real time GitHub api calling?

This is great and I have seen some apps similar to it. One of the things I believe would be a hard problem to solve is, how does a mere picture depict the exact calories? For example, a pasta or a soup can be loaded with butter versus made without it. This is usually not visible with the pictures.

Maybe one of the ways is to identify with the shine and the image differences since fat floats on top. But then how do we add a quantitative metric to it as in how many tbsp of butter were used?

Great work! Feedback: Right now it looks like there's too much going on the website. Maybe clean up to help users take action fast

> future supply chain attacks easier

to clarify if I understood correctly, because packages would be fragmented and hence more attack vector?

This just reminds me of the meme of a big stone structure supported by a pebble to prevent falling, The pebble being an OSS maintainer in Nebraska.

I like the spirit of article however,

1. Tracking every mention of a dependency and assigning value fairly is extremely hard: many packages are widely reused while many are tiny utility libs.

2. Usage in a file doesn’t reflect actual runtime usage. A repo might list a package but never import it.

Overall, solutions that align incentives, and maintain ecosystem neutrality are more likely to gain traction than a platform-wide mandated surcharge.

another reminder of no matter how big we build physical infrastructure like trains/tracks, software & data is the achilles heel

it's getting way better and we've to acknowledge how far we've come in last 4 years. Interestingly, one of the key examples of this is within vs code. AI is able to predict the next world not based on the generic trained data, but in the context of the repo (while manually editing)

This is good stuff. This is very much similar to prismor's sbom visualizer since it is also .json

I do see ads on your website, is it high traffic as well?

Might wanna add a snooze feature. We use this in code security, as a break-glass scenario

I wouldn't say our friend circle has an accountability group but recently in last 2-3 years they have been lot of green washing and fitness related content on social media which might fuel this obsession, even the popularity of the word 'protein' is in its all-time high if you see on Google trends.

Also, backed by science, they have been increase in nutritional studies since 2010s, the same orange which our grandma consumed, had 5x more nutrition than the ones we eat today just because of the genetic modifications we have done over the years. So yes, being on the same diet we may need more fitness and hence the recent popularity

I would be interested to know how long this vulnerability was unknown. Seems like security is only as good as how fast we can find patches to CVEs and communicate globally vs the exploiters

Had fun reading this, pretty well written. >Consolidate into a monorepo lol this sounds like as if you make a dog tired by playing with it so it sleeps which you're gone :'D

>Contextualize the actual risk This is not as easy as it seems, for example reflection cases where runtime behavior affects a package usage. example: const lib = require(process.env.PARSER) lib.parse(userInput) could use a safe parser in production or a vulnerable one in another environment, but from a code level perspective there's no certainity which package is actually used