brw

what does this offer over did:web[0]? or if a central registry + op log is required something like did:plc[1] which came from atproto/Bluesky[2]?

[0] https://w3c-ccg.github.io/did-method-web/

[1] https://plc.directory

[2] https://atproto.com/specs/did

I don't necessarily care about AI use in projects, but it is somewhat ironic seeing a UI library imitating "hand-drawn" elements which is itself made entirely (I assume, reading the readme and commits) using AI.

There's a good chance this will change in the future and the repo on the knot will also contain the social aspects of repos (issues, PRs, etc.)

> As time goes on we are re-assessing the idea of users owning what is "collaborative data" (issues, PRs, etc.) on their PDSes - soon may come the day that an issue also lives on the knot as a source of truth, with an accompanying pointer record on user PDS to attest that it's theirs.

from https://tangled.org/tangled.org/core/tree/master/knot2

Most AUR helpers (well, the ones I've used at least, those being yay and pacaur) include the option to show a diff of PKGBUILD (and other provided files) for AUR package upgrades

Yea I was pleasantly surprised by how simple the code is when I read it. Honestly a great example of what termbox2 is capable of. Very nice!

And now I know about termbox2, which looks very cool. Looking through the example projects[1] in the README I also found ictree[2], which does exactly what I was looking for yesterday (turning the output of `find` into an ncdu-like/interactive tree interface). I didn't manage to find something for that through googling around or asking LLMs, but thanks to you posting this here I did, so thanks!

[1] https://github.com/termbox/termbox2#examples

[2] https://github.com/NikitaIvanovV/ictree

This one does not have a sign-up wall no, however some of their other articles do (e.g. https://www.404media.co/inside-the-telegram-channel-jailbrea..., also from today)

I've asked dang about this before and he answered that it gets killed automatically because of the sign-up wall on some of their articles and that their articles weren't considered suitable for HN in the past:

> does that mean every 404media.co article submission gets killed immediately by software and has to be vouched for before people can vote/comment on it?

Yes.

> Is that the case for every site with a signup wall as a sort of penalty

It depends on whether there are workarounds. Last I checked, 404media.co didn't have those. Your counterexample proves that it does, at least sometimes. Or maybe they changed something?

I'm open to unbanning that site but I'd like to be more sure than I am that this will continue to be the case in the future; and I guess I'd also like to see a few more good (for HN) articles from there before unbanning it. For a long while, all the articles I saw were pretty shallow and fluffy.

That was in 2024 so perhaps it's time for a re-evaluation. I'll shoot him another message.

What about changing the committer timestamp slightly until you find a match like https://github.com/mattbaker/git-vanity-sha? That would make it entirely invisible

I totally agree! This is actually a very good summary of the value prop for atproto honestly. Definitely saving this. ("credible edit" -> "credible exit" I'm assuming.)

It certainly took a while for me to grasp how all the different components in the atproto stack function and work together, but the decoupling actually makes so much sense and I've also become a huge fan of it for all of the reasons you mention. It really feels like a natural extension of Web 2.0 to me.

Re: Tangled

Tangled does actually host a default knot server at https://knot1.tangled.sh. You should be able to select it when you create a repo?

But yes Tangled's component infrastructure is kind of unique. Only the social data (issues, PRs, comments, stars, follows, etc.) is stored in your data repository on your PDS. The git server requires a separate "knot" server.

It's described a bit more in-depth here[1]. As far as I understand it's basically just the git repo hosting part of Tangled's AppView, split off into its own thing to make it possible to self-host it. This means you stay in control of your repo data but also get the benefits of having an actual server with a remote git repo as the authoritative source for the purpose of collaboration, which is what people are generally used to when collaborating using git.

You're probably correct in that the "normal" way would be to have the Tangled AppView act as the git server, but have it store the remote git repo on your PDS. But as records in your PDS data repository are either JSON documents or unstructured blobs I guess it's kind of hard to use that for a git repo, which is largely filesystem dependent. I imagine it would require some kind of translation layer. Or something like git-bundle[2] maybe?

[1] https://wilb.me/3lzyhogtv2s2r

[2] https://git-scm.com/docs/git-bundle

On that note there's also https://tangled.org built on atproto which (kind of?) solves that. You have one identity (the same one for all atproto apps) which you use to interact with any tangled repository (including those on self-hosted servers).

With its support for self-hosted CI runners it could also be a good alternative for people looking to move now that GitHub has decided to charge for those.

Blacksky's AppView did get a mention in his 2025 predictions review[1], but perhaps it's not exactly considered "self-sustainable" yet? I haven't kept up with it in a while either so I'm also not sure on whether it is or isn't.

[1] https://www.timothychambers.net/2025/12/20/my-open-social-we... (at the very bottom)

Woah that's actually huge. I've been very interested in tangled from an atproto perspective but I had no idea it had that as well. Wonder why that isn't talked about more. Seems like an amazing feature to potentially pull some people away from GitHub/GitLab after they've have been asking for years for a better stacking workflow.

I've been going through a lot of different git stacking tools recently and am currently quite liking git-branchless[1] with GitHub and mergify[2] for the merge queue, but it all definitely feels quite rough around the edges without first-party support. Especially when it comes to collaboration.

Jujutsu has also always just seemed a bit daunting to me, but this might be the push I needed to finally give both jj and tangled a proper try and likely move stuff over.

[1] https://github.com/arxanas/git-branchless

[2] https://mergify.com

See also:

EU Council approves Chat Control mandate for negotiation with Parliament | https://news.ycombinator.com/item?id=46062777

See also: "Apple's App Store Full Front End Source Code" https://news.ycombinator.com/item?id=45804664

I wonder why npm doesn't block pre/postinstall scripts by default, which pnpm and Bun (and I imagine others) already do.

EDIT: oh I scrolled down a bit further and see you said the exact same thing in a top-level comment hahah, my bad

Isn't that what lockfiles are for? By default `npm i` downloads exactly the versions specified in your lockfile, and only resolves the latest versions matching the ranges specified in package.json if no lockfile exists. But CI/CD pipelines should definitely be using `npm ci` instead, which will only install packages from a lockfile and throws an error if it doesn't exist.

These days compromised packages are often detected automatically by software that scans all packages uploaded to npm like https://socket.dev or https://snyk.io. So I imagine it's still useful to have those services scan these packages first, before they go out to the masses.

Measures like this also aren't meant to be "final solutions" either, but stop-gaps. Slowing the spread can still be helpful when a large scale attack like this does occur. But I'm also not entirely sure how much that weighs against potentially slowing the discovery as well.

Ultimately this is still a repository problem and not a package manager one. These are merely band-aids. The responsibility lies with npm (the repository) to implement proper solutions here.

> The responsibility lies with

there's apparently an npm RFC from 2022 proposing a similar (but potentially slightly better?) solution https://github.com/npm/rfcs/issues/646

I've used sendme a few times after coming across Iroh on Bluesky. It's honestly great. Just Works™, very fast, supports files and folders, resumable transfers, one sender to many receivers, and has fast relays as a fallback when a direct connection truly isn't possible, and it will actually tell you whether you have a direct connection or are using a relay (unlike others like Magic Wormhole or Croc from my experience).

One issue I always run into with browser-based terminal emulators or remote desktop clients is that common keyboard shortcuts like Ctrl-W might be used by the browser instead. Accidentally closing your browser tab and thus losing all your state when you just wanted to remove the previous word is quite annoying. It could be nice if a web app was able "capture" the keyboard somehow so that the browser doesn't react to any of its normal shortcuts, which is also commonly done in VM software and remote desktop apps, or I guess similar to input mode in Vim.

An open issue here[1] mentions that PWAs can actually define shortcuts that override browser ones which could be a solution. And someone also mentions using extensions that redefine the Ctrl-W shortcut as a workaround. But afaik both of these solutions rely on defining keyboard shortcuts beforehand which doesn't seem easy to do, given that you'd have to somehow define all of the shortcuts possibly used by your shell, editor, or any other terminal apps.

[1] https://github.com/tsl0922/ttyd/issues/1181

Massively agreed. I've had this problem for years and always have hundreds, sometimes thousands of tabs open, spread across a couple dozen windows. Memory usage is actually pretty alright with Chrome these days as the vast majority of tabs stay unloaded, and its Memory Saver feature also unloads opened tabs over time, so it's perfectly usable even with 16GB of RAM. Before that I had to use The Great Suspender to keep the memory usage in check.

I feel like I've tried every tab/bookmark managing app/extension under the sun and none of them stuck. I've also thought about creating my own, but it feels like even I don't know what I'm looking for exactly. The main problem I have is that they all have too much friction compared to simply keeping the tabs open. It would have to be something deeply integrated into the browser.

Vivaldi has some really cool tab management features and it would be my main browser of choice, but with my amount of tabs, windows and extensions its UI performance degraded to the point of becoming unusable, whereas Chrome held up just fine. Granted it has been a couple of years since I last tried it so that might have improved since. I'd still recommend anyone with similar "power user" needs to give it a try. It's a pretty awesome browser.

Tab Groups in Chrome are actually surprisingly decent as well. They're pretty low friction, and open tab groups even sync across devices, including mobile, in (near) real time now, which is great. But I do have some issues with them causing me not to use them. For example, when you re-open a closed tab group it will instantly load all of the tabs inside of it, instead of keeping each tab unloaded until visited, like on startup. You also can't add tabs to a closed tab group. So you either always have to keep the tab group open, meaning they're not much more than a visual aid and only slightly more useful than bookmark folders, or store fewer tabs per group, making them even less useful. They also have the same "object permanence" issue as bookmarks, where it's simply too easy to forget about a closed tab group altogether once I close it.

It's worth noting that the actual sync engine is C++. https://github.com/Foundry376/Mailspring-Sync

Oh! You're right. I suppose I just missed the fact that there's now a skip button/text on the set up screen. Thanks for the correction. And yea its Linux/cross-platform support is also one of the main reasons for why I use it.

I do also remember the part about Exchange not being supported if IMAP is disabled. I had the same issue when I tried to use it at a university, but luckily haven't needed that since. Not surprising to hear that it hasn't changed either.

I've tried a ton of email clients over the years and always end up coming back to Mailspring. Started using ever since it used to be Nylas N1 years ago (which later rebranded to Nylas Mail, then got discontinued and forked into Mailspring).

I actually do think it's the best performing and best looking cross-platform email client, although there are some potential pain points people should probably be aware of:

1. Development has become very stagnant. It's still semi-maintained with small bug fixes every now and then, but it hasn't seen any changes in years. This might also be a good thing depending on how you look at it, it's largely a finished product.

2. There are quite a lot of bugs that have never gotten fixed over the years[1]. I run into these bugs every now and then where e.g. deleting a draft will often also delete the entire thread without you realizing it, leading to unknowingly deleted emails[2]. And sometimes the local sqlite db gets locked/corrupted and you have to reset it[3]. I personally put up with this but I wouldn't expect anyone else to. Especially not non-tech folks. This makes it hard to recommend the app to other people.

3. You're required to have a "Mailspring ID" account to use the app. It doesn't actually do anything useful like synchronize your settings or connected mail accounts. As far as I can tell it's only used to check for a Pro subscription, and probably some telemetry. I don't use any of the Pro features so I can't say how well it works for that. Still required to have it though.

Nonetheless I still use it because no other client seems to have the UI/UX and information density down quite like Mailspring does. And it performs very well even with hundreds of thousands of emails thanks to its C++ sync engine (the UI is Electron, but I'd say it's still pretty snappy, it's one of the better ones). If Gmail ever supports third party IMAP accounts without needing Workspace for it and without needing to have a Gmail address attached to your Google account I would probably just use that instead though.

My favorite client used to use Alto Mail[4], which was a wonderful web and mobile app email client that did support external IMAP accounts. I believe it was created by AOL, but sadly shut down in 2017, shortly after Verizon merged AOL and Yahoo. I've wanted to create a spiritual successor to it ever since, but email standards and HTML email rendering has always seemed like such a massively complicated space. Plus email clients like these are so niche considering that almost everyone simply uses Gmail, Outlook, or their default system mail apps instead that the required effort just doesn't seem worth it. Perhaps I'll still do this someday if I can find the motivation, or maybe I'll try to contribute to Mailspring instead, but for now I just put up with its issues.

[1] https://community.getmailspring.com/c/bugs/10 [2] https://community.getmailspring.com/t/deleting-draft-emails-... [3] https://community.getmailspring.com/t/database-is-locked/420 [4] https://en.wikipedia.org/wiki/Alto_Mail

Once atproto has first party support for private records I'm definitely expecting a massive increase in interest. It would open so many doors and is probably the main thing holding back many potential use cases as of now.

This is the original article (as mentioned by Gizmodo) which I submitted to HN yesterday, but it got killed immediately because of the signup wall. It went into the second chance pool (https://news.ycombinator.com/item?id=26998308) just now but not before another article on the same matter was submitted it seems. Not sure what the procedure is in that case. I'll ask dang.

Looks like there is an update now and it wasn't just piracy-related domains.

It's reported as being a technical issue at the registry.

https://torrentfreak.com/hundreds-of-tv-domains-still-down-a...

It shouldn't affect Trakt at all. All impacted domains are registered with Sarek, whereas trakt.tv is registered with Namecheap.

I'd say Trakt is also pretty far removed from any piracy-related activities, moreso than most of the impacted domains at least, which either host copyrighted content (streaming sites) or lead to it (e.g. torrent trackers like AnimeBytes.tv). Though I don't think it's known whether all .tv domains at Sarek are affected or just the ones related to piracy (but it's safe to assume that most if not all of them are related to piracy as that's what Sarek is known as being a safe harbor for).

Same here. I have my own domain set as the main email address of my personal Google account (I have in fact deleted the Gmail one altogether, as I noticed that otherwise some websites would still pick the Gmail address over the custom domain one when using SSO). Not many people seem to know you can do this without Google Workspace, or that you can have a Google account without a Gmail address.

If I ever lose access to my Google account I can just set a password through the "forgot my password" feature (I've noticed this is often also the only way to set a password if you create an account through SSO with some websites, but it does work). The convenience of SSO with an escape hatch as you say.