jph

Good idea, thank you. I'll add examples in the documentation. Currently there are example repos that show all the components for each flavor: React, Vue, Svelte, Blazor, Nunjucks, HTML. Angular coming soon.

AI use is mixed: I write everything by hand in the specifications, and the components.tsv file, and in the Svelte version because it's my stack of choice. If you dig in, you'll see lots of hierarchies that are all hand-written to help Svelte caching, for example. I also research other major design systems, especially government-oriented public-sector systems such as GOV.UK and Reuters, and fold them in.

Then Claude Opus tranforms the Svelte version into the other stacks. Claude does a lot of the documentation text because I'm aiming for clear and consistent explanations, suitable for novice developers.

I'm developing Lily Design System because I work with multiple teams that each use a different tech stacks, each with their own ad hoc HTML tag names and semantic names. As a salient example, for a hospital form one team used terminology "health banner area" and another used terminology "medical red box". Lily is my attempt to converge these into something that works better internationally and across multiple stacks.

That said, I'm seeking help doing human proofing and improvements for the stacks, because we all know AI isn't perfect, and needs tuning, guardrails, expert feedback, and the like.

Great idea, yes you're right. I'll add that now.

Really? I ask because there's already an epub TUI reader, written in Rust, and open source, and I'm already using it in the terminal. I want it or something similar within Fresh because the two together will greatly help me with Fresh IDE epub docs in projects.

See https://github.com/bugzmanov/bookokrat

Update: a developer just now created a Fresh IDE pull request, thanks to this incentive.

See https://github.com/sinelaw/fresh/pull/2093

I'm the author. I'm seeking HN feedback for how to improve this CVD documentation, because AI attacks are escalating and some are turning up new kinds of security issues.

I have this floating-point problem at scale and will donate $100 to the author, or to anyone here, who can improve my code the most.

The Rust code in the assert_f64_eq macro is:

    if (a >= b && a - b < f64::EPSILON) || (a <= b && b - a < f64::EPSILON)

I'm the author of the Rust assertables crate. It provides floating-point assert macros much as described in the article.

https://github.com/SixArm/assertables-rust-crate/blob/main/s...

If there's a way to make it more precise and/or specific and/or faster, or create similar macros with better functionality and/or correctness, that's great.

See the same directory for corresponding assert_* macros for less than, greater than, etc.

If you're open to questions, I'm switching my teams from Docker to Podman on macOS. I'm hitting blockers for multi-user setups i.e. each developer has a non-admin account on the machine, whereas brew runs in its own account with admin permissions.

I would love a way to have Podman installable in userspace meaning in a non-admin account, or installable without brew, or with a dependency list such as QEMU or whatever else needs to be installed by an admin ahead of time, or with a sudousers config list, etc.

I know this is an atypical setup. Any advice from anyone here is much appreciated about multi-user non-admin macOS container setup for Podman or Docker or equivalent.

Clever hack! <3 I also do namespacing yet in a different way.

I create a home directory "x" for executables that I want to manage as files, and don't want on PATH or as alias.

To run foo: ~/x/foo

For example I have GNU date as ~/x/date so it's independent of the system BSD date.

Good questions.

For shell syntax, I aim for POSIX because for anything more advanced I switch from shell to a more powerful programming language.

Currently POSIX doesn't have the 'declare' statement, nor the '\e' syntax consistently, nor the 'echo -e' syntax consistently.

As for exporting, I do it because I have many quick scripts that I run often, and I prefer to switch the colors in one place such as in the evening from light mode to dark mode.

When you say the print statements aren't going to work by default, can you say more about this? Anything you can explain or point me to about this will be a big help. Thanks!

Yes good points both, thank you. The source code link has more explanation about color choices and my preference of POSIX compatibility. You can also see the color function that checks NO_COLOR, CLICOLOR_FORCE, TERM = "dumb", -t 1, etc.

For color operands, I use raw escape codes because I aim for POSIX compatibility. If I'm working on something that needs more capabilities then I switch to a more powerful programming language e.g. python, rust, etc.

As far as I understand, POSIX tput defines some terminal operands (clear, init, reset, etc.) but not color operands (setaf, setab, sgr0, etc.).

I maintain multiple open source projects. In the past two months I've seen an uptick in AI-forgery attacks, and also an uptick in legitimate code contributions.

The AI-forgery attacks are highly polished, complete with forged user photos and fake social networking pages.

The legitimate code contributions are from people who have near-zero followers and no obvious track record.

This is topsy-turvy yet good news for open source because it focuses the work on the actual code, and many more people can learn how to contribute.

So long as code is good enough to get in the right ballpark for a PR, then I'm fine cleaning the work up a bit by hand then merging. IMHO this is a great leap forward for delivering better projects.

If you want a quick easy way to add some colors to your own shell scripts:

    export STDOUT_COLOR_START=''
    export STDOUT_COLOR_STOP=''
    export STDERR_COLOR_START=''
    export STDERR_COLOR_STOP=''

In your shell script:

    print_stdout() {
        printf %s%s%s\\n "${STDOUT_COLOR_START:-}" "$*" "${STDOUT_COLOR_STOP:-}"
    }

    print_stderr() {
        >&2 printf %s%s%s\\n "${STDERR_COLOR_START:-}" "$*" "${STDERR_COLOR_STOP:-}"
    }

Source: https://github.com/sixarm/unix-shell-script-kit

The source also has functions for nocolor, and detecting a dumb terminal setup that doesn't use colors, etc.

I'm in the affected group because I'm a US citizen working in the UK. There's much more to the story because the UK has many digital ID aspects already in place-- such as for work visas and residence permits-- but these not coordinated into a whole.

What I experienced last year was many digital verification steps that were all required: open a UK bank account, sign up for a UK phone number, secure a UK residential postal address, apply for UK right-to-rent codes, generate a UK national insurance number, file for UK healthcare registration, and more.

Each step had different digital workflows and UI/UX. To traverse all these steps took hundreds of hours and a couple months wall time.

Many steps had catch-22s. The UK bank account needed a UK phone number, while the UK phone company needed a UK bank account. The UK payroll company needed a permanent residence, while the UK landlord needed UK payroll stubs. None of the steps had a quick simple way to digitally verify my UK work visa.

IMHO federation could be a big help here, such as for government agencies and government-approved businesses doing opt-in data sharing and ideally via APIs. For example, imagine each step can share its relevant information with other steps. This could make things more efficient, more accurate, and ideally more secure.

Links:

https://github.com/joelparkerhenderson/demo-rust-lettre-sync

https://github.com/joelparkerhenderson/demo-rust-lettre-asyn...

https://github.com/joelparkerhenderson/demo-rust-lettre-asyn...

Monodraw for Mac is my favorite. I'm a customer. $10 license. https://monodraw.helftone.com/

UK government agencies have opportunities to improve cyber security in a pragmatic way by phasing in coordinated vulnerability disclosure.

This matches the article's point that the UK CSR bill may be a first step that helps to phase in bespoke legislation to improve UK national security.

For me this is professional because my work involves UK software engineering for medical information.

Coordinated vulnerability disclosure: https://github.com/joelparkerhenderson/coordinated-vulnerabi...

These examples could both be much better IMHO with a top comment block that describes the purpose of the functionality and shows good usage examples. Something like this below, and ideally using runnable doc comments to help keep the comment correctly explaining the code.

Replace symbol placeholders in the input string with translated values. Scan the string for symbol placeholders that use the format "$foo". The format uses a dollar sign, then optional ASCII letter, then optional word characters. Each recognized symbol is replaced with its corresponding value.

Symbols are only replaced if the symbol exists i.e. getSymbol(String) returns non-null, and the symbol has not already been replaced in this invocation.

Example:

  - input = "Hello $name, welcome to $city!"

  - output -> "Hello Alice, welcome to Boston!"

Return the string with symbol placeholders replaced.

Great project. Want to contact me when you'd like to talk? I do software engineering for clinicians at a health care organization, and I'd love to have my teams try your work in their own contexts. Email joel@joelparkerhenderson.com.

I worked at Sun and had the ring. We had a great demo where you could walk along a row of Sun workstations, and your X session would move with you, leaping from monitor to monitor, keeping pace with you. The idea at the time was "The Network is the Computer".

IIRC there was some coding that enabled each workstation to know where it was physically, so the security systems could know "User is signed into workstation X, and is requesting a move from workstation X to workstation Y, which is physically one meter away, so AOK to keep signed in."

Yes small features help enormously. I've used ROPE and work breakdown structures (WBS) to estimate multiple projects at thousands of staff hours to under 4% of actual. The ROPE advantage is that it uses multiple perspectives, which gets stakeholders understanding that the estimates are imperfect and depend on many factors.

Yes except in practice it's worked out more like this... Realistic is favored by tech teams. Optimistic is favored by salespeople and marketers. Pessimistic is favored by lawyers and compliance people. Equilibristic is favored by project managers and military.

Each stakeholder gets the kind of fortune they want. The important aspect (to me) is that the four viewpoints show all the stakeholders that their viewpoints are quite different.

Yes you're correct. PERT 3-point was my starting point and I wanted to add a critical chain 50% estimate.

BTW the SixArm name and ROPE is merely my personal work. Way back when, I had to put on the trademark because someone else said my work was theirs.

Critical chain planning has a purpose for the 50%. It's not perfect-- but it's better than other ways, in my experience.

Wikipedia: "The justification for using the 50% estimates is that half of the tasks will finish early and half will finish late, so that the variance over the course of the project should be zero... Because task duration has been planned at the 50% probability duration, there is pressure on resources to complete critical chain tasks as quickly as possible, overcoming student's syndrome and Parkinson's Law."

When teams don't need strong estimates, then Kanban works well.

When teams do need strong estimates, then the best way I know is doing a project management ROPE estimate, which uses multiple perspectives to improve the planning.

https://github.com/SixArm/project-management-rope-estimate

R = Realistic estimate. This is based on work being typical, reasonable, plausible, and usual.

O = Optimistic estimate. This is based on work turning out to be notably easy, or fast, or lucky.

P = Pessimistic estimate. This is based on work turning out to be notably hard, or slow, or unlucky.

E = Equilibristic estimate. This is based on success as 50% likely such as for critical chains and simulations.

Do you know about Framework? https://frame.work/

Thanks for the article and shoutout - CAST is great and I use it extensively with tech teams.

Causal Analysis based on Systems Theory - my notes - https://github.com/joelparkerhenderson/causal-analysis-based...

The full handbook by Nancy G. Leveson at MIT is free here: http://sunnyday.mit.edu/CAST-Handbook.pdf

When you're ready with Aidlab 2, can you contact me? I work for a national health service and I'm keen to learn more, buy, and generate some public anonymized data sets. joel@joelparkerhenderson.com. Thanks and good work! <3

Devices sending data that is anonymized, encrypted, and signed by the device is a must-have for some medical studies.

For example, imagine a medical study that looks at heart rate variability versus an intervention. The data analysts won't need to know each patient's name or email address, but will need to know each patient's heart rate variability when you're having the intervention. The study may span many physical locations, such as at multiple medical providers across a country.

I pay for Fastmail and I'm using the Fastmail desktop app right now.

It's much faster than Thunderbird so far for me, and more convenient than a browser tab for me, and I'm especially liking the interconnections among mail, contacts, and calendar. The best feature for me is being able to click an email link anywhere on any web page, and have it lead to the Fastmail app.

I do have two questions. The app on my macOS system is using 700MB RAM; is that for Electron? The majority of RAM is showing as GPU rendering; is that for font smoothing?

Can you say more about how & why?

I have 1000 or so free open source repos that include a bunch of tiny software demo projects and technical tutorials. I'm exploring Codeberg to understand more about how it works, how easy it is to migrate repos, what options are possible, and the like. My most-popular GitHub repo is the architecture-decision-record repo, and I want to ensure it works reliably on both hosting services.