HNHacker News
TopNewBestAskShowJobs

spankalee

11,983 karma · joined August 4, 2011

submissionscomments
spankalee··on Google Cloud Fraud Defence is just WEI repackaged
You don't think that some people simply disagree with the idea that this is bad? Or like maybe the CAPTCHA company who put out the post has an agenda here? So you want to go after engineers personally?

I wonder what you've done that might warrant harassment?

Look at how complicated CAPTCHAs are getting to try to be unsolvable with AI - it's a losing game. This and the WEI proposal are trying to solve a very, very real problem. If you continue to deny the problem, or every proposal solution without working towards an acceptable one, people will route around the blockage.

spankalee··on Going Full Time on Open Source
Yeah, Mise has caching: https://mise.jdx.dev/cache-behavior.html

I'm a massive fan of Wireit and its caching behavior, so I'm looking for something to live up to that. I have more testing to do. I think Mise defaults to mtime-keyed cache but has an option for content hashing, which it what Wireit uses and makes it quick to undo a change and get a cache hit.

spankalee··on Going Full Time on Open Source
We just started exploring Mise as a (much) simpler alternative to Nix + Bazel for a polyglot monorepo.

One of my concerns was about how well maintained Mise would be given that it's mostly a single maintainer, so I think this is good news in that respect.

Good luck to Jeff!

spankalee··on Multi-stroke text effect in CSS
css-doodle's syntax has a lot of non-standard-CSS stuff in it. All the @ things are extensions.
spankalee··on Multi-stroke text effect in CSS
This is made with (and by the author of) <css-doodle>, a web component that lets you put the CSS variant used in this blog inline into your HTML, like so:

    <script src="https://esm.sh/css-doodle/css-doodle.min.js?raw"></script>
    <css-doodle>
      @grid: 15 / 90%;
      border-radius: 50%;
      background: hsl(@t(/20), 70%, 60%);
      scale: sin(@atan2(@dx, @dy) + @ts);
    </css-doodle>
No JS needed except for loading the definition of the <css-doodle> component. Works in plain HTML, Markdown, frameworks, etc.

https://css-doodle.com/

spankalee··on I am worried about Bun
I partially agree with you, but I also think that it's good that people can make something they want, that seems to have no monetization path, and have some hope of being bailed out.

It's not great that the search for profit will usually corrupt projects, but the other most common option is that the projects don't exist at all. It's very rare (or it used to be before this year) that someone can do something like this on their own with no compensation. So now at least Bun exists.

spankalee··on Why TUIs are back
I really don't get terminal UIs that try to rebuild GUI-like functionality. Don't we think that computer interfaces should get better? We're not limited to a grid of characters to pretend to draw lines and shapes with anymore. You can't even display an image in a terminal without a non-standard terminal like Kitty or iTerm.

It's just a shame that we don't have a great cross-platform, streamed, UI system. The web is great in it's own ways, but clearly something could be a lot better for this purpose. Flutter's ok, but not on-demand enough and too married to Dart.

spankalee··on The agent harness belongs outside the sandbox
This is angling in the right direction, but I think it has two problems:

1) It's still assuming agents have CLIs. This is a very developer-centric concept of agents, and doesn't map well to either consumer or enterprise agents that aren't primarily working with files. Skills, plans, TODO lists, and memory are good, but don't have to be modeled as raw file access. Many harnesses have tools for them.

2) It's talking about a singular sandbox. That's not good enough for prompt injection prevention, secure credential management, and limiting the blast radius of attacks.

spankalee··on Flue is a TypeScript framework for building the next generation of agents
Uh... a flue is not a disease.
spankalee··on Credit cards are vulnerable to brute force kind attacks
> The bank ate the loss for the fraud and you were made whole

_If_ you notice the fraudulent charge.

spankalee··on Who owns the code Claude Code wrote?
Only to perform it, not learn it.
spankalee··on Who owns the code Claude Code wrote?
Humans have been known to recite entire parts from plays from memory, live in front of audiences even.
spankalee··on Waymo in Portland
No. The reason that self-employed don't like payroll tax is that they have to pay both sides of it, so it seems like more than they paid as employees.
spankalee··on The woes of sanitizing SVGs
This is, by the way, why Google Slides doesn't have SVG support even though there's a nearly 15 year old ticket requesting the feature.
spankalee··on Waymo says can't avoid bike lanes because riders want to be dropped off in them
Delivery drivers should find parking. They should be fined heavily for parking in traffic, including bike lanes.
spankalee··on Waymo says can't avoid bike lanes because riders want to be dropped off in them
Maybe drivers should stop thinking they're the center of the universe and consider pedestrians and bicyclists around them. It's more dangerous to block a bike lane, with the more vulnerable user, than a car lane. Other drivers can wait.
spankalee··on Waymo says can't avoid bike lanes because riders want to be dropped off in them
It can't be so uneven. The other drivers will react irrationally if only a few cars obey those rules. Try doing your own drop offs in the car lane, when there's a bike late there, with traffic behind you. They'll often react dangerously.
spankalee··on Waymo says can't avoid bike lanes because riders want to be dropped off in them
Blocking the right car lane for a drop off is perfectly legal outside of No Stopping zones. This is how taxis have always worked.

It's just that other drivers get pissed off if you block a car lane when there's a bike lane next to it. That needs to be trained away by enforcing the rules.

spankalee··on Waymo says can't avoid bike lanes because riders want to be dropped off in them
Are you going to cone the Uber drivers too?
spankalee··on Waymo says can't avoid bike lanes because riders want to be dropped off in them
Cities that want to keep cars out of bike lanes should keep all cars out of them, autonomous or not, by ticketing them. But they don't, so taxis and delivery drivers stop in them. That's traffic enforcement's fault.

Given that human drivers stop in bike lanes, Waymo then has a tradeoff:

1) Be the only ones to follow the letter of the law, break a lot of people's expectations, and catch backlash for disrupting traffic.

2) Follow the most common expectation, even if wrong, and incrementally add to the problem.

IMO, cyclists shouldn't lobby Waymo directly, but should lobby cities to actually enforce the rules on everyone. Then Waymo would fall in line naturally. And if they're inclined to take direct action against Waymo's they should also act against Uber and DoorDash drivers who are a far bigger problem by volume (and wait time for deliveries).

spankalee··on WebUSB Extension for Firefox
What's the difference between that and a subset of what we have now, without, say WebUSB?
spankalee··on Nanopass Framework: Clean Compiler Creation Language
Hey - I used to be on your team long ago :)

> For example, you might think you can do lexical identifier resolution and type checking in separate passes. But then the language gets extension methods and now it's possible for a bare identifier inside a class declaration to refer to an extension method that can only be resolved once you have some static type information available.

Some of this is language design though. If you make it a requirement that scope analysis can be done in isolation (so that it's parallelizable), then you design things like imports and classes so that you never have identifiers depend on types or other libraries.

I've been working on a language lately and thinking about passes - mostly where they run and what previous state they depend on - has been a big help in designing language so the compiler can be parallel, cache, and incremental friendly.

spankalee··on Introducing: ShaderPad
I like versions of this that are web components so that they're declarative and you can just drop them into HTML.

<shader-doodle> is one: https://github.com/halvves/shader-doodle but it hasn't been updated in a long time and I think builds to UMD

<shaderview> is a newer one with a nice site, but I haven't used it: https://keithclark.github.io/shaderview/

spankalee··on Lumina – a statically typed web-native language for JavaScript and WASM
AssemblyScript seems to be seriously languishing these days, and the team has falling-outs with a lot of the Wasm ecosystem.
spankalee··on Lumina – a statically typed web-native language for JavaScript and WASM
Nice! I'm working on a similar language in some ways.

One decision I made is to specifically not compile to JS. JS/Wasm interop is good enough with Wasm GC that I made the choice to focus on Wasm-only constraints and semantics and not worry about how things like the types being wrong, or how ints translate to JS, how to handle null vs undefined, etc. JS GCs collect objects and cycles across the Wasm boundary, and with the JS string built-ins you can handle strings efficiently.

I couldn't load your demo, btw.

spankalee··on A new spam policy for “back button hijacking”
What about all the very legitimate uses of programmatically adding history entries?
spankalee··on Someone bought 30 WordPress plugins and planted a backdoor in all of them
I really wish that the FAIR package manager project had been successful, but they recently gave up after the WordPress drama died down.

https://fair.pm/

FAIR has a very interesting architecture, inspired by atproto, that I think has the potential to mitigate some of the supply-chain attacks we've seen recently.

In FAIR, there's no central package repository. Anyone can run one, like an atproto PDS. Packages have DIDs, routable across all repositories. There are aggregators that provide search, front-ends, etc. And like Bluesky, there are "labelers", separate from repositories and front-ends. So organizations like Socket, etc can label packages with their analysis in a first class way, visible to the whole ecosystem.

So you could set up your installer to ban packages flagged by Socket, or ones that recently published by a new DID, etc. You could run your own labeler with AI security analysis on the packages you care about. A specific community could build their own lint rules and label based on that (like e18e in the npm ecosystem.

Not perfect, but far better than centralized package managers that only get the features their owner decides to pay for.

spankalee··on A perfectable programming language
What is up with so many people doing weird capitalization now? Is this some Bay-tech flex? Alok writes their own name, and other names, with leading caps, but not the first word in sentences? It makes it so uncomfortable to read.
spankalee··on The End of Eleventy
I use Eleventy for nearly all of my static sites. Almost every project of mine has at least an 11ty internal docs site. I'm very happy that Eleventy has a home and Zach a job.

But my only thought on this is: Eleventy is an awesome name.

spankalee··on Intel 486 CPU announced April 10, 1989
With JS and CSS sites can last decades easily.
← PreviousPage 4 of 34Next →