bodash

“The oppressors left, but their systems remain”

AI companies see people's images and data as raw material to be exploited

What a quote

It’s not crazy. I always add a simple message to my prompts: “leave 20% solutions empty and I’ll implement them myself”.

It work wonders for me.

Agreed, JSON is not the most optimal spec language choice, but is it better if different projects all started to writing their own specs?

Related: https://www.openui.com/blog/stop-making-ai-write-json

I’m completely on your side, but also I think about all the AI saturations in the society like this:

“Driving to work or running a 10km on the weekend sharing the same surface goal: from A to B.

You may have less autonomy whether you should drive to work, but you definitely have more decision power about whether to go for that run or not”

Given the audience here, I think an adjacent analogy would be “if we were to understand tech today, do we always go back to the beginning of tech?”

Then the answer is more clear as yes and no. Obviously much of our tech today adapts to modern innovations and standards, but it would not be hard to quickly find examples where even the most cutting edge tech are still being affected by the earliest decisions or natural limitations.

fyi npm 12 will have securer defaults https://github.blog/changelog/2026-06-09-upcoming-breaking-c... but it will be a while for ecosystem to catch up and npm reputation already damaged

Agreed. If it's "digital", it will be used for elite power plays, because it's too easy. How else could you mass control/analyse/manipulate millions of people instantly? Digital, digital, digital...

My browser combo: Firefox Developer Edition + uBo + Privacy Badger + Facebook Containers

One time setup, it’s synced to Mozilla account for later reinstalls

GitHub repo (800+ stars) on a list of tips for protecting against npm supply chain attacks: https://github.com/bodadotsh/npm-security-best-practices

This is a surprise. And they still haven't included corepack as an official instruction on the nodejs.org download page. Is corepack a failed experiment?

few more tips here: https://github.com/bodadotsh/npm-security-best-practices

Astro might be the closest option here. JSX can be used as a templating language for it, and devs can still opt-in for full clientful islands.

AstroNvim v6 just released after neovim 0.12, and it's my favourite out-of-box setup

Some great tips in this thread and I've been collecting them all at https://github.com/bodadotsh/npm-security-best-practices

Exactly! I’ve noticed a resounding amount of people are writing the same pieces recently, it’s almost like everyone’s sounding their alarm for the upcoming tsunami. Who’s listening? Here’s my piece: https://humantodo.dev

Got a link?

Personally, I think Go + HTMX + PostgreSQL + Redis can go a long mile, but I could be missing hindsights

I can see how some high-paced teams might see HUMANTODO as speed bumpers in their environments. To that, I say this will be a conscious choice, and a trade-off teams are willing to experiement to see if the intentional slow-down will improve quality over time.

But yeah, give HUMANTODO a go, and I might add examples (blog/videos/etc) of how this actually works and integrates within real life projects.

Hi HN!

Amidst this turbulent time in our industry, I had this idea: what if we applied the "IKEA effect" instead of relying on the "Coding is dead" extremes.

So I spent the weekend working on this concept, and built this site to demonstrate why I think it could be useful in navigating the confusions and anxiety around the usage of AI.

Interested to know your thoughts!

Just been through several frontend interviews in the last few months, where it's clear that they still judge a developer's JS skills (especially React) than being semantically correct on HTML elements.

Every question/exercise is centred around how well you know React hooks, effect, memoization, modern css-in-js etc. Given I've been working with Astro recently, in one interview I talked about DOM APIs and I can see the interviewer raise an eyebrow. In later stage, even I that passed the exercises, still didn't get the job.

Windows’ downfall will finally give rise to the Linux desktops, already seeing trends in how popular Omarchy is and well received

Sure.

Problem I had with the other newsfeeds is that I get distracted by the constant updates, always refresh the front-page, skipping the actual content and just skimming through headlines and comments.

So I built this one, set it as my homepage, and because it doesn't update often, I will actually read the content of the links. When I'm done, I move on to other things in life.

It's curated by matching keywords (focusing on web development) on HN, mostly automated but with few manual adjustments now and then.

https://lessnews.dev

A while ago I felt this "information fatigue" due to the overwhelming updates from the typical news sources (reddit, twitter, even hn).

So I built a _slow_ webdev newsfeed aggregator that doesn't overwhelm you of constant updates, so you focus on reading the actual blog contents and enjoy other things.

Most of the best practices can be translated to python ecosystem. It’s not exact 1:1 mapping but change few key terms and tools, the underlying practices should be the same.

Or copy that repo’s markdown into an llm and ask it to map to the pip ecosystem

I compiled a list of NPM best practices one can adopt to reduce supply chain attack risks (even if there's no perfect security preventions, _always_): https://github.com/bodadotsh/npm-security-best-practices

Discussion on HN last time: https://news.ycombinator.com/item?id=45326754

shamless plug but here's a list of things you could follow to mitigate risks from npm: https://github.com/bodadotsh/npm-security-best-practices

The lockfile is updated _after_ any new malicious version is downloaded and installed. If we pinned the exact version, `npm install` will _not_ download and execute any new published versions.

That's why we use `npm ci` or `--frozen-lockfile` to install the exactly versions as lockfiles. But, by default, the `^` operator and just `install` command will check registry for any new releases and download them.

The primary arguments against pinning versions are missing security updates and increased maintenance overhead. But given the patterns we've seen, the attackers really _hope_ we automatically install new releases

I also built https://lessnews.dev (HN filtered by webdev links)

One decision I had to make was whether the site should update in real time or be curated only. Eventually, I chose the latter because my personal goal is not to read every new link, but to read a few and understand them well.

I’ve also been experimenting with a curated webdev related newsfeed based on HN submissions: lessnews.dev The goal is not to keep users on the site. If some dev visit the site once in a while, and finds a link useful, that’s it.