rpodraza

At this point I'd highly recommend everyone to think twice before introducing any dependencies especially from untrusted sources. If you have to interact with many APIs maybe use a proxy instead, or roll your own.

Press x to doubt

Looks like AI agents together with np and postinstall scripts are a match made in heaven!

This is great in theory, but answer me sincerely: are you spending less time at work because of AI? Because I reckon for most programmers here it is not the case at all.

I think you are completely oblivious to the problems plaguing the NPM ecosystem. When you start a typical frontend project using modern technology, you will introduce hundreds, if not thousands of small packages. These packages get new security holes daily, are often maintained by single people, are subject to being removed, to the supply chain attacks, download random crap from github, etc. Each of them should ideally be approved and monitored for changes, uploaded to the company repo to avoid build problem when it gets taken down, etc.

Compare this to Java ecosystem where a typical project will get an order of magnitude fewer packages, from vendors you can mostly trust.

What problem is this guy trying to solve? Sorry, but in the end, someone's gonna have to be responsible and it's not gonna be a computer program. Someone approved the program's use, it's no different to any other software. If you know agent can make mistakes then you need to verify everything manually, simple as.

Maybe I'm paranoid, but allowing any coding agent or tool to execute commands within terminal that is not sandboxed somehow will be prone to attacks like that

Huh? I go to a nearby cafe solo, all the time, and a lot of other people do, for instance, to read. That's how I met couple of them, actually.

I'd rather start a completely new, better language for the browser.

Good luck writing Java with notepad.

The author of this post reponds like AI

I would honestly do so, but if I want to run games and music production stuff (like Cubase) I'm pretty much forced to be on Windows.

I spill my drink!

If you're a junior and using AI to generate code, someone has to review it anyway, plus you're not learning on the job. So what's the point if the senior person can generate the code herself?

Someone should eradicate the npm ecosystem and start from scratch. No sane package manager would allow to run arbitrary scripts or download stuff from God knows where, like random github repos.

It looks like they actually got infected as well. So it's not only that, their security practices seem crap

If they are so concerned with "model welfare" they should cease any further development. After all, their LLM might declare it's conscious one day, and then who's to decide if it's true or not, and whether it's fine to kill it by turning it off?

And on top of that, the nomenclature is really confusing.

Gradle is fine once you understand how it works. Admittedly, it takes a bit of time to get used to, but it's very customizable.

they recently removed the lite version.

Does anyone know if they can force users to do so in EU? It sounds like it's gonna make the product unusable if not registered, therefore revoking my previous rights to use a product without an account.

In Poland barely anyone uses cards for online payments. There are couple of different options: one-time automatic transfers that support major banks, BLIK (payment via one-time code), etc.

The state of fractional scaling on Linux is abysymal.

And you're basing this theory on what exactly?

Look up structural sharing

So you're claiming these are inaccurate? Do you have any other solutions for speeding? I think these are still much better solution than a device that tracks your location all the time.

Of course it's bullshit. I would say 95% of the JPQL queries do the job.

Ugh, Anki is complicated? I would say it's powerful not complicated. It was really easy to start with existing decks and make my own.

No, it's actually great. The non-tech people can use your WYSIWYG editor, while you save your document as Markdown (which can be parsed, validated, etc.)

That is actually really fair. You know what to expect.