<rss version="2.0" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:atom="http://www.w3.org/2005/Atom"><channel><title>Hacker News: Ciantic</title><link>https://news.ycombinator.com/user?id=Ciantic</link><description>Hacker News RSS</description><docs>https://hnrss.org/</docs><generator>hnrss v2.1.1</generator><lastBuildDate>Fri, 15 May 2026 18:26:20 +0000</lastBuildDate><atom:link href="https://hnrss.org/user?id=Ciantic" rel="self" type="application/rss+xml"></atom:link><item><title><![CDATA[New comment by Ciantic in "Postmortem: TanStack NPM supply-chain compromise"]]></title><description><![CDATA[
<p>If I saw this in my CI script:<p><pre><code>    curl -X POST $GITHUB_CACHE_URL < wololo.exe
</code></pre>
It would make me pause, but now that it is a misfeature in YAML configuration it is more widely used. Point of bash scripts they are auditable, and understandable.<p>I didn't prescribe what the bash script would be, because it would differ on use case. If I wanted to share artifacts from other runs I would probably use podman and make sure I start new runs from known good condition, but because I understand that. Some other would use nix or whatever else.</p>
]]></description><pubDate>Tue, 12 May 2026 15:21:39 +0000</pubDate><link>https://news.ycombinator.com/item?id=48109637</link><dc:creator>Ciantic</dc:creator><comments>https://news.ycombinator.com/item?id=48109637</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=48109637</guid></item><item><title><![CDATA[New comment by Ciantic in "Postmortem: TanStack NPM supply-chain compromise"]]></title><description><![CDATA[
<p>What I want to focus on is mental model of your CI pipeline, and problem with too much YAML, consider this quote:<p>> Cache scope is per-repo, shared across pull_request_target runs (which use the base repo's cache scope) and pushes to main. A PR running in the base repo's cache scope can poison entries that production workflows on main will later restore.<p>This is very difficult to understand, and teach to new people, because everything is configured as YAML, yet everything is layed out in the background to directories and files.<p>What if your CI pipeline was old-school bash script instead? This would be far more obvious to greater amount of people how it works, and what is left behind by other runs. We know how directories and files work in bash scripts.<p>Could we go back to basics and manage pipelines as scripts and maybe even run small server?</p>
]]></description><pubDate>Tue, 12 May 2026 09:50:32 +0000</pubDate><link>https://news.ycombinator.com/item?id=48106119</link><dc:creator>Ciantic</dc:creator><comments>https://news.ycombinator.com/item?id=48106119</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=48106119</guid></item><item><title><![CDATA[New comment by Ciantic in "Bun's experimental Rust rewrite hits 99.8% test compatibility on Linux x64 glibc"]]></title><description><![CDATA[
<p>Wow, amazing work.<p>Pretty impressive that it is faster than the Go version already.</p>
]]></description><pubDate>Sat, 09 May 2026 19:42:30 +0000</pubDate><link>https://news.ycombinator.com/item?id=48077622</link><dc:creator>Ciantic</dc:creator><comments>https://news.ycombinator.com/item?id=48077622</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=48077622</guid></item><item><title><![CDATA[New comment by Ciantic in "Android CLI: Build Android apps 3x faster using any agent"]]></title><description><![CDATA[
<p>`android docs` is the superpower we need for everything. NPM / pnpm should have similar `npm docs` that would allow humans and agents to search for type-signatures and JSDocs.<p>It is so annoying that each agent has its own ideas where it tries to get the docs, usually by blindly grepping.</p>
]]></description><pubDate>Fri, 17 Apr 2026 09:54:22 +0000</pubDate><link>https://news.ycombinator.com/item?id=47804207</link><dc:creator>Ciantic</dc:creator><comments>https://news.ycombinator.com/item?id=47804207</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=47804207</guid></item><item><title><![CDATA[New comment by Ciantic in "A WebGPU implementation of Augmented Vertex Block Descent"]]></title><description><![CDATA[
<p>AVBD also has this page <a href="https://graphics.cs.utah.edu/research/projects/avbd/" rel="nofollow">https://graphics.cs.utah.edu/research/projects/avbd/</a> I don't know how this implementation differs from the one they are demoing but this one by Jure Triglav feels much smoother to me.</p>
]]></description><pubDate>Thu, 09 Apr 2026 14:39:31 +0000</pubDate><link>https://news.ycombinator.com/item?id=47704380</link><dc:creator>Ciantic</dc:creator><comments>https://news.ycombinator.com/item?id=47704380</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=47704380</guid></item><item><title><![CDATA[New comment by Ciantic in ""The new Copilot app for Windows 11 is really just Microsoft Edge""]]></title><description><![CDATA[
<p>What is the reason they don't use the WebView2? Microsoft Teams uses WebView2, surely it should be enough for Copilot. This defeats the whole point of having WebView builtin and shipped with the Windows 11.</p>
]]></description><pubDate>Tue, 07 Apr 2026 14:29:48 +0000</pubDate><link>https://news.ycombinator.com/item?id=47675973</link><dc:creator>Ciantic</dc:creator><comments>https://news.ycombinator.com/item?id=47675973</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=47675973</guid></item><item><title><![CDATA[New comment by Ciantic in "Shared mutable state in Rust (2022)"]]></title><description><![CDATA[
<p>I happen to be just now experimenting with app states. Out of interest, you mean something like this? <a href="https://gist.github.com/Ciantic/63526ebfe65570b669eca33bf3404b69" rel="nofollow">https://gist.github.com/Ciantic/63526ebfe65570b669eca33bf340...</a><p>What would be disadvanatages of this approach? I don't like Arc's myself either, I would like to see what is best alternative for those in multi threaded apps.</p>
]]></description><pubDate>Sun, 05 Apr 2026 16:29:16 +0000</pubDate><link>https://news.ycombinator.com/item?id=47651039</link><dc:creator>Ciantic</dc:creator><comments>https://news.ycombinator.com/item?id=47651039</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=47651039</guid></item><item><title><![CDATA[New comment by Ciantic in "The Windows equivalents of the most used Linux commands"]]></title><description><![CDATA[
<p>Let me present you my favorite, how do you figure out dirname, basename and filename in batch script?<p><pre><code>    set filepath="C:\some path\having spaces.txt"

    for /F "delims=" %%i in (%filepath%) do set dirname="%%~dpi" 
    for /F "delims=" %%i in (%filepath%) do set filename="%%~nxi"
    for /F "delims=" %%i in (%filepath%) do set basename="%%~ni"

    echo %dirname%
    echo %filename%
    echo %basename%
</code></pre>
It is just as intuitive as one would expect.</p>
]]></description><pubDate>Thu, 02 Apr 2026 09:30:58 +0000</pubDate><link>https://news.ycombinator.com/item?id=47612047</link><dc:creator>Ciantic</dc:creator><comments>https://news.ycombinator.com/item?id=47612047</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=47612047</guid></item><item><title><![CDATA[New comment by Ciantic in "Axios compromised on NPM – Malicious versions drop remote access trojan"]]></title><description><![CDATA[
<p>I know not all, but Debian/Ubuntu/Fedora does, and while the intended purpose of multi-stage releases is not necessarily security but stability, it still does help up with security too. Because third parties can look and scan the dependencies while they are still not in stable.<p>Most of the supply chain vulnerabilities that ended up in the NPM would have been mitigated with having mandatory testing / stable branches, of course there needs to be some sort of way to skip the testing but that would be rather rare and cumbersome and audited, like it is in Linux distributions too.</p>
]]></description><pubDate>Tue, 31 Mar 2026 09:45:49 +0000</pubDate><link>https://news.ycombinator.com/item?id=47584880</link><dc:creator>Ciantic</dc:creator><comments>https://news.ycombinator.com/item?id=47584880</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=47584880</guid></item><item><title><![CDATA[New comment by Ciantic in "Axios compromised on NPM – Malicious versions drop remote access trojan"]]></title><description><![CDATA[
<p>NPM should learn from Linux distribution package managers.<p>Have a branch called testing, and packages stay in testing for few weeks, after which they go to stable. That is how many Linux distributions handle packages. It would have prevented many of these.<p>Advising every user of npm/pnpm to change their settings and set their own cooldown periods is not a real choice.</p>
]]></description><pubDate>Tue, 31 Mar 2026 09:09:18 +0000</pubDate><link>https://news.ycombinator.com/item?id=47584621</link><dc:creator>Ciantic</dc:creator><comments>https://news.ycombinator.com/item?id=47584621</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=47584621</guid></item><item><title><![CDATA[New comment by Ciantic in "AI overly affirms users asking for personal advice"]]></title><description><![CDATA[
<p>ChatGPT has style settings, you probably should set it to something else than the default. Go to your personalization settings and change base style and tone. I have set it as 'efficient' which is less cheery. I can see why attention economy would lead setting the defaults towards more 'affirming' as it keep people more engaged and coming back.</p>
]]></description><pubDate>Sun, 29 Mar 2026 11:32:50 +0000</pubDate><link>https://news.ycombinator.com/item?id=47562239</link><dc:creator>Ciantic</dc:creator><comments>https://news.ycombinator.com/item?id=47562239</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=47562239</guid></item><item><title><![CDATA[New comment by Ciantic in "Go hard on agents, not on your filesystem"]]></title><description><![CDATA[
<p>I've been using podman, and for me it is good enough. The way I use it I mount current working directory, /usr/bin, /bin, /usr/lib, /usr/lib64, /usr/share, then few specific ~/.aspnet, ~/.dotnet, ~/.npm-global etc. I use same image as my operating system (Fedora 43).<p>It works pretty well, agent which I choose to run can only write and see the current working directory (and subdirectories) as well as those pnpm/npm etc software development files. It cannot access other than the mounted directories in my home directory.<p>Now some evil command could in theory write to those shared ~/.npm-global directories some commands, that I then inadvertently run without the container but that is pretty unlikely.</p>
]]></description><pubDate>Sat, 28 Mar 2026 08:33:43 +0000</pubDate><link>https://news.ycombinator.com/item?id=47552710</link><dc:creator>Ciantic</dc:creator><comments>https://news.ycombinator.com/item?id=47552710</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=47552710</guid></item><item><title><![CDATA[New comment by Ciantic in "MAUI Is Coming to Linux"]]></title><description><![CDATA[
<p>I wish they support Linux wholeheartedly, a lot of toolkits and GUI frameworks do it by half-assing things, mostly because Wayland is difficult to understand.<p>In Wayland you have multiple ways to render windows, not just the XDG top level window. It works via surfaces, and here is a list I've discovered so far:<p><pre><code>  - XDG Top Level Window
  - Child Window
  - Popup Surface
  - Layer surface (like task-bars, shell overlays)
  - Subsurface (region in another surface)
  - IME Panel Surface (surface that follows text cursor)
</code></pre>
There probably is others too.<p>It is diffifcult to find high-level toolkits that support all of the above.</p>
]]></description><pubDate>Sun, 22 Mar 2026 17:29:09 +0000</pubDate><link>https://news.ycombinator.com/item?id=47479893</link><dc:creator>Ciantic</dc:creator><comments>https://news.ycombinator.com/item?id=47479893</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=47479893</guid></item><item><title><![CDATA[New comment by Ciantic in "I dropped our production database and now pay 10% more for AWS"]]></title><description><![CDATA[
<p>I've used Claude and AWS CDK to build infra code during past year, it is great help but it is not to be trusted. I would not even consider it for Ralph Wiggum Loop style iteration or let alone allowing it to run `cdk deploy` or `cdk destroy`. It can generate decent looking constructs, but it comes up values for you like serverlessV2MinCapacity or sometimes it creates resources I don't need. It can end up costing a lot if you then deploy something you didn't expect to.<p>Since running destroy and deploy also takes a long time, gets stuck, throws weird errors etc, one still needs to read the docs for many things and understand the constructs it outputs.</p>
]]></description><pubDate>Fri, 06 Mar 2026 15:54:17 +0000</pubDate><link>https://news.ycombinator.com/item?id=47276553</link><dc:creator>Ciantic</dc:creator><comments>https://news.ycombinator.com/item?id=47276553</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=47276553</guid></item><item><title><![CDATA[New comment by Ciantic in "Nobody ever got fired for using a struct"]]></title><description><![CDATA[
<p>If I understand this problem was in rkyv, and solution is using rkyv with glue code. I hope they could integrate some sort of official derive macro `rkyv::Sparse` for this if it can't be done automatically in rkyv.</p>
]]></description><pubDate>Fri, 06 Mar 2026 08:29:36 +0000</pubDate><link>https://news.ycombinator.com/item?id=47272443</link><dc:creator>Ciantic</dc:creator><comments>https://news.ycombinator.com/item?id=47272443</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=47272443</guid></item><item><title><![CDATA[New comment by Ciantic in "Indefinite Book Club Hiatus"]]></title><description><![CDATA[
<p>More and more of the internet of humans need to rely on recommendations of other humans. Lobste.rs and other like such that retain the tree of joined people could work for other communities as well. Kind of like return of the FTP warez scene of 90s but for the rest of us.</p>
]]></description><pubDate>Wed, 04 Mar 2026 10:54:21 +0000</pubDate><link>https://news.ycombinator.com/item?id=47245757</link><dc:creator>Ciantic</dc:creator><comments>https://news.ycombinator.com/item?id=47245757</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=47245757</guid></item><item><title><![CDATA[New comment by Ciantic in "Xfwl4 – The Roadmap for a Xfce Wayland Compositor"]]></title><description><![CDATA[
<p>I've used Smithay's Rust client toolkit for a few months now. For making apps it is still sometimes have unsafe wrappers disguised as safe. It has a lot of internals wrapped in Arc<>, but in my tests, the methods are not safe to call from different threads anyhow, you will get weird crashes if done so.<p>I will seek to dive-in to how Wayland API actually works, because I'd really like to know what not to do, when the wrappers used 'wrong' can crash.</p>
]]></description><pubDate>Tue, 27 Jan 2026 14:38:12 +0000</pubDate><link>https://news.ycombinator.com/item?id=46780538</link><dc:creator>Ciantic</dc:creator><comments>https://news.ycombinator.com/item?id=46780538</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=46780538</guid></item><item><title><![CDATA[New comment by Ciantic in "Oh My Zsh adds bloat"]]></title><description><![CDATA[
<p>I have these plugins: git, zsh-autosuggestions<p><pre><code>    /usr/bin/time -f "%e seconds" zsh -i -c exit
    0.06 seconds
</code></pre>
This is acceptable, maybe the zsh-autocomplete is the problem for author or something else?<p>I originally switched to ZSH + Oh My Shell because it opens so fast. Ideally plugins would initialize asynchronously but it's not very easy with shell scripts I think.</p>
]]></description><pubDate>Sat, 10 Jan 2026 10:02:54 +0000</pubDate><link>https://news.ycombinator.com/item?id=46564352</link><dc:creator>Ciantic</dc:creator><comments>https://news.ycombinator.com/item?id=46564352</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=46564352</guid></item><item><title><![CDATA[New comment by Ciantic in "Amazon will allow ePub and PDF downloads for DRM-free eBooks"]]></title><description><![CDATA[
<p>I have Kobo, but their decision to enable secure boot in newer models, and consequently pushing out FOSS choices as operating systems makes me think I won't get another Kobo. Yes the Nickel menu works still with secure boot enabled devices. I like to think that devices I buy might have different use-case in future, and secure-boot enabled devices seriously harm that.</p>
]]></description><pubDate>Fri, 19 Dec 2025 12:56:22 +0000</pubDate><link>https://news.ycombinator.com/item?id=46325294</link><dc:creator>Ciantic</dc:creator><comments>https://news.ycombinator.com/item?id=46325294</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=46325294</guid></item><item><title><![CDATA[New comment by Ciantic in "Show HN: Orbit a systems level programming language that compiles .sh to LLVM"]]></title><description><![CDATA[
<p>> designed to replace legacy shell scripting ... as arguments are passed as a structured array, not a raw string to be parsed by a shell<p>I find shell scripters prefer ubiquity and readability over raw performance. And making it mandatory to give arguments as arrays worsens the readabilty. However having both options would be good, your example doesn't actually require the shell escaping so it could have simpler way.<p>Here is equivalent in Deno for instance<p><pre><code>    #!/usr/bin/env -S deno run --allow-all
    import $ from "jsr:@david/dax"; 
    const command = $`grep -r keyword .`.pipe($`wc -l`);
    const result = await command;
</code></pre>
Deno (via library) and Bun both have $ that can <i>also</i> handle escaping, e.g.<p><pre><code>    const dirName = "Dir with spaces";
    await $`mkdir ${dirName}`; // executes as: mkdir 'Dir with spaces'
</code></pre>
I don't think syntax is your biggest hurdle though, biggest hurdle is that Bash is so common, Powershell was supposed to be better shell scripting, yet it takes nowhere outside Windows space.</p>
]]></description><pubDate>Fri, 19 Dec 2025 10:54:13 +0000</pubDate><link>https://news.ycombinator.com/item?id=46324399</link><dc:creator>Ciantic</dc:creator><comments>https://news.ycombinator.com/item?id=46324399</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=46324399</guid></item></channel></rss>