Hacker News: SchizoDuckie

New comment by SchizoDuckie in "Cyberscript"

SchizoDuckie — Sun, 02 Aug 2026 11:08:21 +0000

This is by far the most stupid name for a new language imaginable. Shortening it to "cyber" on the landing page too..

When will devs learn that being able to search for a term on the open internet without having it polluted by normal language is kind of important

The solution the supply chain problems is removing your deps from .gitignore

SchizoDuckie — Sun, 24 May 2026 00:31:06 +0000

I head the major realisation today that we've all been bamboozled.

All the supply chain attacks currently happening would never even happen if we just checked in our language-respective vendor/node_modules/venv directories into git and just deployed straight from that.

Screw the dependency install and upgrade step. Screw the automated build step. Screw the breaking changes because $package_owner doesnt adhere to semver.

Checking in dependencies and their updates individually is, and has always been the way out of this mess.

Remove vendor/ node_modules/ and venv/ from your .gitignore today and skip the install step in your CI and you eliminate 99% of the attack surface instantly. Was it always that easy???? I think it was!

You think checking in your composer.lock or package.lock saves you? Hah. Npm install is "smart" and checks for updates and silently installs new versions and updates your lockfile. You should have used npm ci instead. We actively train devs to run 'composer update' to check for new releases that fix 'issues' they might encounter locally and delete the lockfiles as a first measure to fix issues.

Do you vet every update to your composer.lock? That one innocent commit hash that's changed could just pull in 20kb of obfuscated exploit code and you'd never know.

All of this is compounded by the longstanding hilarious github bug where you can fork a repository and push your commit to it, then pluck the commit hash and append that to the original repository URL. On the Github webinterface you'll see a notice "this commit has might not belong to this repo or a fork of it" but on the terminal you'll never see that, and that's exactly what the current worms exploit.

Checking in your dependencies and eliminating the install step would make all of this trackable and traceable. Imo the performance hit is worth it.

Comments URL: https://news.ycombinator.com/item?id=48253062

Points: 10

# Comments: 12

I'm calling BS on YC's latest subscription based mosquito killer drone project

SchizoDuckie — Sat, 08 Nov 2025 15:22:22 +0000

Article URL: https://twitter.com/ycombinator/status/1986917284561207783

Comments URL: https://news.ycombinator.com/item?id=45857245

Points: 3

# Comments: 0

New comment by SchizoDuckie in "YouTube addresses lower view counts which seem to be caused by ad blockers"

SchizoDuckie — Wed, 17 Sep 2025 15:39:02 +0000

Only YouTube can tell, that's the fun part.

New comment by SchizoDuckie in "YouTube addresses lower view counts which seem to be caused by ad blockers"

SchizoDuckie — Wed, 17 Sep 2025 15:38:29 +0000

afairc sub-100 views are not counted in realtime anyway.

New comment by SchizoDuckie in "YouTube addresses lower view counts which seem to be caused by ad blockers"

SchizoDuckie — Wed, 17 Sep 2025 15:33:32 +0000

Go complain to Youtube, where the views should be measured on the backend instead of via an API call.

Does anyone realize how many missed views this implies??

An Unusual Employment Vetting Experience. Grifter Chancing His Luck or DPRK?

SchizoDuckie — Wed, 13 Aug 2025 20:16:20 +0000

Article URL: https://medium.com/@ItsNotNicole/an-unusual-employment-vetting-experience-general-grifter-chancing-his-luck-or-dprk-d7a8a5cd5e21

Comments URL: https://news.ycombinator.com/item?id=44893304

Points: 3

# Comments: 0

New comment by SchizoDuckie in "Jules, our asynchronous coding agent"

SchizoDuckie — Wed, 06 Aug 2025 18:32:26 +0000

How is that any of my business? Well, I'm a software dev by trade and hobby, and I hack the planet on the side and advise multibillion $$$ companies on the security mistakes they make.

Even for the next 5 years I'd like to be able to have some capable humans in my teams.

New comment by SchizoDuckie in "Jules, our asynchronous coding agent"

SchizoDuckie — Wed, 06 Aug 2025 18:27:23 +0000

I can trust humans to do as I ask.

New comment by SchizoDuckie in "Jules, our asynchronous coding agent"

SchizoDuckie — Wed, 06 Aug 2025 18:24:46 +0000

As it stands right now, until there is some radically new way that doesn't hallucinate implementations, is grounded in security rules and actually understands what it's doing in the larger context of the system it's working in I am not really worried about my job.

I stopped worrying about what techbro's think a long time ago. I saw one slinging a blockchain ai nft filesystem that will ingest and organize your documents for you on twitter yesterday.

New comment by SchizoDuckie in "Jules, our asynchronous coding agent"

SchizoDuckie — Wed, 06 Aug 2025 18:11:11 +0000

Great. So Junior devs will be useless now. Now how are we going to train more senior devs that know what they're doing?

New comment by SchizoDuckie in "Jules, our asynchronous coding agent"

SchizoDuckie — Wed, 06 Aug 2025 18:02:14 +0000

Who in their right mind hands off tasks to one of these for their day job? They can never be trusted.

New comment by SchizoDuckie in "Ms's new video editor transcodes video by sending every frame to sharepoint"

SchizoDuckie — Mon, 08 Jul 2024 20:54:45 +0000

I'm sorry. What backend? I'm trying to slice a video on my local machine. Something that was a 30 second job for something like this in the previous Windows Movie Maker that they yanked from the Microsoft Store and replaced with "the new and improved" ClipChamp, which is horribly slow, and I just found out why.

How is sharepoint involved in any of this? Why is it not transcoding locally? What if i throw it a 4k video?

Ms's new video editor transcodes video by sending every frame to sharepoint

SchizoDuckie — Mon, 08 Jul 2024 20:50:40 +0000

Article URL: https://twitter.com/SchizoDuckie/status/1810410346672455794/photo/1

Comments URL: https://news.ycombinator.com/item?id=40909540

Points: 4

# Comments: 4

Show HN: A multiple choice "flash card" game for my daughter using GPT4

SchizoDuckie — Fri, 28 Jun 2024 17:36:49 +0000

Article URL: https://schizoduckie.github.io/unicornpoep/

Comments URL: https://news.ycombinator.com/item?id=40822938

Points: 4

# Comments: 0

New comment by SchizoDuckie in "Is Aschenbrenner's 165 page paper on AI the naivety of a 25 year old?"

SchizoDuckie — Thu, 13 Jun 2024 11:42:23 +0000

I love how the author of this article makes no intent to give even a start on why he thinks the author of the paper is naive or even describe what the paper is about and give an abstract.

New comment by SchizoDuckie in "A useful front-end confetti animation library"

SchizoDuckie — Thu, 25 Apr 2024 22:38:29 +0000

I use this on unicornpoep.nl, a little multiple choice toy i built for my daughter to teach her multiplication tables.

This library is an awesome chromebook killer. I need to find something more optimized. But it does the trick!

Fujitsu spilled private client data,passwords into the open unnoticed for a year

SchizoDuckie — Wed, 20 Mar 2024 23:03:08 +0000

Article URL: https://www.thestack.technology/fujitsu-breach-cloud-buckets/

Comments URL: https://news.ycombinator.com/item?id=39773074

Points: 3

# Comments: 0

New comment by SchizoDuckie in "Bitcoin is dead, but it was a good try"

SchizoDuckie — Sat, 27 Jan 2024 19:01:32 +0000

Thankfully bitcoin is less susceptible to the FED printing press and more to the whims of what someone like Musk is doing on the social media platform he just bought. ¯\_(ツ)_/¯ Your argument makes no sense.

https://www.sciencedirect.com/science/article/abs/pii/S00401....

New comment by SchizoDuckie in "MuseScore/Audacity employee theatening to destroy a Chinese developer's life"

SchizoDuckie — Mon, 19 Jul 2021 12:10:32 +0000

Ever heard of the term "veiled threat"?