<rss version="2.0" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:atom="http://www.w3.org/2005/Atom"><channel><title>Hacker News: auxiliarymoose</title><link>https://news.ycombinator.com/user?id=auxiliarymoose</link><description>Hacker News RSS</description><docs>https://hnrss.org/</docs><generator>hnrss v2.1.1</generator><lastBuildDate>Sat, 18 Apr 2026 18:48:35 +0000</lastBuildDate><atom:link href="https://hnrss.org/user?id=auxiliarymoose" rel="self" type="application/rss+xml"></atom:link><item><title><![CDATA[New comment by auxiliarymoose in "Axios compromised on NPM – Malicious versions drop remote access trojan"]]></title><description><![CDATA[
<p>You can just git submodule in the dependencies. Super easy. Also makes it straightforward to develop patches to send upstream from within your project. Or to replace a dependency with a private fork.<p>In my experience, this works great for libraries internal to an organization (UI components, custom file formats, API type definitions, etc.). I don't see why it wouldn't also work for managing public dependencies.<p>Plus it's ecosystem-agnostic. Git submodules work just as well for JS as they do for Go, sample data/binary assets, or whatever other dependencies you need to manage.</p>
]]></description><pubDate>Tue, 31 Mar 2026 17:48:17 +0000</pubDate><link>https://news.ycombinator.com/item?id=47591023</link><dc:creator>auxiliarymoose</dc:creator><comments>https://news.ycombinator.com/item?id=47591023</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=47591023</guid></item><item><title><![CDATA[New comment by auxiliarymoose in "New York City hospitals drop Palantir as controversial AI firm expands in UK"]]></title><description><![CDATA[
<p>How do I decline it?? I keep clicking no, hide, not interested, cancel, etc. but it keeps showing up and activating...if I had a nickel for every time I clicked it on accident in Azure because a layout shift moved it under my mouse when trying to press a button I would have a lot of nickels. It even showed up as an app on my phone because I guess the Office 365 entry got hijacked...</p>
]]></description><pubDate>Thu, 26 Mar 2026 22:41:36 +0000</pubDate><link>https://news.ycombinator.com/item?id=47536762</link><dc:creator>auxiliarymoose</dc:creator><comments>https://news.ycombinator.com/item?id=47536762</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=47536762</guid></item><item><title><![CDATA[New comment by auxiliarymoose in "The three pillars of JavaScript bloat"]]></title><description><![CDATA[
<p>Sure it's not officially called the "standard library," more precisely it would be "the parts of the ECMAScript and CSS standards implemented by all popular evergreen browsers," but "standard library" expresses this in the way people usually talk about programming languages.</p>
]]></description><pubDate>Sun, 22 Mar 2026 18:54:27 +0000</pubDate><link>https://news.ycombinator.com/item?id=47480796</link><dc:creator>auxiliarymoose</dc:creator><comments>https://news.ycombinator.com/item?id=47480796</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=47480796</guid></item><item><title><![CDATA[New comment by auxiliarymoose in "The three pillars of JavaScript bloat"]]></title><description><![CDATA[
<p>No, it means using the crypto module in the standard library instead of importing some third party dependency.</p>
]]></description><pubDate>Sun, 22 Mar 2026 10:12:24 +0000</pubDate><link>https://news.ycombinator.com/item?id=47476010</link><dc:creator>auxiliarymoose</dc:creator><comments>https://news.ycombinator.com/item?id=47476010</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=47476010</guid></item><item><title><![CDATA[New comment by auxiliarymoose in "The three pillars of JavaScript bloat"]]></title><description><![CDATA[
<p>There are certainly security benefits to keeping things in-house. Less exposure to supply-chain attacks (e.g. shai-hulud malware) and widespread security bugs (e.g. react server components server-side RCE). Plus it's much easier to do a complete audit and threat model of the application when you built and understand everything soup-to-nuts.<p>Of course, it also means you have to be cautious about problems that dependencies promise to solve (e.g. XSS), but at the same time, bringing in a bunch of third-party code isn't a substitute for fully understanding your own system.</p>
]]></description><pubDate>Sun, 22 Mar 2026 09:17:50 +0000</pubDate><link>https://news.ycombinator.com/item?id=47475771</link><dc:creator>auxiliarymoose</dc:creator><comments>https://news.ycombinator.com/item?id=47475771</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=47475771</guid></item><item><title><![CDATA[New comment by auxiliarymoose in "The three pillars of JavaScript bloat"]]></title><description><![CDATA[
<p>Thanks for creating and sharing that resource! I'm reading through it now, and it looks fantastic. I'll share it the next time someone asks where to get started with web dev.<p>Come to think of it, I should write up the techniques I use, too...e.g. I have simple wrappers around querySelector() and createElement() with a bit of TypeScript gymnastics in a JSDoc annotation to add intellisense + type checking for custom elements.<p>Would you be open to a pull request with a page on static analysis/type checking for vanilla JS? (intro to JSDoc, useful patterns for custom elements, etc.) If not, that's totally OK, but I figure it could be interesting to readers of the site.<p>And agreed on vanilla/dependency-free not being a silver bullet. There aren't really one-size-fits-all solutions in software, but I've found a vanilla approach (and then adding dependencies only if/when necessary) tends to help the software evolve in a natural way and stay simple where possible.</p>
]]></description><pubDate>Sun, 22 Mar 2026 09:02:59 +0000</pubDate><link>https://news.ycombinator.com/item?id=47475700</link><dc:creator>auxiliarymoose</dc:creator><comments>https://news.ycombinator.com/item?id=47475700</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=47475700</guid></item><item><title><![CDATA[New comment by auxiliarymoose in "The three pillars of JavaScript bloat"]]></title><description><![CDATA[
<p>yeah, plus stack traces, debuggers, and profiling tools are easier to use when all of the non-essential complexity is stripped out. which in turn means it's possible to work productively on software that solves more complex problems.<p>that's in contrast with the sort of stuff that invariably shows up when something falls over somewhere in a dependency:<p><pre><code>    cannot access property "apply" of null
    at forEach()
    at setTimeout()
    at digest()
    at callback()
    at then()
    ...
</code></pre>
it's not fun to step through or profile that sort of code either...</p>
]]></description><pubDate>Sun, 22 Mar 2026 08:16:42 +0000</pubDate><link>https://news.ycombinator.com/item?id=47475465</link><dc:creator>auxiliarymoose</dc:creator><comments>https://news.ycombinator.com/item?id=47475465</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=47475465</guid></item><item><title><![CDATA[New comment by auxiliarymoose in "The three pillars of JavaScript bloat"]]></title><description><![CDATA[
<p>I really think writing dependency-free JavaScript is the way to go nowadays. The standard library in JS/CSS is great. So are static analysis (TypeScript can check JSDoc), imports (ES modules), UI (web components), etc.<p>People keep telling me the approach I am taking won't scale or will be hard to maintain, yet my experience has been that things stay simple and easy to change in a way I haven't experienced in dependency-heavy projects.</p>
]]></description><pubDate>Sun, 22 Mar 2026 04:15:25 +0000</pubDate><link>https://news.ycombinator.com/item?id=47474386</link><dc:creator>auxiliarymoose</dc:creator><comments>https://news.ycombinator.com/item?id=47474386</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=47474386</guid></item><item><title><![CDATA[New comment by auxiliarymoose in "A case for Go as the best language for AI agents"]]></title><description><![CDATA[
<p>Take async for example. You have to choose some third-party async runtime which may or may not work with other runtimes, libraries, platforms, etc.<p>With Go, async code written in Go 1.0 compiles and runs the same in Go 1.26, and there is no fragmentation or necessity to reach for third party components.</p>
]]></description><pubDate>Mon, 02 Mar 2026 21:25:24 +0000</pubDate><link>https://news.ycombinator.com/item?id=47224320</link><dc:creator>auxiliarymoose</dc:creator><comments>https://news.ycombinator.com/item?id=47224320</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=47224320</guid></item><item><title><![CDATA[New comment by auxiliarymoose in "Fluorite – A console-grade game engine fully integrated with Flutter"]]></title><description><![CDATA[
<p>Godot Engine has pretty good UI building tools.<p>The places where it poses challenges in my experience are high quality typesetting/rich text, responsive UI that requires a wide range of presentations (i.e. different layout structures on mobile vs desktop), and granular control over rendering details.<p>But for functionality-oriented UI, it's hard to beat its simplicity and scalability, particularly when you want to develop on one platform (e.g. computer) and have everything "just work" identically on other form factors (web/tablet/etc.).<p>For example, Godot's editor is bootstrapped/built in Godot, and runs natively on Web, Android, and Quest XR among other platforms.</p>
]]></description><pubDate>Thu, 12 Feb 2026 00:57:46 +0000</pubDate><link>https://news.ycombinator.com/item?id=46983532</link><dc:creator>auxiliarymoose</dc:creator><comments>https://news.ycombinator.com/item?id=46983532</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=46983532</guid></item><item><title><![CDATA[New comment by auxiliarymoose in "Fluorite – A console-grade game engine fully integrated with Flutter"]]></title><description><![CDATA[
<p>Godot is pretty lightweight (especially considering how powerful it is), generally about a second or less. But maybe they are looking for a fast enough startup time that the engine can be started when showing something onscreen and torn down when not visible. In which case, I can see the startup time being an issue.</p>
]]></description><pubDate>Thu, 12 Feb 2026 00:51:46 +0000</pubDate><link>https://news.ycombinator.com/item?id=46983483</link><dc:creator>auxiliarymoose</dc:creator><comments>https://news.ycombinator.com/item?id=46983483</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=46983483</guid></item><item><title><![CDATA[New comment by auxiliarymoose in "AWS European Sovereign Cloud"]]></title><description><![CDATA[
<p>AWS GovCloud is accessible to commercial customers.</p>
]]></description><pubDate>Fri, 16 Jan 2026 00:41:09 +0000</pubDate><link>https://news.ycombinator.com/item?id=46641581</link><dc:creator>auxiliarymoose</dc:creator><comments>https://news.ycombinator.com/item?id=46641581</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=46641581</guid></item><item><title><![CDATA[New comment by auxiliarymoose in "It's hard to justify Tahoe icons"]]></title><description><![CDATA[
<p>Much of the problem stems from inconsistent application of icons. This would have gone better if Apple established (and followed!) clear guidelines for exactly which icon to use for which standard action (e.g. search).<p>That the icons exist is not necessarily a problem, since they can help teach users which buttons in the UI do which actions. (menu bar for discovery, app UI for less mouse travel + contextual options). But that requires consistency, which the current implementation lacks...</p>
]]></description><pubDate>Mon, 05 Jan 2026 16:51:06 +0000</pubDate><link>https://news.ycombinator.com/item?id=46501197</link><dc:creator>auxiliarymoose</dc:creator><comments>https://news.ycombinator.com/item?id=46501197</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=46501197</guid></item><item><title><![CDATA[New comment by auxiliarymoose in "Replacing JavaScript with Just HTML"]]></title><description><![CDATA[
<p>Accordion behavior is discussed in the article in the "Accordions / Expanding Content Panels" section:<p>> Use the same name attribute on all related details (like radio buttons) to restrict only one open panel at a time<p>And tabs can be a <details>-based accordion with some creative CSS to adjust the layout (left as an exercise for the reader, but I could write up an example if that would be helpful!)</p>
]]></description><pubDate>Sun, 28 Dec 2025 08:52:30 +0000</pubDate><link>https://news.ycombinator.com/item?id=46409526</link><dc:creator>auxiliarymoose</dc:creator><comments>https://news.ycombinator.com/item?id=46409526</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=46409526</guid></item><item><title><![CDATA[New comment by auxiliarymoose in "We replaced H.264 streaming with JPEG screenshots (and it worked better)"]]></title><description><![CDATA[
<p>They shared the polling code in the article. It doesn't request another jpeg until the previous one finishes downloading. UDP is not necessary to write a loop.</p>
]]></description><pubDate>Tue, 23 Dec 2025 21:06:33 +0000</pubDate><link>https://news.ycombinator.com/item?id=46369456</link><dc:creator>auxiliarymoose</dc:creator><comments>https://news.ycombinator.com/item?id=46369456</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=46369456</guid></item><item><title><![CDATA[New comment by auxiliarymoose in "We pwned X, Vercel, Cursor, and Discord through a supply-chain attack"]]></title><description><![CDATA[
<p>Because displaying user-submitted images is pretty common and doesn't feel like a security footgun, but displaying user-submitted HTML is less common (and will raise more careful security scrutiny).</p>
]]></description><pubDate>Sat, 20 Dec 2025 00:44:34 +0000</pubDate><link>https://news.ycombinator.com/item?id=46332707</link><dc:creator>auxiliarymoose</dc:creator><comments>https://news.ycombinator.com/item?id=46332707</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=46332707</guid></item><item><title><![CDATA[New comment by auxiliarymoose in "We pwned X, Vercel, Cursor, and Discord through a supply-chain attack"]]></title><description><![CDATA[
<p>The crazy thing is that today the JavaScript standard library is very robust, and yet the culture of pulling in a ton of dependencies persists. It's so much easier to develop code against a stable and secure platform, yet it seems the choice is often to pull in hundreds of bits of code maintained by many different parties (instead of doing a little more in-house).</p>
]]></description><pubDate>Fri, 19 Dec 2025 08:38:15 +0000</pubDate><link>https://news.ycombinator.com/item?id=46323592</link><dc:creator>auxiliarymoose</dc:creator><comments>https://news.ycombinator.com/item?id=46323592</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=46323592</guid></item><item><title><![CDATA[New comment by auxiliarymoose in "We pwned X, Vercel, Cursor, and Discord through a supply-chain attack"]]></title><description><![CDATA[
<p>They are reasonably consistent because there is a de-facto reference implementation (Adobe Acrobat) which, if your implementation does not match exactly, users will think your implementation is broken.<p>There isn't such an implementation for SVG.</p>
]]></description><pubDate>Fri, 19 Dec 2025 07:22:27 +0000</pubDate><link>https://news.ycombinator.com/item?id=46323114</link><dc:creator>auxiliarymoose</dc:creator><comments>https://news.ycombinator.com/item?id=46323114</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=46323114</guid></item><item><title><![CDATA[New comment by auxiliarymoose in "We pwned X, Vercel, Cursor, and Discord through a supply-chain attack"]]></title><description><![CDATA[
<p>Also remember that if the untrusted SVG file is served from the same origin and is missing a `Content-Disposition: attachment` header (or a CSP that disables scripts), an attacker could upload a malicious SVG and send the SVG URL to an unsuspecting user with pretty bad consequences.<p>That SVG can then do things like history.replaceState() and include <foreignObject> with HTML to change the URL shown to the user away from the SVG source and show any web UI it would like.</p>
]]></description><pubDate>Fri, 19 Dec 2025 07:19:53 +0000</pubDate><link>https://news.ycombinator.com/item?id=46323098</link><dc:creator>auxiliarymoose</dc:creator><comments>https://news.ycombinator.com/item?id=46323098</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=46323098</guid></item><item><title><![CDATA[New comment by auxiliarymoose in "We pwned X, Vercel, Cursor, and Discord through a supply-chain attack"]]></title><description><![CDATA[
<p>Yes. Much better to handle all untrusted data safely rather than try to transform untrusted data into trusted data.<p>I found this page a helpful summary of ways to prevent SVG XSS:
<a href="https://digi.ninja/blog/svg_xss.php" rel="nofollow">https://digi.ninja/blog/svg_xss.php</a><p>Notably, the sanitization option is risky because one sanitizer's definition of "safe" might not actually be "safe" for all clients and usages.<p>Plus as soon as you start sanitizing data entered by users, you risk accidentally sanitizing out legitimate customer data (Say you are making a DropBox-like fileshare and a customer's workflow relies on embedding scripts in an SVG file to e.g. make interactive self-contained graphics. Maybe not a great idea, but that is for the customer to decide, and a sanitization script would lose user data. Consider for example that GitHub does not sanitize JavaScript out of HTML files in git repositories.)</p>
]]></description><pubDate>Fri, 19 Dec 2025 07:14:28 +0000</pubDate><link>https://news.ycombinator.com/item?id=46323059</link><dc:creator>auxiliarymoose</dc:creator><comments>https://news.ycombinator.com/item?id=46323059</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=46323059</guid></item></channel></rss>