Hacker News: bakkoting

New comment by bakkoting in "StemDeck, a free, open-source and local AI stem separator"

bakkoting — Sun, 30 Aug 2026 03:15:21 +0000

A while back I ported htdemucs (the same thing this uses) to onnx/wasm/webgpu so you can do it in browser (though I only bothered with the 4-stem version): https://bakkot.github.io/demucs-js/

New comment by bakkoting in "OpenLogi"

bakkoting — Wed, 19 Aug 2026 17:47:57 +0000

I dunno, lots of companies seem pretty happy to build large portions of their business on top of unvetted single-maintainer open source projects. Don't see why they'd stop doing so now.

(Anyway, I don't care so much about what companies go for, as opposed to what I can do on my own devices.)

New comment by bakkoting in "Claude Fable produced a counterexample to the Jacobian Conjecture"

bakkoting — Mon, 20 Jul 2026 14:40:19 +0000

Depends on exactly where you draw the line at "breakthrough", but there's been at least a few novel and interesting results coming from outside mathematicians. Recently for example there were https://old.reddit.com/r/math/comments/1uxj3cy/after_openais... from Phillip Kerger at Berkeley, and https://www.erdosproblems.com/forum/thread/119/proof-claims from Samuel Korsky at Two Sigma (the latter of which was more of a collaboration between the human and machine, not a one-shot like several of the other results we've discussed).

New comment by bakkoting in "Bun has an open PR adding shared-memory threads to JavaScriptCore"

bakkoting — Sat, 20 Jun 2026 22:12:41 +0000

They didn't open a PR against zig either, the compiler concurrency work they did was also only ever in their own fork.

New comment by bakkoting in "Bun has an open PR adding shared-memory threads to JavaScriptCore"

bakkoting — Sat, 20 Jun 2026 22:07:38 +0000

In case anyone missed it, this PR is based on that:

> This is an implementation of the design Filip Pizlo published in 2017: "Concurrent JavaScript: It Can Work!".

New comment by bakkoting in "Upcoming breaking changes for npm v12"

bakkoting — Wed, 10 Jun 2026 15:03:35 +0000

This used to be more common but the pattern these days is to have the binaries split into optionalDependencies which declare their supported CPU etc, one per supported platform. Then npm will install just the matching one (optionalDependencies that require a different platform aren't installed).

The fact that most of the ecosystem has moved to this pattern is a big part of why this change is now feasible.

New comment by bakkoting in "Malicious npm packages detected across Red Hat Cloud Services"

bakkoting — Mon, 01 Jun 2026 16:30:03 +0000

I have; you specify one optional dependency per platform and set the requirements in each package. It works fine. A bunch of packages do this (e.g. esbuild). I don't know what your complaint is or what you're asking for.

New comment by bakkoting in "NPM packages from Red Hat have been compromised"

bakkoting — Mon, 01 Jun 2026 16:16:27 +0000

They have taken action as of very recently. The latest version [1] of npm warns when there are install scripts and tells you they will be disabled by default in a future version, with a per-dependency opt in mechanism [2].

[1] https://github.com/npm/cli/releases/tag/v11.16.0

[2] https://github.com/npm/rfcs/pull/868

New comment by bakkoting in "Node.js 26.0.0 (Now with Temporal)"

bakkoting — Wed, 20 May 2026 21:51:36 +0000

The proposal used to do more thing and we didn't change the URL after we ultimately arrived at this set of APIs.

New comment by bakkoting in "Mini Shai-Hulud Strikes Again: 314 npm Packages Compromised"

bakkoting — Tue, 19 May 2026 18:56:09 +0000

There's an RFC for this: https://github.com/npm/rfcs/pull/868

New comment by bakkoting in "Mini Shai-Hulud Strikes Again: 314 npm Packages Compromised"

bakkoting — Tue, 19 May 2026 18:53:55 +0000

> most people use pre-built distributions (wheels) for their architecture from PyPI, so don't execute arbitrary code to install packages

Technically true, but wheels can include a `.pth` which will run arbitrary code as soon as Python is started, which is only marginally less dangerous. Recently exploited in the LiteLLM attack.

New comment by bakkoting in "'No way to prevent this,' says only package manager where this regularly happens"

bakkoting — Sat, 16 May 2026 14:51:21 +0000

These things are usually caught by tools specifically scanning npm or by the maintainers noticing their account is compromised, not by people auditing their own installed packages.

New comment by bakkoting in "Postmortem: TanStack NPM supply-chain compromise"

bakkoting — Tue, 12 May 2026 00:45:59 +0000

2fa being enabled for people on the team is different from 2fa being required for publishing. It is not current possible to enforce (or use) 2fa for publishing with trusted publishing.

New comment by bakkoting in "PHP 8.6 Closure Optimizations"

bakkoting — Fri, 17 Apr 2026 02:32:11 +0000

> type safety without having to transpile code from another language (so no build processes that rival C++ in complexity just to still have interpreted code at the end)

All major server-side JS runtimes are capable of executing TypeScript without transpilation these days. Complex build processes are only really a thing for client-side JS. The normal state of affairs these days is to run server-side code with no build step whatsoever.

New comment by bakkoting in "Cybersecurity looks like proof of work now"

bakkoting — Fri, 17 Apr 2026 01:46:19 +0000

Ehhhhh basically none of those exploits generalize beyond one very specific engine and set of conditions, and half of them are things to do with interactions between JIT tiers and can't be reliably triggered.

New comment by bakkoting in "You can't cancel a JavaScript promise (except sometimes you can)"

bakkoting — Wed, 08 Apr 2026 15:02:30 +0000

I agree that the original cancellation discussion was bad. I don't agree that these threads reflect the same disfunction. They're a new effort (from me). No one was working on it previously because browsers have said that they were unwilling to add any other form of cancellation given that AbortSignal already exists, so there was never a chance to add a separate CancelToken once it shipped. The work to be done now is basically administrative: moving a subset from the WHATWG spec to TC39. This has ~no relevance to user's lives unless they're using a JS runtime which does not implement the WinterTC spec, which is approximately no one. The delay has nothing to do with SES (which has no bearing on this), and Governors are a _use case_ which motivates bringing it into the language, not a thing with which it needs to be reconciled.

New comment by bakkoting in "You can't cancel a JavaScript promise (except sometimes you can)"

bakkoting — Tue, 07 Apr 2026 19:01:08 +0000

Browsers have said that they are unwilling to ship any new cancelation mechanisms given that AbortSignal already exists, so we can't ship a different CancelToken. But I think there's a path to standardizing a subset of the existing AbortSignal machinery [1].

(I am on TC39 and while this isn't my highest priority I did bring the topic for discussion at the last meeting [2], and there was support from the rest of committee.)

[1] https://github.com/tc39/proposal-concurrency-control/issues/...

[2] https://github.com/bakkot/structured-concurrency-for-js

New comment by bakkoting in "Node.js worker threads are problematic, but they work great for us"

bakkoting — Sun, 22 Mar 2026 17:45:01 +0000

We haven't refused, it just takes time! There was an update at the meeting two weeks ago [1]. There's a lot of other machinery which needs to be specified and implemented before module declarations will work but it's coming along.

[1] https://docs.google.com/presentation/d/1inTcnb4hugyAvKrjFX_X...

New comment by bakkoting in "The three pillars of JavaScript bloat"

bakkoting — Sun, 22 Mar 2026 14:14:54 +0000

Python and Rust have such a thing, but not e.g. Java, Go, C#. And I can't find any libraries on npm which do this. That seems like a very niche need, not actually the sort of thing whose absence causes people to have lots of npm dependencies.

New comment by bakkoting in "A better streams API is possible for JavaScript"

bakkoting — Fri, 27 Feb 2026 17:28:39 +0000

Observables has moved to WHATWG [1] and been implemented in Chrome, although I don't know if the other browsers have expressed any interest (and there's still some issues [2] to be worked through).

But Observables really do not solve the problems being talked about in this post.

[1] https://github.com/WICG/observable [2] https://github.com/WICG/observable/issues/216