Hacker News: benmccann

New comment by benmccann in "The unexpected effectiveness of one-shot decompilation with Claude"

benmccann — Sat, 06 Dec 2025 17:54:35 +0000

I used Gemini to compare the minimized output of the Rollup vs Rolldown JavaScript bundlers to find locations where the latter was not yet at the same degree of optimization. It was astoundingly good and I'm not sure how I would have been able to accomplish the task without an LLM as an available tool.

New comment by benmccann in "Shai-Hulud Returns: Over 300 NPM Packages Infected"

benmccann — Mon, 24 Nov 2025 17:46:26 +0000

fixed!

New comment by benmccann in "Shai-Hulud Returns: Over 300 NPM Packages Infected"

benmccann — Mon, 24 Nov 2025 17:24:56 +0000

Hundreds of people had access to publish the Zapier SDK, so it's little surprise they were eventually compromised! (https://bsky.app/profile/benmccann.com/post/3m6fdecsbdk2u)

The e18e community are reducing dependencies in popular libraries and building tools to prevent and reduce the impact of such attacks. Join if you want to help out! https://e18e.dev/

Just this morning, after trying to make the case over the past year, we had a change landed to remove more than a dozen dependencies from typescript-eslint! https://bsky.app/profile/benmccann.com/post/3m6fcjax7ec2h

New comment by benmccann in "Shai-Hulud malware attack: Tinycolor and over 40 NPM packages compromised"

benmccann — Tue, 16 Sep 2025 13:14:29 +0000

Yes, eslint is particularly frustrating: https://npmgraph.js.org/?q=eslint

There are plenty of people in the community who would help reduce the number of dependencies, but it really requires the maintainers to make it a priority. Otherwise the only way to address it is to switch to another solution like oxlint.

New comment by benmccann in "Next.js is infuriating"

benmccann — Tue, 02 Sep 2025 18:34:05 +0000

The number 3, 4, and 5 contributors to SvelteKit in the past year work at Vercel: https://github.com/sveltejs/kit/graphs/contributors?from=8%2...

Rich and Simon are incredibly important, but they're in it for Svelte and the community more so than a paycheck from Vercel. Tee has been doing most of the maintenance on SvelteKit currently funded by community donations. And this isn't counting other infrastructure like vite-plugin-svelte or the Svelte CLI which are entirely maintained by volunteers. I don't think Vercel funds a majority of the work on Svelte even if it might be close to it.

New comment by benmccann in "Next.js is infuriating"

benmccann — Tue, 02 Sep 2025 13:40:28 +0000

Only 3/40 Svelte maintainers work at Vercel and they mainly finance work on Svelte core. SvelteKit day-to-day is primarily maintained by folks outside Vercel

New comment by benmccann in "Vendors that treat single sign-on as a luxury feature"

benmccann — Tue, 19 Aug 2025 22:56:35 +0000

Wouldn't vouch proxy only work with self hosted apps? How would you use it with a SaaS app?

New comment by benmccann in "PlasticList – Plastic Levels in Foods"

benmccann — Wed, 25 Jun 2025 19:32:16 +0000

What is the plastic.love you're referring to? That domain doesn't resolve for me. Do you mean PlasticList?

New comment by benmccann in "I like Svelte more than React (it's store management)"

benmccann — Sun, 01 Jun 2025 15:42:14 +0000

It's neither true that Svelte has few users or that we can easily break things. Tons of sites are built with Svelte like Yahoo Finance and Apple Music. Svelte 5 was the only big change in syntax in the past five years and we made sure that there's a good migration tool, etc. to minimize the amount of hardship and upgrade might cause. As a result the majority of users have already upgraded to Svelte 5.

That being said, Svelte absolutely does continue to innovate. We'll be introducing a new async primitive, RPC mechanism, etc. in the near future: https://m.youtube.com/watch?v=1dATE70wlHc

New comment by benmccann in "Claude 4"

benmccann — Thu, 22 May 2025 17:17:02 +0000

The updated knowledge cutoff is helping with new technologies such as Svelte 5.

New comment by benmccann in "Launch HN: Better Auth (YC X25) – Authentication Framework for TypeScript"

benmccann — Mon, 19 May 2025 19:59:31 +0000

NextAuth certainly needs some competition. However, I wish better-auth didn't have so many dependencies. I feel like it shouldn't be necessary to depend on things like kysley and Typescript.

New comment by benmccann in "US Judge invalidates blood glucose sensor patent, opens door for Apple Watch"

benmccann — Fri, 21 Feb 2025 14:37:49 +0000

Check out https://www.perceptive.io/

New comment by benmccann in "Svelte 5 and the Future of Frameworks: A Chat with Rich Harris"

benmccann — Thu, 30 Jan 2025 04:18:40 +0000

I believe the reason for that was to enable event forwarding, which was a highly requested feature and makes a lot of things easier.

New comment by benmccann in "Svelte 5 and the Future of Frameworks: A Chat with Rich Harris"

benmccann — Thu, 30 Jan 2025 04:16:53 +0000

The docs for single page apps live at https://svelte.dev/docs/kit/single-page-apps

By default, SvelteKit does SSR for the first page and client-side routing thereafter. This is fully configurable. Perhaps it's worth an additional mention on the routing page. I'll take a look later. Thanks for the suggestion.

New comment by benmccann in "Svelte 5 and the Future of Frameworks: A Chat with Rich Harris"

benmccann — Thu, 30 Jan 2025 04:04:55 +0000

You should only access credentials in `.server` files. We have a built-in feature that checks that you only access credentials in `.server` files to try to prevent newcomers from accidentally making any mistake in that regard.

New comment by benmccann in "Svelte 5 and the Future of Frameworks: A Chat with Rich Harris"

benmccann — Wed, 29 Jan 2025 21:08:14 +0000

Actually, I forgot that this landed as an official part of the docs now: https://svelte.dev/docs/llms

It might still be a bit big, but PRs welcome if folks want to try slimming it down to just the stuff that's new in Svelte 5.

New comment by benmccann in "Svelte 5 and the Future of Frameworks: A Chat with Rich Harris"

benmccann — Wed, 29 Jan 2025 10:49:40 +0000

I haven't used Claude much personally, but have seen https://svelte-llm.khromov.se/ built to help on that front, do you might want to check it out.

New comment by benmccann in "Svelte 5 and the Future of Frameworks: A Chat with Rich Harris"

benmccann — Wed, 29 Jan 2025 10:41:35 +0000

Vite does statically replace the `browser` variable with `true` or `false` based on whether you're on the client or server, but this shouldn't affect the correctness of your code. It does allow Vite to remove any unused code, however. E.g. `if (browser)` turns into `if (false)` on the server and any code within that block can be removed. This can avoid shipping unused code to the client.

Astro is also built in top of Vite and the same thing happens there. If you reference `import.meta.env.SSR` it is statically replaced during build and unused code is tree-shaken out: https://vite.dev/guide/env-and-mode#env-variables

New comment by benmccann in "Svelte 5 and the Future of Frameworks: A Chat with Rich Harris"

benmccann — Wed, 29 Jan 2025 10:24:33 +0000

Files with `.server` in the name run only on the server. The remaining files run on the client and server. This is mentioned in the introduction on https://svelte.dev/docs/kit/routing

What's confusing about this and what could we do to help?

New comment by benmccann in "Svelte 5 and the Future of Frameworks: A Chat with Rich Harris"

benmccann — Wed, 29 Jan 2025 10:13:08 +0000

Snippets are far more powerful than slots and so the change is not merely cosmetic. Snippets give you a way to create reusable HTML fragments within a component.