<rss version="2.0" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:atom="http://www.w3.org/2005/Atom"><channel><title>Hacker News: rictic</title><link>https://news.ycombinator.com/user?id=rictic</link><description>Hacker News RSS</description><docs>https://hnrss.org/</docs><generator>hnrss v2.1.1</generator><lastBuildDate>Tue, 14 Apr 2026 09:50:13 +0000</lastBuildDate><atom:link href="https://hnrss.org/user?id=rictic" rel="self" type="application/rss+xml"></atom:link><item><title><![CDATA[The Kernel Panicked (Apologies to the Front Fell Off)]]></title><description><![CDATA[
<p>Article URL: <a href="https://twitter.com/morphillogical/status/2041711892159484172">https://twitter.com/morphillogical/status/2041711892159484172</a></p>
<p>Comments URL: <a href="https://news.ycombinator.com/item?id=47684494">https://news.ycombinator.com/item?id=47684494</a></p>
<p>Points: 2</p>
<p># Comments: 0</p>
]]></description><pubDate>Wed, 08 Apr 2026 03:01:51 +0000</pubDate><link>https://twitter.com/morphillogical/status/2041711892159484172</link><dc:creator>rictic</dc:creator><comments>https://news.ycombinator.com/item?id=47684494</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=47684494</guid></item><item><title><![CDATA[New comment by rictic in "Coding Agent VMs on NixOS with Microvm.nix"]]></title><description><![CDATA[
<p>Yep. What nix adds is a declarative and reproducible way to build customized OS images to boot into.</p>
]]></description><pubDate>Wed, 04 Feb 2026 16:27:27 +0000</pubDate><link>https://news.ycombinator.com/item?id=46887849</link><dc:creator>rictic</dc:creator><comments>https://news.ycombinator.com/item?id=46887849</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=46887849</guid></item><item><title><![CDATA[New comment by rictic in "Lessons from 14 years at Google"]]></title><description><![CDATA[
<p>Inflation adjusted incomes are up in the US across the board. The affordability problem is largely the price of housing because it's illegal to build.</p>
]]></description><pubDate>Mon, 05 Jan 2026 04:25:48 +0000</pubDate><link>https://news.ycombinator.com/item?id=46495325</link><dc:creator>rictic</dc:creator><comments>https://news.ycombinator.com/item?id=46495325</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=46495325</guid></item><item><title><![CDATA[New comment by rictic in "Avoid Mini-Frameworks"]]></title><description><![CDATA[
<p>Agree, for modern React with hooks. A React component looks like a normal function, only you can't call it. Only React can call it, in order to set up its hooks state.</p>
]]></description><pubDate>Wed, 24 Dec 2025 23:53:45 +0000</pubDate><link>https://news.ycombinator.com/item?id=46380623</link><dc:creator>rictic</dc:creator><comments>https://news.ycombinator.com/item?id=46380623</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=46380623</guid></item><item><title><![CDATA[New comment by rictic in "Why the Sanitizer API is just `setHTML()`"]]></title><description><![CDATA[
<p>You can disable it for your site using a trusted types content security policy.</p>
]]></description><pubDate>Thu, 11 Dec 2025 16:19:44 +0000</pubDate><link>https://news.ycombinator.com/item?id=46233310</link><dc:creator>rictic</dc:creator><comments>https://news.ycombinator.com/item?id=46233310</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=46233310</guid></item><item><title><![CDATA[New comment by rictic in "How/why to sweep async tasks under a Postgres table"]]></title><description><![CDATA[
<p>Missing from the article: how to communicate progress and failure to the user?<p>This is much more complicated with task queues. Doable still! But often skipped, because it's tempting to imagine that the backend will just handle the failure by retrying. But there are lots of kinds of failure that can happen.<p>The recipient's server doesn't accept the email. The recipient's domain name expired. Actually, we don't have an email address for that recipient at all.<p>The user has seen "got it, will do, don't worry about it" but if that email is time sensitive, they might want to know that it hasn't been sent yet, and maybe they should place a phone call instead.</p>
]]></description><pubDate>Fri, 21 Nov 2025 20:05:48 +0000</pubDate><link>https://news.ycombinator.com/item?id=46008363</link><dc:creator>rictic</dc:creator><comments>https://news.ycombinator.com/item?id=46008363</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=46008363</guid></item><item><title><![CDATA[New comment by rictic in "Just use a button"]]></title><description><![CDATA[
<p>A click handler can be doing a lot of things that aren't much like a button, like letting you close a modal if you click outside of it, capturing mouse events for a game, or passively recording events for analytics. All that a click handler tells you is that there's some code that sometimes cares about some clicks somewhere inside that element.</p>
]]></description><pubDate>Fri, 31 Oct 2025 18:42:43 +0000</pubDate><link>https://news.ycombinator.com/item?id=45775278</link><dc:creator>rictic</dc:creator><comments>https://news.ycombinator.com/item?id=45775278</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=45775278</guid></item><item><title><![CDATA[New comment by rictic in "Element: setHTML() method"]]></title><description><![CDATA[
<p>A somewhat related spec, at the page level rather than the module level, are Content Security Policies, which let a page disable various unsafe browser features for a page: <a href="https://developer.mozilla.org/en-US/docs/Web/HTTP/Guides/CSP" rel="nofollow">https://developer.mozilla.org/en-US/docs/Web/HTTP/Guides/CSP</a><p>One of my favorite features in there is trusted types enforcement: <a href="https://developer.mozilla.org/en-US/docs/Web/API/Trusted_Types_API" rel="nofollow">https://developer.mozilla.org/en-US/docs/Web/API/Trusted_Typ...</a><p>Lets you create your own API for what code is allowed to create arbitrary, potentially unsafe HTML at runtime, so you can allow secure templating systems but disallow code that just concats strings together naively.</p>
]]></description><pubDate>Thu, 23 Oct 2025 15:59:53 +0000</pubDate><link>https://news.ycombinator.com/item?id=45683394</link><dc:creator>rictic</dc:creator><comments>https://news.ycombinator.com/item?id=45683394</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=45683394</guid></item><item><title><![CDATA[New comment by rictic in "Element: setHTML() method"]]></title><description><![CDATA[
<p>It is also painful when your app gets hacked, accounts get taken over and abused, user data is compromised, and so on. For serious sites it's worth the pain to turn on security enforcement features.</p>
]]></description><pubDate>Thu, 23 Oct 2025 15:53:34 +0000</pubDate><link>https://news.ycombinator.com/item?id=45683313</link><dc:creator>rictic</dc:creator><comments>https://news.ycombinator.com/item?id=45683313</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=45683313</guid></item><item><title><![CDATA[New comment by rictic in "JSON River – Parse JSON incrementally as it streams in"]]></title><description><![CDATA[
<p>For anyone else following along, see <a href="https://github.com/rictic/jsonriver/issues/39" rel="nofollow">https://github.com/rictic/jsonriver/issues/39</a></p>
]]></description><pubDate>Thu, 23 Oct 2025 02:01:19 +0000</pubDate><link>https://news.ycombinator.com/item?id=45677376</link><dc:creator>rictic</dc:creator><comments>https://news.ycombinator.com/item?id=45677376</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=45677376</guid></item><item><title><![CDATA[New comment by rictic in "First Self-Propagating Worm Using Invisible Code Hits OpenVSX and VS Code"]]></title><description><![CDATA[
<p>So, they have a custom decode function that extracts info from unprinted characters which they then pass to `eval`. This article is trying to make this seem way fancier than it is. Maybe GitHub or `git diff` don't give a sense of how many bits of info are in the unicode string,  but the far scarier bit of code is the `eval(atob(decodedString))` at the bottom. If your security practices don't flag that, either at code review, lint, or runtime then you're in trouble.<p>Not to say that you can't make innocuous looking code into a moral equivalent of eval, but giving this a fancy name like Glassworm doesn't seem warranted on that basis.</p>
]]></description><pubDate>Mon, 20 Oct 2025 20:53:54 +0000</pubDate><link>https://news.ycombinator.com/item?id=45649224</link><dc:creator>rictic</dc:creator><comments>https://news.ycombinator.com/item?id=45649224</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=45649224</guid></item><item><title><![CDATA[New comment by rictic in "JSON River – Parse JSON incrementally as it streams in"]]></title><description><![CDATA[
<p>Oh this isn't about the public API, it's about the internal logic of the parser.</p>
]]></description><pubDate>Tue, 14 Oct 2025 20:34:40 +0000</pubDate><link>https://news.ycombinator.com/item?id=45584482</link><dc:creator>rictic</dc:creator><comments>https://news.ycombinator.com/item?id=45584482</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=45584482</guid></item><item><title><![CDATA[New comment by rictic in "JSON River – Parse JSON incrementally as it streams in"]]></title><description><![CDATA[
<p>jsonriver's invariants do give you enough info to notice which values are and aren't complete. They also mean that you can mutate the objects and arrays it returns to drop data that you don't care about.<p>There might be room for some helper functions in something like a 'jsonriver/helpers.js' module. I'll poke around at it.</p>
]]></description><pubDate>Tue, 14 Oct 2025 00:57:06 +0000</pubDate><link>https://news.ycombinator.com/item?id=45575044</link><dc:creator>rictic</dc:creator><comments>https://news.ycombinator.com/item?id=45575044</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=45575044</guid></item><item><title><![CDATA[New comment by rictic in "JSON River – Parse JSON incrementally as it streams in"]]></title><description><![CDATA[
<p>Only for numbers! Strings, objects, arrays, true, false, and null all have an unambiguous ending.</p>
]]></description><pubDate>Mon, 13 Oct 2025 23:40:29 +0000</pubDate><link>https://news.ycombinator.com/item?id=45574529</link><dc:creator>rictic</dc:creator><comments>https://news.ycombinator.com/item?id=45574529</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=45574529</guid></item><item><title><![CDATA[New comment by rictic in "JSON River – Parse JSON incrementally as it streams in"]]></title><description><![CDATA[
<p>I've just published v1.0.1. It's about 2x faster, and should have no other observable changes. The speedup is mainly from avoiding allocation and string slicing as much as possible, plus an internal refactor to bind the parser and tokenizer more tightly together.<p>Previously the parser would get an array of tokens each time it pushed data into the tokenizer. This was easy to write, but it meant we needed to allocate token objects. Now the tokenizer has a reference to the parser and calls token-specific methods directly on it. Since most of the tokens carry no data, this keeps us from jumping all over the heap so much. If we were parsing a more complicated language this might become a huge pain in the butt, but JSON is simple enough, and the test suite is exhaustive enough, that we can afford a little nightmare spaghetti if it improves on speed.</p>
]]></description><pubDate>Mon, 13 Oct 2025 22:45:45 +0000</pubDate><link>https://news.ycombinator.com/item?id=45574136</link><dc:creator>rictic</dc:creator><comments>https://news.ycombinator.com/item?id=45574136</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=45574136</guid></item><item><title><![CDATA[New comment by rictic in "JSON River – Parse JSON incrementally as it streams in"]]></title><description><![CDATA[
<p>Good feedback! Just updated the README with the following:<p>> The parse function also matches JSON.parse's behavior for invalid input. If the input stream cannot be parsed as the start of a valid JSON document, then parsing halts and an error is thrown. More precisely, the promise returned by the next method on the AsyncIterable rejects with an Error. Likewise if the input stream closes prematurely.<p>As for why strings are emitted incrementally, it's just that I was often dealing with long strings produced slowly by LLMs. JSON encoded numbers can be big in theory, but there's no practical reason to do so as almost everyone decodes them as 64bit floats.</p>
]]></description><pubDate>Mon, 13 Oct 2025 22:25:04 +0000</pubDate><link>https://news.ycombinator.com/item?id=45573989</link><dc:creator>rictic</dc:creator><comments>https://news.ycombinator.com/item?id=45573989</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=45573989</guid></item><item><title><![CDATA[New comment by rictic in "JSON River – Parse JSON incrementally as it streams in"]]></title><description><![CDATA[
<p>Try import maps, something like:<p><pre><code>    {
      "imports": {
        "express": "/usr/share/nodejs/express/index.js",
        "another-module": "/usr/share/nodejs/another-module/index.js"
      }
    }
</code></pre>
Then run node like: `node --import-map=./import-map.json app.js`<p>The Debian approach of having global versions of libraries seems like it's solving a different problem than the ones I have. I want each application to track and version its own dependencies, so that upgrading a dependency for one doesn't break another, and so that I can go back to an old project and be reasonably confident it'll still work. That ultimately led me to nix.</p>
]]></description><pubDate>Mon, 13 Oct 2025 21:16:13 +0000</pubDate><link>https://news.ycombinator.com/item?id=45573413</link><dc:creator>rictic</dc:creator><comments>https://news.ycombinator.com/item?id=45573413</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=45573413</guid></item><item><title><![CDATA[New comment by rictic in "JSON River – Parse JSON incrementally as it streams in"]]></title><description><![CDATA[
<p>Bare module specifiers aren't just for Node! Deno and browsers support import maps e.g.<p>The library doesn't use any APIs beyond those in the JS standard, so I'm pretty confident it will work everywhere, but happy to publish in more places and run more tests. Any in particular that you'd like to see?</p>
]]></description><pubDate>Mon, 13 Oct 2025 19:50:29 +0000</pubDate><link>https://news.ycombinator.com/item?id=45572594</link><dc:creator>rictic</dc:creator><comments>https://news.ycombinator.com/item?id=45572594</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=45572594</guid></item><item><title><![CDATA[New comment by rictic in "JSON River – Parse JSON incrementally as it streams in"]]></title><description><![CDATA[
<p>Do any LLMs support constrained generation of newline delimited json? Or have you found that they're generally reliable enough that you don't need to do constrained sampling?</p>
]]></description><pubDate>Mon, 13 Oct 2025 18:26:58 +0000</pubDate><link>https://news.ycombinator.com/item?id=45571720</link><dc:creator>rictic</dc:creator><comments>https://news.ycombinator.com/item?id=45571720</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=45571720</guid></item><item><title><![CDATA[New comment by rictic in "JSON River – Parse JSON incrementally as it streams in"]]></title><description><![CDATA[
<p>Yeah, getting numbers correct was one of the trickier wrinkles in the project. <a href="https://github.com/rictic/jsonriver/blob/5515be978bb564e9bdc6b13323b23090a899d0de/src/tokenize.ts#L152-L190" rel="nofollow">https://github.com/rictic/jsonriver/blob/5515be978bb564e9bdc...</a></p>
]]></description><pubDate>Mon, 13 Oct 2025 18:13:24 +0000</pubDate><link>https://news.ycombinator.com/item?id=45571576</link><dc:creator>rictic</dc:creator><comments>https://news.ycombinator.com/item?id=45571576</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=45571576</guid></item></channel></rss>