Hacker News: robshippr

New comment by robshippr in "Decisions that eroded trust in Azure – by a former Azure Core engineer"

robshippr — Fri, 03 Apr 2026 14:56:35 +0000

The "too risky to deploy" problem is really a visibility problem. When you can't quickly see what's actually changing in a deploy, fear becomes the default. The teams that break out of this aren't the ones who stop shipping, they're the ones who build better signals before the deploy so engineers can ship with confidence instead of just hoping nothing breaks.

New comment by robshippr in "Post Mortem: axios NPM supply chain compromise"

robshippr — Fri, 03 Apr 2026 14:23:54 +0000

The interesting detail from the GitHub thread is shaanmajid's observation that every legitimate v1 release had OIDC provenance attestations and the malicious one didn't, but nobody checks. Even simpler, if you're diffing your lockfile between deploys, a brand new dependency appearing in a patch release is a pretty obvious red flag without needing any attestation infrastructure.

New comment by robshippr in "Post Mortem: axios NPM supply chain compromise"

robshippr — Fri, 03 Apr 2026 03:09:08 +0000

The interesting detail from this thread is that every legitimate v1 release had OIDC provenance attestations and the malicious one didn't, but nobody checks. Even simpler, if you're diffing your lockfile between deploys, a brand new dependency appearing in a patch release is a pretty obvious red flag.

New comment by robshippr in "Mercor says it was hit by cyberattack tied to compromise LiteLLM"

robshippr — Thu, 02 Apr 2026 16:59:31 +0000

Second major supply chain compromise in a week after the axios npm attack. 40 minutes and 500k machines affected. SOC2 won't catch this. The real question is whether your CI pipeline would have flagged a dependency change that happened between your last build and the one going to prod. Most teams have no visibility into that window at all.

New comment by robshippr in "Axios compromised on NPM – Malicious versions drop remote access trojan"

robshippr — Wed, 01 Apr 2026 15:29:30 +0000

Three hours between the malicious publish and npm pulling the versions. If your CI ran an install during that window, this went straight to prod. Most teams I've worked with still have loose version ranges somewhere in their dependency tree even if they think they've locked everything down.

New comment by robshippr in "MiniStack (replacement for LocalStack)"

robshippr — Wed, 01 Apr 2026 02:55:48 +0000

The real issue with LocalStack was always drift. Tests pass locally, then something breaks in staging because the S3 response format is slightly different or DynamoDB throttling doesn't match. After getting burned enough times we just switched to short-lived real AWS environments for integration tests. More expensive, but way fewer surprises in prod.

New comment by robshippr in "GitHub's Historic Uptime"

robshippr — Tue, 31 Mar 2026 19:47:24 +0000

This at least makes me feel like I am not going crazy when I say "Github used to be much more reliable before Microsoft bought them"

New comment by robshippr in "Ask HN: Do you also "hoard" notes/links but struggle to turn them into actions?"

robshippr — Sat, 31 Jan 2026 04:03:04 +0000

I am very good at writing down notes, especially in meetings... I am not so great at going back to those notes. I also have an issue with jumping around to different notebooks.

New comment by robshippr in "Painless Software Schedules (2000)"

robshippr — Fri, 30 Jan 2026 20:35:33 +0000

I miss his writing, I haven't seen a post by him in a while. His blog and Coding Horror are what I used to read all the time in my undergrad.

New comment by robshippr in "Apple to soon take up to 30% cut from all Patreon creators in iOS app"

robshippr — Thu, 29 Jan 2026 14:51:08 +0000

Don't give them any ideas haha

New comment by robshippr in "Airfoil (2024)"

robshippr — Wed, 28 Jan 2026 19:47:29 +0000

This is so cool. I've become more interested in aerodynamics since I've started watching F1 and reading Adrian Newey's book. This is such a great post, especially the diagrams in the velocity section.

New comment by robshippr in "Show HN: I built a small browser engine from scratch in C++"

robshippr — Wed, 28 Jan 2026 19:31:55 +0000

Incredible job here. Really took a lot of work to get this done. Keep it up.