Hacker News: robszumski

New comment by robszumski in "Goes-19 weather satellite enters Safe Hold mode"

robszumski — Thu, 16 Jul 2026 16:57:20 +0000

I'm sure they take detailed close out photos and likely video of the entire handling process.

New comment by robszumski in "Show HN: Reverse-engineering web apps into agent tools"

robszumski — Thu, 09 Jul 2026 17:46:18 +0000

Really cool. It would be interesting to see a demo of an app that is clearly more bespoke, like your Tesla account, online banking, movie theatre ticketing, etc.

New comment by robszumski in "Turn Dependabot off"

robszumski — Sat, 21 Feb 2026 00:30:44 +0000

example analysis on a Dependabot PR: https://github.com/daniellockard/tiltify-api-client/pull/36#...

New comment by robszumski in "Turn Dependabot off"

robszumski — Fri, 20 Feb 2026 23:20:42 +0000

I commented elsewhere but our team built a custom static analysis engine for JS/TS specifically for the dep update use-case. It was hard, had to do synthetic execution, understands all the crazy remapping and reexporting you can do, etc. Even then it’s hard to penetrate a complex Express app due to how the tree is built up.

New comment by robszumski in "Turn Dependabot off"

robszumski — Fri, 20 Feb 2026 23:00:28 +0000

Totally hear you on the noise…but we should want to auto-merge vs ignore, no? Given the right tooling of course.

New comment by robszumski in "Turn Dependabot off"

robszumski — Fri, 20 Feb 2026 22:43:52 +0000

We’ve built a modern dependabot (or works with it) agent: fossabot analyzes your app code to know how you use your dependencies then delivers a custom safe/needs review verdict per upgrade or packages groups of safe upgrades together to make more strategic jumps. We can also fix breaking changes because the agents context is so complete.

https://fossa.com/products/fossabot/

We have some of the best JS/TS analysis out there based on a custom static analysis engine designed for this use-case. You get free credits each month and we’d love feedback on which ecosystems are next…Java, Python?

Totally agree with the author that static analysis like govulncheck is the secret weapon to success with this problem! Dynamic languages are just much harder.

We have a really cool eval framework as well that we’ve blogged about.

New comment by robszumski in "Infrastructure decisions I endorse or regret after 4 years at a startup (2024)"

robszumski — Fri, 20 Feb 2026 00:36:38 +0000

Thanks for sharing, really helpful to see your thinking. I haven't fully embraced FaaS myself but never regretted it either.

Curious to hear more about Renovate vs Dependabot. Is it complicated to debug _why_ it's making a choice to upgrade from A to B? Working on a tool to do app-specific breaking change analysis so winning trust and being transparent about what is happening is top of mind.

When were you using quay.io? In the pre-CoreOS years, CoreOS years (2014-2018), or the Red Hat years?

New comment by robszumski in "Oxide raises $200M Series C"

robszumski — Tue, 10 Feb 2026 15:06:59 +0000

no, but still being super impressive. CEO of a company rebuilding a CAD rendering engine because they put an LLM on top of it. So you describe the mechanical specs of the part you want and it models it. Takes all the tedium out of modeling stuff. Super cool and many applications.

New comment by robszumski in "We put Flock under surveillance: Go make them behave differently [video]"

robszumski — Mon, 15 Dec 2025 17:35:11 +0000

Same author talked about adversarial license plates that trick these cameras with a sequence of black blocks, discussed here in original form [1]. He is interested in breaking both the plate detection (ideal) and character recognition (good). The examples are pretty cool looking.

[1]: https://youtu.be/Pp9MwZkHiMQ?&t=1428

New comment by robszumski in "IBM to acquire Confluent"

robszumski — Mon, 08 Dec 2025 20:11:11 +0000

exactly. standard move when you aren't going to get a second shot.

New comment by robszumski in "We should all be using dependency cooldowns"

robszumski — Fri, 21 Nov 2025 17:49:40 +0000

We built and launched this product about 2 months ago, HN thread here: https://news.ycombinator.com/item?id=45439721

Totally agree that AI is great for this, it will work harder and go deeper and never gets tired of reading code or release notes or migration guides. What you want instead of summaries is to find the breaking changes, figure out if they matter, then comment on _that_.

New comment by robszumski in "A classified network of SpaceX satellites is emitting a mysterious signal"

robszumski — Fri, 17 Oct 2025 14:25:01 +0000

If a giant chunk of the constellation can act as a truly huge antenna, what can you get from that? Super high resolution? Seek/dwell time on a target that is effectively infinite?

New comment by robszumski in "Fossabot: AI code review for Dependabot/Renovate on breaking changes and impacts"

robszumski — Wed, 01 Oct 2025 17:44:11 +0000

It requires you to go deep in both the code analysis and the research, which is expensive at their scale

And, as someone who's start up (EdgeBit was acquired by FOSSA recently) wrote a new JS/TS static analysis engine, it's just hard to get correct.

Fossabot: AI code review for Dependabot/Renovate on breaking changes and impacts

robszumski — Wed, 01 Oct 2025 16:30:16 +0000

Article URL: https://fossa.com/blog/fossabot-dependency-upgrade-ai-agent/

Comments URL: https://news.ycombinator.com/item?id=45439721

Points: 108

# Comments: 18

New comment by robszumski in "Fossa Acquires Edgebit - Auto Dependency Updates"

robszumski — Mon, 29 Sep 2025 15:22:35 +0000

Rob from EdgeBit (YC W23) – super excited to bring our dependency autofix tech + static analysis tools to FOSSA!

You can read more on our blog: https://edgebit.io/blog/edgebit-joins-fossa/

Resemver: Using AI to rewrite semver based on actual breaking changes

robszumski — Fri, 19 Sep 2025 15:12:20 +0000

Article URL: https://fossa.com/changes/

Comments URL: https://news.ycombinator.com/item?id=45302528

Points: 7

# Comments: 0

Rolling out binary authorization for all laptops at Figma

robszumski — Thu, 10 Jul 2025 16:31:24 +0000

Article URL: https://www.figma.com/blog/rolling-out-santa-without-freezing-productivity/

Comments URL: https://news.ycombinator.com/item?id=44522788

Points: 1

# Comments: 0

New comment by robszumski in "Honda conducts successful launch and landing of experimental reusable rocket"

robszumski — Tue, 17 Jun 2025 15:57:56 +0000

For reference, Rocket Lab's Electron has a wet mass of 13,000 kg. This rocket is much smaller at 1,312 kg wet mass.

New comment by robszumski in "Weaponizing Dependabot: Pwn Request at its finest"

robszumski — Fri, 06 Jun 2025 14:22:13 +0000

Curious if auto-merge philosophy changes between libraries and applications. The library definitely has a larger user base to break and a wider matrix of use-cases. IMO, auto-merge is more palatable for an application – do you agree? Especially when you're under SOC2/FedRAMP/etc.

New comment by robszumski in "Weaponizing Dependabot: Pwn Request at its finest"

robszumski — Fri, 06 Jun 2025 14:18:54 +0000

How do you scale this besides keeping the dep list short? Are you reading every item or just scanning for words like "deprecated" or "breaking change"?