Hacker News: ssiddharth

Don't let AI fill in all the important blanks

ssiddharth — Wed, 01 Jul 2026 18:16:05 +0000

Article URL: https://www.0xsid.com/blog/dont-let-ai-fill-all-the-blanks

Comments URL: https://news.ycombinator.com/item?id=48751035

Points: 2

# Comments: 0

Double Entry Programming

ssiddharth — Thu, 18 Jun 2026 15:56:34 +0000

Article URL: https://www.0xsid.com/blog/double-entry-programming

Comments URL: https://news.ycombinator.com/item?id=48587361

Points: 4

# Comments: 0

New comment by ssiddharth in "Every Byte Matters"

ssiddharth — Wed, 03 Jun 2026 11:47:55 +0000

Slight tangent, but every ms, μs, and ns counts too. We've gotten awfully carefree with response times and wasted compute cycles.

The newest Instagram “exploit” is the goofiest I've seen

ssiddharth — Mon, 01 Jun 2026 16:31:42 +0000

https://krebsonsecurity.com/2026/06/hackers-used-metas-ai-su...

Comments URL: https://news.ycombinator.com/item?id=48359102

Points: 2210

# Comments: 490

New comment by ssiddharth in "Google's Antigravity bait and switch"

ssiddharth — Thu, 21 May 2026 19:11:47 +0000

I've become an Antigravity convert mainly because of the generous limits, especially on the Anthropic models. User since day 1.

Google's Antigravity bait and switch

ssiddharth — Thu, 21 May 2026 13:50:59 +0000

Article URL: https://www.0xsid.com/blog/antigravity-bait-n-switch

Comments URL: https://news.ycombinator.com/item?id=48222529

Points: 771

# Comments: 345

Hardening TanStack After the NPM Compromise

ssiddharth — Tue, 12 May 2026 17:05:30 +0000

Article URL: https://tanstack.com/blog/incident-followup

Comments URL: https://news.ycombinator.com/item?id=48111076

Points: 1

# Comments: 0

New comment by ssiddharth in "Agentic coding is burning me out"

ssiddharth — Fri, 01 May 2026 06:10:21 +0000

No worries, it just grated a bit to be called AI slop by the person you were responding to and I assumed you agreed with them too.

New comment by ssiddharth in "Agentic coding is burning me out"

ssiddharth — Thu, 30 Apr 2026 21:14:05 +0000

Which part of the post feels LLM written to you? Not snark, I’m genuinely curious.

I’ve recently started writing again, after well over a decade, so I’m not very up to date on how things are done and perceived. FWIW, I write these on Google Docs and then port them over to my site. Earlier posts had an AI disclaimer saying I used Google Docs which presumably uses AI for spellchecking and obvious grammar issues but it ticked people off so I’ve stopped adding those.

Agentic coding is burning me out

ssiddharth — Thu, 30 Apr 2026 14:09:42 +0000

Article URL: https://www.0xsid.com/blog/agentic-coding-fatigue

Comments URL: https://news.ycombinator.com/item?id=47962775

Points: 29

# Comments: 16

An Audience of One: Cutting Corners on Unscalable Personal Software

ssiddharth — Thu, 16 Apr 2026 14:45:35 +0000

Article URL: https://www.0xsid.com/blog/ship-quickly

Comments URL: https://news.ycombinator.com/item?id=47793803

Points: 2

# Comments: 0

New comment by ssiddharth in "Keep Android Open"

ssiddharth — Wed, 15 Apr 2026 13:38:25 +0000

Somewhere along the way, installing became side-loading and the rot started taking hold.

Tell HN: GitHub might have been leaking your webhook secrets. Check your emails.

ssiddharth — Tue, 14 Apr 2026 16:40:02 +0000

Got an email from Github a few minutes back asking me to rotate my webhook secrets, the relevant portions of it below.

We're writing to let you know that between September 2025 and January 2026, webhook secrets for webhooks you are responsible for were inadvertently included in an HTTP header on webhook deliveries. This means that any system receiving webhook payloads during this window could have logged the webhook secret from the request headers. Webhook deliveries are encrypted in transit via TLS, so the header containing the secret was only accessible to the receiving endpoint in a base64-encoded format. We have no evidence to suggest your secrets were intercepted. This issue was fixed on January 26, 2026. Please read on for more information.

User privacy and security are essential for maintaining trust, and we want to remain as transparent as possible about events like these. GitHub itself did not experience a compromise or data breach as a result of this event.

What happened?

On January 26, 2026, GitHub identified a bug in a new version of the webhook delivery platform where webhook secrets were included in an `X-Github-Encoded-Secret` HTTP header sent with webhook payloads. This header was not intended to be part of the delivery and made the webhook secret available to the receiving endpoint in a base64-encoded format. Webhook secrets are used to verify that deliveries are genuinely from GitHub, and should only be known to GitHub and the webhook owner.

The bug was limited to only a subset of webhook deliveries that were feature flagged to use this new version of the webhooks platform. The bug was present between September 11, 2025, and December 10, 2025, and briefly on January 5, 2026. The bug was fixed on January 26, 2026.

What information was involved?

The webhook secret for each affected webhook was included in HTTP request headers during the window that the bug was present. The webhook payload content itself was delivered normally and was not additionally affected. No other credentials or tokens were affected. Webhook deliveries are encrypted in transit via TLS, so the header containing the secret was only accessible to the receiving endpoint.

If the receiving system logged HTTP request headers, the webhook secret may be present in those logs. The webhook secret is used to compute the `X-Hub-Signature-256` HMAC signature on deliveries — if compromised, an attacker who knows the secret could forge webhook payloads to make them appear to come from GitHub.

Comments URL: https://news.ycombinator.com/item?id=47767928

Points: 43

# Comments: 12

New comment by ssiddharth in "TanStack Start Now Support React Server Components"

ssiddharth — Tue, 14 Apr 2026 06:10:28 +0000

I've been a big fan of TanStack start and have a few small apps (<10k users) in production running on TSS.

The DX is smooth, the defaults are sane, and things generally makes sense if that makes sense. There are plenty of skills available so Claude Code and Codex know how to work with it too.

If you're maybe finding Next a bit bloated these days, I'd recommend giving this a try. Plus Tanner, the creator, responds to almost every mention on Twitter so it's easy to get eyeballs on issues that you might face. :)

New comment by ssiddharth in "Protect your shed"

ssiddharth — Wed, 08 Apr 2026 06:52:13 +0000

Same here. I've been trying to get more into the physical world, with a tech angle, rather than just pure software. As you said, using my hands is what keeps me sane, makes the world seem a little more real, if that makes sense?

New comment by ssiddharth in "I Won't Download Your App. The Web Version Is A-OK"

ssiddharth — Mon, 06 Apr 2026 15:05:36 +0000

I do mention cases where the browser model doesn't work, like accessing Lidar sensors. Just didn't want to bloat the post with too many examples. But I totally agree with you on this front: not everything can be done as a PWA.

I won't download your app. The web version is a-ok

ssiddharth — Mon, 06 Apr 2026 14:31:29 +0000

Article URL: https://www.0xsid.com/blog/wont-download-your-app

Comments URL: https://news.ycombinator.com/item?id=47661439

Points: 929

# Comments: 564

New comment by ssiddharth in "The 667MHz Machine"

ssiddharth — Sun, 29 Mar 2026 13:27:51 +0000

Fair enough. I've read a bit too much LLM written non-tech posts these year that I'm a bit fatigued. I figured people would just want to know this upfront. Moved it to the bottom now.

The 667MHz Machine

ssiddharth — Wed, 25 Mar 2026 14:44:47 +0000

Article URL: https://www.0xsid.com/blog/667mhz-machine

Comments URL: https://news.ycombinator.com/item?id=47518010

Points: 57

# Comments: 12

New comment by ssiddharth in "Never buy a .online domain"

ssiddharth — Thu, 26 Feb 2026 07:44:50 +0000

The site is already back online after the post. You can check yourself. If I really did have malicious content on the site, this post would have had zero effect on the result.