Hacker News: tabwidth

New comment by tabwidth in "Dependabot version updates introduce default package cooldown"

tabwidth — Tue, 14 Jul 2026 23:12:56 +0000

Most of the malicious ones just curl something in a postinstall script, scanners already catch that. The sneaky ones don't look malicious until they run, and three days may not help.

New comment by tabwidth in "Upcoming breaking changes for npm v12"

tabwidth — Tue, 09 Jun 2026 23:34:56 +0000

Build tooling still runs though. Your bundler plugin or PostCSS transform gets full fs access at build time, nobody's auditing that.

New comment by tabwidth in "What color is your function? (2015)"

tabwidth — Tue, 26 May 2026 22:39:22 +0000

It may depend on the runtime giving you a sync wait that doesn't deadlock the loop you came from. In JS you just can't. `dontawait` would need V8 to be a different VM.

New comment by tabwidth in "Stop MitM on the first SSH connection, on any VPS or cloud provider"

tabwidth — Sun, 10 May 2026 23:47:17 +0000

The box itself is probably fine. It's the path between you and it. In shared infrastructure one compromised hop somewhere upstream is enough and now you're SSHing into the wrong thing without realizing it.

New comment by tabwidth in "Over-editing refers to a model modifying code beyond what is necessary"

tabwidth — Wed, 22 Apr 2026 22:45:32 +0000

Reviewing isn't hard when the diff is what you asked for. It's when you asked for a one-line fix and get back 40 changed lines across four files. At that point you're not even reviewing your change anymore, you're auditing theirs.

New comment by tabwidth in "Atlassian enables default data collection to train AI"

tabwidth — Mon, 20 Apr 2026 23:40:41 +0000

Half the time I just grep the ticket key in Slack because it's faster than using Jira's own search.

New comment by tabwidth in "Tell HN: Docker pull fails in Spain due to football Cloudflare block"

tabwidth — Sun, 12 Apr 2026 22:45:05 +0000

This isn't really about centralization. ISPs are blocking at the IP level, not Docker Hub specifically. You could self-host a registry behind Cloudflare and still run into the same thing.

New comment by tabwidth in "Why AI Code Needs the Same Rigor We Should've Been Using All Along"

tabwidth — Thu, 02 Apr 2026 02:41:55 +0000

Started from a thread on "Slop is not necessarily the future" (https://news.ycombinator.com/item?id=47587953). I commented that technical debt from sloppy code shows up too late to fix. someone replied that humans also write sloppy code. Fair enough, but that got me thinking about what's actually different when AI writes the code.

Short version: AI doesn't lower the bar for code quality. It just makes the lack of process hurt faster. Two things get amplified: the gap between what you ask for and what gets built, and not knowing which generated code is going to survive.

Why AI Code Needs the Same Rigor We Should've Been Using All Along

tabwidth — Thu, 02 Apr 2026 02:41:55 +0000

Article URL: https://whetlan.substack.com/p/why-ai-code-needs-the-same-rigor

Comments URL: https://news.ycombinator.com/item?id=47609380

Points: 2

# Comments: 2

New comment by tabwidth in "Slop is not necessarily the future"

tabwidth — Tue, 31 Mar 2026 23:09:27 +0000

How long does that take though? Technical debt from sloppy code doesn't show up in the product until way later. By the time users notice, the team is already three features deep and can't back out.

New comment by tabwidth in "Be intentional about how AI changes your codebase"

tabwidth — Thu, 19 Mar 2026 22:16:30 +0000

The intention part is right but the bottleneck is review. AI is really good at turning your clean semantic functions into pragmatic ones without you noticing. You ask for a feature, it slips a side effect into something that was pure, tests still pass. By the time you catch it you've got three more PRs built on top.

New comment by tabwidth in "RX – a new random-access JSON alternative"

tabwidth — Thu, 19 Mar 2026 06:05:10 +0000

Yeah the raw parse speed comparison is almost a red herring at this point. The real cost with JSON is when you have a 200MB manifest or build artifact and you need exactly two fields out of it. You're still loading the whole thing into memory, building the full object graph, and GC gets to clean all of it up after. That's the part where something like RX with selective access actually matters. Parse speed benchmarks don't capture that at all.

New comment by tabwidth in "Speed at the cost of quality: Study of use of Cursor AI in open source projects (2025)"

tabwidth — Mon, 16 Mar 2026 22:33:11 +0000

The part that gets me is when it passes lint, passes tests, and the logic is technically correct, but it quietly changed how something gets called. Rename a parameter. Wrap a return value in a Promise that wasn't there before. Add some intermediate type nobody asked for. None of that shows up as a failure anywhere. You only notice three days later when some other piece of code that depended on the old shape breaks in a way that has nothing to do with the original change.

New comment by tabwidth in "The Cost of Indirection in Rust"

tabwidth — Thu, 12 Mar 2026 23:16:40 +0000

The worst version of this I've seen is when every layer is like four lines long. You step into a function expecting some logic and it's just calling another function with slightly different args. Do that six times and you forgot what the original call was even trying to do. Naming helps in theory but in practice half those intermediate functions end up with names like processInner or handleCore because there's nothing meaningful to call them.