Comments URL: https://news.ycombinator.com/item?id=48934858

Points: 3

# Comments: 0

(See the “Window of opportunity” column in the table.)

[1]: https://blog.yossarian.net/2025/11/21/We-should-all-be-using...

(I am not a hater of distribution packaging, either. But I typically find comparisons between it and language packaging lacking, because the two have very different trust topologies.)

> Just post one link of a "supply chain" problem that was prevented by any of these companies before it went into the wild and affected users.

This is not the claim being made, since cooldowns are not widely adopted at the moment.

(This is, to be clear, fine. But we should be clear-headed about what package distribution mechanisms actually provide in terms of guarantees.)

[1]: https://bugs.launchpad.net/ubuntu/+source/apt/+bug/1461834

Of course, maybe the attacker profile changes over time. But that's the nature of the game.

(This cuts both ways: I’d say that distribution package managers have learned valuable lessons about what users actually want from language package managers. Learning is a good thing.)

No: the security assumption behind cooldowns rests on security scanning parties, not on innocent users being victimized. Three days is a short cooldown, but it should be a good enough lead for scanning parties.

> I'm not fully sure if it's possible to preventively scan all NPM packages or how much compute it would require.

It’s not that much data, particularly for parties that are directly financially incentivized to be the first to report malware.

Comments URL: https://news.ycombinator.com/item?id=48913050

Points: 207

# Comments: 143

> I grew up using this term, but upon encountering Louden’s work, I learned that “dialect” often functions more as an insult than a linguistically useful designation.

A shprakh iz a dyalekt mit armey un flot!

I do find these kinds of “get good” arguments tiresome, though. Our job as responsible engineers is to develop strong and safe abstractions for the next group of engineers to use. Rust is one such abstraction.

I also don’t think that forking the compiler is a big fuss. Large companies do that all the time, to carry whatever patches they haven’t upstreamed yet (or can’t). It’s really not that big of a deal.

The points they make around explicit defers are a lot more subtle than it being too many lines. Quoting:

> For Zig code, when exactly should we be running the cleanup code? If we're passing the same *T to many different functions, how do we know when it's no longer accessible and can be cleaned up? How does it work when some functions need to continue to reference the memory after the function is called?

(As for Anthropic's motivation: only they know. But I suspect that they saw Zig's AI policy as a potentially existential risk, and moved to de-risk their position. That is a technical decision, just not one rooted in the merits of any particular language.)