<rss version="2.0" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:atom="http://www.w3.org/2005/Atom"><channel><title>Hacker News: yawaramin</title><link>https://news.ycombinator.com/user?id=yawaramin</link><description>Hacker News RSS</description><docs>https://hnrss.org/</docs><generator>hnrss v2.1.1</generator><lastBuildDate>Thu, 16 Apr 2026 06:32:21 +0000</lastBuildDate><atom:link href="https://hnrss.org/user?id=yawaramin" rel="self" type="application/rss+xml"></atom:link><item><title><![CDATA[New comment by yawaramin in "Post Mortem: axios NPM supply chain compromise"]]></title><description><![CDATA[
<p>No, it really doesn't scale that well. 'Thousands' of packages is laughable compared to the scale of npm. And even at the 'thousands' scale distros are often laughably out of date because they're so slow to update their packages.<p>You are of course right that a signed package ecosystem would be great, it's just that you're asking people to do this labour for you for free. If you pay some third party to verify and sign packages for you? That's totally fine. Asking maintainers already under tremendous pressure to do yet another labour-intensive security task so you can benefit for free? That's out of balance.<p>Are they <i>incapable</i> of doing it? Probably not. Does it take real labour and effort to do it? Absolutely.</p>
]]></description><pubDate>Sat, 04 Apr 2026 03:16:20 +0000</pubDate><link>https://news.ycombinator.com/item?id=47635321</link><dc:creator>yawaramin</dc:creator><comments>https://news.ycombinator.com/item?id=47635321</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=47635321</guid></item><item><title><![CDATA[New comment by yawaramin in "‘Energy independence feels practical’: Europeans building mini solar farms"]]></title><description><![CDATA[
<p>I don't know about others but personally I'd like my electricity source to not be constantly degrading over time and requiring maintenance crews to go out and replace the panels as they randomly start falling below the required efficiency levels. I'd prefer if the entire production unit was a single all-inclusive compound maintained by the team on site, with a relatively compact ecological footprint.</p>
]]></description><pubDate>Fri, 03 Apr 2026 05:25:10 +0000</pubDate><link>https://news.ycombinator.com/item?id=47623442</link><dc:creator>yawaramin</dc:creator><comments>https://news.ycombinator.com/item?id=47623442</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=47623442</guid></item><item><title><![CDATA[New comment by yawaramin in "Post Mortem: axios NPM supply chain compromise"]]></title><description><![CDATA[
<p>If the solution is 'maintainers just need to do xyz', then it's not a solution, sorry. It's not scalable and which projects become 'successful' and which maintainers accidentally become critical parts of worldwide codebases, is almost pure chance. You will <i>never</i> be able to get all the maintainers you need to 'just' do xyz. Just like you will never be able to get humans to 'just' stop making mistakes. So you had better start looking for a solution that doesn't rely on humans not making mistakes.</p>
]]></description><pubDate>Fri, 03 Apr 2026 05:20:02 +0000</pubDate><link>https://news.ycombinator.com/item?id=47623421</link><dc:creator>yawaramin</dc:creator><comments>https://news.ycombinator.com/item?id=47623421</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=47623421</guid></item><item><title><![CDATA[New comment by yawaramin in "‘Energy independence feels practical’: Europeans building mini solar farms"]]></title><description><![CDATA[
<p>> expected lifespan of >30 years<p>More like <25 years.<p>> I think being reliant on the fossil fuel supply chain for so long<p>France isn't. And they are net exporting their (nuclear fission) electricity to their neighbours who shut down nuclear power plants.</p>
]]></description><pubDate>Sat, 28 Mar 2026 05:41:02 +0000</pubDate><link>https://news.ycombinator.com/item?id=47551958</link><dc:creator>yawaramin</dc:creator><comments>https://news.ycombinator.com/item?id=47551958</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=47551958</guid></item><item><title><![CDATA[New comment by yawaramin in "Show HN: µJS, a 5KB alternative to Htmx and Turbo with zero dependencies"]]></title><description><![CDATA[
<p>> the devs and other users keep telling me I shouldn't want that as a feature and that it "doesn't make sense"<p>I mean if the devs and the users are all telling you it doesn't make sense, maybe it really doesn't make sense. Not everything is supposed to be able to do everything. Some things are targeted and focused on specific use cases.</p>
]]></description><pubDate>Sun, 15 Mar 2026 03:58:17 +0000</pubDate><link>https://news.ycombinator.com/item?id=47384197</link><dc:creator>yawaramin</dc:creator><comments>https://news.ycombinator.com/item?id=47384197</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=47384197</guid></item><item><title><![CDATA[New comment by yawaramin in "Show HN: µJS, a 5KB alternative to Htmx and Turbo with zero dependencies"]]></title><description><![CDATA[
<p>But surely even in a SPA you have to eventually send a request and get a response? Like you're not going to suggest that eg in an online store webapp the user would click 'add to cart' and you wouldn't send a request to add the item to the cart and wait for and render the response?<p>Hypermedia libraries like htmx etc. are just doing these interactions, the ones that need a server request-response cycle. The difference is they get the response as already-rendered HTML, so they don't need to do anything further, just swap it in to the existing page. It's super simple and very efficient. And usually results in fewer AJAX calls which also are much more minimal and don't include any redundant data.</p>
]]></description><pubDate>Sun, 15 Mar 2026 03:54:51 +0000</pubDate><link>https://news.ycombinator.com/item?id=47384179</link><dc:creator>yawaramin</dc:creator><comments>https://news.ycombinator.com/item?id=47384179</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=47384179</guid></item><item><title><![CDATA[New comment by yawaramin in "Returning to Rails in 2026"]]></title><description><![CDATA[
<p>> not to have to think about e.g. standing up a HA PostgreSQL cluster or Redis<p>I don't understand...Rails does not replace a HA PostgreSQL cluster or Redis, they are orthogonal. Why would you not have to think about them?</p>
]]></description><pubDate>Fri, 13 Mar 2026 00:04:39 +0000</pubDate><link>https://news.ycombinator.com/item?id=47359035</link><dc:creator>yawaramin</dc:creator><comments>https://news.ycombinator.com/item?id=47359035</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=47359035</guid></item><item><title><![CDATA[New comment by yawaramin in "SPA vs. Hypermedia: Real-World Performance Under Load"]]></title><description><![CDATA[
<p>Yeah but the problem is that people don't just use a <i>single</i> webapp all the time. We all browse and go to many different websites, which all have payloads that they want us to download and run. So in practice it ends up that we're re-downloading bundles constantly, many of them which have the exact same libraries, but because they're bundled and minified, they're not cacheable so we have to fetch them over and over again.<p>Don't believe me? Check this out: <a href="https://tonsky.me/blog/js-bloat/" rel="nofollow">https://tonsky.me/blog/js-bloat/</a></p>
]]></description><pubDate>Sat, 07 Mar 2026 20:10:54 +0000</pubDate><link>https://news.ycombinator.com/item?id=47291046</link><dc:creator>yawaramin</dc:creator><comments>https://news.ycombinator.com/item?id=47291046</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=47291046</guid></item><item><title><![CDATA[New comment by yawaramin in "Goodbye InnerHTML, Hello SetHTML: Stronger XSS Protection in Firefox 148"]]></title><description><![CDATA[
<p>Actually... <a href="https://github.com/microsoft/TypeScript/issues/52924" rel="nofollow">https://github.com/microsoft/TypeScript/issues/52924</a></p>
]]></description><pubDate>Tue, 24 Feb 2026 18:37:42 +0000</pubDate><link>https://news.ycombinator.com/item?id=47140815</link><dc:creator>yawaramin</dc:creator><comments>https://news.ycombinator.com/item?id=47140815</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=47140815</guid></item><item><title><![CDATA[New comment by yawaramin in "Shipping Htmx in Production (A Post-Mortem)"]]></title><description><![CDATA[
<p>He makes it sound like he did something special, but this is just something that htmx offers out of the box. In fact if he had used something like:<p><pre><code>    <a href="/?page=2" hx-target="#dashboard-content" hx-boost="true">
      Next Page
    </a>
</code></pre>
Then he would have gotten the functionality out of the box without even using hx-push-url explicitly. And he would have gotten graceful degradation with a link that worked without JS and Ctrl/Cmd-click to open in a background tab.<p>Also the article seems to be full of errors. Eg<p>> In HTMX, if the server returns a 500 error, the browser might swap the entire stack trace or the generic error page into the middle of a table by default. This is a poor user experience.<p>This is simply incorrect. By default htmx does <i>not</i> swap 4xx/5xx responses. Instead it triggers an error event in the DOM. Developers can choose to handle that event <i>or</i> they can choose to override the default behaviour and do a swap.</p>
]]></description><pubDate>Mon, 16 Feb 2026 02:51:07 +0000</pubDate><link>https://news.ycombinator.com/item?id=47030341</link><dc:creator>yawaramin</dc:creator><comments>https://news.ycombinator.com/item?id=47030341</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=47030341</guid></item><item><title><![CDATA[New comment by yawaramin in "WolfSSL sucks too, so now what?"]]></title><description><![CDATA[
<p>Someone reporting an RFC violation doesn't automatically mean there is actually an RFC violation. That's why they are asking for a minimal repro, not a dump of the reporter's stream of consciousness. If your teammate at work. came to you and dumped something like this on your desk, how would you react?</p>
]]></description><pubDate>Sat, 14 Feb 2026 18:00:18 +0000</pubDate><link>https://news.ycombinator.com/item?id=47016692</link><dc:creator>yawaramin</dc:creator><comments>https://news.ycombinator.com/item?id=47016692</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=47016692</guid></item><item><title><![CDATA[New comment by yawaramin in "CSS Web Components for marketing sites (2024)"]]></title><description><![CDATA[
<p>All of this is introducing complexity that simply goes away if we just avoid Shadow DOM.</p>
]]></description><pubDate>Wed, 21 Jan 2026 23:31:42 +0000</pubDate><link>https://news.ycombinator.com/item?id=46713198</link><dc:creator>yawaramin</dc:creator><comments>https://news.ycombinator.com/item?id=46713198</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=46713198</guid></item><item><title><![CDATA[New comment by yawaramin in "CSS Web Components for marketing sites (2024)"]]></title><description><![CDATA[
<p>Yeah but most people don't need or want 'interoperable composition', they want sites with a consistent look-and-feel. Shadow DOM makes this much more difficult.</p>
]]></description><pubDate>Mon, 19 Jan 2026 20:13:47 +0000</pubDate><link>https://news.ycombinator.com/item?id=46683888</link><dc:creator>yawaramin</dc:creator><comments>https://news.ycombinator.com/item?id=46683888</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=46683888</guid></item><item><title><![CDATA[New comment by yawaramin in "How to make a damn website (2024)"]]></title><description><![CDATA[
<p>> This is honestly all you need.<p>No, you need less than that! :-)<p><pre><code>    ┍━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━┑
    │                     how-to-make-a-damn-website.html                      │
    ├──────────────────────────────────────────────────────────────────────────┤
    │ <title>How to Make a Damn Website</title>                                │
    │ <h1>How to Make a Damn Website</h1>                                      │
    │                                                                          │
    │                                                                          │
    │ <p>A lot of people want to make a website but don’t know where to start  │
    │ or they get stuck.</p>                                                   │
    ┕━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━┙
</code></pre>
HTML is very forgiving! You can start <i>really</i> simple and work your way up to more complexity when you need it.</p>
]]></description><pubDate>Tue, 13 Jan 2026 21:05:14 +0000</pubDate><link>https://news.ycombinator.com/item?id=46607981</link><dc:creator>yawaramin</dc:creator><comments>https://news.ycombinator.com/item?id=46607981</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=46607981</guid></item><item><title><![CDATA[New comment by yawaramin in "Git Rebase for the Terrified"]]></title><description><![CDATA[
<p>No, the original base is in the commit history. It's just not relevant any more after rebase. It's like your individual keystrokes before a commit are not relevant any more after a commit. They're not lost provenance.</p>
]]></description><pubDate>Tue, 13 Jan 2026 18:51:26 +0000</pubDate><link>https://news.ycombinator.com/item?id=46605802</link><dc:creator>yawaramin</dc:creator><comments>https://news.ycombinator.com/item?id=46605802</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=46605802</guid></item><item><title><![CDATA[New comment by yawaramin in "Unauthenticated remote code execution in OpenCode"]]></title><description><![CDATA[
<p>> when we ask a person for a favourite tool<p>I think you're focusing too much on the word 'favourite' and not enough on the fact that they didn't actually ask for a favourite tool. They asked for a favourite how-to for using the suggested options, a Dev Container or a VM. I think before asking this question, if a person is (demonstrably in this case) into LLMs, it should be reasonable for them to ask an LLM first. The options are already given. It's not difficult to form a prompt that can make a reasonable LLM give a reasonable answer.<p>There aren't <i>that</i> many ways to run a Dev Container or VM. Everyone is not special and different, just follow the recommended and common security best practices.</p>
]]></description><pubDate>Tue, 13 Jan 2026 18:20:29 +0000</pubDate><link>https://news.ycombinator.com/item?id=46605295</link><dc:creator>yawaramin</dc:creator><comments>https://news.ycombinator.com/item?id=46605295</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=46605295</guid></item><item><title><![CDATA[New comment by yawaramin in "Git Rebase for the Terrified"]]></title><description><![CDATA[
<p>> reviewers will love you, peers will hate 8 small PRs that are chained together<p>My peers are my reviewers...</p>
]]></description><pubDate>Tue, 13 Jan 2026 16:09:56 +0000</pubDate><link>https://news.ycombinator.com/item?id=46602916</link><dc:creator>yawaramin</dc:creator><comments>https://news.ycombinator.com/item?id=46602916</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=46602916</guid></item><item><title><![CDATA[New comment by yawaramin in "Git Rebase for the Terrified"]]></title><description><![CDATA[
<p>Merging a PR with rebase doesn't lose provenance. You can just keep all the commits in the PR branch. But even if you squash the branch into a single commit and merge (which these tools automate and many people do), it still doesn't lose provenance. The provenance is the PR itself. The PR is connected to a work item in the ticketing system. The git history preserves all the relevant info.</p>
]]></description><pubDate>Tue, 13 Jan 2026 16:08:24 +0000</pubDate><link>https://news.ycombinator.com/item?id=46602883</link><dc:creator>yawaramin</dc:creator><comments>https://news.ycombinator.com/item?id=46602883</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=46602883</guid></item><item><title><![CDATA[New comment by yawaramin in "Git Rebase for the Terrified"]]></title><description><![CDATA[
<p>From what I can tell the vast majority of developers don't use git bisect and never will.</p>
]]></description><pubDate>Tue, 13 Jan 2026 16:03:11 +0000</pubDate><link>https://news.ycombinator.com/item?id=46602792</link><dc:creator>yawaramin</dc:creator><comments>https://news.ycombinator.com/item?id=46602792</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=46602792</guid></item><item><title><![CDATA[New comment by yawaramin in "Unauthenticated remote code execution in OpenCode"]]></title><description><![CDATA[
<p>I checked with Gemini 3 Fast and it provided instructions on how to set up a Dev Container or VM. It recommended a Dev Container and gave step-by-step instructions. It also mentioned VMs like VirtualBox and VMWare and recommended best practices.<p>This is exactly what I would have expected from an expert. Is this not what you are getting?<p>My broader question is: if someone is asking for instructions for setting up a local agent system, wouldn't it be fair to assume that they should try using an LLM to get instructions? Can't we assume that they are already bought in to the viewpoint that LLMs are useful?</p>
]]></description><pubDate>Tue, 13 Jan 2026 15:38:58 +0000</pubDate><link>https://news.ycombinator.com/item?id=46602377</link><dc:creator>yawaramin</dc:creator><comments>https://news.ycombinator.com/item?id=46602377</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=46602377</guid></item></channel></rss>