jviide.iki.fi @jviide.iki.fi · 01/10/2026Preact v11 is an amazing release! Kudos to the whole @preactjs.com team, with special shoutouts to @jovidecroock.com and @rschristian.dev, who have gone above and beyond to make this a killer release (both literally and figuratively). 1302
jviide.iki.fi @jviide.iki.fi · 06/09/2026I don't see any way someone could misuse this GitHub functionality. 1220
jviide.iki.fi @jviide.iki.fi · 09/08/2026Our top researchers are cooperating with the authorities to conduct a thorough press release. 0332
jviide.iki.fi @jviide.iki.fi · 10/07/2026I sometimes wonder how many "local" containerized services are accidentally exposed to the internet because of this. See also: docs.docker.com/engine/netwo... 3161
jviide.iki.fi @jviide.iki.fi · 10/06/2026We interrupt our regularly scheduled programming to bring you this important message. 260
jviide.iki.fi @jviide.iki.fi · 21/05/2026Whee! Published @badrap/valita v0.5.2 using both trusted & staged publishing just now insert party emoji here 0242
jviide.iki.fi @jviide.iki.fi · 12/05/2026For example React's server-side action payload deserializer can call FormData.delete. 2/3 320
jviide.iki.fi @jviide.iki.fi · 12/05/2026Deno’s FormData, URLSearchParams + Headers show O(n²) behavior in .set()/.delete() when many repeated keys are present. Example: FormData.delete("_") on ~1MB of _=&_=&_=&... Node: ~4ms Deno: ~74s Could turn otherwise reasonable cleanup of untrusted request data into a potential DoS vector. 1/3 2110
jviide.iki.fi @jviide.iki.fi · 11/05/2026More companies, governmental organizations and community projects should adopt the security.txt convention/proposal: securitytxt.org Making security contact discovery as easy as possible is good for everyone. Yes, even within the context of the recent AI vulnerability report slopocalypse. 0225
jviide.iki.fi @jviide.iki.fi · 06/05/2026Switched @badrap/valita to ESM-only, pretty cool how @npmx.dev celebrates the package size reduction 🎉 npmx.dev/package/@bad... 0557
jviide.iki.fi @jviide.iki.fi · 27/04/2026Announcing the general availability of Schrödinger's Pull Requests 2394
jviide.iki.fi @jviide.iki.fi · 20/04/2026There's highly personalized phishing, and then there's this. 1150
jviide.iki.fi @jviide.iki.fi · 10/04/2026A gentle reminder that while `pnpm install` (or `bun install`) doesn't run the lifecycle scripts of the dependencies by default, it *does* run them from the repo's own package.json. Let's be mindful when cloning and exploring all those new & exciting projects on our local machines. 2256
jviide.iki.fi @jviide.iki.fi · 30/03/2026GitHub's auto-suggest using the display names instead of the account names isn't really doing us any favors. The latter "Dependabot" here is our beloved, and very fake, depenbadot. 151
jviide.iki.fi @jviide.iki.fi · 23/03/2026However it's kinda worrying that "copliot", "copllot" etc. were already taken. 040
jviide.iki.fi @jviide.iki.fi · 23/03/2026You can create pretty convincing pull requests with something like this. Just sayin'. 1181
jviide.iki.fi @jviide.iki.fi · 23/03/2026It's, uh, less than ideal that I'm allowed to claim a GitHub username like this. 8563
jviide.iki.fi @jviide.iki.fi · 21/03/2026Been a paying user since May 2024. Currently on the Professional plan. Can recommend. The ability to block/downrank/uprank/pin domains (kagi.com/stats?stat=i...) along with the slop filtering features alone are worth the price of admission for me. 120
jviide.iki.fi @jviide.iki.fi · 11/03/2026Okay, so it turns this is really, really slow. Which led to CVE-2026-30226: github.com/sveltejs/dev... Thanks to @ell.iott.dev and the rest of the @svelte.dev team for a well-handled vuln process, a pleasure as always 🫡 1170
jviide.iki.fi @jviide.iki.fi · 12/01/2026AND THEY EXPECT US TO BELEIVE THIS IS "JUST A COINCIDENCE" ?? !? 040
jviide.iki.fi @jviide.iki.fi · 08/01/2026Pretty cool that you have to create a Facebook account to file a vulnerability report to Meta. 050
jviide.iki.fi @jviide.iki.fi · 30/12/2025Turns out that the gym app has a Year in Review feature, and I'm now contemplating a side hustle as a part-time nutcracker. 130
jviide.iki.fi @jviide.iki.fi · 12/12/2025In the end, it would be best if NPM just blocked TOTP reuse. TOTP stands for “Time-based One-Time Password,” after all. The “one-time” property is important enough to account for 50% of the acronym. 🙂 Even the spec explicitly calls for blocking reuse: datatracker.ietf.org/doc/html/rfc... 6/6 0103
jviide.iki.fi @jviide.iki.fi · 17/09/2025Pay special attention to "Automation" and "Publish" token types, as they aren't scoped and allow writes. They also never expire. "Granular" ones are trickier. They MAY be read-only or tightly scoped. It's hard to tell, as the token page doesn't show this info. Their lifetimes can also be very long. 110
jviide.iki.fi @jviide.iki.fi · 17/09/2025This was a very good read. It's also a good reminder to check our own NPM access token pages and maybe delete old lingering tokens. 152
![A pale fish (?) with a large round sac. A Wikipedia-style caption reads: "The horngus of a dongfish is attached by a scungle to a kind of dillsack (the nutte sac)", followed by citation [77].](https://cdn.bsky.app/img/feed_thumbnail/plain/did:plc:vmiebbb4cxmbnq5giqqhlvkj/bafkreidmkfypisftu7davazig7ogs47otdjenfs6pal5i5o4aaubk3mtse)
