iiinova — where your digital self keeps evolving

Mathieu Hofman @mhofman.bsky.social · 31/07/2026

How is "blowing up the committee" any kind of solution. The whole problem is one of incentives. Incentives for browsers to implement proposals, incentives for delegates and their organization to spend time championing proposals. The ecosystem expects things to happen without factoring the costs.

100

Mathieu Hofman @mhofman.bsky.social · 31/07/2026

You're calling out a problem that I also have concerns with: engine implementors being reluctant to implement features that have advanced. It's effectively a silent veto. I don't see how that is relevant here. No matter the consensus model, that problem will always exist.

100

Mathieu Hofman @mhofman.bsky.social · 31/07/2026

When was that? I'm not denying there were historical instances of dysfunction, or that there aren't things that could be improved, but I cannot recollect veto without a path forward happening recently.

200

Mathieu Hofman @mhofman.bsky.social · 31/07/2026

Now some proposals don't make progress, not because of veto, but because they haven't reached a point where a critical mass of delegates are in favor. Call it self censure if you want, but champions do realize when there are remaining documented concerns that need to be addressed first.

110

Mathieu Hofman @mhofman.bsky.social · 31/07/2026

While my experience is more recent, I honestly haven't seen any occurrence of delegates blocking a proposal without reason or without working with the champions to find solutions. I see the veto power as a "change requested to address specific concerns".

200

Mathieu Hofman @mhofman.bsky.social · 31/07/2026

For decorators, things have started moving again, and implementation concerns have been raised. Most in the committee still seem interested in getting this proposal through, but the champion also has limited availability. If there was any political concern, it was implementors dragging their feet.

110

Mathieu Hofman @mhofman.bsky.social · 31/07/2026

Afaik the previously active champions of signals were well aware of the potentially controversial aspects of the proposal and working on solutions to address them. The proposal is not stuck because of any political reason, unless you consider lack of champion activity to be a political symptom.

100

Mathieu Hofman @mhofman.bsky.social · 26/07/2025

I also had an alternative design that would allow a framework / library to track when a promise it created (e.g. a network query) becomes the eventual result of a promise it receives (e.g. userland handler that triggers the network query). But that'd require a significant JS engine and spec change.

100

Mathieu Hofman @mhofman.bsky.social · 26/07/2025

The approach we're taking is to forego native promises and thenables altogether, and use another object that represents an eventual result. I need to write up our design somewhere (it leverages some of the concepts for eventual send).

100

Mathieu Hofman @mhofman.bsky.social · 26/07/2025

It's fragile in the face of some user code refactors too. Anything that introduces a tick before these trapping thenable are adopted into a promise prevents the detection. Having faced similar problems of trying to track the flow of eventual results, I'm confident thenable tricks isn't a solution.

100

Mathieu Hofman @mhofman.bsky.social · 26/07/2025

I really didn't expect to see then getters (ab)used like that in the wild! I'm quite suspicious of how fragile this all actually is. This is effectively another form of Zalgo being released.

100

Mathieu Hofman @mhofman.bsky.social · 24/04/2025

There is a long discussion on the topic at github.com/tc39/proposa.... Besides some of the performance concerns raised, my main concern is preventing the ability of some code to confuse other code it interacts with in the same realm. Adding an object to a collection should not have side effects.

github.com

Don't understand how the solution aligns to the problem · Issue #16 · tc39/proposal-composites

The problem statement is that Map and Set don't allow clients to override equality. It seems that the straightforward solution would be to have an option to pass a comparer function to those struct...

010

Mathieu Hofman @mhofman.bsky.social · 24/04/2025

'user" is a bit confusing here. If the hashCode / equal is a protocol implemented by the object, then the author of the object can affect all collections in which the object is added 👎. If the functions are per collection, then you lose the standard synchronization point 👎

110

Mathieu Hofman @mhofman.bsky.social · 21/04/2025

An equality predicate is not sufficient for collections. Something like hashCode is also needed. The problem with those is stability. There is no way to guarantee that user code will be side effect free and produce stable results.

100

Mathieu Hofman @mhofman.bsky.social · 27/03/2025

Hey there, any update on the recordings of the presentations? Would love to reference it.

000

Reposted by Mathieu Hofman

SeattleJS @seattlejs.com · 21/02/2025

Don't what a realm is in JavaScript? Ask @mhofman.bsky.social ! He is talking all about them :)

Mathieu speaking to a room of people about realms in JavaScript

253

Mathieu Hofman @mhofman.bsky.social · 06/02/2025

Really insightful read of @kriskowal.bsky.social's experience of helping bring modules to the JavaScript ecosystem.

050

Mathieu Hofman @mhofman.bsky.social · 06/12/2024

And even though there was no actual vulnerability, we did pay out the researcher as it was a really informative report.

010

Mathieu Hofman @mhofman.bsky.social · 06/12/2024

Got a similar report a few months ago. We were not actually vulnerable (CI is powerless on forks, and it couldn't affect any output), but it was a really good learning experience. Use env variables as much as possible in GH actions, those are sanitized.

110

Mathieu Hofman @mhofman.bsky.social · 06/12/2024

Reminds me of an "RCE" last year where a JWT library was "vulnerable" to an object with a `toString` method. How do you think that method got there in the first place... unit42.paloaltonetworks.com/jsonwebtoken...

unit42.paloaltonetworks.com

Security Issue in JWT Secret Poisoning (Updated)

We discovered a new high-severity vulnerability (CVE-2022-23529) in the popular JsonWebToken open source project.

000

Reposted by Mathieu Hofman

🪷 kumavis 🪷 @kumavis.me · 30/11/2024

my view is that large mission-critical systems that are targeted by threat actors are in fact multi-tenant systems (whether their authors realize it or not) and immutability is one of the tools for writing defensive code against potential threats running in the same process

132

Mathieu Hofman @mhofman.bsky.social · 02/12/2024

Yeah I'd say in general control flow based on API calls is a weakness in TS. Possible to implement yourself but very complex, and the standard library types don't do it.

010

Mathieu Hofman @mhofman.bsky.social · 29/11/2024

Oh interesting. Wondering if this has something to do with integer index properties.

100

Mathieu Hofman @mhofman.bsky.social · 24/11/2024

I was seeing similar scroll resetting weirdly on back navigation on Chrome on Android, but I haven't seen it today.

000

Mathieu Hofman @mhofman.bsky.social · 24/11/2024

I have to admit, Twitter has a really good mobile web experience, even after the sabotages from Elon. The navigation in BlueSky mobile web is not great, and don't get me started on the lack of a manifest to support installing the web app and push notifications.

010

Reposted by Mathieu Hofman

Jake Bailey @jakebailey.dev · 23/11/2024

A flag which bans TS features with runtime emit (enums, namespaces, experimental decorators, etc) will come in 5.8 to help people executing TS code via Node.js (or who want to avoid using those features for "reasons").

512427

Mathieu Hofman @mhofman.bsky.social · 23/11/2024

Yeah it's been a known won't fix issue since 2020: github.com/microsoft/Ty...

000

Mathieu Hofman @mhofman.bsky.social · 23/11/2024

Unfortunately TS is already not a superset of JS. Its syntax is ambiguous enough that some valid JS programs have different semantics when handled by a TS parser. Also not all TS programs can simply have their types stripped off.

110

Mathieu Hofman @mhofman.bsky.social · 19/11/2024

GitHub can recognize and hide some generated files (e.g. from protobuf), not sure what the heuristics are. To enforce they are up to date, we just have a CI job that regenerates them and a check there are no dirty files (also good to handle lock files and similar)

010