Arnout, 3rdEden

Father of 2, Author of countless OS projects/libraries (Node.js, React(-Native), WebSockets, Frameworks etc) I shoot stuff online.

[Arnout, 3rdEden @3rdEden]

Its time that @npmjs , @github step up, take responsibility, and start protecting authors.

Let me opt-out of exposing my email against my will.

[Arnout, 3rdEden @3rdEden]

Just want to make it perfectly clear, @npmjs is 100% to blame for all the phishing attacks we package authors have to endure. Exposing the email address of authors for shits’n’giggles is 100% to blame for this.

There is no option to prevent your email from being leaked by npm

[Arnout, 3rdEden @3rdEden]

Not only that, there is only 1 email address that is exposed, that is the same email npm uses for their communication, hence an easy phishing.

As I use a dedicated alias for npm, i can also see that this public exposure is the reason I get so much spam. At least 40% is my alias

[Arnout, 3rdEden @3rdEden]

Does any have a spare blsky invite? Seems like its time to move while twitter is on its way to implode. 🫣

[Arnout, 3rdEden @3rdEden]

@tlrobinson Its a great way to tell someone is a good or bad engineer.

[Arnout, 3rdEden @3rdEden]

TFW you find out the web finally has a deep clone API called `structuredClone`: 🥳

TFW you realise it doesn't work on Proxies: 😩

[Arnout, 3rdEden @3rdEden]

I really hate that this keeps happening.

[Arnout, 3rdEden @3rdEden]

TFW, you accidentally create another framework.

[Arnout, 3rdEden @3rdEden]

It's very liberating to work on your own projects, as you're not hindered by the constraints and boundaries of your work environment.

You create.
You experiment.
You innovate.

You're the mad scientist.

[Arnout, 3rdEden @3rdEden]

My dog has been responsible for 100% of the fires caused by our 2 @iRobot Roomba's.

Long hair dogs, rotating parts == friction. It's a recipe for disaster.

[Arnout, 3rdEden @3rdEden]

Security researcher reporting bug: $100-1000
OpenSource maintainer fixing bugs: $0

🥲

[Arnout, 3rdEden @3rdEden]

The current state of the art mono repo tooling, nx/lerna, decided that fork bombing is an acceptable pattern when executing tasks.

Is this _really_ the best we can do? Like, really?

[Arnout, 3rdEden @3rdEden]

Hot take: React did more harm than good for the web.

Our apps got heavier, and we somehow accepted that is fine to ship duplicate content because yay hydration. It's extremely overkill for the majority of apps that just render basic UI elements.

[Arnout, 3rdEden @3rdEden]

@bahmutov While not without flaws either, I do agree, it solves a lot of the problems.

[Arnout, 3rdEden @3rdEden]

I'm thankful for JSDOM.

For reminding about the mistake I made for installing it, and using it in a project. What were we thinking, trying to polyfil a JS environment with non functioning polyfill API's that do not represent the real world usage of our code at all.

[Arnout, 3rdEden @3rdEden]

It doesn't throw an Error, no, that would make too much sense right? Instead we create an Error instance, and log it to the console instead, sending you on a while goose chase figuring out where the error is coming from, why your tests are still passing.

[Arnout, 3rdEden @3rdEden]

Not only does it means you're not testing your code correctly and you basically cross your fingers and hope that there's no implementation difference between the real API and whatever polyfill they designed. But when you hit those API differences...

[Arnout, 3rdEden @3rdEden]

@MylesBorins @Raynos I understand the importance of 2FA on high profile packages to severely reduce the attack surface, but when the 2FA is forced upon you in these cases is should be on package basis, not account wide. This would severely reduce the friction on developers.

[Arnout, 3rdEden @3rdEden]

@Raynos @MylesBorins I feel exactly the same. It feels like a punishment every time im forced into 2fa. Didn’t ask for, don’t want it, no way to opt out. I get it, some packages are high risk, but there’s better ways to solve it than taking npm accounts hostage.

[Arnout, 3rdEden @3rdEden]

@devongovett I have to disagree here. The bundler knows exactly which modules are bundled, and it decides to bundle multiple copies of it.