Nano

SW Engineer/Entrepreneur documenting my whole journey: wins, failures, tech insights, opinions, and everything I’m learning

[Nano @nanodlfa]

Hey, I’m Nano.

Starting from zero and sharing everything: wins, failures, tech insights, opinions, and lessons learned. 🤓

Builders, dreamers, lifelong learners: this space is for us.
Join the ride, let's grow side by side.⚡

[Nano @nanodlfa]

Recommended read

[Gergely Orosz @GergelyOrosz]

That DHH saying out loud that the age of writing code by hand is over for the industry, and causing such a huge uproar is a bit interesting, given this was clear enough since ~January for most of us using the models + paying attention.

Removed paywall: https://t.co/sSfyCm8jk8

[Nano @nanodlfa]

@engagekit_io Very annoying indeed 🫠

[Nano @nanodlfa]

Crazy times. Check your npm packages, make sure axios is pinned to a safe version

[Feross @feross]

🚨 CRITICAL: Active supply chain attack on axios -- one of npm's most depended-on packages.

The latest [email protected] now pulls in [email protected], a package that did not exist before today. This is a live compromise.

This is textbook supply chain installer malware. axios has 100M+ weekly downloads. Every npm install pulling the latest version is potentially compromised right now.

Socket AI analysis confirms this is malware. plain-crypto-js is an obfuscated dropper/loader that:

• Deobfuscates embedded payloads and operational strings at runtime
• Dynamically loads fs, os, and execSync to evade static analysis
• Executes decoded shell commands
• Stages and copies payload files into OS temp and Windows ProgramData directories
• Deletes and renames artifacts post-execution to destroy forensic evidence

If you use axios, pin your version immediately and audit your lockfiles. Do not upgrade.

[Nano @nanodlfa]

@madalinabalazs Similar experience here, not worth it, consumes A LOT of tokens

[Nano @nanodlfa]

@beka_saparbek I feel you, been there. Small steps instead of trying to do everything at once to avoid that overwhelming feeling

[Nano @nanodlfa]

@heygeorgekal It depends on the project, but most of the time I review it. YOLO commits only for personal projects.

[Nano @nanodlfa]

@hadinawaz_ Thanks!

[Nano @nanodlfa]

Visiting a client this week ✈️
Challenge is trying to stay active on X!

[Nano @nanodlfa]

@frmbrice Exactly ! Understimated. Thanks man

[Nano @nanodlfa]

@sajibrahman206 Thanks, man! Perfectly said.

[Nano @nanodlfa]

@m_chaseallen Good one! Thanks

[Nano @nanodlfa]

@Hem_curio @amazon Really inspiring! failing that many times and still coming back shows real perseverance, congrats!

[Nano @nanodlfa]

@cjd_labs Very interesting idea to use Grok to analyze X account! I'll give it a try

[Nano @nanodlfa]

@alexanderOpalic honestly, don’t give a shit, just be yourself, directness and kindness stand out way more than trying to please everyone online

[Nano @nanodlfa]

@heygeorgekal thanks bro!

[Nano @nanodlfa]

@Paul_vot I wish I could 😅 will do eventually

[Nano @nanodlfa]

@mscode07 long term relationship client

[Nano @nanodlfa]

@heygeorgekal explaining to family I don't fix printers or microwaves, I just write code 😂

[Nano @nanodlfa]

If you want to work with AI seriously, learn basic data science. Agents aren’t magic.

You still need data, labels, evals, and feedback loops. Ignoring that is why most AI apps never mature.

[Nano @nanodlfa]

@heygeorgekal That’s great! Have you tried Polar?