boneskull

ok so I made an assertion library bupkis.zip

Submissions for the Package Management devroom at @fosdem.org 27 are now open! 🎉️ Do you work on improving the community's package management and software supply chain security infrastructure? This work is more important than ever, and we'd love it if you submitted a talk!

This excerpt from a 1994 Spin magazine story about Soundgarden (written by the legendary Jonathan Gold) is all you need to know about Billy Corgan. We are all Soundgarden guitarist Kim Thayil.

If you need a JS runtime that's not subject to being "acquired" and "sunsetted", @nodejs.org is right there. By design, it can't be governed by a single company.

pepto should come in beer cans

a nonzero number of inmates on death row in the US are innocent, btw

reminder on the current state of AI security

reading “Exploding the Phone” by Phil Lapsely which is a history of #phreaking. super interesting (and an engaging read) if you are so inclined

Odyssey as a security engineering metaphor since before it was cool. www.youtube.com/watch?v=RZ7b...

don’t worry everyone, I’m hoarding slop for the coming slop shortage

www.jorkulator.com

🔇 🔇 🔇 My book, Deep Unlearning, is now available for preorders! I don't know how people write so many books because this one took a lot out of me. It turns out, I had a lot to say 😂, with editors cutting out 50k of my words 🫣 ✴️ You can now preorder it at www.simonandschuster.com/books/Deep-U....

today I switched from vivaldi to firefox bc of chromium dropping manifest v2. don’t love it, but guess it’s good enough

I have debated releasing this for several days, but have ultimately decided that I'm okay with putting it out there. I have revised it to be a bit tamer, but 🤷‍♂️ Basically: stop treating open source as if it is a private org selling a product with a guarantee of safety. jrfom.com/posts/2026/0...

GTA 6 leak reveals you need to change your smoke alarm batteries every year.

I need a new blog. I was using ghost years ago but would rather just go static site gen. probably publish to GH pages. what are people using for this nowadays? maybe a good astro template or smth?

Changesets v3 is here! 🦋 After months of chipping away at issues alongside @bluwy.me, @haglund.dev, and many other contributors, we’re excited to finally share it. changesets.dev/blog/announc...

@lu.is long time no chat. can I dm you?

Why is there no such thing in #nodejs as a "conditional subpath import"? Only conditional subpath exports? Technical reason? Use-cases are few? Nobody bothered?

github is pissing me off. what kind of institutional rot enables so much downtime?

my kid was asking me about my job. she asked what I do when there’s no more code to write

little AVA-like macro implementation for node:test github.com/boneskull/no... not published yet. cc @naugtur.pl

my saturday: - wake up at 11a - go back to bed - wake up at 2p - go back to bed - wake up at 5p (don’t bother getting out of bed this time) - wake up at 7:30p - sit around until 2a - go back to bed

Lemmy Koopa is not a reference to Lemmy.

The Error code property proposal has advanced to Stage 2 ... github.com/tc39/proposa... WHATWG folks have raised an objection based on a potential conflict with DOMException's legacy code property. We'll need to figure that out in order to push further. github.com/tc39/proposa...

this is adorable

how many more must die due to GitHub outages?

Free newsletter: The OpenAI Bubble, my comprehensive, 15k word thesis about why the AI Bubble and the AI Trade were inflated by OpenAI and can't exist without OpenAI, who will be the victims of the bubble bursting, and how we can stop it from happening again. www.wheresyoured.at/the-openai-bubble/

is there a fork of chromium that aims to retain manifest v2 compat?

🔥 "This [Flock Safety] contract is not being renewed because of serious concerns around civil liberties and civil rights issues, particularly around privacy and the data that is being collected from these cameras." — Dean Gialamas, LAPD's chief information officer 🧾 abc7.com/post/lapd-en...

NO BILLIONAIRE TAX (seize their assets instead)

Annoucing git-pkgs, explore the dependency history of your git repositories. git pkgs init git pkgs blame git pkgs history rails git pkgs diff --from=v2.0 git pkgs stats git pkgs why rails git pkgs diff --from=HEAD~10 git pkgs diff --from=main --to=feature nesbitt.io/2026/01/01/g...

LET ME RERUN FAILED CHECKS FROM THE PR PAGE, YOU COWARDS

13 years ago today I made the first commit to the ESLint Git repo. It’s hard to believe that this project I cobbled together in my spare time over a couple of weeks is still going strong. I’ve been doing a lot of reflecting over these years and the journey it’s been. A thread.

goth by birth, dad by choice

are certain cats naturally hypoallergenic or what. why am I not erupting in hives? what is happening to my body????

I got really tired of having to manually track down whether a package ships its own types, or has a DefinitelyTyped package, or how that changes over time. so, I made npmjs.com/dt-clean - `npx dt-clean -u` and you'll have the right version of the right DT packages!

tf is a zizmor anyway. nobody asks these questions and it’s important

📦new supply chain security tool📦 I've published an early version of www.npmx.dev/package/@lav... for testing only. Soon it'll also have a wizard and validator. Opinions it ships will be refined. I'm looking for some initial testing and feedback. Planning a stable release after npm12 is out.