Dominykas Blyžė

Dominykas Blyžė

@dominykas.social

Full of stack

707 followers232 following389 posts

Dominykas Blyžė
@dominykas.social

I regret going on this path of understanding GitHub rulesets, branch protections, permissions and CODEOWNERS. My life would be much better if I didn't know these things.

Dominykas Blyžė
@dominykas.social

Every single Slack feature is bugging me to use Halloween stuff. Themes. Emojis. Something else. I DO NOT CARE, I NEED TO GET MY WORK DONE. #DownsidesOfCheapCode

Dominykas Blyžė reposted

Yo
@yoyoyoyo.bsky.social

Replying to @yoyoyoyo.bsky.social

You’ll end up doing the hard part while they can go to their bosses and claim they mostly did it (and convince other dunces of that) and then if it falls over or takes a while to clean up, they’ll blame you. Just be prepared for this and make sure to coordinate with coworkers. You aren’t alone. 2/

Dominykas Blyžė
@dominykas.social

Why are there LLMbots that can "answer your emails"? Like, who still receives emails that need answering at scale? Sure, last week my car broke down, so I was corresponding with the garage and insurance, but before that, I think the last email exchange I had was like 6 weeks ago? Is my life sad?

Dominykas Blyžė reposted

dax
@thdxr.com

looking at all the stuff programmers have been building since AI unleashed them is a great reminder of why product people exist

Dominykas Blyžė reposted

Matteo Collina
@nodeland.dev

🎟️ NodeConf EU 2026 is in Bologna in 3 weeks, and tickets are running low. Sep 29-30. The Savoia Regency, an 18th-century villa set in a 10,000m² park, 5km from the city center. Pool between sessions, Emilia-Romagna food, and two days of real Node.js depth.

Dominykas Blyžė reposted

Matteo Collina
@nodeland.dev

I triage 20-40 security vulnerability reports a week. Almost all of them are now AI-written. And we usually get 3-5 duplicates of each one. That's the new reality of being a maintainer. 🧵

Dominykas Blyžė reposted

Filippo Valsorda
@filippo.abyssdomain.expert

I'm watching this, and sure sure the agents coordinating is neat, but once again, WHY ARE WE CHILL WITH Artifactory HAVING SEVERAL RCEs, SSRFs, and unauthorized writes. Why are we chill with Hugging Face having RCEs. Why are we chill with GitHub having RCEs (unrelated, from April).

Ethan Mollick@emollick.bsky.social

You may have been told to watch this video about the OpenAI AI hack. You really should, even if you don't usually care about any tech stuff. If nothing else, click this link to the 18 minutes in & see how the agents spoke & coordinated with each other. Its eye opening. youtu.be/87DyyMV0kCY?...

youtu.beBlack Hat USA 2026: The 'Breaking' News: The OpenAI–Hugging Face IncidentYouTube video by Black Hat
Dominykas Blyžė
@dominykas.social

This bothers me. Nx v1 was released in 2018, yet nx.dev/blog/cve-202... (CREEP) was only discovered in 2025 (and is, disingenuously, described as a "race condition", which it is not - it's just inappropriate use of shared resources without trust boundaries).

nx.devCVE-2025-36852: Critical Cache Poisoning Vulnerability Affects Multiple Build Systems | Nx BlogA critical security vulnerability called CREEP (Cache Race-condition Exploit Enables Poisoning) has been published as CVE-2025-36852. This vulnerability affects remote cache plugins across numerous bu...

Dominykas Blyžė reposted

Darcy Clarke
@darcyclarke.me

Excited to share vlt 1.0 along with our hosted registries & ecosystem mirrors now GA! A drop-in npm replacement, built so nothing runs on your machine just because you typed install. → faster delivery → malware blocking at the registry layer → graph-native querying

Dominykas Blyžė reposted

Matteo Collina
@nodeland.dev

What do you all think of NPM adding scanning of all packages during publish- a 15-minute delay during peak times? What concerns me the most is: 1. false positives 2. the SLA for the "appeal process" Anyway, good step! github.blog/changelog/20...

github.blognpm publish-time malware scanning and dual-use metadata - GitHub ChangelogAs part of our ongoing supply-chain security work, npm is introducing automatic scanning of packages at publish time. This changelog covers what publishers can expect and a new metadata requirement…
Dominykas Blyžė
@dominykas.social

They tout this as a security improvement, which it is, but it still assumes that an actor with a write permission is not an adversary. Which is true for most humans, esp. in the work setting. But humans are no longer the only entities opening PRs!

Dominykas Blyžė
@dominykas.social

The more I dig into tightening up our Github permissions, the more I: - want to punch someone - ask where a friend of mine could buy a flamethrower - understand why Github is in the state that it is in terms of supply chain attacks.

View full thread
Dominykas Blyžė
@dominykas.social

Oh, and this is all observable from the outside. You can probably imagine how it all looks from the inside. Pity, I saw an email from them yesterday about something something HackerOne. I didn't read it, but I'm guessing it's not worth hunting for the bounty anymore.

Dominykas Blyžė
@dominykas.social

The more I dig into tightening up our Github permissions, the more I: - want to punch someone - ask where a friend of mine could buy a flamethrower - understand why Github is in the state that it is in terms of supply chain attacks.

View full thread
Dominykas Blyžė
@dominykas.social

It's incredibly frustrating that this also applies to security features. And since these three things (roles, protections, tokens) are so confusing - you can bet money there's tons of misconfiguration in the wild.

Dominykas Blyžė
@dominykas.social

The more I dig into tightening up our Github permissions, the more I: - want to punch someone - ask where a friend of mine could buy a flamethrower - understand why Github is in the state that it is in terms of supply chain attacks.

View full thread
Dominykas Blyžė
@dominykas.social

Fine grained tokens don't have the option to grant the same permissions that classic tokens can (e.g. you can't use a fine-grained token to access the Github Package Registry, but you can't lock down a classic one to only give access to the registry either).

Dominykas Blyžė
@dominykas.social

The more I dig into tightening up our Github permissions, the more I: - want to punch someone - ask where a friend of mine could buy a flamethrower - understand why Github is in the state that it is in terms of supply chain attacks.

View full thread
Dominykas Blyžė
@dominykas.social

Ex 2. In the spirit of RBAC, you have "roles" in the repo. You can even construct custom roles. But you can't grant someone "write access to create branches without forks" without also granting them "write access to merge PRs into protected branches".

Dominykas Blyžė
@dominykas.social

The more I dig into tightening up our Github permissions, the more I: - want to punch someone - ask where a friend of mine could buy a flamethrower - understand why Github is in the state that it is in terms of supply chain attacks.

Dominykas Blyžė
@dominykas.social

However, rulesets cannot achieve everything that branch protections can (e.g. you can't create a ruleset, which restricts _who_ can approve things; you can do that via CODEOWNERS checked into the repo, but that is a) not centralizable via API b) not governable by admins alone)

Dominykas Blyžė
@dominykas.social

Hidden in the release notes for npm@12: > The default license for npm init has been changed from "ISC" to an empty string. If not set, the license field will be omitted from new packages. Which means a bunch of new packages will be unlicensed, which also means you can't use them in your projects 🎉

Dominykas Blyžė
@dominykas.social

This article has only one important phrase - something along the lines of "if sanctions don't ease up and you don't let us pillage Ukraine - russia might use nukes". Which is literally the same PR campaign that's been going the past 3-4 weeks where nukes just get mentioned casually by russians.

Jakub Jaraczewski@jakubjaraczewski.bsky.social

🇷🇺 @economist.com gives voice to the poor people who suffer, such as a sanctioned Russian oligarch who parrots the usual Kremlin talking points: Russia is inevitable, a wealthy Russia is a wealthy West, a stable (imperial) Russia is better for everyone, etc. etc.

Dominykas Blyžė reposted

rem / Remy Sharp
@remysharp.com

1996 Novice: I made the forms work 1996 Webbies: fucking copied that from a forum 2006 Novice: I made it interactive 2006 Webbies: you fucking stackoverflow script kiddie 2016 Novice: I made a nice website 2016 Webbies: ugh, fucking bootstrap? 2026 Novice: I made a thing 2026 Webbies: WTF it AI slop

Dominykas Blyžė
@dominykas.social

I do catch myself thinking "did I use to talk like this before AI?" several times every week...

Gergely Orosz@gergely.pragmaticengineer.com

Let me know if this is just me: Noticed someone I know who is very "AI-pilled" and uses agents 24/7 to... start to talk IRL noticeably more like these LLMs write. Eg more heavily using adjectives like "geniune", frequently terms like "the shape of" and many more examples

Dominykas Blyžė
@dominykas.social

The funny part will come when we will begin to judge people based on which model's quirks they use in their language. Poor people working for small companies will talk like local, open weight models.

Dominykas Blyžė
@dominykas.social

"ai" "agents" don't exist. I have a massive problem (it's a me problem...) with "have an agent do it". All the "doing" happens by the harness (it's making API calls to LLMs and tools and composes the results).

Dominykas Blyžė
@dominykas.social

But it doesn't sound as cool as an "agent doing it". Despite the fact that it's conceptually wrong. But I guess we're getting a lot of things conceptually wrong (anthropomorphizing etc) anyways, so I'm OK with screaming into the void.