Jordan Harband

Microsoft literally told fragile white guys to use AI to compete with Black co-workers.

remember the coworker who annoyed you a decade ago by pushing back on “move fast and break things,” “perfect is the enemy of the good,” and “just ship it”? in the age of slop, they’re your most valuable hire. treat them accordingly.

“Ratatouille is here - anyone can cook” i love the accuracy of this. Anyone can cook - but it’s important to remember that that doesn’t mean you’re not still a diseased rodent. ht Max Pollard (cotool)

ECMAScript excitement 😉 This week @tc39.es advanced these proposals 🎉 4️⃣ Dynamic Code Brand Checks 4️⃣ Iterator Chunking/Includes/Join 3️⃣ Thenable Curtailment 2️⃣.7️⃣ default in export * from "mod" 2️⃣.7️⃣ export defer 2️⃣.7️⃣ JSON.parse options 2️⃣ BigInt from Exponential 2️⃣ Composites 1️⃣ Pulling in AbortController

Some pics from the Giants/Swallows game tonight (that’s a sake juice box)

just had a really cool experience on a Tokyo train - i saw two women using JSL, and i used some ASL to communicate with them, plus some google translate. they were kind and appreciative!

Two new CVEs published today (as well as the fixed releases for them): `shell-quote`: www.cve.org/CVERecord?id... `pbkdf2`: www.cve.org/CVERecord?id...

i wish I’d discovered both scuba diving and Japan in my 20s rather than in my 40s. the last two decades would have been quite different.

nvm.sh v0.40.8 is out, fixing a path traversal vuln and a number of bugs - cve.org/CVERecord?id... - github.com/nvm-sh/nvm/r...

It’s very simple. A reality TV host became dictator because he turned down a role for Sharknado 4 and that’s why the king of outer space, who cheats at Diablo, got to kill Africa. Now the economy is controlled by a sex cult that has something to do with Harry Potter fanfic because of robots.

DO SOMETHING YOU LOVE AND YOU'LL NEVER WORK A DAY IN YOUR LIFE. COROLLARY. DO SOMETHING YOU LOVE AND YOU NEVER TAKE DAYS OFF EITHER. THIS IS A POST ABOUT BEING AN ENGINEER.

don't be nice.

Joel Spolsky, 2002

tfw you and your cat successfully hunt a bug

Oh, right. The daybed. The daybed for Kuzco, the daybed chosen especially to relax Kuzco, Kuzco’s daybed. That daybed?

Your friendly reminder that a thing developed in isolation, absent sufficient stakeholders, has to be insanely, extremely, staggeringly good to be able to outweigh the aforementioned badness. (spoiler alert: it probably isn’t)

lol why would Glendale Community College have any info about me whatsoever??? I've never attended, applied, lived near it, or been to Glendale. this is the most confusing @haveibeenpwned.com email i've gotten yet

npm v12 is now generally available. npm install now makes install scripts, Git, and remote-URL dependencies opt-in by default. We're also retiring npm 2FA-bypass GAT: no account management (early Aug 2026), no direct publishing (~Jan 2027). More info at github.blog/changelog/20...

You shouldn’t trust Trusted Publishing https://blog.yossarian.net/2026/07/07/You-shouldnt-trust-trusted-publishing #python #security #oss

can someone please tell *every bank* that if a "secure messaging system" goes to my email address, then it's basically not possible for it to be more secure than my email account itself?

please be student patient driver

@tantek.com.web.brid.gy (ง’̀-‘́)ง

I got really tired of having to manually track down whether a package ships its own types, or has a DefinitelyTyped package, or how that changes over time. so, I made npmjs.com/dt-clean - `npx dt-clean -u` and you'll have the right version of the right DT packages!

ok i know i'm a couple months late, but wtaf is this new "Marathon" game? it seems like it has precisely nothing to do with actual Marathon lore, and is just a (potentially fun but) entirely unrelated game with the title slapped on top.

it is oddly satisfying watching ferrier content on the reels

nvm.sh v0.40.5 is out, with some CVE fixes: github.com/nvm-sh/nvm/r... Be sure to update!

what happened to the kiki bouba labeler??

oh no, i don't use the ai for <thing that i am paid to do> it's terrible at that. it's great for <thing you are paid to do> though.

Today is a big day for @socket.dev. We raised a $60M Series C at a $1B valuation, led by Thrive Capital. 20,000+ orgs, 1.5M repos protected, 1,000+ supply chain attacks blocked per week. 3/5 FAANG companies are customers. We're just getting started.

Clutching pearls about how many PURLs are in your application is just FUD and nonsense. The only thing that matters is, how many humans can put code into it. (ie all your engineers + every linux dev + every OSS maintainer etc)

PSA: add `export GH_TELEMETRY=false` and `export DO_NOT_TRACK=true` to your shell profile files to opt out of @github.com's on-by-default `gh` telemetry.

oof, who do i complain to about the name of git 2.54's "history" command? git does not have a history, it has a changelog, and the conceptual difference is very important for having the proper mental model :-(

I was pretty happy with my surroundings while discussing supply chain security today.

The thing people may not realize is that the best way to secure the supply chain is to secure the maintainers. And the best way to secure the maintainers is to pay them and give them a laptop, health insurance, and maybe even a desk to sit at.

so what i am learning from github.com/axios/axios/... is that you should simply never join a Microsoft Teams call for any reason --- because of security

🚨 New Investigation: Attackers are hunting the maintainers behind Lodash, Fastify, buffer, Pino, mocha, Express, and #Nodejs core, because compromising one of them means write access to packages downloaded billions of times a week. socket.dev/blog/attacke...

tldr; if you used @vlt.sh as your package manager, then you were protected the minute @socket.dev flagged the malicious packages in the `axios` attack yesterday. The best time to switch your package manager was 48hrs ago, the next best time is right now. More below: blog.vlt.sh/blog/vlt-build

🧨 Axios only needed to be resolved somewhere in your dependency graph to affect you. Semver + transitive deps + runtime installs = hidden blast radius. If you only checked your project’s lockfile, you may still not know. socket.dev/blog/hidden-... #nodejs #javascript

ECMAScript Euphoria! 🎉 We don't always post when a single proposal advances, but when we do, it's Temporal -> Stage 4. Just days shy of 9 years from Stage 1, a herculean effort on the part of many champions, delegates, invited experts, and contributors, past and present. Thank you all! 🙌

ECMAScript excitement 😉 Congrats to @jordan.har.band on advancing Error.prototype.stack to Stage 2.7 at TC39 today 🎉 This proposal seeks to standardize the existence of the accessor in the JS spec. github.com/tc39/proposa...

did you know claude code has _weekly_ usage limits? i didn't

Finally found a plane with a device holder that can fit an iPad Pro

i hadn’t hit Claude’s limits once since upgrading to the 10x max plan, but it took me less than 24 hours to hit the limits on the free open source 20x max plan (－‸ლ)

Your mission, should you choose to accept it

minimatch patched 3 high-severity ReDoS vulnerabilities that can stall the Node.js event loop. Because it's pulled into nearly every corner of the #NodeJS ecosystem (~472M weekly downloads), we're releasing free Certified Patches for all three. socket.dev/blog/minimat... #JavaScript

We're excited to announce that Socket is joining the @openjsf.org! Proud to support the #JavaScript ecosystem alongside so many great projects and contributors. socket.dev/blog/socket-...

🎉 We’re thrilled to welcome @socket.dev as our newest Silver member. Socket is doing critical work to secure the JavaScript ecosystem by helping developers identify and prevent supply chain risks. We're excited to collaborate and make open source safer for everyone! 🛡️💻 openjsf.org/blog/socket-...