Peter van der Zee

Peter van der Zee

@pvdz.ee

tafka @kuvos eng @socket.dev - 15yr js/ts - rust - ex vercel - ex fb - js1k-guy

454 followers92 following1K posts

Eeew. Programmers have now entered the world of "it's not an exact science, but it probably works, most of the time" like biology like doctors working on the human body. This is not how programming was supposed to work! This is not what I signed up for! But I'm kinda hooked to it now. Eew.

Dealing with a midlife gaming crisis. Having dealt with existentialism a long time ago, I now face the problem of trying to find out what kind of games I still enjoy playing. What do I really want to sink time into? And what's just another low effort has-been copy cat. Vibe coded at that. feh.

Even playing Heroes of Hammerwatch for a few hours right now I'm like, "meh, I'm not gonna bother with finding the jail button on every 4 5 and 6 floor just to get the ore". Just not gonna bother. It's still just so linear. But that's a high effort game. Like, what does it take?

The aggressiveness of Android Auto is absurd. Unable to disable, unable to prevent, forces bluetooth and wifi. Also forces audio takeover. What the fuck is this virus.

My team hard at work while I'm on a mini vacation. Mmm, wasnt litellm popped recently? Yunoroll?!?

Socket@socket.dev

🚨 LiteLLM, a Python package for connecting to AI model providers with 92M+ monthly downloads, has been compromised. Version 1.107.0 ships credential-stealing malware through PyPI wheels and Docker images, targeting cloud credentials, developer secrets, and AI tools.

"npm's July fix has already been bypassed" If you're calling out malware that exists in a package but doesn't use postinstall as "Dependency installation security measure already defeated" then just quit now. Please. such fud, much wow.

ngl, I'm not sure I would have been able to do this in 9s. They gave up when I made this move. I mean, don't get me wrong. I _know_ how to do it. But in under 9s time pressure? Oof. Also turns out I kinda stole this game. Or at least, had made enough mistakes to deserve losing. Def. felt behind.

Why don't openai/anthropic etc create an actual airgapped local network for their CTF training? Strikes me as not too hard to gate all egress. Anything not covered can be caught by a set of monkeys (->AIs), ask the requesting AI for what it was, and create a mock service to simulate it. Easy peasy?

et.alet.al

claude 5.5 is great but the security fences are super annoying. i know when working on a deobufscation tool you're kind of just asking for it but come on :/ it's not even a hard block (retry and it's fine) but it's very frustrated to my workflows

VCRDD; vibed code-review driven development Vibe some code, then spend the same amount of time as you otherwise would reviewing the 5k loc resulting PR.

I always knew that moving Tenko to a flat buffer tape AST approach would improve perf. I just could never be bothered. Now I just let Claude do it and low and behond; it's indeed faster. Gotta love it.

Been working on preval with claude for a few weeks now. It's great. I've been letting it implement ideas and patterns and every so often I let it do some perf hunting. It gives up very easily but /goal is a life saver. Past two days I had it use this 10mb malware sample and it's been gutting perf 😍

"This reducer is taking 1200ms for this 10mb sample, bring it under 100ms" Non-trivial because there are million element loops (idents) galore and it's quite a complex beast at this point. But it managed to slowly chip away and is now sitting at 150ms. Just optimizing. Over and over. So nice.

All the while I've just been playing minecraft (getting ready for adventure with the kids) and chess :D It's not exactly an idle game (claude) and in many ways it is (you still have to holds its hand, be present, clickyticlick). But I enjoy it.

props to logitech's logi keyboard and mouse. it's actually amazing how little power draw they have. my wireless logi keyboard gets ~15h usage a day throughout the year. it has two or three aa/a batteries that I replace less than once a year. mouse needs a charge less than once a month. really good

Works or B0rks? ``` Number = { prototype: { x: 1 } }; console.log( (5).x ); console.log( new Number(5).x ); ``` sorrynotsorry

Works or B0rks? ``` Number.prototype.x = 1; Number.prototype = {x: 2}; console.log( (5).x ) ``` Fun stories about Array way back notwithstanding

What github needs, if they're not going to do a "AI" mode for PRs like they have draft, is a simple "collapse up to this point" marker so all AI review conversation noise can be hidden when you're ready for human review. Honestly, them not having an AI review state at this point is bonkers though.

Works or B0rks? ``` function f(){ console.log(this); } const x = {f} // Direct f(); // undefined // Indirect (0, x.f)() // undefined // Optional chain x?.f() // x // Ok, now you! x.f?.() // ? x?.f?.() // ? const y = {g: function(){ return f; }} y?.g()() // ? y?.g()?.() // ? ``` (strict mode!)

Works or B0rks? ``` function *f() { return 1; console.log('A'); } const a = f(); a .next(); a .next(); const b = f(); b .next(); b.return(); const c = f(); c.return(); c.return(); ``` In what cases does this print A? (See followup too)

Works or B0rks? ``` function *g() { try { return 1 } finally { console.log('B'); } } const a = g(); a .next(); a .next(); const b = g(); b .next(); b.return(); const c = g(); c.return(); c.return(); ``` In what cases does this print B? (See prev too)

Achievement unlocked. I usually forget to even look at them before I forget where I even was. Of course heavily buried in sand so I just TNT'd my way to the chest, destroying the chest in the blast, and so immediately half of it disappears. But oh well.

Eyyyy it works on the actual ereader. Not great but also... Well this is like a few hours of Claude doing stuff mostly on its own and me giving it feature creep. It's extremely low effort on my side and it works. Not so sure about KOreader though holy moly what a complex app.

Oh no. I just realized I can use my wife's paperwhite for that dedicated chess puzzle app/device I wanted. Using the lichess puzzle DB, Claude is finishing it faster than I can get koreader installed on that thing.

Well. It got busy. I had it set up a docker with emulation stuff for the koreader app. And it went to town on a lua script to do this. Can't wait to actually get koreader working on the ereader and actually try this. But it's been giving me some problems.

Next challenge: trying to connect a keyboard to an old Kindle paperwhite ereader to become an ewriter for the kids. The problem is no bluetooth and PW's usb can't power a keyboard. Usb keyboard usually don't run on batteries. Maybe (old) usb bluetooth dongle?

I would works or b0rks this bug but not even sure how to frame it without giving it away Basically I had been transforming `const [a, b] = c` as `const tmp = [...c]; const a = tmp[0]; const b = tmp[1];` and it's broken because the spread will _drain_ an iterator, where the assignment just takes two

About to get home after a week in the US for Socket. At home I let Claude fuzz preval all week long (5x plan). Outer bash loop starts Claude with prompt to fuzz and fix, repeat and keep going. Outer loop kills after 3h. After exit, sleep 1h and start again. Now let's see what kind of mess it made...

315 things found, ton of changes and test cases (and a full fuzzer test suite to boot). Used about 75% of weekly (so this was running all week starting sunday). Obviously not using tokens while it's doing a fuzzing batch while still consuming time. Now need to make sense of it and verify them...

Do think I'll need to switch to something like opencode soon. Colleagues have been raving about gpt sol, deepseek, and Kimi. Plus Gemini got a price cut too. Shouldn't allow myself to get vendor locked in on the Claude CLI (or its web code env). Wonder if opencode has an alt to the old TUI now...

Got my power draw down from 45 to 16 watts. Combination of an unused GPU device and some polling devices and installing and configuring tlp. Sweet. Super valuable. Of course, did I actually learn anything here? Not much. So I care? lolnope.

Why didn't I realize before that I can now just have Claude tweak my Linux setup? Fix minor bugs or inconveniences. And improve the power draw of the laptop. Super useful

AI does make it easy to work with obfuscation without worrying about visual confusion. I just copy paste and it gets it. Doesn't matter that it's garble

Must ... refrain... from logging in... during holiday... one more day. Good luck to anyone in/affected 🫂

Socket@socket.dev

🚨 Update: Watching this npm worm propagate in real time, we’re now tracking 2,234 affected package artifacts across 444 unique packages, and it’s still spreading. Average detection time: 5 min and 18 seconds after publication. Our campaign page includes all affected packages/versions.