meet.js x Netflix Poland Warsaw thank you for hosting our event @naugtur.pl @notwes.bsky.social @dominykas.social

I've got some simply bad, totally not dual-use, packages that I might document that way github.blog/changelog/20... www.npmjs.com/~selfpentest Here's the letter truncated form the title in case you need it: a

npm publish-time malware scanning and dual-use metadata - GitHub Changelog

As part of our ongoing supply-chain security work, npm is introducing automatic scanning of packages at publish time. This changelog covers what publishers can expect and a new metadata requirement…

github.blog

reminder on the current state of AI security

OSS maintainers are already doing tremendous work. Getting out of their way to do all this: nesbitt.io/2026/08/28/n... and then also being told to carve out more time to "work with their users", preferably that tiny minority that only gets out of the woodwork to be uselessly angry. What's the point?

Now Hiring: Senior Open Source Maintainer

A rare opportunity to make a real impact in a fast-paced, high-visibility role.

nesbitt.io

No the problem is the entitlment of users. You are not entitled to conscript someone’s labor and then harass him because they disapprove of the tools he used to make Linux support possible. What it shows is that even when you arent paying for a product you can become a fucking Karen.

Resharc@reshar.cc · yesterday

the whole paint.net debacle is an interesting microcosm of a wider problem in software engineering, where developers seem to have no interaction with their users or put any effort into understanding them, and end up being surprised when they piss them off

I'm in the middle of @gilduran.com's great new book www.thenerdreich.com that speaks to why all these tech CEOs act like this

The Nerd Reich | Silicon Valley Tech Extremism

Silicon Valley tech billionaire politics: authoritarianism, fascism, plutocracy, weirdness

thenerdreich.com

so unfair that you might be attacked for just wanting a white ethnostate anyway after like a decade plus of usage i canceled my @1password.bsky.social subscription and switched to apple passwords. took 15 minutes.

andy™@andylevy.net · yesterday

ah yes once again the racists are the real victims

Top-level await is fixed in Safari for iOS 27 and macOS Golden Gate. Here's how I did it: webkit.org/blog/18227/f...

Fixing Top-Level Await in Safari

WebKit for Safari 27 adds full spec compliance for top-level `await`.

webkit.org

OpenAI's Codex Security and Anthropic's Mythos both reported 0 remaining security issues in curl AISLE then discovered 6 new zero-days that curl's security team validated & has now assigned CVEs to 6-to-0 on one of the world’s most hardened codebases: aisle.com/blog/aisle-d...

🚀 Thrilled to announce @vlt.io as a #Silver #Sponsor of #NodeConfEU 2026! Thank you! 💛 Your partnership is helping us create something truly special in the #Node.js #community! 🎟️ nodeconf.eu

What if our ears were like our eyes, and only had three (types of) receptors? Interestingly speech is still more or less intelligible, but not much else to me this shows how much more discriminating of frequencies our hearing is than our vision. Of course our vision has much more spatial resolution

Encountered one of the best emails I've ever seen

If buying isn't owning then piracy can't be theft. Any reasonable corporation knows that.

VGC@videogameschronicle.com · 3d ago

Sony says "reasonable consumers" know they don’t own the digital PlayStation games they buy. It argues that it's "not plausible" to suggest that when they buy a digital game they actually believe they're "obtaining ownership" of it. www.videogameschronicle.com/news/sony-sa...

I have 27 vulnerabilities to triage and 31 confirmed ones to publish a fix for. This is not really sustainable long-term. How can one fund all of this work?

Security by obscurity is ripe for rehabilitation.

Soliciting open feedback on gist.github.com/naugtur/6eb6...

Object partition syntax proposal draft

Object partition syntax proposal draft. GitHub Gist: instantly share code, notes, and snippets.

gist.github.com

The Rustification of #JavaScript tooling continues: @pnpm.io 12 has been rewritten in Rust, with installs up to 90% faster in testing. Other highlights: project-aware global bins, registry revisions, and deterministic lockfiles for cyclic dependency graphs. socket.dev/blog/pnpm-12

pnpm 12’s Rust Rewrite Cuts Install Times by Up to 90%

pnpm 12 rewrites the package manager in Rust, cutting install times by up to 90% while preserving pnpm 11 workflows and lockfiles.

socket.dev

If you run Omarchy I will judge you

aly@aly.codes · 2w ago

re: omarchy trying to create parallel infra to subvert the linux community and kick trans/female/black people out i know some people think that sounds crazy but DHH literally is doing a podcast tour saying that is exactly what he's doing lol

The only real signal for whether to trust a package is what the code actually does. Does it hit the network? Read your filesystem? Grab your API keys and env vars? Everything else is a proxy. There's no replacement for reading the code:

4 weeks left until #NodeConf EU 2026. If you touch #Node.js in production, this is the conference where you stop explaining your job and start arguing about it with people who get it. 📍 September 29–30, Bologna, Italy. 🎟️ Grab your tickets now ti.to/apropos/node... #NodeJS #NodeConfEU #JavaScript

NodeConf EU 2026

NodeConf EU is heading to Italy. After years of gathering on a secluded Irish island, Europe’s longest-running Node.js conference finds a new home in Bologna, a city full of history and energy. The…

ti.to

Some of you may remember the halting struggle to establish netiquette: rules of interaction on the internet. I believe it to be a matter of “aitiquette” that we keep bots out of human spaces. We should not impose AI on anyone.

This, again and again

psychologists discover mathematicians:

Julia M. Rohrer@dingdingpeng.the100.ci · 6d ago

Person who answers an item with “always” in the question with “strongly disagree” because they can think of a single counterexample.

I am genuinely surprised that people don’t know that copyleft exists to facilitate this exact arrangement and that even Stallman thinks that this is the GPL working as designed. Microsoft contributes massively to the Linux kernel and helps pay the salaries of Linus, Greg, and many many more.

jake@yetanotheruseless.com · 6d ago

Copyleft is a waste of time IMO. It was supposed to protect eg Linux from getting co-opted by in particular, MSFT. How well did that work out? MSFT basically ships it with Windows and makes billions off it in Azure. So “protected”. 🙄

Oh cool, I was called a "piece of garbage" from a "vomit-party" by the Neovim developer. I'm glad I started switching to Emacs... This is no way to treat your users. Specially so when they're calling out a literal white supremacist on your front page: github.com/neovim/neovi...

Remember: The GOP’s nonsensical culture wars are meant to distract you from corporate corruption and plunder. [Cartoon by Jace Avery]

this is pretty crazy, US is designating a small italian tech company as a terrorist org. whats next, declaring Signal a terrorist org for allowing encrypted chats? claiming libraries are terrorist orgs for hosting "violent left wing" books? this is some dark shit man

Robin Berjon@robin.berjon.com · last wk.

The US State Department has designated A/I, a small Italian provider of open source infrastructure for political activists, as a global terrorist group. They will reach into our very homes to grab us — if we let them. www.state.gov/releases/off...

The US State Department has designated A/I, a small Italian provider of open source infrastructure for political activists, as a global terrorist group. They will reach into our very homes to grab us — if we let them. www.state.gov/releases/off...

Designation of Autistici/Inventati as a Specially Designated Global Terrorist - United States Department of State

Today, the Department of State, in partnership with the Department of the Treasury, is announcing the designation of Autistici/Inventati as a Specially Designated Global Terrorist. Autistici/Inventati...

state.gov