Lightnews — Scholar-powered news

sukka @skk.moe · 2h

Guess what? They are doing this anyway.

sukka @skk.moe · 13d

Why is @github.com and @npmjs.bsky.social 's the trusted publisher feature stupid? The simplest thing: how do I set up the trusted publisher if I am creating a brand new package?

In the meantime, @pypi.org allows you to set up the trusted publisher before/while creating a new package.

sukka @skk.moe · 14h

That's only 3 weeks. Look at my dead simple PR toward @nextjs.org , took them 3 months to merge: github.com/vercel/next....

1 3

sukka @skk.moe · 2d

#TodayMyPullRequest

Make @fastify.dev's etag 70% to 110% faster on medium (2 KiB) to large (2 MiB) inputs:

github.com/fastify/fast...

perf(fnv1a): adopt a way faster fnv1a impl (up to 110% faster on large input) by SukkaW · Pull Request #152 · fastify/fastify-etag

Checklist run npm run test && npm run benchmark --if-present tests and/or benchmarks are included documentation is changed or added commit message and code follows the Developer's ...

github.com

1 1

sukka @skk.moe · 7d

As I said, @pypi.org already supports setting up a trusted publisher while creating a new package. It demonstrates it is doable.

The real problem is why @npmjs.bsky.social / @github.com not implementing the same.

sukka @skk.moe · 13d

Why is @github.com and @npmjs.bsky.social 's the trusted publisher feature stupid? The simplest thing: how do I set up the trusted publisher if I am creating a brand new package?

In the meantime, @pypi.org allows you to set up the trusted publisher before/while creating a new package.

1 1

Reposted by sukka

REL1CX @rel1cx.bsky.social · 13d

Announcing eslint-react.xyz v2.0.0: Now ESM-Only
eslint-react.xyz/docs/release...

Announcing v2.0.0 | ESLint React

A major release embracing modern JavaScript standards with powerful new rules and DX improvements

eslint-react.xyz

2 16

sukka @skk.moe · 24d

I already know macOS 26's new design is suck, I didn't know it would end up this kind of suck.

Every element on the Wi-Fi setting page of macOS 26 is misaligned.

sukka @skk.moe · Sep 7

But what happens if you opt in for a package because of its needs, and then it gets compromised after you trusted it?

1

sukka @skk.moe · Aug 28

Once again, my proposed github.com/pnpm/pnpm/is... would protect the community against such attacks. Yet @pnpm.io refuses to implement this.

1 1

sukka @skk.moe · Aug 16

Multi-threaded linting creates extra challenges (and overheads) for many popular ESLint plugins: typescript-eslint, eslint-plugin-import(-x), etc.

See github.com/un-ts/eslint... as an example.

5

sukka @skk.moe · Aug 16

#TIL It finally happens! @MacHomebrew's Parallel downloading feature has already landed and can be enabled right now with the environment variable "HOMEBREW_DOWNLOAD_CONCURRENCY={int}". This will be enabled by default in the future.

See GitHub Issue github.com/Homebrew/bre... for more.

Tracking Issue: Concurrent Downloads · Issue #18278 · Homebrew/brew

Concurrent Downloads Implement MVP of concurrent downloads for brew fetch. Implemented in #17756. Improve output logic. For simplicity, the output currently only uses at most terminal height - 1 li...

github.com

Reposted by sukka

层叠 - The Cascading [ɑ] @thecascading.bsky.social · Aug 8

在 Fediverse 分身运行约三年半后，我台在 Bluesky 上的分身开始测试运行。各位 Bluesky 社交平台的用户将可以在平台上直接订阅本台更新。

我们的帐号是： @thecascading.bsky.social
欢迎反馈遇到的问题及对频道的建议。

#today

4 4

sukka @skk.moe · Mar 15

fxtwitter.com/tencentcloud...

1

sukka @skk.moe · Mar 13

The notorious copypastor Tencent Cloud grabs all articles from my blog and posts them on their website without my permission, yet they want me to promote their tools in my blog.

Go to hell, Tencent and Tencent Cloud.

1 4

sukka @skk.moe · Feb 22

[zh-Hand] blog.skk.moe/post/proxmox...

为 Proxmox VE 定制 Debian Cloud 系统镜像与创建虚拟机模板 | Sukka's Blog

最近在「家里云」里搞了个 Proxmox VE 8.3，打算在上面跑几个 VM 玩玩。而作为一名忠实的 Debian 系用户我才不会告诉你我日用的 Linux 系统是搭载 GNOME 的 Fedora 的，所有的 VM 自然要用 Debian 了。借着制作自己的定制化 Debian Cloud Image 的机会，顺便写一篇文章出来和大家分享一下，并纠正、辟谣一下网上现有的有关教程的一些错误。

blog.skk.moe

1 4

sukka @skk.moe · Feb 14

Now, who needs to be sacked for the cost efficiency of all~

sukka @skk.moe · Feb 13

It still shocks me that no one has #RIIR the homebrew yet. The slowest package/dependency manager/tool these days (no parallel casks downloading, no multi-threads downloading, and no parallel attestation verification).

sukka @skk.moe · Feb 8

So @pnpm.io's onlyBuiltDependencies feature is flawed by default: you don't re-approve to update dependencies.

Let's say you use @rspack.dev and add "rspack/core" to the list, what happens if rspack is compromised and releases a malicious version? It is still "trusted" by pnpm.

1 1 6

Reposted by sukka

Deno @deno.land · Feb 4

Oracle justified its JavaScript trademark by claiming Node.js — now it wants that ignored
#FreeJavaScript

deno.com/blog/deno-v-...

Oracle justified its JavaScript trademark with Node.js—now it wants that ignored

Oracle filed a motion to dismiss in response to Deno’s petition to cancel its “JavaScript” trademark. But instead of addressing the real issue—that JavaScript is an open standard with multiple indepen...

deno.com

16 120 310

sukka @skk.moe · Jan 24

v8.dev/blog/spread-...
I am pretty sure this is "against" spec anyway.

Speeding up spread elements · V8

V8 v7.2 / significantly speeds up Array.from(array) as well as [...spread] for arrays, strings, sets, and maps.

v8.dev

sukka @skk.moe · Jan 22

Others' vacation plans: traveling, eating, meeting friends...
My vacation plan:

1 6

sukka @skk.moe · Jan 22

I don't care about ops or percent. As long as destructure is consistently slower, it is slower.

It makes sense why array index access is way faster: destructure requires extra overhead from the iterator protocol, while array index access doesn't.

1

sukka @skk.moe · Jan 21

拷打 v8 没用，而 SpiderMonkey 早就摆烂了。所以只能拷打 React Compiler 了。

1

sukka @skk.moe · Jan 21

It still shocks me that JavaScript runtime nowadays still does not optimize array destructure access.

This means `let [v, setV] = useState('')` is way slower than `let t = useState['']; let b = t[0]; let setV = t[1]`).

So it's React Compiler's turn: github.com/reactwg/reac...

Optimization `useState` and `useReducer` returned tuple · reactwg react-compiler · Discussion #54

v8 (and many other javascript runtimes) never optimizes the array destructure access as fast as array index access. So code block A is always faster than code block B: // A const tuple = useState('...

github.com

2 3

sukka @skk.moe · Jan 17

I must admit, GitHub Actions's new hosted arm64 runner (currently in public beta) is FAST, about 100% faster than the amd64 ones. Though there are some issues, one of them is EACCES: github.com/actions/part...

[ubuntu-24.04-arm] Tons of EACCES · Issue #29 · actions/partner-runner-images

There is a ton of EACCES when CI is attempting to run a command. The shell appears to be searching in $PATH but failed to access many files. Here is some example logs: actions/checkout@v4 Unexpecte...

github.com

1