Notices by Zach Leatherman :11ty: (zachleat@fediverse.zachleat.com)

folks migrating away from hosting providers that hadn’t previously considered how tightly coupled their web framework was to said host are about to learn some things — I’m sorry and I wish you the best on your journey

Really appreciate that GitHub is taking steps to lock down npm publishing workflows: https://github.blog/security/supply-chain-security/our-plan-for-a-more-secure-npm-supply-chain/

@scott a completely optional cc to maybe @Wilto or @eaton?

I anthropomorphized my pet rock to such a degree that we are now both hallucinating its sentience

controversially: why can’t software be good?

@awfulwoman well wait I like usb-c 😅

maybe as a society we should spend less time “Verifying that you are a human” and more time “Verifying your humanity”

have you ever *really* stopped to think about how wild it is that [].join("\n") returns "" — what is it joining??

“if a calculator can do math for me, why should I learn math?” is something you’ll hear children, under-educated adults, and AI proponents say

Today on Trans Day of Visiblity I’m thankful to folks living their lives in an unapologetically authentic way — truly showing us what freedom can look like when we discard the baggage society has imposed on all of us. Love y’all.

can we have a feature where a toot self destructs when it hits 50 boosts

bribecoding is a new phenomenon where you pay open source developers a living wage to work on projects that your business uses

it’s hard not to be jaded when facial recognition is being used in criminal investigations while our industry is having trouble accurately testing whether two strings are equal

Why does socket.dev report that the latest version of next.js has a malware dependency? https://socket.dev/npm/package/next/alerts/15.2.3?tab=dependencies

“Malicious code in gen-mapping (npm) Any computer that has this package installed or running should be considered fully compromised.”

Update: looks like this is a pretty big flaw in the vulnerability scanner — not in next (check the replies for more info)

Update: thanks to @chrisw_b for hunting this down: looks like a huge flaw in the vulnerability scanner being used by these tools (it ignores namespaces on package names!)

More info:

https://github.com/jridgewell/gen-mapping/issues/12
https://github.com/anchore/grype/issues/1701

are we ready to reconcile how many tech spaces have at least one anger-as-a-personality-substitute man that everyone just tolerates (if not idolizes)

dismissing valid feedback as “change aversion” is a big ol’ red flag 🚩🚩🚩

let’s keep what AI in w3.org/WAI/ means between us until after the investment checks have been written, ok

Had a delightful conversation with @DavidDarnes and Matt Johnson about the unique space “Design Engineer” occupies in web development https://www.podcastawesome.com/2092855/episodes/16692493-what-the-heck-is-a-design-engineer-with-dave-darnes

Inspired by Dave’s recent blog post! https://zeroheight.com/blog/design-engineer/

automated themed screenshot border colors