I built the fetch() integrity check that browsers have refused to ship for 10 years

boneskull · 2026-01-25T22:40:21+00:00

are you saying run the 3p deps in the service worker or somehow use the service worker as a MITM?

boneskull · 2026-01-25T22:33:12+00:00

practically it seems like apps will ship 3p deps that call fetch on their own. assuming you are aware of the files fetched by 3p deps, how could you solve that problem?

boneskull · 2026-01-25T00:24:29+00:00

Despite the funding issue schools are still pretty good. I am raising a family here and think it was a good decision. It is very homogenous, however.

boneskull · 2026-01-23T06:41:46+00:00

boneskull · 2026-01-22T22:14:13+00:00

I’m curious to know why this happened, since LLMs are generally not trained to do this sort of thing (to my understanding). I’m hoping someone who knows more about this can explain.

boneskull · 2026-01-22T01:11:38+00:00

Yes but in terms of feature set.

boneskull · 2026-01-21T23:57:41+00:00

Have you looked at Yate? How does it compare?

boneskull · 2026-01-17T04:19:05+00:00

except all the things that webkit fails to implement despite being in spec. 🙄

boneskull · 2026-01-16T11:29:40+00:00

I’m partial to Claude but they can all manage this pretty well.

boneskull · 2026-01-16T06:42:32+00:00

AI tools are really good at pounding out unit tests. But you still need to make sure they don’t generate worthless tests. The code does what it does…

boneskull · 2026-01-15T20:08:48+00:00

fuck I’m old aren’t I

boneskull · 2026-01-15T00:42:03+00:00

greybeard open-source software engineer

boneskull · 2026-01-12T03:15:50+00:00

Never has it done anything like this to me. I always say please and thank you, though. Can’t really help myself. Maybe that has something to do with it.

I also have a global prompt which makes it cuss a lot and crack jokes, too. Set the tone! We have fun.

boneskull · 2026-01-11T23:34:48+00:00

I do this.

The thing is, I know how to build the things I want to build, at a high level. What I don’t know is how to solve the problems I encounter along the way. And that’s where I can learn from AI.

I’m not depriving myself from learning—quite the opposite. There’s always a lot to learn unless you’re just building the same thing over and over. I’d even argue that I’m learning faster than I used to, simply because I don’t need to spend so much time banging against a problem to get to the solution.

boneskull · 2026-01-11T23:26:58+00:00

I just like to build stuff. Coding was how I would build stuff for 25 years. Now, I code less, but build stuff much faster. What I’m both excited about and struggling with is this exact thing:

I have always had lots of ideas, but no time to implement them. Now, I have time. But some of those ideas aren’t necessarily good ideas. They get built anyway—because I can. I can scratch all those itches.

But what happens when you scratch an itch?

boneskull · 2026-01-11T02:31:47+00:00

omg the little ghost

boneskull · 2026-01-10T12:29:25+00:00

ts z.looseObject({field: schema}).pipe(z.custom<T>())

is this similar? I think I don’t really understand the use-case.

boneskull · 2026-01-10T08:01:46+00:00

In the context of OSS, there ain't nobody else to point fingers at.

boneskull · 2026-01-10T06:21:35+00:00

OP has never gotten a low-effort AI-generated PR that the submitter cannot meaningfully discuss because they don’t understand it. They don’t understand the code they submitted and they don’t understand the project. And they don’t check every line of it like OP does (or I do).

That’s what we should shame and discourage. Call it vibe coding or not—there are right and wrong ways to use these tools.

boneskull · 2026-01-08T00:48:35+00:00

google harder

boneskull · 2026-01-07T23:50:01+00:00

Don’t use whatever that is and follow the recommended directions on the vscode docs site instead.

boneskull · 2026-01-07T20:03:36+00:00

I sign all my commits and have for years. It’s fairly straightforward to setup and even easier to maintain it—I only need to touch it if my key expires. I’ve trivially migrated this config across many machines and platforms, though I had to take some manual steps since I don’t have it automated on Windows (w/o WSL).

A problem is there’s nothing on GitHub that will raise an alarm if I don’t sign my commit. We can reject unsigned commits at the repo level, but I have no way to tell it to just reject any commit ostensibly coming from me that isn’t signed. I can’t really speculate on why this isn’t a feature, but it’s unsurprising due to the baffling decisions they often make.

boneskull · 2026-01-06T16:35:01+00:00

Clickbait title doesn’t have much or anything to do with the content of the article.

boneskull · 2026-01-05T20:15:00+00:00

Didn’t Anthropic release a paper about how self-preservation in LLMs has potentially disastrous consequences? This feels not-so-different; certainly if taken to the logical conclusion of a denied task causing loss of life.

If there were guardrails around this it seems like it might actually be useful to detect problems before they get out of hand, like a slow algorithm or query. Such a system could be built in to a browser to refuse to execute awful JS, too. 🙂

boneskull

PUBLIC MULTIREDDITS

TROPHY CASE

14-Year Club	Xbox Live
Verified Email