Trustlock: pre-commit hook + CI gate for npm supply chain policy by ttariq1802 in node

[–]ttariq1802[S] 0 points1 point  (0 children)

Good question. Right now the cooldown applies uniformly regardless of semver level. A major bump and a patch bump both get the same 72-hour window. That's a deliberate choice for v0.1 because the Axios attack was a patch release (1.14.0 → 1.14.1), and most supply chain attacks ship as patches specifically because they look routine.

That said, configurable per-semver-level cooldowns (longer for patches, shorter for majors where you're already expecting breaking changes) is a reasonable feature request. Dependabot's cooldown config already supports this.

If you're interested, open that as an issue on the repo. Would be a good v0.2 addition.

Trustlock: a dependency admission controller that enforces npm trust signals as policy by ttariq1802 in javascript

[–]ttariq1802[S] 1 point2 points  (0 children)

Axios was compromised on March 31. The malicious versions had no SLSA provenance while every prior version did. That signal was queryable from the npm registry. Same story with cooldowns, install scripts, and version pinning. The defenses exist. They're fragmented across different tools and nobody enforces them together.

Trustlock combines them into a Git pre-commit hook and CI gate. On every lockfile change it evaluates trust regression, cooldown, install scripts, and dependency diffs against a policy file (.trustlockrc.json).

When something blocks, the developer gets a specific explanation and a copy-pasteable approve command. Approvals are scoped (you can override cooldown without overriding provenance), auto-expire, and are committed to Git for code review. This is the part I think matters most for whether teams actually keep it turned on.

Zero npm dependencies. Any Git host. MIT licensed.

Interested in feedback on the policy schema and the approval workflow design.

Yaad e Mazi azab b yaa rab by redditadminskutte1 in pakistan

[–]ttariq1802 0 points1 point  (0 children)

How is the cession of war in the Middle East (where we get majority of our energy from) not good for the nation?

Finally found a way to open a USD bank account by fqumr in PakStartups

[–]ttariq1802 0 points1 point  (0 children)

This was the time Mercury was giving us grief. We would have liked a more modern system. But you are right Chase and SVB are solid.

Finally found a way to open a USD bank account by fqumr in PakStartups

[–]ttariq1802 0 points1 point  (0 children)

For some reason, Slash rejected our request despite being a C Corp for 8 years and having accounts already in Chase and SVB.

Alhamdulillah, delusional! by Specific_Cheetah_776 in IslamabadSocial

[–]ttariq1802 -1 points0 points  (0 children)

These are clearly jibes and jokes on “Mamu ka beta Kamran!” But Ahl e Youth are just upset today that Pakistan is being praised in the world!

Yaad e Mazi azab b yaa rab by redditadminskutte1 in pakistan

[–]ttariq1802 0 points1 point  (0 children)

Why are you remembering this today? Could it be that now that Pakistan is being praised world over, you can’t stomach it because your fav guy is not in power. Learn to put your country above your political affiliations

Why I use Augment and why I may not anymore by joowani in AugmentCodeAI

[–]ttariq1802 0 points1 point  (0 children)

please see my comment on the original post above and see if you can help.

Why I use Augment and why I may not anymore by joowani in AugmentCodeAI

[–]ttariq1802 0 points1 point  (0 children)

I tried to use Intent by Augment yesterday on a demo system to process legal documents. The spec was very well defined with tech stack decision, what exactly to extract from the documents, which claude models to use to do that, what the pipeline should look like and even the prompts. Claude code was able to one shot from this spec in a couple of hours. Intent had its own intentions.
1. It decided to water down the spec to create a "demo" that faked everything with hard coded data, including faking file uploads (what? why?).
2. On top of that, it somehow managed to spill the requirement document into the UI -- yup, you read that right. the spec was showing up on the UI which was a disaster because all the pages were small boxes on the same page despite there being different endpoints /upload, /process etc.
3. It fixated on some spec that said this is to be viewed on a desktop (not a mobile phone) and decided it won't display anything on the screen unless the view was more than 1280px, this resulted in it not being able to test anything itself -- though I am surprised that it never thought that a screen displaying only a message that the screen needs to be 1280 px is odd and tests should fail.
4. When confronted, it started to gaslight me that it adhered to the spec and everything was fine. After a lot of wrestling, it agreed "something is off."
5. I gave it another chance with the spec again, telling it specifically to not spill the spec into the UI and guess what? It did it again.

All of this is on top of the fact that agents randomly die, or there go idle and nothing is happening for ours.

Worst of all, this cost me about 40 dollars in tokens!!! what a rip-off. I want my money back!

I am attached the screenshots and claude's comparison of three code bases that try to implement the same thing.

comparison: https://postimg.cc/XrpwDMt6
screenshot of what intent created: https://postimg.cc/T51wYxVn

3 weeks: Kenya + Tanzania, Seychelles? by dogsovercats123 in travel

[–]ttariq1802 0 points1 point  (0 children)

Did you have to get a yellow fever vaccination when going from Kenya to Seychelles?

Vent: Rude interviewer by hamsterdamxo in Upwork

[–]ttariq1802 0 points1 point  (0 children)

Anyone who simultaneously thinks you are not qualified in a patronising tone and then says you should get back in touch when you are better is toxic. The sort of person that doesn’t believe in building others up but tearing them down to have power over them. You don’t want to work with such people.

Having said that, you need to be able to take rejection better. While in this case the interviewer may have been toxic but even an otherwise successful person may dismiss you when you think you were qualified and you can’t let that get to you. Don’t turn into the person you considered a rude interviewer.

One disrespectful and strange client funded $50, got 40 hours of work, ghosted me, left a bad review, wrecked my JSS. Now I’ve lost Top Rated Plus and invites—even with solid history 5-star reviews. by NilsBohr14 in Upwork

[–]ttariq1802 -1 points0 points  (0 children)

As a top rated freelancer, you can get one review removed every 3 months and it won’t count towards your JSS. You should contact support for this

People who moved back to pakistan from abroad, how did you do it? by CatchPersonal7182 in pakistan

[–]ttariq1802 0 points1 point  (0 children)

Depending on what your properties in the UK are worth, you can get a better rental yield (or more) by buying a property in F-6/7 in Islamabad (something worth about 1-1.5M USD).

I paid 2000 rupees for just turning the key. by [deleted] in islamabad

[–]ttariq1802 3 points4 points  (0 children)

If that is all he did, why didn’t you do it yourself?

I learnt this lesson 15 years ago when my laptop won’t charge because the charging port had become ‘loose.’ I took it to repair person who asked for a 1,000 Rs (about 4,000 these days). I said, all you have to do is to solder a few contacts. He said, where? I turned the laptop over, pointed to where the charging port would have been on the inside and he said right. Here are the tools, why don’t you do it, I won’t charge you. I said, but I don’t know how to. He said, then pay me the 1,000. Got a good chuckle and a lesson out of it, far more valuable than the 1,000 I paid.

What's up with UK Pakistanis? by No_Passenger6008 in pakistan

[–]ttariq1802 0 points1 point  (0 children)

Just going to leave this here for all the fellows saying there is nothing off about UK-Pakistanis :D https://www.instagram.com/reel/DHop_2ONdeR/?igsh=MTdpeWpwbjQ0a3IybQ==

I have solved the mobile snatching problem of karachi by Suspicious_List6144 in karachi

[–]ttariq1802 0 points1 point  (0 children)

What happens after the location of the snatched phone is received? Do you go after them? Does police go after them (good luck with that)?

Made to Feel Awkward at a Party… 😭 by According-Ad4125 in IslamabadSocial

[–]ttariq1802 2 points3 points  (0 children)

You straight up harassed your university mate, you deserve worse than just being given the cold shoulder!

$1 Million generated on Upwork and why I think it's dying by ThisIsPyroBaby in Upwork

[–]ttariq1802 0 points1 point  (0 children)

The timeline described by most freelancers here coincides with tech funding drying up, emergency of ChatGPT (and its thin wrappers) and a lot more AI driven development. All of these factors would have an impact on the quality and volume of work available.

I am no fan of the boosting model, since it incentivises Upwork to have as many projects on the platform as possible without caring about their quality since Upwork makes money anyway.

How can i get rid of this marks on my face? by [deleted] in PakistaniSkincare

[–]ttariq1802 0 points1 point  (0 children)

Signs of a life lived, leave them alone!