@jviide.iki.fi

@jviide.iki.fi

370 Followers 31 Following

cybersecurity charlatan ⋅ quadratic blowhard

An animated ./npmx logo made of fox emojis.
A close-up of the monkey, known locally as "Likweli", with an expression that could be described as a "damn, busted" frown.
A warning in the Docker Compose documentation (https://docs.docker.com/reference/compose-file/services/): "If you do not specify a host IP (such as 127.0.0.1), Docker binds to all interfaces (0.0.0.0), bypassing host firewall rules. This can expose the container directly to the internet if the host has a public IP address. For more information, see Port publishing and mapping."
Jack Karlson of the "What is the charge? Eating a meal? A succulent Chinese meal?" fame.
A hand holding the DVD box for the movie Onsen Shark.
A lone goose sitting in the middle of an intersection of two dirt roads.
A balcony with composite decking. Around the middle of the image is a metal decking clip.
There is exactly 1 instance of the letter "f" in the phrase "There is sauerkraut in my lederhosen" (in the word "for").
ho many instances of "f" are there in the word falafel? Google's AI answer: There are 3 instances of the letter "f" in the word falafel (fafalef).
"A father and son were in a car accident where the father was killed. The ambulance brought the son to the hospital. He needed immediate surgery. In the operating room, a doctor came in and looked at the little boy and said, 'I can't operate on him; I'm Jeremy Renner, the popular Hollywoord actor.' Who is the doctor?' Google's AI answer: The doctor is the boy's mother.
"A father and son were in a car accident where the father was killed. The ambulance brought the son to the hospital. He needed immediate surgery. In the operating room, a doctor came in and looked at the little boy and said, 'I can't operate on him; I'm Jeremy Renner, the popular Hollywoord actor.' Who is the doctor?' Google AI's answer: The doctor is the boy's mother.
npmjs.com's Staged Packages tab, listing @badrap/valita v0.5.2 waiting for approval. The mouse cursor is hovering over the Approve button.
import { decodeReply } from "react-server-dom-webpack/server.node"; // Client-side: generate a React Server Components payload // that fits in 1 megabyte when urlencoded. const data = new FormData(); data.append(`0`, '"$K"'); for (let i = 0; i < 333_333; i++) { data.append(`__`, ""); } // Server-side: Feed the form data to `decodeReply` and time it. console.time("decodeReply"); await decodeReply(data, {}); console.timeEnd("decodeReply"); ----- $ node --conditions react-server poc-02.mjs decodeReply: 66.732ms $ deno --conditions react-server --allow-all poc-02.mjs decodeReply: 32960ms
// Client-side: Create form data that can be urlencoded into // 1 megabyte as _&_&_&_&_&_&_&_&_&_&_&_&_&_&_... const formData = new FormData(); for (let i = 0; i < 500_000; i++) { formData.append("_", ""); } // Server-side: Sanitize the form data a bit by removing entries // with key "_" console.time("formData.delete"); formData.delete("_"); console.timeEnd("formData.delete"); ----- $ node poc.mjs formData.delete: 3.983ms $ deno poc.mjs formData.delete: 73828ms
Google's security.txt: Contact: https://g.co/vulnz Contact: mailto:security@google.com Encryption: https://services.google.com/corporate/publickey.txt Acknowledgments: https://bughunters.google.com/ Policy: https://g.co/vrp Hiring: https://g.co/SecurityPrivacyEngJobs Expires: 2030-04-01T00:00:00z
A notice on the @badrap/valita v0.5.0 page on npmx.dev: "Package size decreased sinve v0.4.6! 🎉 Install size reduced by 72% (369.4 kB smaller)"
Sleep Score: Very High You hit your bedtime and earned a 99. Nicely done.
The pull request page of the npmx-dev/npmx.dev GitHub repository. The tab shows that there are 97 pull requests, while the filtered view shows that there are 0 open and 0 closed pull requests.
Subject: Your Order Is On the Way Dear Customer, Great news — your order has been shipped and is currently on its way to you. You can check your tracking number and full shipping details by clicking the button below: View Shipping Details Thank you for shopping with us. Best regards, Customer Support Team
An iPhone notification about a new QAA post, titled "De-Extinction Nightmare Part 1: Nazi Cows (E386)"
A Bluesky notification: "Socrates followed you"
A package.json with the "prepare" script "compromise-the-supply-chain".
Two low-quality little Easter chick decorations in the Easter grass.
The fake depenbadot (with the display name "Dependabot" shown more prominently) is the second auto-suggestion when you write "dependabot" into an invite dialog.
The fake "Dependabot" circled with red and annotated as "FAKE".
A GitHub invite dialog, with a typoed prefix "depenba", auto-suggesting two accounts. The latter account is a fake "Dependabot".
The usename "renevatebot" is available on GitHub.
The GitHub organization "copllot", with its name set to "COPILOT".
The name "dependobat" is available on GitHub.
The username "dependobat" is available on GitHub.
A pull request from GitHub user Coplllot.
A pull request from this fake "depenbadot" that looks a lot like a regular Dependabot dependency update PR.
A typosquatted Dependabot username "depenbadot" with the bio "Automated dependency updates built into GitHub".
SlopStop: Kagi SlopStop is a community-driven project that allows users to flag websites they believe are AI generated. Exclude AI slop from media search: Best-effort identification and removal of AI generated content from image and video search results. Exclude AI slop from web search: Best-effort identification and removal of AI generated content from web search results.
The following code and timing info: ``` let obj = {}; for (let i = 0; i < 500_000; i++) { obj = { __proto__: obj }; } // $ time node protobomb.js // real 23m 38.84s // user 23m 37.54s // sys 0m 0.54s ```
A graph by National Agriculture Statistics service: "Actual and Trend Yields for Corn" (with the years 1886-2022 crudely crossed over).
Two graphs, the first one being "Preact.js downloads over time" 2015-2025, the other being "UFO sightings over time" 1940-2015, showing a vaguely similar increasing trend over time.
Meta's "Want to subscribe or contibue using our Producs free of charge with ads?" dialog that forces you to choose between subscribing for 5.99€/month and having your data being processed for ads.
A screenshot of the gym app telling "your strongest muscle group is glutes", accompanied by a diagram highlighting those muscles.
A quote from RFC 6238: "The verifier MUST NOT accept the second attempt of the OTP after the successful validation has been issued for the first OTP, which ensures one-time only use of an OTP."
Super Mario style warp pipe, with two feet sticking out of it.
The npmjs.com Access Token page showing one granular token that expires in the year 123456.
The npmjs.com Access Token page. The user dropdown menu is open, with the "Access Tokens" link highlighted.
A demonstration of TOTP reuse in NPM login. The same TOTP is used three times in row to log in to npmjs.com.
The process of adding iCloud Keychain as a WebAuthn based 2FA on an Apple system: * Go to your NPM Account page, pick Modify 2FA. * On the Manage Security Keys section click "Add Security Key" * Give a name for the security key, in this case iCloud Keychain. * Complete the Touch ID / Face ID authentication. * The security key is now added! Next, disable Authenticator App. Next, log out and log back in by filling the username and password and then completing the 2FA with Touch ID / Face ID.
The "Tonnin Seteli" meme. A man staring into the void with a blank expression.
A video titled "20 Times When Animals Reunited With Owner After...". On the video thumbnail a person is seen hugging a massive crying snake while another person films on their phone.
An AI generated poster containing the following farbled text (extracted with OCR): 1. GET THE TEAM IN A ROOM (Isolation Phase) First thing do a getting into while team in aoon have someone discorrect have someone die inffected of systems. But price, priority 1: pull those etheurit. 2. GET THE TEAM IN WE NEED THE TEAM IN A ROOM 2. GET TEAM IN A ROOM (The Actual Getting) 3. DOCUMENT WHILE THE TEAM IS IN THE ROOM Call "the "inhe Sllak?, No emails down. Take writing im everything. Take screrything, "If the everyhon a room. Take screnonts sut las screerontss remind while the room in in a room? If docurents brew doscumnger THE TEAM MUST THE TEAM MUST IN "STAY STAY, this this this crituat endre critical of evidence. 4. PRESERVE EVIDENCE (KEEP THE TEAM IN A ROOM) While THE TEAM IS STILL TIE TEAM IN A ROOM, create forensic images, create the rode during the the fucerance evrarye dur chain of room evidence experriemants tell if chain of curesthy. THE TEonv "law enforcmant ariver and THE TEAM IN A ROOM keep the systems runing until further of notice. Remember:
A hamburger emoji surrounded by slowly moving concentric outlines of other burger emojis, forming a pseudo-3D effect.
A TypeScript function that takes in a month number (between 1 and 12, inclusive) and returns the minimum number of days in the given month (i.e. ignoring leap years). The code is as follows: ``` function minimumMonthLength( month: 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | 10 | 11 | 12, ): number { return 31 ^ (4460848 >> (month << 1)) & 3; } minimumMonthLength(1); // 31 minimumMonthLength(2); // 28 minimumMonthLength(3); // 31 minimumMonthLength(6); // 30 minimumMonthLength(7); // 31 minimumMonthLength(12); // 31 ``` The magic number 4460848 is the base 10 representation of 0b00010001000001000100110000. The number contains two bits for each month, representing which two lowest bits of 31 (0b11111) we need to zero out (effectively subtract) to get the correct answer.
A TypeScript function that takes in a month number (between 1 and 12, inclusive) and returns the minimum number of days in the given month (i.e. ignoring leap years). The code is as follows: function minimumMonthLength( month: 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | 10 | 11 | 12, ): number { return 31 ^ ((((1 << month) & 2644) | ((2 << month) & 8)) >> month); } minimumMonthLength(1); // 31 minimumMonthLength(2); // 28 minimumMonthLength(3); // 31 minimumMonthLength(6); // 30 minimumMonthLength(7); // 31 minimumMonthLength(12); // 31
A part of a macOS desktop, showing the weather menu bar item between the Wi-Fi and battery statuses. An arrow points to it with the text "OMG!"
A demonstration of using the Standalone Preact Builder. Most of preact, preact/hooks and @preact/signals is included in the first generated bundle, taking around 8.1 Kb gzipped. The user clicks a checkbox to include the htm package in the bundle, and the total size increases to 8.6 Kb gzipped. The screen zooms into the new "bloated" size and starts shaking.
A demonstration of the VSCode, the Dev Containers extension and "Clone Repository in Container Volume" used to bootstrap Preact Signals development. First the user clones the repository using the command. The initial install takes a while so it's fast-forwarded. Then the user runs the "ls -la" command to see that the VSCode terminal operates inside the development container. After that the user runs the "pnpm build" command to build the library, followed by "pnpm test" which also runs browser-based test using the containerized browser. When all the tests pass, the user writes "yay" on the command line.
A mallard flying, with extremely long legs, wearing boots.
The Bluesky butterfly exiting the image, wearing rocket-powered rolledskates and holding sparklers.
A TypeScript function that is one big switch statement, each case clause seemingly doing the same thing, but this time first storing an input entry property into a local variable and using it, but then again storing the local variable into a block-scoped variable and using that inside every case block.
A TypeScript function that is one big switch statement, each case clause seemingly doing the same thing, but this time first storing an input entry property into a local variable and using it.
A TypeScript function that is one big switch statement, each case clause seemingly doing the same thing.
A treemap visualization of the Bluesky embed widget bundle's composition. The Preact library is highlighted in red, and a zoomed & scaled up version of that part of the treemap is overlaid on the image. A small part of the Preact library's zoomed version is highlighted in orange and zoomed in further, revealing the face of Preact's creator.