Hacker Newsnew | past | comments | ask | show | jobs | submit | ashishb's commentslogin

I don't even give it full disk access.

I have written a tool to easily run the agents inside a container that mounts only the current directory.


Generate the open API spec from the backend for internal applications.

No need to update manually. Further, you can prevent breaking changes to the spec using oasdiff


Same experience here.

Post-honeymoon, I returned to REST+Open API

https://ashishb.net/programming/openapi/


Markdown is the final perfect form for every text (non-binary) content based system.

Every product will eventually use markdown as their content store.


One of the biggest benefits of LLMs is that products are incentivized to have a way to import and export from markdown.

And many sites have their documentation pages available as markdown just for this reason.

If an LLM can use your product/API easily, it will get more users. If you make it hard, they'll choose something else.


Gitlab offers all three as well

Are you sure you never cared about it?

For example, how would you decide which FOSS vector database to use? Do you completely ignore GitHub Stars in the process?


Yes? I mean I’ve never gone looking for a tech solution by browsing GitHub repos. I would have already done research online, read documentation, etc and decided on the vector database and then gone to the GitHub repo (or probably just installed from my package manager or docker and never even seen the repo).

Things like good documentation, good performance, good DX, and an active user community would be the deciding factors for me. One repo having more stars than another wouldn’t even factor into it.



The JavaScript fanatics will downvote me for saying this, but I'll say this, "using a single JavaScript codebase on your client-side and server-side is like cooking food in your toilet, sooner or later, contamination is guaranteed" [1]

1 - https://ashishb.net/tech/javascript/


This isn't a Javascript problem, this is a React problem. You could theoretically rewrite React and RSC in any language and the outcome would be the same. Say Python ran in the browser natively, and you reimplented React on browser and server in Python. Same problem, not Javascript.

> This isn't a Javascript problem, this is a React problem.

It happened with Next.js as well https://github.com/vercel/next.js/discussions/11106

> Say Python ran in the browser natively, and you reimplented React on browser and server in Python. Same problem, not Javascript.

Yes.

And since Python does not natively run in the browser, that mistake never happens. With JavaScript, the desire to have "backend and frontend in a single codebase" requires active resistance.


> It happened with Next.js as well

It's the same vulnerabilities because Next uses the vulnerable parts of React.

Your rational is quite poor as I can write an isomorphic web app in C or Rust or Go and run parts in the browser, what then? Look, many of us also strongly dislike JavaScript but generally that distaste is based on its actual shortcomings and failures, you don't have to invent new ones plenty already exist.


> I can write an isomorphic web app in C or Rust or Go and run parts in the browser, what then?

If you have a single codebase for Go-based code running in an untrusted browser (the "toilet") and a trusted backend (the "kitchen"), then the same contamination is highly likely.


>And since Python does not natively run in the browser, that mistake never happens.

Did you even bother to read my comment? Try again, please. Next time don't skip over parts.


You can still have separate codebases for server and client in JS/TS...

> You can still have separate codebases for server and client in JS/TS...

Indeed, but unlike Go/Python (backend) and TS/JS (frontend), the separation is surmountable, and the push to "reuse" is high.


> and the push to "reuse" is high

Other than types and stuff like zod validators there's not a lot of overlap between server and client code.

I agree with your point that iso code can be confusing. But beyond that I think you're just pushing an irrational anti JS narrative.


You're mixing programming languages with software architecture.

> You're mixing programming languages with software architecture.

Programming languages do lead to certain software architectures. These are independent but not orthogonal issues.


JavaScript is meant to be run in a browser. Not on a backend server [1].

Those who are choosing JS for the backend are irresponsible stewards of their customers' data.

1- https://ashishb.net/tech/javascript/


Sorry you feel that way.


TypeScript is really nice though.


> TypeScript is really nice though.

Even if that's true, it is irrelevant.

  - You need to decide package manager and everyone has their favorite one: npm, yarn, bun, pnpm ...
  - You need to depend on npmjs.com for dependencies, which has an unusually high number of malicious packages compared to other dependency sources.
  - You need to use some framework like Next.js, which itself is a cesspool of backward-incompatible changes, combined with outrageous security issues


If you use deno you can consume dependencies much more securely from arbitrary URLs, such as your own. You can also set permissions for the runtime, though that might not save you depending on the severity of exploits.

Arguably the safest approach is to embed all dependencies in your source, and vet all of them for each release. But I'm glad deno lets me choose which registry I use.

Bun also allows for this but it feels a bit more tacked-on and less like an early architectural decision based around security concerns.


> If you use deno you can consume dependencies much more securely

How would Deno have prevented the RCE issue with React+Next.js?


It wouldn't. I was responding to your concerns about the TypeScript ecosystem more generally.

You avoid the RCE by recognizing that React—and more recently Vercel's—management is a bit of a tire fire, and you should choose better tools with more responsible maintainers.

Part of what bothers me about this situation is that React appears to be a view library, and to many people using it that is what it functions as... But it's now a framework which extends well beyond the browser and entails all kinds of security risks that aren't intuitive at a glance, at all. A lot of people using Next probably have no idea about the security implications of the framework or how React fits into them. It's a mess.

Deno definitely can't fix that.


... if your baseline is JavaScript.


Here is my single way of deciding what your favorite language is.

It is not "I like to write code in this language" but "If I am handed down a production ready system, I would prefer it to be written in this language".

A lot of people won't say the same answer to the first and the second question.


I think those are two separate concerns. Writing code and running a tech business are two different things. I personally love Ocaml and think it's an excellent language and very underrated. However, I (probably) wouldn't want a production-ready system written in it, because it has a weaker ecosystem of libraries and frameworks, and it's harder to hire experienced people who already know or are willing to learn the language.


> I think those are two separate concerns.

Indeed. And the latter, that is, taking over and maintaining code written by someone else, is the more common concern in day-to-day jobs. More likely that you will get to build and improve an existing system than create one from scratch.


This heavily depends on the particular era of the language and the particular coding practices of the team though.

For example, I'm happy to maintain Python codebases with type annotations and type checking enabled. Those without better have a pretty solid docstring culture and be willing to add progressive type checking. It doesn't so much matter what version of Python it is.


> For example, I'm happy to maintain Python codebases with type annotations and type checking enabled.

"Python codebases with type annotations and type checking enabled" is not the norm. Consider a random file from the famous `pytorch` framework.

https://github.com/pytorch/pytorch/blob/main/torch/_functorc...

Even this file does not have type annotations everywhere.


They're becoming the norm for newer systems written in Python though. So I don't think the language is enough information to go on. This heuristic simply biases against languages that have been around a long time because more of their code was written before practices evolved.


Yes, but ... this depends strongly on whether your task is to maintain that production system in its current state indefinitely, or to keep developing it and continuously integrate with new technologies under time constraints. If the former, the right answer would probably be COBOL. If the latter, this is where things get interesting.


Why COBOL?


COBOL is used for the longest continuously running systems, particularly in the financial industry, many of which have been in production since the 1960s - mainly on mainframes, but noawadays also increasingly in cloud environments. There's nothing that comes close to the level of reliability that these offer, with the next closest probably being Fortran, Ada and Erlang.

I found this article with some numbers [0], with the top one being that "95% of ATM swipes rely on COBOL code". If you just need to maintain something in production, and only occasionally update the business logic, without having to upgrade the architecture, COBOL is the way to go.

[0] https://www.pragmaticcoders.com/resources/legacy-code-stats


I think the correlation here is pretty solid but I wonder about the causality. There are a few big confounding variables; off the top of my head,

1. COBOL systems are typically written on a much shallower software stack with less room for unreliability

2. banking systems have a ton of effort put into reliability over decades of development.


My old boss wrote COBOL code for a core finance process… in 1975, well before I was born. He retired in 2019, and that code is still there with a few mods and probably will remain for another decade.

In fairness, it’s pretty fundamental stuff. But… the company has been working on moving to some Oracle bs for 5-6 years.


As long as I’ve written the system, any language is fine. Otherwise, hand it down to someone else!

/s but also true


Yes, this exactly. I like to write code in Forth but I sure as FUCK don't want it to be my day job.


Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: