Unlike the more common postinstall-hook supply-chain pattern, this campaign executes at module-load (import/require) time. When any consuming build or application imports a poisoned package, the injected block runs immediately. Because the trigger is an import rather than an install script, the common npm install –ignore-scripts mitigation does not neutralize it.

[–] [S] 6 points 5 months ago (5 children)

Regardless of what the author says about AI, they are bang on with this point:

You have the truth (your code), and then you have a human-written description of that truth (your docs). Every time you update the code, someone has to remember to update the description. They won't. Not because they're lazy, but because they're shipping features, fixing bugs, responding to incidents. Documentation updates don't page anyone at 3am.

A previous project I worked on we had a manually maintained Swagger document, which was the source of truth for the API, and kept in sync with the code. However no one kept it in sync, except for when I reminded them to do so.

Based on that and other past experiences, I think it's easier for the code to be the source of truth, and use that to generate your API documentation.

  • source
  • [–] [S] 9 points 5 months ago (12 children)

    There is much debate about whether the use em-dash is a reliable signal for AI generated content.

    It would be more effective to compare this post with the author's posts before gen AI, and see if there has been a change in writing style.

  • source
  • parent
  • context
  • [–] [S] 114 points 5 months ago (44 children)

    This quote on the abstraction tower really stood out for me:

    I saw someone on LinkedIn recently — early twenties, a few years into their career — lamenting that with AI they “didn’t really know what was going on anymore.” And I thought: mate, you were already so far up the abstraction chain you didn’t even realise you were teetering on top of a wobbly Jenga tower.

    They’re writing TypeScript that compiles to JavaScript that runs in a V8 engine written in C++ that’s making system calls to an OS kernel that’s scheduling threads across cores they’ve never thought about, hitting RAM through a memory controller with caching layers they couldn’t diagram, all while npm pulls in 400 packages they’ve never read a line of.

    But sure. AI is the moment they lost track of what’s happening.

    The abstraction ship sailed decades ago. We just didn’t notice because each layer arrived gradually enough that we could pretend we still understood the whole stack. AI is just the layer that made the pretence impossible to maintain.

  • source
  • [–] [S] 19 points 6 months ago

    Instead, most organisations don’t tackle technical debt until it causes an operational meltdown. At that point, they end up allocating 30–40% of their budget to massive emergency transformation programmes—double the recommended preventive investment.

    I can very much relate to this statement. Many contracts I've worked on in the last few years, have been transformation programmes, where an existing product is rewritten and replatformed, often because of the level of tech debt in the legacy system.

  • source
  • [–] [S] 1 point 6 months ago

    I originally shared this after stumbling upon it in one of Martin Fowler's posts.

    The article reminds me of how my mother used to buy dress patterns, blueprints if you will, for making her own clothes. This no code library is much the same, because it offers blueprints if you wanted to build your own implementation.

    So the thing that interests me is what has more value - the code or the specifications? You could argue in this age of AI assisted coding that code is cheap but business requirements still involve a lot of effort and research.

    To give a non-coding example, I've been wanting to get some cupboards built, and every time I contact a carpenter about this, it's quite expensive to get something bespoke made. However, if I could buy blueprints that I could tweak, then in theory, I could get a handyman to build it for a lower cost.

    This is a very roundabout way of saying I do think there are some scenarios where the specifications would be more beneficial than the implementation.

  • source
  • view more: ‹ prev next ›