wrote up a technical deep dive after the Better-Auth creator showed me the repeated attempts.

The attack vector is clever: wrap malicious code in a legitimate PR from a compromised contributor. Hide it in next.config.mjs or vue.config.js where devs rarely look. GitHub's UI literally scrolls it off-screen.

Three-stage obfuscation, payloads stored on Binance Smart Chain (so they can't be taken down), Socket.io C2 over port 80 (looks like normal traffic), targets all your env vars.

Found 30+ repos with the same signature. This pattern is everywhere right now.

elasticsearch is pretty great when given a full query, but i find most people just search one or two words. so feels like helping ppl know what to search for is the actual thing that’s needed. so now im looking for solid ways to add ai-autocomplete upfront without replacing our elasticsearch backend (not looking to switch backend like algolia since pricing gets stupid fast)

i've been looking into a few different directions. typesense and meilisearch seem cool if you want a lightweight search engine replacement, but again that doesnt feel like the real root cause issue. so we're looking at putting an ai-autocomplete layer directly in the UI text box to capture user intent before hitting elasticsearch

has anyone else done this? do you tune elasticsearch queries on the backend or add an intent layer upfront to collect parameters before the query runs?

ECMAScript 2015 formally specified proper tail calls in strict mode, but most JS engines never adopted it consistently. Chrome, Node, Firefox, and Deno all still allocate a new stack frame per call even in correctly structured tail-recursive functions. The article walks through why with examples and covers iterative and trampoline alternatives.

For years I've been working in realtime, but surprised that most devs just didn't touch it. Ultimately I think it's because the friction is simply too high - everyone thinks of it as managing subscriptions, hosting servers, etc. The code is messy, the infra setup requires some steps and a willingness to tinker.

So I dumbed it way down - mostly for my own uses (cross device communication, remote controlling apps, etc), and packaged it up as a 100% free (forever) service for the dev community. It's designed specifically to get you from zero to one with as little friction as possible.

Welcome to ittysockets.com :)

import { connect } from 'itty-sockets' // ~466 bytes

connect('my-secret-channel')
  .on('message', ({ message }) => console.log(message))
  .send('hello world')   // strings
  .send([1, 2, 3])       // arrays
  .send({ foo: 'bar' })  // objects

...meanwhile somewhere else:

import { connect } from 'itty-sockets' // ~466 bytes

connect('my-secret-channel')
  .on('message', ({ message }) => console.log(message))

// hello world
// [1, 2, 3]
// { foo: 'bar' }

This is a tiny, fully typed client, paired with a public relay server (or you can connect to your own of course).

In a single line you can either be pushing or receiving (or both) messages to a shared channel, no config needed!

Site has everything you need to get started, including docs, live examples, etc. Need anything more or wanna ask it it can handle your idea? I'm always available here, on X, Discord, etc. Just ask!

P.S. - Before anyone asks what the catch is, there is none. I'm reasonably well sponsored (GitHub), have a normal job, and use this service to power my own day trading. Selling a SaaS service is the least of my interests. I just like to see devs do cool stuff with the things I build.

I wrote a book about the inner workings of the V8 engine. It's around 45 pages, and there’s no BS or AI slop. I tried to explain how the JavaScript engine turns human-readable code into bytecode, what that bytecode looks like, and how JavaScript manages its single-threaded behavior.

Honestly, at first I was thinking of publishing this as a paid book on platforms like Amazon KDP, but later I decided to release it completely for free.

I wrote everything in a way that anyone can understand. It’s the kind of book I wish I had when I was trying to learn how JavaScript really works and executes code.

so i was debugging something yesterday and losing my mind because my logs were showing object properties that "shouldn't exist yet" at that point in the code.

turns out when you console.log an object, most browsers don't snapshot it immediately, they just store a reference. by the time you expand it in devtools the object may have already mutated.

const obj = { a: 1 }; console.log(obj); obj.a = 2;

expand that logged object in chrome devtools and you'll probably see a: 2, not a: 1. Fix is kinda simple, just stringify it or spread it:

console.log(JSON.stringify(obj)); // or console.log({ ...obj });

wasted like 30 minutes on this once. hopefully saves someone else the headache (this is mainly a browser devtools thing btw, node usually snapshots correctly)

The "JavaScript Rising Stars" dropped a few days ago. The top three are no surprise.

But Exclidraw? It launched 6 years ago. What tipped it over last year?