Bluesky

Crashing out at how poorly npm (Microsoft) is handling this security incident. Eleventy is not affected any more but *lots* of other tools in the JavaScript ecosystem are!

Hours later and the compromised package versions are still public…

Maybe don’t install anything from npm today, folks.

remember: folks that say “we won’t do it without your consent” often also (much more quietly) believe that agreeing to their privacy policy counts as consent

Charlie Brooker crying & throwing up learning that the smart ring users are mad that the smart ring company signed a deal with the United States military & the smart ring company's defense is well have had deals with the DoD forever & we won't share ur smart ring data with them, unless u r a troop

What Oura Ring’s partnership with the U.S. military means for your data
Oura Ring promises users their data is safe — is that enough?

— Erin Fogg says Free Link (September 3, 2025 at 8:59:48 PM UTC)

“sometimes its ok to just… not support things”

a common thing i've run into this week:

packages which exhaustively try to cover every possible edge case. but it turns out almost no consumer calls it in a way that would hit those cases

some are 1/4 of the size when you cut those out. sometimes its ok to just... not support things

— James (August 4, 2025 at 8:30:29 PM UTC)

Monetizing frameworks is incredibly difficult given the incentives and more of your favorite VC-funded frameworks are going to repeat this playbook, unfortunately

what was the point of Netlify acquiring Gatsby? did they get a lot of cloud customers or something? did Gatsby have valuable stuff beyond the framework that got incorporated into Netlify business? what was the point of pretending the project isn’t getting killed when essentially it was? just curious

— dan (June 15, 2025 at 1:59:24 PM UTC)