16 replies

1. Alex Grant Mastodon 15 min later

   @zachleat

   Thank you 🙏

   1. Zach Leatherman Mastodon 1 hr later

      @localnerve you’re welcome!

2. rem / Remy Sharp Bluesky 52 min later

   I know I need to read this, but I'm going to let npm completely removing token support and my nodemon deploys to start failing to actually get me off my arse to get around to it.

   Future Rem is not impressed with Present Rem.

   1. Bramus Bluesky 57 min later

      👆 THIS

   2. Zach Leatherman Bluesky 1 hr later

      oh no! 😱 Classic tokens are the only ones going away! I don’t think they’ll ever remove token support fully so elevated exposure will still be there 🫣

      1. Zach Leatherman Bluesky 2 hr later

         I should note if you don’t publish packages from your CI server the checklist would be shorter (basically require 2FA, restrict GitHub and npm to require 2FA): steps 1, 2, 4, and 6

3. leah 🛸 Bluesky 1 hr later

   have you figured out how to do a first release in ci? seems like you need to have published the package first before you can then set up trusted publishing right

   1. Zach Leatherman Bluesky 1 hr later

      yeah, afaik local publish with 2FA is still a super secure option and works fine. Locking down npm publishing access doesn’t prevent that (as long as 2FA is used and not tokens)

      1. Zach Leatherman Bluesky 1 hr later

         (but to be clear that first publish won’t be locked down at all because the package won’t exist and have settings that you can change 😅)

      2. leah 🛸 Bluesky 2 hr later

         darn i really liked having every single publish automated and with provenance 🫠

         1. Zach Leatherman Bluesky 2 hr later

            yeah, fair point — I don’t think they care too much to secure packages that aren’t being used by anyone yet 😅

   2. Zach Leatherman Bluesky 2 hr later

      uh… a proper re-read of your question and the answer would be no 😅 I would just do a local publish and then set up my CI to be secure

4. Frank // Mottokrosh Mastodon 1 day later

   @zachleat Ok but what did you do that makes the snowflakes only appear on some elements? Like headers but not body text? Some blend mode wizardry or *gasp* z-indexes?

   1. Zach Leatherman Mastodon 1 day later

      @mottokrosh nothing magical — they are there. white snow on a white bg 😅

      (https://www.zachleat.com/web/snow-fall/)

      1. Frank // Mottokrosh Mastodon 4 days later

         @zachleat I looked more closely, and can indeed see the snow on the body text occasionally. I guess since it's not so dense it simply isn't visible so much, whereas on larger dark areas it stands out more. Next time I'll examine more closely before yelling questions. :D

         1. Zach Leatherman Mastodon 5 days later

            @mottokrosh no worries at all! happy to answer easy questions