with supply chain attacks becoming a bigger problem AUR really has to become more sophisticated or get replaced

it's impossible to securely publish packages there
57
9
431
24,373
Replying to @thdxr
@thdxr 我觉得社区应该推动更安全的软件分发方式,比如 @jdxcode 的 github.com/jdx/packslip
1
0
2
68
Replying to @hansloong
@hansloong @thdxr yes: we should cut out the middleman and also stop using package managers that aren't cross-platform by default
0
0
1
30
We've poured so many upgrades and features into this release it's hard to keep track. Too many, in fact! Should really have been three separate releases. But despite all of that, it's slimmer, lighter, and WAY WAY FASTER TO INSTALL! 🤘
Omarchy 4.5 RC2 is now out and it includes our new F1 install technique that can almost get a full installation down to the time of a pitstop on the fastest machines (current record is 6 seconds!!). github.com/omacom/omarchy…
97
58
1,562
65,954
Replying to @dhh
@dhh Every time I update, I get bombarded with these mise preinstalls. They override many packages that I installed with another package manager. How do I stop this?
2
0
4
718
Replying to @pnd280
@pnd280 @dhh just run `mise settings add disable_tools node` for the things you don't want mise managing
0
0
0
28
fyi dependabot time to open a PR is median 8 days
if your project can't autonomously react to a cve being published with a correct upgrade and deploy within 60 minutes or less, you do not have a software factory and that's probably the first place you should start.
3
3
93
11,674
Replying to @jdxcode
@jdxcode ghostty 1.4 release notes said they've given up. I imagine we all will.
1
0
0
115
Replying to @nateberkopec
@nateberkopec i could look at the numbers but i am pretty certain they never assign in 3 days, i don't even think i ever get assigned new ones within 3 weeks
0
0
1
58
Replying to @nateberkopec
@nateberkopec lol i feel like i've been waiting to get cves for over a month on average
1
0
1
114
Replying to @jdxcode
1
0
0
2,323
Replying to @jdxcode
@jdxcode good point, I didn't consider that it doesn't block install. I think it's fine then. I listened to your recent remote ruby and I realize the @jdx api limit is a precious resource! 🤣
1
0
0
290
Replying to @nateberkopec
@nateberkopec @jdx another thing i didn't consider is mise defaults to 24h min release age anyhow, so out of the box it is going to ignore releases less than 24h old anyways
1
0
2
141
jdx retweeted
New in CodeRabbit Secure:

Deep Scan now follows a vulnerability across your linked repos, then replays the exploit in a throwaway sandbox to prove it's real before it flags anything.

Hendrik walks through this and everything else in the new update:
242
476
1,045
1,505,519
If `git clone` is a problem at your company you should definitely have a look at this
We are returning Git to its distributed roots, building a storage layer where objects replicate freely and only refs need consensus. Fast. Independent. Soon, open source. Our Co-founder & CTO @ge0rgf explains the architecture and tradeoffs behind it.

entire.com/blog/a-git-for…
0
2
32
3,872
How the fuck does it even have that many? What are they all doing?
BREAKING: DocuSign says it may lay off up to 162,000 employees.
Community note
As of Docusign's most recent 10-K filing, Docusign had 7,044 employees as of 1/31/2026, making it impossible to lay off 162,000 employees.

sec.gov/Archives/edgar…
6
0
22
4,301
Replying to @GrahamJCampbell
0
0
1
367
mr-boxington 1.28 supports blaze! (formerly ra-jit) now you can have warm worktrees, automatic target/ cleanup, and incredibly fast rebuilds. 🔥

Just set MBX_BLAZE=1 and see build times like 2150ms → 116ms.

mr-boxington.jdx.dev
6
14
161
8,658
Replying to @jdxcode
@jdxcode Is there a downside to turning this on?
1
0
0
451
Replying to @brandur
@brandur you're limited to one nightly version and it uses a lot of memory
0
0
3
196
jdx retweeted
Agents reinvented how we produce code. It changed our tools and half of our workflow. It’s time for the other half to catch up.
Today, we’re shipping Entire: the Git forge for agent-human collaboration. We’ve built @GoEntire using Entire. Now we want to see what you'll build with t’s different. 🧵
103
101
728
174,042
It’s Mr 📦, and I helped 🥰
mr-boxington 1.28 supports blaze! (formerly ra-jit) now you can have warm worktrees, automatic target/ cleanup, and incredibly fast rebuilds. 🔥

Just set MBX_BLAZE=1 and see build times like 2150ms → 116ms.

mr-boxington.jdx.dev
2
0
18
1,820
Replying to @jdalton
@jdalton yeah i hadn't heard of it before your pr, it's awesome
0
0
0
215
glad i blocked this toxic guy a while ago when he was being condescending to someone else. also meta has its own scm and my commits aren’t all public 🤡
373
63
5,982
481,762
Replying to @poteto
@poteto he blocked me after this tweet lol x.com/jdxcode/status…
@neogoose_btw you might want to look at my profile before you say that
3
0
9
932
having a yaml pipeline, to run a build system command always felt unnecessary indirection in most cases, so i’m extending @buildoncedev so we don’t have to deal with that indirection anymore
1
0
2
972
Replying to @pepicrft
@pepicrft @buildoncedev i wonder if it would look cleaner if you did `trigger.invoke = {}` with the new multiline tables in toml 1.1
0
0
0
396
she looms for yet another year.
19
247
3,026
253,596
Replying to @txbamxnmicxh_s
0
0
12
8,125
The United States divided into regions based on nearest metro with 1 million+ residents
20
63
1,299
55,927
Replying to @beatmastermatt
@beatmastermatt new orleans is less than 1m?
2
0
1
1,126
The biggest barrier to Spinel adoption is probably just that local developer toolchains aren't set up to compile it, in the same way that almost everyone has the tools already to compile Rust or Go programs.
2
0
14
3,206
Replying to @nateberkopec
1
0
1
376
Replying to @jdxcode
@nateberkopec we don't have spinel itself yet though
1
0
1
372