Reddit Programming
200 subscribers
1.22K photos
126K links
I will send you newest post from subreddit /r/programming
Download Telegram
Dependency cooldown using the publish age as a signal for package resolution
https://www.reddit.com/r/programming/comments/1smt6ph/dependency_cooldown_using_the_publish_age_as_a/

<!-- SC_OFF -->Majority tools we have seen works on known signals that are bad like CVE(databases), malware signatures or could be reputation of scores. And all of them just lag. There is a window between when malicious version is published and when a detection actually happens.
One understood fix was filter packages by publish age during version resolution. So if a semver range would resolve to a version published in the last N days then fall back to an older eligible version instead. If nothing outside the window satisfies the range, fail the install.The implementation actually at the registry metadata layer. Before the package manager processes version candidates it strip anything too fresh from the response. The resolver never sees the new version. No lockfile changes and no workflow changes also. And yes there is a obviously a tradeoff that is you will not get the latest version immediately. And for most production dependencies that is acceptable. For development tools where you want bleeding edge, you skip it per-invocation. <!-- SC_ON --> submitted by /u/BattleRemote3157 (https://www.reddit.com/user/BattleRemote3157)
[link] (https://safedep.io/pmg-dependency-cooldown/) [comments] (https://www.reddit.com/r/programming/comments/1smt6ph/dependency_cooldown_using_the_publish_age_as_a/)
Switching higher-order streams to first-order streams
https://www.reddit.com/r/programming/comments/1smwekm/switching_higherorder_streams_to_firstorder/

<!-- SC_OFF -->I discuss streams. It's a pretext to learn about higher-order streams, like flatten and to introduce a new stream: switch! It's very useful, and will have no secret for you. <!-- SC_ON --> submitted by /u/Hywan (https://www.reddit.com/user/Hywan)
[link] (https://mnt.io/articles/switching-higher-order-streams-to-first-order-streams/) [comments] (https://www.reddit.com/r/programming/comments/1smwekm/switching_higherorder_streams_to_firstorder/)
VOMPECCC: A Modular Completion Framework for Emacs
https://www.reddit.com/r/programming/comments/1sn4e7z/vompeccc_a_modular_completion_framework_for_emacs/

<!-- SC_OFF -->"I'm writing this post because these packages have recently taken the Emacs community by storm, but I rarely see discussions on how they relate or how they compose together to provide a feature complete ICR system in emacs. These packages implement concretely what the antecedent post argues in the abstract: completion is a substrate, or set of primitives, on top of which users can build rich interfaces for effortlessly interacting with your machine to do almost anything." <!-- SC_ON --> submitted by /u/misterchiply (https://www.reddit.com/user/misterchiply)
[link] (https://www.chiply.dev/post-vompeccc) [comments] (https://www.reddit.com/r/programming/comments/1sn4e7z/vompeccc_a_modular_completion_framework_for_emacs/)