frontpage.
newsnewestaskshowjobs

Open Source @Github

fp.

Open in hackernews

Building my npx business card

https://ashley.dev/posts/turning-feedback-into-features/
8•edent•1y ago

Comments

steele•1y ago
Ooh, free real estate, let's colonize and gentrify package management
aabhay•1y ago
Lmao, gentrify cracked me up
neilv•1y ago
Do these npx business cards run arbitrary code on your computer?
cypherpunks01•1y ago
npx

Run a command from a local or remote npm package

Description

This command allows you to run an arbitrary command from an npm package (either one installed locally, or fetched remotely), in a similar context as running it via npm run.

neilv•1y ago
Yes, then is a "command from an npm package" arbitrary code?

And what is this "similar context as running it via npm run"?

Would it be better to answer the question directly?

joshka•1y ago
Yeah, this seems like a very smart but inherently flawed idea.
cypherpunks01•1y ago
Yes I agree! OSS package management ecosystems are a great idea, but allowing submissions without any review or vetting is just asking for supply chain attacks.
Xss3•1y ago
May as well just release an executable tbh.
theamk•1y ago
Reminds me of JAPH [0] - a tiny Perl program that was used in email/newsgroup signature to give it personal touch.

[0] https://www.perlmonks.org/?node_id=412464

watusername•1y ago
Terminal business cards are a nice idea, but RCE business cards are just asking for trouble. Instead of npx, what happened to good'ol curl? Something like

$ curl ashley.dev

Some decades ago, we had finger (https://en.wikipedia.org/wiki/Finger_%28protocol%29) which is designed for this very use case. Sadly it's no longer installed by default with most distros:

$ finger @ashley.dev

queezey•1y ago
This would be a great advertisement for security consulting.

"I was just able to run arbitrary code on your computer. Here is a sample of your recent browser history. Let me tell you help you mitigate your security vulnerabilities."

Universal Health Coverage Could Save $1T and 114,000 Lives a Year, Yale Study

https://ysph.yale.edu/news-article/universal-health-coverage-could-save-one-trillion-dollars-and-...
129•karakoram•28m ago•96 comments

A Preview of DuckDB v2.0

https://duckdb.org/2026/08/17/duckdb-20-highlights
195•ibotty•2h ago•25 comments

AI-Generated GitHub Copilot "Autofix" Allowed Compromise of Snowflake's Jira

https://www.wiz.io/blog/red-agent-snowflake-copilot-cicd-bug
89•galnagli•1h ago•39 comments

How to disable or avoid intrusive AI

https://www.librarian.net/notoai/
66•ColinWright•2h ago•16 comments

GPT 5.6 Sol is the best "vision" model OpenAI ever released

https://blog.roboflow.com/openai-gpt-5-6/
171•plurby•4h ago•96 comments

Launch HN: Speko (YC S26) – OpenRouter for Voice AI

18•abdik•41m ago•5 comments

Incident with Github.com

https://www.githubstatus.com/incidents/zkxwbgr0cnmx
660•kevcampb•2h ago•472 comments

How to put 170 atoms in an atom

https://signoregalilei.com/2026/08/02/how-to-put-170-atoms-in-an-atom/
39•surprisetalk•1h ago•4 comments

GitHub down again? no PR access

262•yodon•2h ago•92 comments

Apple's App Tracking Transparency treated its own apps better than rivals

https://www.bundeskartellamt.de/SharedDocs/Meldung/EN/Pressemitteilungen/2026/08_17_2026_Apple_AT...
158•nyku•2h ago•54 comments

Qwen3.8-27B at 256K on a 24GB RTX PRO 4000 SFF (432 GB/s): 50 tok/s with MTP

https://piszczek.pl/blog/qwen38-27b-256k-50-tps-24gb-gpu
29•pich•1h ago•20 comments

Qwen 3.8 27B is excellent, but it defaults to overthinking things

https://simonwillison.net/2026/Aug/16/qwen-38-27b/
698•bilsbie•16h ago•331 comments

Show HN: Sokoban AI Solver

https://mkornreich.me/projects/sokoban/
36•enjoyyourlife•3h ago•26 comments

How I developed an Am29000 C compiler and web browser

https://nanochess.org/am29000_c_compiler_web_browser.html
25•nanochess•19h ago•0 comments

Olo (Color)

https://en.wikipedia.org/wiki/Olo_(color)
37•inigyou•5d ago•1 comments

Show HN: Learn Flags Quiz

https://flagquizzes.com/
12•artiomyak•2h ago•3 comments

Anthropic's 'watermark' text adulteration in Claude is a perversion of writing

https://daringfireball.net/2026/08/anthropics_watermark_text_adulteration_in_claude_is_a_perversi...
590•ropbear•18h ago•525 comments

How to ship a database every day

https://turbopuffer.com/blog/control-plane
24•tarunnnp•2h ago•1 comments

On A.I. regulation and messaging

https://twitter.com/DarioAmodei/status/2088758816376807762
187•jacquesm•14h ago•382 comments

Show HN: Desktopcolors.com – A museum for solid background colors of classic OS

https://desktopcolors.com
92•vlowrian•8h ago•37 comments

Cialis is an erectile dysfunction drug. Could it also help you live longer?

https://www.npr.org/2026/08/17/nx-s1-5928263/cialis-viagra-tadalafil-longevity-heart-health
65•brandonb•2h ago•44 comments

A third world engineer responds to “RISC-V: They should have known better”

https://rvembedded.com/blog_post/12/
588•Narishma•23h ago•297 comments

How Go detects struct copies with sync.noCopy

https://func25.dev/posts/go-sync-nocopy/
43•func25•4d ago•42 comments

Mexico Crackdown on Coastal Development Underway

https://yucatanmagazine.com/mexico-crackdown-on-coastal-development/
72•untiledsource•4h ago•13 comments

Ask HN: Alternatives to GitHub

168•dhruv3006•2h ago•112 comments

Show HN: LLMs each trading $100K vs. a frozen rulebook – the rulebook leads

https://aitradingcompetition.com/
7•chumzygood•2h ago•0 comments

Linear algebra done right

https://linear.axler.net/
186•the-mitr•10h ago•65 comments

Claude: System Prompts

https://platform.claude.com/docs/en/release-notes/system-prompts
730•tosh•1d ago•276 comments

Reticulum – Decentralized Mesh Network

https://reticulum.network/
187•sudo_cowsay•16h ago•64 comments

The only known trebuchet casualty in history

https://arstechnica.com/science/2026/08/meet-the-only-known-trebuchet-casualty-in-history/
25•Tomte•1h ago•6 comments