frontpage.
newsnewestaskshowjobs

Open Source @Github

fp.

Open in hackernews

Building my npx business card

https://ashley.dev/posts/turning-feedback-into-features/
8•edent•1y ago

Comments

steele•1y ago
Ooh, free real estate, let's colonize and gentrify package management
aabhay•1y ago
Lmao, gentrify cracked me up
neilv•1y ago
Do these npx business cards run arbitrary code on your computer?
cypherpunks01•1y ago
npx

Run a command from a local or remote npm package

Description

This command allows you to run an arbitrary command from an npm package (either one installed locally, or fetched remotely), in a similar context as running it via npm run.

neilv•1y ago
Yes, then is a "command from an npm package" arbitrary code?

And what is this "similar context as running it via npm run"?

Would it be better to answer the question directly?

joshka•1y ago
Yeah, this seems like a very smart but inherently flawed idea.
cypherpunks01•1y ago
Yes I agree! OSS package management ecosystems are a great idea, but allowing submissions without any review or vetting is just asking for supply chain attacks.
Xss3•1y ago
May as well just release an executable tbh.
theamk•1y ago
Reminds me of JAPH [0] - a tiny Perl program that was used in email/newsgroup signature to give it personal touch.

[0] https://www.perlmonks.org/?node_id=412464

watusername•1y ago
Terminal business cards are a nice idea, but RCE business cards are just asking for trouble. Instead of npx, what happened to good'ol curl? Something like

$ curl ashley.dev

Some decades ago, we had finger (https://en.wikipedia.org/wiki/Finger_%28protocol%29) which is designed for this very use case. Sadly it's no longer installed by default with most distros:

$ finger @ashley.dev

queezey•1y ago
This would be a great advertisement for security consulting.

"I was just able to run arbitrary code on your computer. Here is a sample of your recent browser history. Let me tell you help you mitigate your security vulnerabilities."

We should be more ambitious with the software we build

https://danluu.com/ambitious/
350•ltratt•10h ago•299 comments

Cerebras Deploys Trillion-Parameter AI Models

https://www.cerebras.ai/blog/how-we-deploy-trillion-parameter-frontier-models-on-cerebras
122•gmays•6h ago•41 comments

How Japanese Dried Bonito Is Made

https://kottke.org/26/10/how-japanese-dried-bonito-is-made
16•bookofjoe•2d ago•2 comments

The Goose Programming Language

https://aardappel.github.io/goose/
356•bobbydigitales•12h ago•237 comments

SpeedCrunch 1.1

https://www.speedcrunch.org/
128•LordNibbler•12h ago•23 comments

Small Programs and Languages

https://ratfactor.com/cards/pl-small
94•andsoitis•10h ago•7 comments

Why Gopher in 2026?

https://gopher.muffinlabs.com/sdf.org/users/nervtoji/phlog/001.txt
69•andsoitis•8h ago•20 comments

America has lost 200k of jobs in media, film and the arts. How much is AI?

https://www.apricitas.io/p/ai-and-the-fall-of-the-creative-class
324•gnabgib•8h ago•319 comments

I Built a Stereo Vision Board for Hardware Hackers

https://rootkitlabs.com/2026/10/06/i-built-a-stereo-vision-board-for-hardware-hackers/
64•machinehum•4d ago•10 comments

I don't understand quantum physics (2018)

https://www.southampton.ac.uk/~doug/quantum_physics/index.html
307•rramadass•22h ago•243 comments

FreeDNS

https://freedns.afraid.org/
282•esher•16h ago•73 comments

Social dynamics of toxic metal industry in medieval Europe

https://www.cambridge.org/core/journals/antiquity/article/social-dynamics-of-toxic-metal-industry...
37•XzetaU8•4d ago•14 comments

Pragtical v3.14 Lua-based text editor adds menus, floating views, and sessions

https://pragtical.dev/blog/pragtical-v3140-release
12•rd07•4d ago•1 comments

A story of a Figma bug that wasn't a bug at all (2021)

https://aresluna.org/this-is-a-story-of-a-figma-bug/
25•jllyhill•3d ago•1 comments

The Importance of Limitations for Creativity and Learning (2023)

https://ratfactor.com/cards/limitations
59•andsoitis•10h ago•15 comments

Node2Shell evolves to HTTP2Shell, blast radius affects many HTTP libs and apps

https://www.aikido.dev/blog/python-packages-vulnerable-node2shell-brotli-cve-2026-111497
300•theanonymousone•23h ago•151 comments

Local Wikipedia: Wikipedia, but only for things a half hour walk from you

https://edjefferson.com/localwiki/
1577•sohkamyung•2d ago•246 comments

In Rainbows

https://hitogata.neocities.org/Rainbows
22•surprisetalk•2d ago•4 comments

The St. Helena 5 pence coin shows Jonathan, a roughly 190 year old tortoise

https://de.numista.com/9866
112•schleck8•15h ago•35 comments

Show HN: Steal My Bitcoin

https://stealmybitcoin.com/
462•cloudlandsdev•11h ago•286 comments

Neural chip decodes interactions between brain regions

https://actu.epfl.ch/news/neural-chip-decodes-interactions-between-brain-r-2/
102•giuliomagnifico•15h ago•37 comments

Roku developer repositories moved from GitHub to GitLab

https://blog.roku.com/developer/gitlab-move
284•cxr•15h ago•193 comments

GPU-unlock: FP/BF16 instruction issue rate on Nvidia 3000's cards

https://github.com/Zagitta/gpu-unlock
229•fragebogen•21h ago•71 comments

Five Qwen3.8-27B models match Fable 5 Using GVS5H Harness

https://github.com/slee-persis/GVS5H
146•rzk•3h ago•48 comments

Bbtree: Fastest Ordered Map

https://bbtree.xiangpeng.systems/post/
99•aoli-al•13h ago•10 comments

Physicists trap a single antimatter particle for a month

https://www.scientificamerican.com/article/physicists-trap-a-single-antimatter-particle-for-a-month/
302•mooreds•3d ago•86 comments

How close can pure functional programming get to C?

https://rtfeldman.com/fp-vs-c
265•stmonty•1d ago•93 comments

New Open-Source Cybersecurity Platform Uses AI Agents to Hunt Threats

https://medium.com/@ai_news/argus-might-be-one-of-the-most-impressive-open-source-cybersecurity-p...
16•is_dev_active•45m ago•2 comments

Why is AI generated language so hard to understand?

https://arxiv.org/abs/2610.29162
186•canjobear•13h ago•164 comments

A practical guide to AI image generation, from diffusion to agents

https://danielball.com/notes/ai_image_generation.html
255•westsmith•4d ago•83 comments