Piotrek Koszuliński

If searching via Google is "googling",

then searching via ChatGPT is... what? 🤔

Second Sha1-Hulud Wave Affects 25,000+ Repositories via npm Preinstall Credential Theft Security vendors warn Sha1-Hulud has hijacked 25,000+ GitHub repos via npm packages, stealing cloud credentials or wiping dev home directories.

Source: thehackernews.com/2025/11/seco...

Yet another reminder to use @pnpm.io's minimum dependency age.

pnpm.io/settings#min...

Settings (pnpm-workspace.yaml) | pnpm pnpm gets its configuration from the command line, environment variables, pnpm-workspace.yaml, and

The cooldown period can also be achieved with @pnpm.io's pnpm.io/settings#min...

We follow the same strategy: pinned deps, lockfiles, minimum dependency age, SCA to double that, PR reviews by fileowners for lockfiles. But most importantly: short list of deps (though, realistic only for prod ones).

I start to believe that we should measure our professional progress by the number of acronyms we understand. 🙈

The last one I had to google were ACV and TCO 😅

Why Does Development Slow? It's the options

One big lesson: how we frame progress matters. That’s why I love @kentbeck.com’s options-vs-features perspective. It's elegant and clear.

I highly recommend reading: tidyfirst.substack.com/p/why-does-d...

Sounds familiar? After 10+ years on the same product, it definitely does to me. I made plenty of mistakes along the way (and hopefully learned a few things too).

Why Does Development Slow?

"Rapid progress at first, then stagnation despite our best efforts. Bugs pile up. The build slows. Backwards compatibility imposes its own tax on progress."

Hello, bluesky people 👋

How do I figure out who's here and who to follow?