[-] Kissaki@programming.dev 6 points 18 hours ago

A classic that crossed my path again. It has not been shared in this community yet, so I am posting it.

Great resource about platformer control forgiveness with visual references.

9

[…] about some Celeste game-feel tricks. I don’t think that we invented any of these techniques, but they are important parts of the moment-to-moment experience of Celeste.

  1. Coyote Time
  2. Jump Buffering
  3. Halved-Gravity Jump Peak
  4. Jump Corner Correction
  5. Dash Corner Correction
  6. Semi-Solid Popping
  7. Lift Momentum Storage
  8. Wide Wall-Jump Window
  9. Even Wider Super Wall-Jump Window
  10. Stamina Refunds

You might have noticed a pattern! All are centered around widening timing or positioning windows, so that everything is fudged a tiny bit in the player’s favor. I think that this is a big reason why Celeste can feel kind even though it’s very difficult — it wants you to succeed.

[-] Kissaki@programming.dev 7 points 19 hours ago

Now, with all that telemetry in place and a coding agent I can finally engage with production properly: not reactively when something goes wrong, but every day I can chat with the production, ask it about its concerns, about what is going on lately, if something feels wrong.

Good luck

[-] Kissaki@programming.dev 7 points 3 days ago

If Firefox revoked trust and I open one of these websites it should reject the secure connection, right?

[-] Kissaki@programming.dev 1 points 3 days ago

I assume NIM only works with nvidia cards not AMD?

[-] Kissaki@programming.dev 7 points 4 days ago* (last edited 4 days ago)

All 39 observed attempts to publish packages to our NuGet feeds were rejected.

The observed attempts to access other customers' data or restricted resources were rejected. Tens of thousands of requests targeting our core systems did not result in unauthorised access.

Did I just read about good security practices? It certainly feels like a nice change compared to catastrophic or non-transparent reports we often see from other parties.

That they can trace, analyze, and recognize the attack activities and consequences stood out to me as well. (It's a topic/target in my work environment too.)

[-] Kissaki@programming.dev 5 points 5 days ago

On Tuesday, the world found out about two massive security vulnerabilities in PHP, a programming language that is used by roughly 70 percent of websites.

Matthew Prince, the CEO of the hosting company Cloudflare, wrote that in the 10 hours before the flaws were publicly announced, “we saw thousands of attempts to exploit it. That jumped to tens of thousands in the 45 minutes post announcement, hundreds of thousands within 2 hours, and millions now.”

Surý, who lives in Czechia, does not work for the PHP Foundation. But alongside his day job as director of domain-name-system engineering at the nonprofit Internet Systems Consortium, in a volunteer capacity, he maintains and helps automate patches for the coding language. His work, with that of just a handful of others, has allowed countless websites and organizations to fix these vulnerabilities quickly. Over the past 48 hours, he’s become arguably the unsung hero of the entire internet—despite the fact that the only compensation he receives is from modest donations. “Ondřej will save the internet today,” a user in the PHP Subreddit wrote.

I spoke with Surý today from his home about the unfolding AI-cybersecurity crisis, how the internet’s infrastructure is maintained by small crews of volunteers such as himself, and how it feels to go to bed after saving the web as we know it.

(Bolding is mine to indicate who this is about.)

[-] Kissaki@programming.dev 1 points 5 days ago* (last edited 5 days ago)

Is it free (title claim) if I'm blocked from accessing it? I don't think so. At least not freely accessible.

Is it free if I pay with personal data, tracking, and information about me being sold? I don't think so. (The block popover certainly doesn't give any information about their ad practices but I can only assume it'll be a big network tracking users.)

[-] Kissaki@programming.dev 15 points 5 days ago

Reading the tldr immediately made me think of special keywords being introduced that you wouldn't guess.

Those in the know could then trigger the more secure mode, while everyone else wouldn't know any better.

It could also be the language you prompt with. Make Chinese prompt results secure by default, and others not.

The latter would be demonstrable. The prior would need discovering or leaking/whistleblowing the secret phrase before it would be demonstrable.

[-] Kissaki@programming.dev 2 points 6 days ago

(Touch) scrolling seems broken on that website. Jitters/stutters.

[-] Kissaki@programming.dev 2 points 6 days ago* (last edited 6 days ago)

It's a broad topic.

Be mindful of how you communicate. Differentiate between questions, risks, wrongs, subjective. Talk with your teammates. Establish a common understanding of deliberate word use or forms, intentions, and necessities to answer or change or not.

Consider whether passive and non-aggressive communication is the best approach. Some people may not pick up on defensive tone and just not care. Maybe they need more direct and pushy speech and discussions where you point stuff out, including the overall approach to working together and your assumptions or expectations.

Be mindful of sharing alternative approaches or knowledge vs not commenting to reduce own time investment and number of comments. Discuss with your team where the sweet spot is. This may change over time and is different with different people, their experience in general and in the project.

Make it clear that the one submitting the code is the owner and person responsible. They have to take ownership.

If necessary, establish a common understanding of where to commit time investment. Usually it's much preferable for the author to invest time into a well documented submission over a reviewer trying to understand and find things out through analysis and questions.

Try to find a common understanding of not just the solution but what the authors understanding and intentions, what edges and alternatives did they consider, what risks or decision basis did they use.

Establish understanding on what your role as reviewer is. Risk reduction? Common standardized solutions and code? Are you lead and give long term direction, including how things are implemented to reduce long term complexity and variance? Do you teach through reviews?

If necessary or unclear, ask what or how deep you are being asked to review. Depending on the author expertise and trustworthyness and your load, sometimes merely approving a concept and a broad peek into the most risky parts or what you want to see the approach on may be enough. Sometimes they may be confident and just want approval on the concept, not every code change.

Be mindful of when to not post comments but ask for a shared screen meeting and talk for them to walk you through or explain things. The author should also be mindful of when they think discussion before asynchronous written review makes sense.

Consider whether you are always the one who should review. At all, or first. Maybe someone else can. Maybe you can do a second review pass, maybe only on remaining open questions.

[-] Kissaki@programming.dev 1 points 6 days ago* (last edited 6 days ago)

who is brian hood

Depending on the context, Brian Hood most commonly refers to one of two notable figures: […]

It tells me about two Brian Hoods. I assume one of them is the supposed denied one?

Or it is selective about what information it gives about them.

15

In this video I explain the methodology and techniques I used to make the physical-yet-arcadey physics in my game Parking Garage Rally Circuit, including a (possibly misguided) observation about Mario Kart that influenced my entire process.

14
20

While load testing one of our Rust services at work, we ran into something that took us way longer to figure out than we'd like to admit: memory that shoots up under load and just stays there.

Though glibc is the default allocator and works well for the majority of applications, it can retain significant allocator-owned memory for bursty workloads due to arena reuse, fragmentation, and cached free chunks.

Allocator switch, and this article was mentioned in Lemmy Release v0.19.20 - Reduced Memory Usage

This release significantly reduces memory usage for the Lemmy backend. Metrics on production instances show a reduction up to 10 times. Here you can see the statistics from a few different instances. Read on for a technical explanation below. Note that the change only affects x86, there is no difference on ARM (e.g. Raspberry Pi), see here for details.

40

Clara explores the concept of metacognitive awareness, the role it plays in learning, common traps in your thinking, and how using LLMs affects it in surprising ways.

Goes into research about learning, and more specifically about metacognitive awareness.

Timestamped link to where significant content begins.

Metacognitive traps:

  • Forming: Right question, wrong answer - right problem understanding, wrong solution approach
  • Dislodging: Failing to change an approach that is not working even upon realization
  • Assumption: Wrong question, right answer - solving the wrong problem
  • Location: So close, but so far - almost done, but realization that crucial steps were skipped in the beginning
  • Achievement: Band-aid on a broken bone - a lot written, small fixes in hopes that it'll start working

LLM don't solve any but introduce three new metacognitive traps:

  • Progression: Falling Behind Without Noticing - using AI-generated code beyond own understanding
  • Interruption: Distracting pop-ups - like generated-code auto-completion suggestions
  • Mislead: Following bad advice

Before these sections, I find "pauses are not bad" particularly noteworthy as well. I will be sending this to a Junior colleague.

11
16

The htmx team is very happy to announce the release of htmx 4.0.0! This is the culmination of 8 months of work (plus a game) and we are very happy with the results.

Note that we are not marking 4.0 as latest in NPM because we do not want to force-upgrade users who are relying on non-versioned CDN URLs for htmx. Instead, 2.x will remain latest and the 4.0 line will remain next until some point in early 2027. The website, however, will reference 4.0.

We hope you enjoy htmx 4. htmx 2 will continue to be supported indefinitely so don’t feel any pressure to upgrade.

2

For five days in March 2026, a single stolen token let one group poison five software ecosystems including a package downloaded 95 million times a month. The attack started with a misconfigured GitHub Actions workflow, and ended with backdoored code sitting inside CI/CD pipelines around the world.

Today, two people behind this attack were arrested. TeamPCP, allegedly operated by these threat actors, started attacks in late 2025 running opportunistic cloud exploits, then pivoted in early 2026 to targeting the software supply chain itself.

Flare’s Emerging Threats Team wanted to share examples of some of the techniques that can be used to unmask one operator behind TeamPCP, using the Flare platform to trace a single alias across the accounts, credentials, and infrastructure that connected back to a real identity. There were other independent investigations on this topic, including by Brian Krebs. Below, we walk through who TeamPCP is and share the process of deanonymizing threat actors.

4

Game trailers which take their time to show gameplay can perform way better than trailers which are cut fast and make a hard sell. See a before/after for the Sheepherds' Announce/Launch trailer to see what a difference the editing style made!

I explain how to make a game trailer which lets the viewer see what’s special about the game and how to apply it when you edit a gameplay trailer.

46

In Brief:

  • Two motions regarding "artificial intelligence" and Large Language Models (LLMs) were voted on among Codeberg e. V. members and passed.
  • We are promising to not use any of your data to train LLM and explain what the planned Terms of Use change mean for 'vibe-coded' projects.
  • We believe that LLMs endanger the free/libre software ecosystem as a whole.

The blog/news post then goes extensively into where Codeberg understands itself to be in the development landscape, and their voting results. They present their interpretation of the current software development and hardware landscape under the influence of LLMs, and the consequences they take. And how it changes not only development in general, but FOSS collaboration and projects specifically.

To us, it seems ridiculous to see projects with a single developer and virtually no users consuming as much or even more resources than some of the largest community projects on Codeberg, which operate frugal with CI/CD and storage resources. We do not believe it is reasonable for Codeberg to invest our precious donation money into hosting of large ghost projects.

-3
47

Andrew Kelley quit his job in 2018 to build a programming language. Eight years later, Zig powers Ghostty, TigerBeetle and Uber's cross-compilation. It's top 5 most admired on Stack Overflow. There's just one thing missing: 1.0. Andrew Kelley explains why.

Vitaly talked to Andrew about:

  • Why Zig has no 1.0 after a decade, and why that's deliberate
  • Why Zig left GitHub
  • Why Zig banned AI from Zig
  • What makes Zig better than C (and why every other C replacement failed)
  • Andrew’s take on Open Source

It's a long interview, but I found it very interesting and worth it.

view more: next ›

Kissaki

0 post score
0 comment score
joined 3 years ago
MODERATOR OF