Article URL: https://runrepeat.com Comments URL: https://news.ycombinator.com/item?id=49697642 Points: 12 # Comments: 0
This is an AI-generated summary. ShortSingh links to the original source for the complete article.
A software developer noticed their project's acceptance-check step was repeatedly killed by the OS out-of-memory killer four times over two days. Investigation revealed the step, named a 'read', was actually triggering a full recompile of all 15 project units just to extract pass/fail booleans — duplicating work already done by prior control runs. Each control run had already stored its result alongside the exact commit hash it ran against, making re-execution unnecessary. The fix replaced the costly rebuilds with a simple comparison of stored commit identifiers, adding a 'stale' counter to flag outdated records instead. The developer concluded that any observational step consuming resources disproportionate to mere data-gathering is likely re-deriving facts that already exist.
Rob, founder of small indie firm Fortitude Omnis Group Ltd, has introduced OSPulse, a software supply-chain security tool designed to detect risks before official vulnerability identifiers exist. Unlike mainstream tools from VC-backed competitors such as Snyk and Sonatype, OSPulse monitors maintainer churn, ownership changes, and commit-velocity drops across more than ten data feeds. A standout feature called PoisonBox runs every npm package install inside an isolated disposable microVM, using an eBPF kernel probe to record all processes, file access, and outbound connections without touching the host machine. Rob also disclosed a pricing bug in which the checkout displayed £249 per month while Stripe was configured to charge £2,988 as a lump sum, a discrepancy caught before any customer was billed and since resolved by tying all pricing to a single source of truth. The introduction was posted on developer community platform DEV as part of a self-introduction thread.
A practical guide published on DEV Community explains core data modeling concepts in Microsoft Power BI, a business intelligence tool used to connect data sources and build reports and dashboards. The article compares three structural approaches — flat table, star schema, and snowflake schema — outlining the roles of fact and dimension tables in each design. It highlights why a well-structured data model matters, noting that poor design leads to slow performance, inflated file sizes, and inaccurate report figures. The guide also covers how relationships and filter direction operate within the data model, and how Power Query joins differ from model-level relationships. A recommended approach for structuring a typical BI solution is included, with star schema presented as a scalable and report-friendly option despite its data redundancy trade-offs.
Security scanners that rely on CVE databases are structurally blind to supply-chain attacks because a CVE can only be assigned after a flaw is discovered, catalogued, and published — a process that takes time attackers do not wait for. High-profile incidents including the event-stream npm compromise in 2018, the ua-parser-js hijack in 2021, and the polyfill.io domain sale in 2024 all caused damage before any CVE existed. Even xz-utils, which did receive CVE-2024-3094, had visible human warning signs — a new contributor slowly gaining trust and a tarball diverging from its git source — nearly a year before the identifier was assigned. Analysts argue that meaningful early detection requires monitoring project-level signals such as maintainer turnover, sudden drops in commit activity, ownership transfers, and artefact-to-source mismatches. These indicators consistently appear before an advisory is written and do not depend on a vulnerability number to be actionable.
Discussion (0)
Log in to join the discussion and vote.
Log in