Comment by eterm
18 hours ago
You've made me realise a good signal for bug hunting: Search repos with lock files listed in their .gitignore.
It's the sort of terrible practice that someone might be frustrated into taking after a nasty merge conflict, and signals a willingness to cut corners.
My lockfile was not gitignored, I had made significant changes to package.json so I was expecting diffs in the lockfile.
I just don't usually read lockfile diffs and claude inadvertently updated a few dozen packages to new minor versions without me noticing. In fact I only realized the problem after I looked at the lockfile diff.
Makes sense. This is why I like using jj, because "update deps" and "fix bug" are going to be two separate commits, and when "fix bug" has changes in the lock file, the red flags go up.
Claude seems to be super good at jj so that can take the edge off as well.
Why do you need jj for this? I'd usually make incremental commits with git, and I'm wondering how jj levels it up.
> You've made me realise a good signal for bug hunting: Search repos with lock files listed in their .gitignore.
What would be the point of that? Do you just go around hunting for bugs in random repos?
Sure, in the spirit of open source, why not? It's a hobby, and it scratches an itch. I very much enjoy deconstructing things more than putting them together.
We also live in a world where a package written by someone learning to code ended up critically underpinning the entire ecosystem and is downloaded 500 million times a month.
Ignoring the eco-terror aspect of that for now, it means there's an awful lot of code out there which is finding itself under constant attack by a fleet of hostile AI.
I don't personally believe that the solution to that is "more AI", which firstly just overwhelms maintainers and secondly surrenders our human agency to a giant machine, with a hope that the "good" side can out-spend the bad.
Nor do I think the solution is to abandon the open internet and retreat behind corporate walls into curated spaces, "benevolently" protected by giant companies.
Which means holding on to the open internet requires a human approach, and any signal to help amplify the work there is a benefit.
>We also live in a world where a package written by someone learning to code ended up critically underpinning the entire ecosystem and is downloaded 500 million times a month
whoa what? which one is that?
6 replies →
It's also a good practice when taking a new job, especially if someone is a contractor and changes gigs every few months or years.
I've found that, when I start a job, I have to rely on smells like this to know what kind of mess (or if there is a mess) I need to clean up.