News for hackers. Stuff that matters.
Re:Axios Compromised on NPM – Malicious Versions Drop Remote... by notpushkin on Tuesday March 31, 2026 @01:47AM (#47583201)
You mean first 86,400 seconds?
Re:Axios Compromised on NPM – Malicious Versions Drop Remote... by x0x0 on Tuesday March 31, 2026 @02:45AM (#47583592)
You have to admire the person who designed the flexibility to have 87239 seconds not be old enough, but 87240 to be fine.
Re:Axios Compromised on NPM – Malicious Versions Drop Remote... by raverbashing on Tuesday March 31, 2026 @03:01AM (#47583720)
This is the difference between thinking about the user experience and thinking just about the technical aspect
Re:Axios Compromised on NPM – Malicious Versions Drop Remote... by zelphirkalt on Tuesday March 31, 2026 @05:42AM (#47584866)
I actually think it is not too bad a design, because seconds are the SI base unit for time. Putting something like "x days" requires additional parsing steps and therefore complexity in the implementation. Either knowing or calculating how many seconds there are in a day can be expected of anyone touching a project or configuration at this level of detail.
Re:Axios Compromised on NPM – Malicious Versions Drop Remote... by wongarsu on Tuesday March 31, 2026 @06:27AM (#47585229)
Seconds are also unambiguous. Depending on your chosen definition, "X days" may or may not be influenced by leap seconds and DST changes.

I doubt anyone cares about an hour more or less in this context. But if you want multiple implementations to agree talking about seconds on a monotonic timer is a lot simpler

Re:Axios Compromised on NPM – Malicious Versions Drop Remote... by sverhagen on Tuesday March 31, 2026 @08:11AM (#47586173)
I came here to argue the opposite. Expressing it in seconds takes away questions about time zones and DST.

I think you're incorrect to say that second are also ambiguous. Maybe what you mean is that days are more practical, but that seems very much a personal preference.

Re:Axios Compromised on NPM – Malicious Versions Drop Remote... by pavel_lishin on Tuesday March 31, 2026 @09:18AM (#47586953)
I think you misread the comment you're replying to.
Re:Axios Compromised on NPM – Malicious Versions Drop Remote... by friendzis on Tuesday March 31, 2026 @11:08AM (#47588479)
I understand the [flawed] reasoning behind "x seconds from now is going to be roughly now() + x on this particular system", but how does defining the cooldown from an external timestamp save you from dealing with DST and other time shenanigans? In the end you are comparing two timestamps and that comparison is erroneous without considering time shenanigans
Re:Axios Compromised on NPM – Malicious Versions Drop Remote... by woodruffw on Tuesday March 31, 2026 @10:12AM (#47587689)
Could you explain what you mean re: ambiguity? I understand why “calendar units” like months are ambiguous, but minutes, hours, days, and weeks all have fixed durations (which is why APIs like Python’s `timedelta` allows them).
Re:Axios Compromised on NPM – Malicious Versions Drop Remote... by nightpool on Tuesday March 31, 2026 @10:22AM (#47587812)
The minute between December 31, 2016 23:59 and January 1st 2017 is 61 seconds, not 60 seconds. The hour that contains that minute is 3601 seconds, the day that contains that hour is 43201 seconds, etc. If you assume a fixed duration and simply multiply by 43200, your math will be wrong compared to the rest of the world.

Daylight savings time makes a day take 23 hours or 25 hours. That makes a week take 7254000 seconds or 7261200 seconds. Etc.

Re:Axios Compromised on NPM – Malicious Versions Drop Remote... by woodruffw on Tuesday March 31, 2026 @10:30AM (#47587932)
That’s what I mean by calendar units. These aren’t issues if you don’t try to apply durations to the “real” calendar.

(This is all in the context of cooldowns, where I’m not convinced the there’s any real ambiguity risk by allowing the user to specify a duration in day or hour units rather than seconds. In that context a day is exactly 24 hours, regardless of what your local savings time rules are.)

Re:Axios Compromised on NPM – Malicious Versions Drop Remote... by wongarsu on Tuesday March 31, 2026 @11:18AM (#47588623)
"exactly 24 hours" could still be anywhere between 86399 and 86401 seconds, depending on leap seconds. At least if by an hour you mean an interval of 60 minutes, because a minute that contains a leap second will have either 59 or 61 seconds.

You could specify that for the purposes of cooldowns you want "hour" to mean an interval of 3600 seconds. But that you have to specify that should illustrate how ambiguous the concept of an hour is. It's not a useless concept by any means and I far prefer to specify duration in hours and days, but you have to spend a sentence or two on defining which definition of hours and days you are using. Or you don't and just hope nobody cares enough about the exact cooldown duration

Re:Axios Compromised on NPM – Malicious Versions Drop Remote... by hunter2_ on Wednesday April 01, 2026 @10:52AM (#47601744)
If you say "wait 1 day without using a calendar+locale" then the duration is unambiguously 86400s, but if you say "wait 1 day using a calendar+locale" or "wait until this time tomorrow" then the duration is ambiguous until you've incorporated rules like leap/DST. I think GP's point is that "wait 1 day" unambiguously defaults to the former, and you disagree, but perhaps it's a reasonable default.
Re:Axios Compromised on NPM – Malicious Versions Drop Remote... by woodruffw on Wednesday April 01, 2026 @11:02AM (#47601880)
Yep, this is exactly my point. Durations are abstract spans of "stopwatch time," they don't adhere to local times or anything else we use as humans to make time more useful to us. In that context there's no real ambiguity to using units like hours/days/weeks (but not months, etc.) because they have unambiguous durations.
Re:Axios Compromised on NPM – Malicious Versions Drop Remote... by hunter2_ on Sunday April 05, 2026 @10:44AM (#47649975)
Now you've got me wondering something: if a "stopwatch month" can't exist since everyone agrees that different months have different durations (and therefore you must select one like "the month of January" to know how long to run the stopwatch), isn't there an argument that a "stopwatch year" has the same need to select one since everyone agrees that different years have different day counts (unless we mean a solar year in seconds, not quantized to the nearest day, but that's probably a Bad Default)?

The collective human decision to make days-per-year vary (requiring leap rules to calculate days) seems similar to the collective human decision to make days-per-month vary (requiring month names to calculate days). So if we say a "stopwatch year" suffers the same fate as the "stopwatch month" then it's a slippery slope to saying the "stopwatch minute" is no different than a "stopwatch year" (requiring leap rules to calculate seconds) even if, for all practical purposes, it seems exempt.

I guess this is why we make "second" the SI unit, and none of our human-convenience rules mess with the duration of a second. A leap second changes the duration of a minute (and above), and a leap year changes the duration of a month (and above). Which, oddly enough, demonstrates an inconsistency: we ought to say "leap day" instead of "leap year" if the thing being added will follow the word "leap."

Re:Axios Compromised on NPM – Malicious Versions Drop Remote... by _alternator_ on Tuesday March 31, 2026 @11:30AM (#47588850)
Leap seconds are their own nightmare. UNIX time ignores them, btw, so that the unix epoch is 86400*number of days since 1/1/1970 + number of seconds since midnight. The behavior at the instance of a leap second is undefined.
Re:Axios Compromised on NPM – Malicious Versions Drop Remote... by adrianN on Tuesday March 31, 2026 @12:07PM (#47589481)
Undefined behavior is worse than complicated defined behavior imo.
Re:Axios Compromised on NPM – Malicious Versions Drop Remote... by oasisbob on Tuesday March 31, 2026 @01:18PM (#47590572)
That's a good way of describing that. It's far too easy to pretend UNIX timestamps would correspond to a stopwatch counting from 1/1/1970.
Re:Axios Compromised on NPM – Malicious Versions Drop Remote... by _alternator_ on Tuesday March 31, 2026 @02:43PM (#47591682)
Right. Currently epoch time is off the stopwatch time by 27 seconds.
Re:Axios Compromised on NPM – Malicious Versions Drop Remote... by jon-wood on Tuesday March 31, 2026 @10:21AM (#47587798)
In the UK last Sunday was 23 hours long because we switched to BST, and occasionally leap seconds will result in a minute being something other 60 seconds.
Re:Axios Compromised on NPM – Malicious Versions Drop Remote... by extraduder_ire on Tuesday March 31, 2026 @01:02PM (#47590325)
No it wasn't. The country instantaneously changed timezones from UTC+0 to UTC+1 (called something else locally), it was no different to any other timezone change from e.g. physically moving into another timezone.
Re:Axios Compromised on NPM – Malicious Versions Drop Remote... by myhf on Tuesday March 31, 2026 @12:16PM (#47589646)
exploiting the ambiguity in date formats by releasing a package during a leap second
Re:Axios Compromised on NPM – Malicious Versions Drop Remote... by rolux on Tuesday March 31, 2026 @07:38AM (#47585865)
> seconds are the SI base unit for time

True. But seconds are not the base unit for package compromises coming to light. The appropriate unit for that is almost certainly days.

Re:Axios Compromised on NPM – Malicious Versions Drop Remote... by PunchyHamster on Tuesday March 31, 2026 @08:22AM (#47586278)
that kind of complexity is always worth it. Every single time. It's user time that you're saving and it also makes config clearer for readers and cuts out on "too many/little zeroes on accident" errors

It's just library for handling time that 98% of the time your app will be using for something else.

Re:Axios Compromised on NPM – Malicious Versions Drop Remote... by x0x0 on Tuesday March 31, 2026 @12:40PM (#47590012)
I find it best when I need a calculator to understand security settings. 604800 here we come
Re:Axios Compromised on NPM – Malicious Versions Drop Remote... by dspillett on Tuesday March 31, 2026 @10:03AM (#47587565)
Probably went with the simplest implementation, if starting from the current “seconds since epoch” value. Let the user do any calculations needed to translate three days into that measurement.

It also efficiently annoys the most people at once: those what want hours will complain if they set it to days, thought that want days will complain if hours are used. By using minutes or seconds you can wind up both segments while not offend those who rightly don't care because they can cope with a little arithmetic :)

Though doing what sleep(1) does would be my preference: default to seconds but allow m/h/d to be added to change that.

Re:Axios Compromised on NPM – Malicious Versions Drop Remote... by Xirdus on Tuesday March 31, 2026 @10:13AM (#47587701)
I'm old enough to remember computers being pitched as devices that can do tedious math for us. Now we have to do tedious math for them apparently.
Re:Axios Compromised on NPM – Malicious Versions Drop Remote... by dspillett on Tuesday March 31, 2026 @10:22AM (#47587811)
Hence the way I would do it (and have for other purposes), as stated in my final sentence. Have the human state the intent and convert to your own internally preferred units as needed.
Re:Axios Compromised on NPM – Malicious Versions Drop Remote... by darepublic on Tuesday March 31, 2026 @11:00AM (#47588329)
I'm sure you would like to memorize all kinds of API instead of having something idiot proof and straightforward
Re:Axios Compromised on NPM – Malicious Versions Drop Remote... by Xirdus on Tuesday March 31, 2026 @02:59PM (#47591902)
As if `minimumReleaseAge` in `[install]` section of `.bunfig.toml` doesn't require the same kind of memorization.
Re:Axios Compromised on NPM – Malicious Versions Drop Remote... by moralestapia on Tuesday March 31, 2026 @11:33AM (#47588890)
Hey that's a great joke, you made me spill my morning home-brewed kombucha.

I'm going to steal that one for my JavaScript monthly developers meetup.

Is it ok if I attribute it to "Xirdus on Hacker News"?

Re:Axios Compromised on NPM – Malicious Versions Drop Remote... by Xirdus on Tuesday March 31, 2026 @02:57PM (#47591866)
Lol sure.
Re:Axios Compromised on NPM – Malicious Versions Drop Remote... by OJFord on Tuesday March 31, 2026 @04:05PM (#47592730)
No no no, see now we just say "computer! do tedious math!", and it will do some slightly different math for us and compliment us on having asked it to do so.
Re:Axios Compromised on NPM – Malicious Versions Drop Remote... by fc417fc802 on Tuesday March 31, 2026 @10:40AM (#47588046)
The one true unit of time is hexadecimal encoded nanoseconds since the unix epoch. (I'm only half joking because I actually have authored code that used that before.)
Re:Axios Compromised on NPM – Malicious Versions Drop Remote... by scoutt on Tuesday March 31, 2026 @11:34AM (#47588910)
Well, you have 1000000 microseconds in between. That's a big threshold.
Re:Axios Compromised on NPM – Malicious Versions Drop Remote... by pwillia7 on Tuesday March 31, 2026 @10:31AM (#47587938)
wait what if we start on a day DST starts or ends????