jph

Want to add a link to your work to the architecture decision record repo? I maintain it.

https://github.com/architecture-decision-record/architecture...

I maintain a coordinated vulnerability disclosure repo: it explains how to do it well, why it matters to discovers and companies, and links to some relevant concepts.

Coordinated vulnerability disclosure is especially relevant right now because of the PHP disclosure affecting so many people.

Constructive feedback welcome. Free open source. Written by me by hand. Translated into many languages by Sonnet.

I use Loco extensively on many projects and it's great. The creators are very responsive to ideas and questions. Loco feels like it's a perfect halfway point between Axum and Rails.

On my wishlist is batteries-included command-line setup support for database access using Diesel instead of SeaORM because I like formal types, and security tokens using PASETO instead of JWT because I like specific algorithms.

I'm doing this attack surface tactic with Vix IDE, a terminal text editor that helps novices get comfortable with vi, emacs, git, jj, sql, commands, and more.

The prompt I used was "Goal: rework to reduce the attack surface. Process: move features into feature-flag Rust crates. Output: build a minimal version. Questions: Ask me anything."

https://github.com/vixide/vix

This past weekend, Claude Fable/Opus/Sonnet together successfully refactored the whole Vix IDE codebase into many separate Rust crates and Cargo features.

This refactor enables a security-oriented user to pick and choose, and also makes it easier for a security auditor to look at one capability at a time.

If you're curious you can see the commit messages by Claude Sonnet. IMHO they're reasonably good.

The simple command is:

  sv@next migrate sveltekit-3

I'm upgrading hundreds of projects right now and it's going great so far. Here's the shell script I'm using; adjust as you like.

  find ~/git -path '*/.*' -prune \
  -o -path '\*/node_modules' -prune \
  -o -type f -name 'svelte.config.js' -exec dirname {} \; |
  while read -r x; do
    cd "$x"
    echo "y" | 
    pnpx sv@next migrate sveltekit-3 \
    --tasks all \
    --confirm \
    --install pnpm < /dev/null
  done

I start with these rules, then adjust as I want...

EMPHASIZE:

- *Summary.* First paragraph like newspaper (who, what, where, when, how, why).

- *Benefits.* Focus on the benefits for the reader.

- *Why this matters* Focus on what it adds to the reader.

NO:

- *No tech stack.* Do not say the tech implementation; covered elsewhere.

- *No counts.* Do not say page counts, part counts, chapter counts, etc.

- *No special formatting.* Do not bold, not italic, not bullet lists.

- *No "if".* Do not say "If you do X then Y"; instead use positive.

- *No run-on sentences.* Do not use many clauses nor too many words.

- *No passive voice.* Do not use passive, or non-subject, sentences.

Good article on Rust's strengths with types. If you like this, you may be curious how you might build your own parse capabilities. I like the Rust crates Winnow and Nom, and also the Rust traits From and Into.

Jujutsu is a better smarter git. It's a great convergence of better UX, plus more expressive, plus easier to use.

If you haven't tried jj yet, take it for a spin and see how you like it.

If you like Arthur, you may be surprised that some scholars think he wasn't English, but rather he was Cymro/Welsh: https://www.wales.com/about/history-and-heritage/welsh-tradi...

Seconded. Ben, you have a great teaching style, thank you for sharing this.

Thanks! Added. What is your donate link?

https://tangled.org/joelparkerhenderson.com/architecture-dec...

https://tangled.org/joelparkerhenderson.com/ways-of-working

https://tangled.org/joelparkerhenderson.com/coordinated-vuln...

Can you suggest a viable infrastructure alternative?

My wishlist: free for open source and paid for closed source, able to do simple projects that are handwritten and also complex projects including AI LLM code that needs CI/CD/auditing, and hosting in the UK or EU.

Aside, I donate money to Codeberg because I think Codeberg is a wonderful service with strong commitment to free open source, and because I host some larger projects and AI projects that are for public welfare social good.

Help encourage alternatives by trying Gitlab.com or Codeberg.org or Tangled.org or others, and please star some projects there to help motivate more options.

Self-promo links below if you would like to star a few of mine good for developers.

https://gitlab.com/architecture-decision-record

https://gitlab.com/ways-of-working

https://gitlab.com/coordinated-vulnerability-disclosure

Yes in some senses, but no from a compliance perspective. This is AFAIK and IANAL and YMMV etc.

For example: The standard FHIR $export operation can support extensions that take de-identification config details as additional parameters. The standard openEHR can query then return non-id fields. The standard SNOMED codes can be rolled up e.g. high-specificity codes can be aggregated into a low-specificity code.

But: for compliance/legal/auditing reasons, all organizations that I know of personally do not rely exclusively on these protocols for de-identification. Instead, the organizations place their de-indentification processes in a kind of "clean room" that does many more kinds of cleansing, redacting, aggregating, chaffing, filtering, and the like.

Worldwide medical standards implementations with Rust for FHIR, openEHR, SNOMED, etc. Official specifications work well with Claude Fable, test automation, and storage using relational databases.

Fast Healthcare Interoperability Resources (FHIR) using Rust:

https://github.com/fhir-rust/fhir-rust

Open Electronic Patient Record (openEHR) using Rust:

https://github.com/openehr-rust/openehr-rust

Systematised Nomenclature of Medicine (SNOMED) using Rust:

https://github.com/snomed-rust/snomed-rust

I have work in progress creating stores for PostgreSQL, SQLite, MySQL, MariaDB, MSSQL, Oracle.

Great username :-) I'm a happy longtime Fastmail customer and I'm migrating to the new EU area.

I'm experimenting with large-ish software projects using Claude Fable. The results are surprising to me.

- Project portfolio management software. Good results so far. This is unguided experimentation: Fable researches feature ideas and plans them, then Opus 5 implements them, without me in the loop. The features include things such as an auth server, full-text search, audit logging, resource leveling, HA/DR, IaC, and more.

- FHIR & SNOMED medical software experimentation in demo-only environments. This has mixed results so far. This is guided experimentation: the FHIR specifications and SNOMED specifications are thorough and I'm in the loop. Fable plans OK, but Opus 5 is thrashing a lot, going down many rabbit holes.

Lots of errors. Opus 5 is also giving me many more hallucinations, including things that aren't even in the right territory. It's also telling me that it's making many mistakes, and the language feels off-kilter as if it's not using typical clear phrases.

> Anywhere you need direct database access outside your application, CipherStash Proxy provides a secure escape hatch.

This sounds like a back door. Is it?

To me, the whole article feels super-unclear about what exactly is involved.

Can HN folks who know more weigh in?

Queueing theory introduction for software developers:

http://github.com/joelparkerhenderson/queueing-theory

I'm building Lily Design System as a response to Shadcn and similar systems not yet being available directly for multiple stacks including Svelte, Angular, Nunchucks. It's all free open source. If you want to send me your feedback, suggestions, etc. I can easily add things to Lily.

https://lilydesignsystem.github.io

Good work. I signed up @joelparkerhenderson. It's unclear to me how to start using Pieces because the site says I'm awaiting approvals.

I understand the point of that for unknown accounts; perhaps you could consider faster FTUX by leveraging my other existing social accounts? E.g. GitHub, GitLab, Codeberg, LinkedIn, Reddit, etc. And/or enable me to browse public accounts or example content in the meantime?

If you want more open UI, I lead Lily Design System (https://lilydesignsystem.github.io) which has hundreds of components for Svelte, React, Vue, Blazor, Nunjuks, and HTML. The focus on semantics helps AI generators, and there are many prebuilt themes, locales, and examples. I'm using Fable right now to improve it.

If anyone from OpenUI would like to connect with me to add Lily, please do, [email protected].