Hawk Ticehurst

Hawk Ticehurst

@hawkticehurst.com

UX Engineer @vscode.dev. He/Him 🕸️ hawkticehurst.com 📍 New York, NY

1.6K followers337 following612 posts

Hawk Ticehurst
@hawkticehurst.com

The Tesla flying car apparently uses a compressed air tank that has *double* the PSI the Titan submarine implosion from 2023 experienced A car crash in this thing means you and everyone near you literally poofs out of existence

Katie Mack@astrokatie.com

We already have flying cars. They're called helicopters. They're really expensive and there are good reasons you have to have a pilot license and work with air traffic control to fly them. Putting jets on a sedan is not going to result in a better vehicle or transportation experience in any way.

Hawk Ticehurst
@hawkticehurst.com

Seriously tho it's hard to overstate how impactful Deno was: The first major competitor to Node. 4 years before Bun I'd confidently argue the @deno.land team played a history-changing role shaping + inspiring what modern development looks like in 2026 I think that's something to be applauded 👏

Hawk Ticehurst@hawkticehurst.com

Woah rip Deno > We will support the Deno runtime for another year ... After that year we will end our development of the Deno runtime. Wonder what this means for the JS trademark battle with Oracle.. @cloudflare.social wanna do like the coolest thing and be the darling of web dev forever? ;)

deno.comDeno is joining Cloudflare | DenoPutting ourselves in the best place to build the future of the web

Hawk Ticehurst reposted

Visual Studio Code
@vscode.dev

🐾 The VS Code pet needs a name! Have you met your new coding companion? Open GitHub Copilot Chat in VS Code and enter /vscode-pet 💡 Submit your name ideas September 10 - 17, 2026 🏆 Winner: 1 month of GitHub Copilot Max ✨ Honorable mentions: VS Code swag 👉 Learn more: aka.ms/vscode-pet

Hawk Ticehurst reposted

jamelle
@jamellebouie.net

this is incredible

Max Dubler 🏳️‍🌈@maxdubler.com

The Squamish people of what is now Vancouver were illegally dispossessed of their land 100 years ago. They sued, got the land back, and used their sovereignty to ignore local zoning and build 6,000 new homes over the loud objections of nearby wealthy NIMBYs. Now other tribes are getting in the game.

Hawk Ticehurst reposted

Jake Lazaroff
@jakelazaroff.com

oh i forgot to mention but since each cuboid is seven elements with no content and each "model" has up to ten cuboids, @hawkticehurst.com's "css web components" pattern made it waaaay easier to stay organized

hawkticehurst.comCSS Web Components for marketing sitesThe truly No JavaScript web component.
Jake Lazaroff@jakelazaroff.com

pretty proud of this homepage i threw together for my company. i tried to come up with something very obviously not designed by AI and came up with this low-poly 3D aesthetic inspired by @jhey.dev and @anatudor.bsky.social. 100% CSS, no javascript at all! phaze.app

Hawk Ticehurst reposted

daniel r(ooooooh) in nyc 🇺🇸
@danielroe.dev

💥 just released a github action: `uppt` it aims to be a very simple, secure release workflow for maintainers that adheres to best security practices ⚪ trusted, staged publishing on npmjs.com ⚪ github environment protection ⚪ generated release PR + changelog ⚪ automatic release + publish on merge ✨

Hawk Ticehurst
@hawkticehurst.com

Yes. They are more deterministic and (theoretically) more token efficient If anything I think we should be evolving these scripts so they can execute in one shot via flags cause the multistep flows are error prone for agents and cost everyone unneeded rounds of tool calling imo

Matthew Phillips@handle.invalid

Do we even need `npm create` scripts any more? "Set up a foobar project following this guide: example.com/getting-star... "

example.comexample.com

Hawk Ticehurst reposted

Ky
@ky.fyi

fantasizing about living in a competent country

Hawk Ticehurst reposted

patak
@patak.cat

Mythos' underwhelming results for curl are a great example of why Open Source is even more important now that we have access to these tools. curl is more secure because everyone can tinker with it. We should be doubling down on Open Source rather than closing projects in panic.

daniel:// stenberg://@bagder.mastodon.social.ap.brid.gy

#Mythos finds a #curl vulnerability yes, as in singular one. https://daniel.haxx.se/blog/2026/05/11/mythos-finds-a-curl-vulnerability/

daniel.haxx.seMythos finds a curl vulnerabilityyes, as in singular _one_. Back in April 2026 Anthropic caused a lot of media noise when they concluded that their new AI model _Mythos_ is _dangerously good_ at finding security flaws in source code. Apparently Mythos was so good at this that Anthropic would not release this model to the public yet but instead trickle it out to a selected few companies for a while to allow a few good ones(?) to get a head start and fix the most pressing problems first, before the general populace would get their hands on it. The whole world seemed to lose its marbles. Is this the end of the world as we know it? An amazingly successful marketing stunt for sure. ## My (non-) access Part of the deal with _project Glasswing _was that Anthropic also offered access to their latest AI model to “Open Source projects” via Linux Foundation. Linux Foundation let their project Alpha Omega handle this part, and I was contacted by their representatives. As lead developer of curl I was offered access to the magic model and I graciously accepted the offer. Sure, I’d like to see what it can find in curl. I signed the contract for getting access, but then nothing happened. Weeks went past and I was told there was a hiccup somewhere and access was delayed. Eventually, I was instead offered that someone else, who has access to the model, could run a scan and analysis on curl for me using Mythos and send me a report. To me, the distinction isn’t that important. It’s not that I would have a lot of time to explore lots of different prompts and doing deep dive adventures anyway. Getting the tool to generate a first proper scan and analysis would be great, whoever did it. I happily accepted this offer. (I am purposely leaving out the identity of the individual(s) involved in getting the curl analysis done as it is not the point of this blog post.) ## AI scans of curl Before this first Mythos report, we had already scanned curl with several different very capable AI powered tools (I mean _in addition to_ running a number of “normal” static code analyzers all the time, using the pickiest compiler options and doing fuzzing on it for years etc). Primarily AISLE, Zeropath and OpenAI’s Codex Security have been used to scrutinize the code with AI. These tools and the analyses they have done have triggered somewhere between _two and three hundred_ bugfixes merged in curl through-out the recent 8-10 months or so. A bunch of the findings these AI tools reported were confirmed vulnerabilities and have been published as CVEs. Probably a dozen or more. Nowadays we also use tools like GitHub’s Copilot and Augment code to review pull requests, and their remarks and complaints help us to land better code and avoid merging new bugs. I mean, we still merge bugs of course but the PR review bots regularly highlight issues that we fix: our merges would be worse without them. The AI reviews are used _in addition_ to the human reviews. They help us, they don’t replace us. We also see a high volume of high quality security reports flooding in: security researchers now use AI extensively and effectively. Security is a _top_ _priority_ for us in the curl project. We follow every guideline and we do software engineering properly, to reduce the number of flaws in code. Scanning for flaws is just one of many steps to keep this ship safe. You need to search long and hard to find another software project that makes as much or goes further than curl, for software security. Steps involved in keeping curl secure ## May 6, 2026 It was with great anticipation we received the first source code analysis report generated with Mythos. Another chance for us to find areas to improve and bugs to fix. To make an even better curl. This initial scan was made on curl’s git repository and its master branch of a certain recent commit. It counted 178K lines of code analyzed in the src/ and lib/ subdirectories. The analysis details several different approaches and methods it has performed the search, and how it has focused on trying to find which flaws. A fun note in the top of the report says: > curl is one of the most fuzzed and audited C codebases in existence (OSS-Fuzz, Coverity, CodeQL, multiple paid audits). Finding anything in the hot paths (HTTP/1, TLS, URL parsing core) is unlikely. … and it correctly found no problems in those areas. Completely unscientific poll on Mastodon about people’s expectations for Mythos scanning curl ## The size of curl curl is currently 176,000 lines of C code when we exclude blank lines. The source code consists of 660,000 words, which is 12% more words than the entire English edition of the novel War and Piece. On average, every single production source code line of curl has been written (and then rewritten) 4.14 times. We have polished on this. Right now, the existing production code in git master that still remains, has been authored by 573 separate individuals. Over time, a total of 1,465 individuals have so far had their proposed changes merged into curl’s git repository. We have published 188 CVEs for curl up until now. curl is installed in over _twenty million instances_. It runs on over _110 operating systems_ and _28 CPU architectures_. It runs in every smart phone, tablet, car, TV, game console and server on earth. ## Five findings became one The report concluded it found **five** “Confirmed security vulnerabilities”. I think using the term _confirmed_ is a little amusing when the AI says it confidently by itself. Yes, the AI thinks they are confirmed, but the curl security team has a slightly different take. Five issues felt like nothing as we had expected an extensive list. Once my curl security team fellows and I had poked on the this short list for a number of hours and dug into the details, we had trimmed the list down and were left with _one_ confirmed vulnerability. The other four were three false positives (they highlighted shortcomings that are documented in API documentation) and the fourth we deemed “just a bug”. The single confirmed vulnerability is going to end up a _severity low_ CVE planned to get published in sync with our pending next curl release 8.21.0 in late June. The flaw is not going to make anyone grasp for breath. All details of that vulnerability will of course not get public before then, so you need to hold out for details on that. The Mythos report on curl also contained a number of spotted bugs that it concluded were not vulnerabilities, much like any new code analyzer does when you run it on hundreds of thousands of lines of code. All the bugs in the report are being investigated and one bye one we are fixing those that we agree with. All in all about twenty bugs that are described and explained very nicely. Barely any false positives, so I presume they have had a rather high threshold for certainty. curl is certainly getting better thanks to this report, but counted by the volume of issues found, all the previous AI tools we have used have resulted in larger bugfix amounts. This is only natural of course since the first tools we ran had many more and easier bugs to find. As we have fixed issues along the way, finding new ones are slowly becoming harder. Additionally, a bug can be small or big so it’s not always fair to just compare numbers ## Not particularly “dangerous” My personal conclusion can however not end up with anything else than that the big hype around this model so far was primarily marketing. I see no evidence that this setup finds issues to any particular higher or more advanced degree than the other tools have done before Mythos. Maybe this model is a little bit better, but even if it is, it is not better to a degree that seems to make a significant dent in code analyzing. This is just _one_ source code repository and maybe it is much better on other things. I can only tell and comment on what it found here. ## Still very good But allow me to highlight and reiterate what I have said before: AI powered code analyzers are _significantly_ better at finding security flaws and mistakes in source code than any traditional code analyzers did in the past. All modern AI models are good at this now. Anyone with time and some experimental spirits can find security problems now. The high quality chaos is real. Any project that has not scanned their source code with AI powered tooling will likely find huge number of flaws, bugs and possible vulnerabilities with this new generation of tools. Mythos will, and so will many of the others. Not using AI code analyzers in your project means that you leave adversaries and attackers time and opportunity to find and exploit the flaws you don’t find. ## How AI analyzers differ * They can spot when the comment says something about the code and then conclude that the code does not work as the comment says. * It can check code for platforms and configurations we otherwise cannot run analyzers for * It “knows” details about 3rd party libraries and their APIs so it can detect abuse or bad assumptions. * It “knows” details about protocols curl implements and can question details in the code that seem to violate or contract protocol specifications * They are typically good at summarizing and explaining the flaw, something which can be rather tedious and difficult with old style analyzers. * They can often generate and offer a patch for its found issue (even if the patch usually is not a 100% fix). ## More details from the report **Zero memory-safety vulnerabilities found.** Methodology note: this review is hand-driven analysis using LLM subagents for parallel file reads, with every candidate finding re-verified by direct source inspection in the main session before being recorded. The CVE to variant-hunt mapping was built from curl’s own vuln.json. No automated SAST tooling was used. This outcome is consistent with curl’s status as one of the most heavily fuzzed and audited C codebases. The defensive infrastructure (capped dynbufs everywhere, `curlx_str_number` with explicit max on every numeric parse, `curlx_memdup0` overflow guard, CURL_PRINTF format-string enforcement, per-protocol response-size caps, pingpong 64KB line cap) systematically closes the bug classes that would normally be productive in a codebase this size. Coverage now includes: all minor protocols, all file parsers, all TLS backends’ verify paths, http/1/2/3, ftp full depth, mprintf, x509asn1, doh, all auth mechanisms, content encoding, connection reuse, session cache, CLI tool, platform-specific code, and CI/build supply chain. ## AI finds existing kinds of errors It should be noted that the AI tools find the usual and established kind of errors we already know about. It just finds new instances of them. We have not seen any AI so far report a vulnerability that would somehow be of a novel kind or something totally new. They do not reinvent the field in that way, but they do dig up more issues than any other tools did before. ## More to find These were absolutely not the last bugs to find or report. Just while I was writing the drafts for this blog post we have received more reports from security researchers about suspected problems. The AI tools will improve further and the researchers can find new and different ways to prompt the existing AIs to make them find more. We have not reached the end of this yet. I hope we can keep getting more curl scans done with Mythos and other AIs, over and over until they truly stop finding new problems. ## Credits Thanks to Anthropic and Alpha Omega for providing the model, the tools and doing the scan for us. Thanks also to the individual who did the scan for us. Much appreciated! Top image by Jin Kim from Pixabay Thanks for flying curl. It’s never dull.
Hawk Ticehurst
@hawkticehurst.com

A year of work later and we can finally tie a bow on this series of web component perf threads. I built a fully declarative, compile-time reactive framework on web components. In the latest JS Framework Benchmark, Roqa is the 2nd fastest (unflagged) – beating Ripple, Vue Vapor, Solid & Svelte. 🏎️💨

Hawk Ticehurst@hawkticehurst.com

The idea of web component “overhead” is overblown — to even my own surprise! Rendering 1000s of nested WCs is *more* than competitive with the heavyweight champs of the web framework world. We’re talking S/S+ tier perf depending on the initialization method. Cont…

Hawk Ticehurst
@hawkticehurst.com

And to tie up another convo: @rich-harris.dev (and @ryansolid.bsky.social) here’s what I came up with! Took the learnings from last year, plus a whole boatload of research in between, and landed on a declarative web components model I feel pretty happy about. github.com/roqajs/roqa

rich harris@rich-harris.dev

As Ryan alluded to elsewhere in the thread, I think 'idiomatic' is overselling things somewhat. I suspect it would be hard to build a pleasant abstraction from these findings, but I'm interested to see what you come up with

Hawk Ticehurst
@hawkticehurst.com

I'm also not quite finished. This JSX compiler was just a proving ground to make sure the baseline web component model and execution was undeniably fast. Now that we know the output is world-class... I have much bigger plans for what Roqa is actually going to be. More on that this summer 🤫

Hawk Ticehurst
@hawkticehurst.com

Last year I prototyped a feature in VS Code where your entire chat thread was editable, meaning you could edit mistakes, cut out bad context, etc. It was fun to play with but from my experience it was kind of a wash for improving performance. Most of the time starting a fresh chat was better.

David Buchanan@retr0.id

I wonder if you could improve agent performance by editing out corrected mistakes from context retroactively (as if it always got things right first try)

Hawk Ticehurst
@hawkticehurst.com

Congrats to the Zed team! Huge milestone

Zed@zed.dev

We've shipped more than a thousand versions of Zed, but all of them began with zero. Today, that changes. zed.dev/blog/zed-1-0

Hawk Ticehurst
@hawkticehurst.com

🌶️: If we were still writing all our apps in vanilla web tech in 2026, the state of the web would be at least 100x worse than what it is today. React's model won because good abstractions are good! Creating better abstractions is like kind of the *entire* deal when it comes to programming / software

dan@danabra.mov

it’s always funny to me when people try to paint react as some kind of “big company” propaganda. it was like one person’s wild idea and then there was at most ~5 people maintaining it for years. people HATED it when fb open sourced it. the only reason it won is because the model was actually good

Hawk Ticehurst reposted

Hank Green
@hankgreen.bsky.social

NASA and Mamdani are proving that Americans are desperate to see their money spent in ways they feel good about. This, however, is not the same thing as simply spending the money on things we would feel good about but never know happened. People need to be able to see it.

Hawk Ticehurst
@hawkticehurst.com

Wow! Someone has literally already been building it, atproto community moves quick www.aetheros.computer

Hawk Ticehurst@hawkticehurst.com

Depending on how the winds of the future blow, a social filesystem could also be the foundation for an entirely new computing platform where your OS is portable / device agnostic Like @rsms.me’s Playbit, but anyone could come along make a Playbit competitor and still access the same filesystem/data

Hawk Ticehurst
@hawkticehurst.com

On my 2030s bingo card: ATProto eventually becomes *the* desirable and premium app ecosystem because if you enshittify your app you die The apps that win will win because they’re literally the best or most specialized at what they do

Guido X Jansen@gui.do

That means we need new moats. Deeper specialization. Better UX. Domain expertise. Community trust. Optional premium features. Enterprise integrations. The old thinking of "my proprietary access to data protects me" is exactly the Big Tech model we're here to leave behind.

Hawk Ticehurst
@hawkticehurst.com

Can someone explain what the long term road map / vision for @npmx.dev is? I saw this post saying there's a 10+ year vision for it, but haven't been able to find more info Also super curious how the PDS work plays into this vision as well -- something I wouldn't expect from an alt NPM client

npmx@npmx.dev

what we're building will take us ten years or more, we can't sprint a healthier online future

Hawk Ticehurst
@hawkticehurst.com

Yeah! Worth mentioning for those who may not have seen: The most recent @vscode.dev release shipped a preview for natively using third-party coding agents like Claude and Codex with the VS Code chat UI

code.visualstudio.comJanuary 2026 (version 1.109)Learn what is new in the Visual Studio Code January 2026 Release (1.109).
Ian@woolie.meowmeow.city

I think I might prefer using Claude through the VS Code Github Copilot interface than the native Claude VS Code extension.

Hawk Ticehurst reposted

Jeppe Reinhold 🇩🇰
@reinhold.is

Y'all are sleeping on VSCode's AI UX. Their velocity here is wild, they keep building so many great features that improves the agent experience. I also think GitHub Copilot is fantastic, but if Claude Code is more your jam, you can use custom agents now within VSCode's chat, which is pretty cool.

Visual Studio Code@vscode.dev

You told us you’re running multiple AI agents and wanted a better UX. We listened and shipped it! Here’s what’s new: 🗂️ Unified agent sessions workspace for local, background, and cloud agents 🔀 Parallel subagents 💻 Claude and Codex support for local and cloud agents 🌐 Integrated browser & more...

Hawk Ticehurst
@hawkticehurst.com

Got to watch IRL and it's easily one of my favorite talks / takes on AI-driven development I've seen so far Rich (as always) wonderfully threads the needle of taking a critical look at this topic without being AI-pilled or anti-AI. He's nuanced, funny, and treats the topic with respect

rich harris@rich-harris.dev

I cover quite a lot of ground in this talk, but the bit I hope people take away from it is that AI-driven development poses dangers that we're not talking about nearly enough. This clip was recorded before we knew how prominently Elon features in the Epstein files: 🎞️ youtube.com/clip/UgkxImh...

youtube.comYouTubeShare your videos with friends, family, and the world
Hawk Ticehurst
@hawkticehurst.com

It's wild how much has changed in the last 100 days (literally) –– both in terms of LLMs and VS Code agent features. @vscode.dev release notes are now generated with a tiny custom web app. Took 1 day to design and build. I would have never considered even attempting this before.

Hawk Ticehurst@hawkticehurst.com

Lol you got us. Fixed this release ;) bsky.app/profile/vsco...

Hawk Ticehurst
@hawkticehurst.com

And the app itself is nothing fancy. Just vanilla HTML, CSS, and TS + a little Vite to keep all together –– it's a really powerful lightweight combo

Hawk Ticehurst reposted

Visual Studio Code
@vscode.dev

You told us you’re running multiple AI agents and wanted a better UX. We listened and shipped it! Here’s what’s new: 🗂️ Unified agent sessions workspace for local, background, and cloud agents 🔀 Parallel subagents 💻 Claude and Codex support for local and cloud agents 🌐 Integrated browser & more...

Hawk Ticehurst
@hawkticehurst.com

Lol cool, a year and some change later this blog post made it to HN front page today news.ycombinator.com/item?id=4667...

news.ycombinator.comCSS Web Components for marketing sites | Hacker News
Hawk Ticehurst@hawkticehurst.com

Hot take: I think “regular” web components (the ones with Shadow DOM and friends) are a terrible solution for marketing website design systems hawkticehurst.com/2024/11/css-...

hawkticehurst.comCSS Web Components for marketing sitesThe truly No JavaScript web component.
Hawk Ticehurst
@hawkticehurst.com

Depending on how the winds of the future blow, a social filesystem could also be the foundation for an entirely new computing platform where your OS is portable / device agnostic Like @rsms.me’s Playbit, but anyone could come along make a Playbit competitor and still access the same filesystem/data

𝕮@chrisshank.com

The foundation of personal computing is the filesystem. The foundation of the internet is a networked filesystem. The foundation of a new social web will likely be a social filesystem. (It remains an ope question if atproto is such a foundation)

Hawk Ticehurst reposted

Ben Collins
@bencollins.bsky.social

Half the battle with this guy is just reiterating government can and already does good things that are so ubiquitous they’ve become invisible. He’s able to remind you in a way that you understand that good government can exist outside of a 24/7 vengeance operation, and in NYC already does.

Mayor Zohran Kwame Mamdani@mayor.nyc.gov

Stay warm, stay safe New York.

Hawk Ticehurst reposted

Chris Coyier
@chriscoyier.net

I like this setting for VS Code from Ben Frain. JUST show the vertical line for the current indentation, not all of them ``` "workbench.colorCustomizations": { "editorIndentGuide.background1": "#00000001", "editorIndentGuide.activeBackground1": "#ff9900" } ``` benfrain.com/vs-code-high...