Jacob Bolda

Jacob Bolda

@jacobbolda.com

Board and Core Team @tauri.app Senior Software Engineer @frontside.bsky.social | Consulting for Fortune 100 | frontside.com 📺 watch | youtube.com/@JacobBolda 📖 read | www.jacobbolda.com 🧑‍💻 code | github.com/jbolda

439 followers321 following491 posts

That better be their last seat at the table.

these fucking guys, man. “surely there must have been some mistake” “nah bro we did that on purpose and our company culture is so wild this is a normal thing to say on the public Internet”

Woo that's bad.

nightshade →home, for now@nightshade.technology

details leaked. this vulnerability is a full unauthenticated unconditional remote code execution exploit against any service running on a PHP version from 5.4 until latest yeah if anything deserves CVSS 11, this is it. this is CATACLYSMICALLY bad.

Jacob Bolda reposted

Replying to @anildash.com

This is part of the endgame of Big AI in an era when everything we do is mediated through digital platforms. This is also why I keep trying to tell people that just wishing AI away isn’t a useful or effective answer — there has to be actual *countermeasures*. That means alternative technologies.

Jacob Bolda reposted

Hi, I’m a sighted alt text user! Here are some reasons I use it: - Slow Internet on an airplane - I’m over 40, I have no idea who that celebrity is - Bluesky broke images again - My vision sucks and that text is too small to read otherwise - Conveys further context and authorial intent

This post is unavailable.

Well, got lucky with the wait-list lottery, and pulled the trigger. The steam frame isn't perfect and a bit pricey in this current market. It checks enough of the boxes though for what I've been waiting for for more than a decade now 😅

Amazing but color me unsurprised

Micah Lee@micahflee.com

HaJ3FgupAm8RrDJW3MHgT9X7Ft27eVaD What is that? That's a hard-coded API token that Flock cameras use to identify themselves and get OAuth credentials, which can then be used to talk to Flock's production servers. Like, anyone on the internet can probably do this right now.

I've been waiting for wireless PC VR for sooo long 🥹

Valve@valvesoftware.com

Steam Frame is here! Our wireless VR headset + controllers, available now in the following models: Steam Frame 256GB Steam Frame 1TB Sign up now and learn more on @steampowered.com : store.steampowered.com/hardware/ste...

This is such a strong comparison.

Anil Dash@anildash.com

There are a lot of people who think their parents got their brains destroyed by Fox News, but somehow they’re not getting their brains destroyed by staying on Twitter.

Remove all those TV apps, folks! 🧵

Bruno Dies@brunodias.dev

If you want to do something about the onslaught of AI crawling DDoSing every website on the internet: check to see if something you own is a residential proxy. Smart TVs are the most common culprit. Ideally, disconnect them from the internet entirely, but if not that at least uninstall unused apps.

Building things is always better with friends 🎉 So excited for what's to come!

bombshell@bomb.sh

exciting news! we've partnered with @frontside.com together we're bringing their work on clayterm into the ecosystem as @bomb.sh/tty, a high-performance wasm renderer for terminal apps and we're jointly contributing $400/mo to support maintenance of the underlying clay layout engine

Real excited for more of this. Just need to figure out how to buy more time to play with it!

bombshell@bomb.sh

glyph coverage for borders/curves is particularly poor, so subcell precision for those does require fancy kitty graphics support but we'll use the highest fidelity we can—the second row in the fill demo below renders in any terminal because eighth-blocks provide subcell precision using only glyphs

Jacob Bolda reposted

clack 1.6.0 is out. keyboard hints on select menus, cleaner note() output, and a handful of fixes that make multiline + password prompts behave the way you'd expect. big thanks to @florian-lefebvre.dev for helping ship this 💣

github.comRelease @clack/prompts@1.6.0 · bombshell-dev/clackMinor Changes #568 f87933f Thanks @florian-lefebvre! - Updates default formatter of note() to note dim lines anymore If you want the old behavior, provide a format() function: import { note } fro...

Jacob Bolda reposted

Given the feedback, we decided to move forward and start verifying maintainers and projects in the npm ecosystem. Later on, large ecosystem projects could also become verifiers for their communities. Reach out if you're interested in these conversations! Here are the first 100+ verifications 🩷

atproto.atapp.bsky.graph.verification - @npmx.devBrowse @npmx.dev's app.bsky.graph.verification collection on Taproot
npmx@npmx.dev

We've started by verifying npmx maintainers. Log in to mu.social to see the verified badges! We'd like to discuss the best strategy for our communities with OSS maintainers. Should all large enough OSS projects be verifiers? Or would it be better for a few orgs/foundations to take on the task?

Jacob Bolda reposted

… are fucking kidding me. A github.com cross-account RCE due to the most pedestrian of injection attacks along the obvious exposed surface… and they actually have a globally shared “git” UNIX user!! This is not what taking the role of supply chain stewards seriously looks like.

wiz.ioGitHub RCE Vulnerability: CVE-2026-3854 Breakdown | Wiz BlogA CVSS 8.7 vulnerability in GitHub Enterprise Server allows remote code execution. Read the threat brief and find vulnerable GHES instances from Wiz.

Getting real excited to use this to build utility CLIs in TS that just weren't really possible before.

Charles Lowell@cogentdude.com

Just put together an initial implementation of transitions for clayterm. Yes, these are just terminal apps.

Jacob Bolda reposted

Added "line" mode to clayterm to support nice interactions in normal scrolling CLIs. The trick: 1. render frame continuously into the region at the bottom. 2. "commit" the final frame to scroll history. Non-terminal pipes like CI logs see the last frame only, so look nice github.com/thefrontside...

Jacob Bolda reposted

🚨 Active supply chain attack on axios@1.14.1. The latest version pulls in plain-crypto-js@4.2.1 -- a brand-new package that didn't exist before today. We're still investigating. If you use axios, pin your version and audit your lockfile. socket.dev/blog/axios-n...

socket.devSupply Chain Attack on Axios Pulls Malicious Dependency from...A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHu...

Jacob Bolda reposted

To celebrate the launch of the @npmx.dev alpha, I wrote up a guide on how to make your first contribution to an open-source project. Let me know if this helps you make your first contribution (and it doesn't have to be code)!

whitep4nth3r.comHow to make your first contribution to an open source projectGetting involved in open source doesn't have to be scary! Understand how to find a great project and make your first contribution in this ten-step guide.

Jacob Bolda reposted

Heartbreaking. Take the time to read this post. We're doing such a terrible job as a society in distributing resources. Emelia's work is so valuable. We need her focused on open networks. She would be fully funded in any sane universe. Hire her. Or donate to help her thrive so she can help us.

Emelia@thisismissem.social

So here's a short write up explaining what happened today and what I'm going through, at a high level. It does include some history too, but I tried to keep it brief.

Jacob Bolda reposted

Protests happen, but most of what is happening in Minneapolis isn’t protesting. More accurate terms: - observers - witnesses - volunteers - neighbors - residents - people

Lydia Polgreen@polgreen.bsky.social

One thing that irks me: people keep calling the folks on the streets in Minneapolis protestors. They are not generally there to protest, they are there to observe and document. This is the product of organizing and mutual aid. It is telling that these acts of citizenship are seen as protest!

Jacob Bolda reposted

With Elon enabling and profiting of the production of CSAM (Child sexual abuse material), I finally think of Twitter as X now

Jacob Bolda reposted

Interop is brilliant. Aligning the efforts of all browsers around crucial focus areas every year is doing wonders for interoperability, and its effect is compounding.

Jen Simmons@jensimmons.bsky.social

Switch to the “experimental” tab (which is not about experimenting, but about what is definitely coming soon) and you can see that every browser reached at least 98. Once all this engineering work ships in browsers, the overall interoperability for these 19 Focus Areas is 96%! wpt.fyi/interop-2025

Jacob Bolda reposted

ECMAScript excitement 😉 The Temporal API ships in Chrome 144 Beta today 🎉 developer.chrome.com/blog/chrome-... Right on time. Arriving in the Chrome Stable release in approximately one month!

developer.chrome.comChrome 144 beta  |  Blog  |  Chrome for DevelopersLearn about the latest features shipping in Chrome.
Rob Palmer@robpalmer.bsky.social

ECMAScript excitement 😉 Congrats to @manishearth.bsky.social on unflagging TC39 Stage 3 Temporal in V8 today. Heading for Chrome 144 🎉 By many metrics this new date-time API is the single biggest change to JS ever 🔥 V8 uses Boa's temporal_rs by @jason-williams.co.uk Kevin Ness & Manish 👍

I've turned on automatic tab closing on my new phone, in part, because my previous phone still has 300 tabs open. It's jarring but... I think I might like the forced cleansing? Helps to force me to immediately shift something to a long term location if I really care.

One of those days where I found a werewolf shaped problem for a client. Wasn't specifically looking for that type of problem, but glad I had that silver bullet ready.

I am the destroyer of useEffect. I ruthlessly cull the many instances in each component I touch. Also, please stop. I have enough on my hands making certain the node_module black hole doesn't kill us first.

I probably don't talk about it enough, but we made a package to help in building up a changelog and handling releases. We made it for @tauri.app as we needed to release multiple Rust crates and JavaScript npm packages all from the same repo, coordinated. github.com/jbolda/covec...

github.comGitHub - jbolda/covector: Transparent and flexible change management for publishing packages and assets.Transparent and flexible change management for publishing packages and assets. - jbolda/covector

If you need to release one or many of those (and other languages too!), then give it a look. We also use it for publishing our GitHub Action and VSCode extension.