Platformatic.dev Co-Founder & CTO, Node.js TSC member, Lead maintainer Fastify, Board OpenJS, Conference Speaker, Ph.D. Views are my own.
@nodeland.devno software is well defined
Matteo Collina
@nodeland.dev
@nodeland.dev@nodeland.devStill stand to what I wrote. But if you read the full series, there is essentially a path forward for the tinkerers!
@nodeland.devIndeed they are. And they will get even more unfortunately, as all tech is becoming more and more expensive to join. Sadly.
@nodeland.devwe are doing it again next year!
@nodeland.devMaybe I should see if I can get custom bags for next year!
@bengl.devReposted by @nodeland.devI have sampled the @nodeconf.eu speaker gift (a bag of coffee) and I can confirm that it's pretty tasty!
Thanks @nodeland.dev et al!
(For the curious: I did 383ml to 23g, steeped for 2 min in a Clever Dripper, stir, another 30s, then release.)
@nodeland.devIn the era of AI, our network is what makes us valuable, and the work more enjoyable. (The work is mysterious and important). Go to more conferences.
@nodeland.devAs a maintainer who lives in these flows, this is a huge quality-of-life boost. Trying to triage vulnerability reports with a single free-text box and no way to share private context was painful. GitHub heard us. 👏
@nodeland.dev5. New SecurityAdvisory fields in the GraphQL API.
cveId, sourceCodeLocation, githubReviewedAt, nvdPublishedAt, repositoryAdvisoryUrl, plus severities and isWithdrawn filters. One auth path, one rate limit budget, fewer round trips.
@nodeland.devAnnouncement: github.blog/changelog/20...
@nodeland.dev4. Repository security advisory comments API (public preview). Until now, the triage discussion lived only in the web UI. Now you can list, get, add, and edit comments via the REST API, and get comment counts in responses. I can now fully automate this via my custom Pi configuration.
@nodeland.dev3. Confidential comments on repository security advisories.
Post comments visible only to maintainers. No more moving your abuse/investigation notes to Slack when a reporter can see everything. Clearly marked, permission-aware, and audit-logged.
@nodeland.dev2. Rate limits for private vulnerability reports.
Bulk and automated reports were burying the real ones. Now there's a daily per-user cap, you can set a custom repo limit, and add trusted reporters to an allow list. Legit researchers get through, spam doesn't.
@nodeland.devAnnouncement: github.blog/changelog/20...
@nodeland.dev1. Structured forms for private vulnerability reports. No more single free-text box. Now reporters fill in a summary, details, PoC (min 150 chars), and impact. You can even customize the form via .github/VULNERABILITY_REPORT.yml and require a CWE. Reporters can also disclose whether they used AI. 🎯
@nodeland.devBig shoutout to @GitHub this week. In two days, they shipped a stack of security advisory updates that maintainers have been asking for for a long time. 🛡️
@nodeland.devSo do I still read code written by AI? Every single line. The human in the loop isn't a bug to be optimized away. It's the feature to protect.
See you next wednesday for the full conversation 👇
streamyard.com/watch/PDmxZD...
@nodeland.devAn academic paper just confirmed what I've been arguing: the bottleneck is judgment, and it's getting more valuable. Not prompting. Not "agentic infrastructure." Judgment.
@nodeland.devMy worry isn't that software development is dying. It's that "I didn't review it, the AI wrote it" becomes an acceptable excuse. At AI speed, the scale of damage when you ship code you don't understand is enormous.
@nodeland.devThe moment I stop reviewing is the moment I stop being responsible for what I ship. AI is just another contributor now. I review its PRs like I review anyone else's, and I decide if it's good enough.