#random (2023-09)

This might be the context you seek: https://devclass.com/2023/09/07/ruby-on-rails-creator-removes-typescript-from-turbo-framework-upsets-community/

This is the 2nd post I came across today about ditching Typescript…

I’m not sure two posts makes something a trend. And in this particular article the only thing I’d consider “fighting” is people arguing to keep typescript.

Why would people ditch typescript

apparently more people are fed up with M$, I heard many people didn’t like M$ 20 years ago and I didn’t know why but now I knew after OpenAI’s sneak attack

People have been bashing MS for decades, and much of it has been deserved. Especially given their embrace, extend, extinguish strategies.

That said, I’ve never seen anyone say they were ditching/avoiding typescript because they don’t like MS (though it very well could happen).

The reason I’ve seen has been that JavaScript is good enough now, and doesn’t require a build step. Both valid points, but typescript isn’t going anywhere.

I vividly remember seeing dozens of “java is dead” articles in the early 2000s. Clearly it was not. Saying that people are fighting against typescript feels like a modern iteration of that kind of thing.

just came across this video published in 24 hours https://www.youtube.com/watch?v=5ChkQKUzDCs

it may or may not be the trend but the industry is more cautious about what M$ is doing after OpenAI

Perhaps, but that’s not going to drive a large migration away from MS created tech by engineering teams. If a team chooses something because it’s the cool new thing and then moves away from it as soon as anything negative comes out about the creator of the tech, that team isn’t going to get much actual work done.

Are people abandoning Visual Studio, VS Code, MS Office, .Net in large numbers because of this stuff? Nah. We may bitch and whine about it, but in the end we’ll keep using the tools that we believe get the job done.

ThePrimeTime joined, https://www.youtube.com/watch?v=Bv3YhGku92w

I believe a lot of the migration has been for library/framework maintainers

As in, the burden of maintaining typescript isn’t really needed. Especially with jsdoc annotations.

Svelte is a much better example of a rational choice than whatever twitter vomit DHH makes.

I don’t think ThePrimeTime saw this in his new video, https://www.youtube.com/watch?v=Bv3YhGku92w

Meet the second day of DevOpsDays Ukraine: Disaster Recovery! We will go live at 6:00 pm by Kyiv time. If you’re not with us yet, you still can register and join the second day of DevOps talks. Also after event we’ll send all participants records https://www.devopsdays.com.ua/

OMG I haven’t thought of Sixel for decades.

Does it have to be Sixel? iTerm2 supports rendering images to the screen, see imgcat (macOS only, alas)

Lol. I just got used to being able to pipe vegeta attack output onto jplot…. there’s probably a Linux way, but I haven’t looked into it yet.

Just need something to make an active chart in the term…

Often I’ll do something like this, where “makeplot” will render plot to plot.png file:
while sleep 30 ; do date ; ./makeplot.sh ; imgcat plot.png ; done

In editor, update data and makeplot script. Results will be shown in terminal 30 seconds later.

Nice. I’ll see about it soon. Have some load tests to do.

Ty

Sweeeet. I went from PoC to Production after taking Mumshad’s course on k8s 5 years ago.

That’s awesome!

sonarcloud - to the best of my knowledge - does not nor do they plan to implement SCA, and choose to focus on the sast side of the product.

For self-hosted, there used to be plugins, but that configuration is not supported by sonarcloud.

the toolchain aboove is what i refer to as legacy sast, and although it has its place, i personally feel it raises too many false positives to be really useful.

have you considered a tool change? tools such as snyk (what i would refer to as nextgen sast) offer both sca and sast in the same tool, although they dont highlight code quality, they offer licensing compliance, sca, sast, and iac scanning in a single pane of glass.

I’ve checked on synk, but it seems quite costly & I’m looking at solving somewhat same problem using open source. I’ve come down to following tools in my research so far

• SCA - Dependabot / Renovate

• SAST - SonarCloud

• DAST - Currently WIP. Not sure yet Let me know if you’ve any other suggestions for me

Sast - semgrep Dast - golismero, zap, burpsuite, nikto

Have you seen fossa ?

Nope I haven’t heard about fossa yet.

I’m assuming above tools can be integrated in CI/CD pipelines easily, We use circleci in our environments

Sonar community have confirmed that they don’t do any Software composition analysis (SCA). Ref

Github.com/fossas Yeah, im aware that sonarcloud doesnt plan to step into the sca market.

Yes, many of the tools i mentioned above can be automated, but you would have to do the work on getting a good result and centralised systems that can handle the information results

I’ll check out the tools & also share some findings here! Thanks @Alanis Swanepoel

gimme a shout anytime, this is one of my speciality domains

(both oss and app-sec)

Seems like fossascli needs a signup too. I’ll look at some alternatives to it.