Do You Read The Code?

This is another argument I have about React is we've kind of stagnated. There's not a lot of innovation.

AI is just spitting out the same old React. And so in a sense, that kind of feels like we're stuck. Like, even if something like this comes along and it does it better, it doesn't matter because it doesn't have the critical mass. And AI is just gonna poop out, like, bad React code with a bunch of use states and use effects in it anyways, but something better might come along.

What's up, everybody? It's Syntax Live. Another wonderful Monday as we get into some stuff here. We're gonna be talking about reading code. Is that a thing you should be doing? What are people talking about? Because it seems like there has been a lot of conversation on if you read the code and a ton of really interesting people have chimed in on this.

I have a feeling like I'll know your answer a bit, CJ.

Yes, I have thoughts.

Yes.

What's up, everyone? It's kind of shocking that we are just slightly late to this, given that this is the first episode without Wes, who is kind of Is Wes ever late? I guess Wes isn't late. Maybe it's me. He's an on time guy. Yeah. Yeah. Maybe it's my fault. Sorry, folks. I'll take responsibility I'll for that. But what's up? Welcome to Syntax Live. Every single week, we get into the topics that are going on the web. We're getting into new libraries.

We're getting into new projects and we're getting into what people are talking about. My name is Scott Tolinski, and with me today is CJ Reynolds. What's up, CJ?

Hello.

Not much.

So I'm not a soccer watcher or football watcher, but I did watch the Mexico versus England game. Saw you watching the the World Cup at all? Are you watching? I... You know what? I'm not a big soccer guy either. Okay.

But I did watch that game, and that was an exciting ass game. That was crazy. Spectacle. Like, red cards. Yeah. Penalty kicks. Like, yeah. It was... I was sad Mexico didn't win, but it was an incredible game. Yeah. I'm good here. I'm I'm I'm the the mind that soccer would be better if, one, the the players obviously didn't flop around on the ground. That's that's table stakes for me. Like, as a hockey watcher much. Yeah. Yeah. As a hockey watcher, it's like, come on, guys. You know, the hockey players will take a a puck to the the face, lose a bunch of teeth, and keep playing. Like, you can get up. It actually really bugs me on defense when a defenseman, like, goes down and lays down. Like, brother, you need to be standing up and helping your team. What are you what are you Yeah.

But I I also like the opposite, though. So near the end of the game, someone got really hurt, like, rolled his ankle. They just dragged him off the field and kept playing because there was, like, two minutes left. So I thought that was hilarious that they don't pause the game. They just, like, we gotta we gotta get this corner kick.

Yeah. Yeah. But it would be fun if there was, like, actual... Like, we need a penalty box in soccer. We need, like, actual fights. Put them in the box for ten minutes. Let them cool off. Let them cool off.

I know. I'll make I'll make football people mad about my takes on on soccer. But another one for me is no offsides. Get rid of offsides. Let them cherry pick. Let them just kick the ball down, run and score goal. Let's get some goals going.

That's my caveman approach to soccer right there. That's how I fix it. Nice. I'm excited to get into it. I I think... So I've... Personally, I've been staying off of x, but Scott did bring this to my attention, and I've been reading some of the replies. So, Scott, do you wanna get into this this first story? Do you still read the code?

Yes. CJ, I gotta say, how could you stay off of X, the everything app? The app that has everything.

The everything app. Yes. Check it once a week before we go live. It's good for your mental health. But... Yeah. Yeah. I believe that. Yeah. Man, I gotta say one thing that X has been doing a terrible job lately is serving me a bunch of crazy reaction videos. Like, I don't care. Like, this is not TikTok. I don't wanna see somebody else watching a video. Either way, the tweet is how much better do the models have to get before you stop reading the code? And that led to responses from all kinds of people.

So even just this first one here, man, it's crazy the amount of people that that chimed in on this. So like David Capeano, Justin Schroeder says negative 20%. Reading the code is meaningless now. It always was. You have to verify it. Interesting.

Cheng Lau, reading code. I barely even look at the folder structure now.

That's mister pretext himself.

ReasonML, Glauber from, Terso. For database or OS code, I will expect that never.

A lot of us still routinely read assembly code. So Glauber is big on reading the code, which, I mean, Terso, great product. So...

Yeah. Would think, like, with Glauber... So he's... He maintains a framework. He maintains a library that people use. And I actually watched a video. It was an interview with Rich Harris, the creator of Svelte, and he talked about how, like, if you're creating a library or a framework, you kinda still need to be reading the code because you're on a bit of a frontier in a sense. Like, that the thing you're making doesn't exist. So I would expect that, and I would hope, that people creating the libraries that we use are still reviewing it in a... With a human in some way.

Yeah. Otherwise, you're gonna get Openclaw, which Openclaw for all of its... You could argue that that because of its popularity, that doesn't matter. Every single time you update Open Claw, it breaks. Where, like, Hermes, they do read the code, and it is more curated, and Hermes never breaks. So, yeah, that's just anecdotal right there. Prime Engine says, I think this read code slash don't read code really comes down to one thing. Dude, devs need something to fight about. This is our new React. And Prime is... Nails this here because Absolutely. Before this is is HTML a programming language? There's just an endless amount of bike shedding on this kind of stuff that happens. So, yes,

devs Yeah. Are just going to fight about anything, reading the code or not. That's not what matters. And I think the answer, just like with everything else, has nuance and lies somewhere in the middle. Because, I mean, personally, if if you've seen my takes on this channel, you would expect that, yes, I read the code. But I will say for some personal projects, for some one off scripts, I don't. I I do actually turn on auto accept edits. And that's because a lot of times, those aren't projects that are gonna have a long life. It's something that I'm I'm just testing out. I wanna get it up and going. So I am more than happy to just let the AI write the code because I'm I'm there to test the functionality or just, like, test the thing itself. But when it comes to production code, when it comes to, like, code that you're shipping for your company or that you're contributing to, you probably should read the code just as an engineer.

If you want to pull up the tweet from Kramer, he responded that says, no good engineer will tell you it's useless to read the code, by the way. That's the easiest signal. I think, like, it's part of our jobs. Like, we have to care. I think, like, if you're too lost in the sauce if you just think that just prompt, prompt, prompt, prompt, prompt. Because that also gets into like, you're not necessarily caring about token usage or bill or efficiency or moving too fast. And these are all things that we actually need to care about in real production code.

So... Yeah. Yeah. I... Kramer is always dead on in my experience. And it's so funny, the people the people that respond to him. And, like, he, like, doesn't know what he's talking about. Like Yeah. Bro.

Yeah, Kramer is like, one, he's a cracked engineer, but he's also built something insanely large.

It's like, Yeah. He runs a, I mean, he's built this business into

a billion dollar company. Like, that's crazy to me. So yeah. If you don't know, like, Kramer is one of the co founders, former CTO, former COO of Century, who we work for as well.

Yeah. I'm not just big upping my boss either. I'll just say that. So... No.

And you can see it from the proof. Like, I mean, we we have a little more insight into this because we can see all his messages in Slack and, like, we hear him from all hands. But, like, this guy, he still is... Even though he's not an engineer or CTO anymore, he's still writing code. He's still using agents. He's still working on workflows. He's he knows what matters.

It's So Man's built a bunch of stuff that I'm using right now. Yep. Whether that's the Dex thing for I use Dex every day. Yeah. Yeah. For my my issue tracking and stuff. We also had David Fowler says, I see a lot of influencers talking about reading the code and building software factories, but I don't see much discourse about what software engineering teams of the future will look like. Software's a multiplayer game as much as everyone will try to convince you that all you need is a team of agents. Yes. I I so much agree. David nailed this. And I think there are some people who are working on this problem. Back when we were at JS Nation, there was a panel that I was a part of and afterwards a discussion room. And a big portion of the room really lined up on the idea of pair prompting and what that looks like in working on agents together. And I think there's some really neat tools coming in this space that I'm not quite sure what I can share yet, but that's a little teaser for maybe future episodes when I can share some stuff. But I I do think that there is some really interesting work being done in that space. What does teamwork look like in this world of AI agents?

I think that's the biggest question. Because a lot of devs have... Even on one individual... One big team, every dev is gonna have their own workflow, and they haven't necessarily figured out how to collaborate on that, like how to share skill files or workflows.

And, personally, like, I... Even though I'm on the syntax team, I'm still kind of a solo dev in in the sense that I'm working on on a lot of side projects.

And all the workflows that I've created are just for me and my ability to, like, write code and review it. But that, I haven't even thought about how that works on a team.

And I think that's gonna that's gonna be the answer moving forward. Be... I mean, I I feel like it is. I feel like there will be some people that say, oh, we don't need teams going forward. And I did see some tweets from... Maybe they were rage baiting, but I saw tweets from people that were like, like, we don't need managers anymore. Just hire a few devs and that's all you need. Like, one or two devs and that's all you need. But I mean, like, real software is built by multiple engineers collaborating and, like, that's we're still not there in terms of how we work with agents. So I think it's something to think about as well. Yeah.

Folks, if you're just joining us, we're talking about does reading the code even matter? Twitter has been a buzz. All... A lot of, like, really interesting people have chimed in on this. This actually was one of my favorite tweets because CJ says some guy named Notch says how much better do the poll requests have to get before you stop reading the code? And I said, do you really not know who Notch is? And he was like, nope. Yeah.

I didn't.

People don't know Notch created Minecraft also. Just Minecraft, something that has been going on every single day in my household for the past billion years. So not just for me, my son is absolutely obsessed with Minecraft like many other third graders. So, yeah, before you stop reading the poll requests. Yes. Poll requests have to get better. That's funny. Yeah.

There's one more tweet from Dax I wanna highlight that's... And he always has the most level headed takes.

He says, guys, stop trying to argue with the code doesn't matter posts and just ask them if they're so ahead of the game, why aren't they richer? Like, he has multiple posts like this. Like, if if if really we don't have to read the code anymore code anymore, like, show me the receipts. Like, are... Have you built a million dollar business with this? Are you, like, actually making money from it? Are you actually more productive? Because it does seem like, especially in the Twitter space, there's a lot of people just spinning wheels and and burning tokens with with not much to show for it. So... I I feel like I... I'm crazy sometimes when I see the amount of people who...

Like, what are you actually making? And is anybody using it? No. You know? So I I mean, there's so much of that.

Somebody... Patrick says, I don't really take this. This famous software engineer says x, so it must be correct argument seriously.

Successful people are wrong all the time. Yes. Patrick, you. No, Patrick. You you don't have to apologize. You wrote this just fine. I can't read. So, no, I think this is... I think it's dead on Patrick.

Yeah. I think it's one... No. Sorry. That's where the nuance comes from. It's just multiple takes. Right? Because not every engineer is gonna have it perfectly right. That's why we're seeing all sides of it. Yeah. Yeah. Totally. The next tweet was from Zach Corman. Zach's a good follow.

And Zach does cybersecurity stuff. I think he's he's a real good follow. He says, I find Theo's takes on this exhausting.

No one knows your process, your role, or the way your brain works, but you. It reminds me of all the people who tell me that I'd stop writing and reading code as a manager without understanding why I did it. Man, this is such a thing where people become a manager. They they feel like, oh, now I have a team of agents to go off and do the work, and then they lose sight on everything where, again, it's the same thing of, like, you kind of have a bigger role than ever to be able to control things.

So Zach is a good follow. Again, cybersecurity stuff, if you are interested in that.

I think it also it also plays into one thought I had, like, in reading this initial thread was the fact that, like, before agents, people already didn't read the code in pull requests. Like, if you're if you're ever working on a team and you made a really big PR, you'd get multiple comments, LGTM, like, looks good to me. So this is an old problem. Right? Just like when there's a lot of code to review, it often doesn't get reviewed to begin with. And now you couple that with the fact that we're producing code at 10 x speed, people are already set in their ways and are already not reviewing. So I don't know. I think we're here to say to, like, take a step back. There was a post from a few months ago. Just... It was like, slow the f down.

Like, we can produce code at 10 x, but should Yeah. From Mario. From Mario. Exactly. Mario Zechner, the creator of pi, says that he slows down and he reads the code. Now me, it... The the... To give my answer to this, whether or not I read the code entirely depends on what project it is. Is it a project I care about? If it's a project I care about, I read the code. If it's not, you know, whatever. Just slap it together. So I... For me, it's an entirely situational dependent thing.

I completely agree.

And, yeah, that's where I'm at as well. It's... And there was a a blog... I need to... I'll link it in the comments if I can find it. There was a blog post that I found on Hacker News that... Very similar to Mario's post about slowing down. It just talked about, like, if you actually wanna be successful with agents, you need to turn off auto accept, and you need to review the changes.

Because we're also getting into the realm of, like, when we were writing code by hand, we're building up this mental model of our code base. Right? As we code, we we learn more about where this code lives, how it relates to the whole system.

We're kind of, like, building up this mental model as we code it. But when you let AI do everything, you're not building up that mental model. So in a sense, that is moving into the realm of, like, what is my job anymore? Like, why why am I even here? So I think you should be slowing down. I think you should turn off, especially on features that you care about, features that need to be engineered well and need to have good code, you should turn off auto accept. You should just slow down. Take your time. There are some things I'm going to say that I don't read if it's something that I don't understand.

For instance, I had an agent port a shader for me to another language, and I don't even know...

I don't know shader... I mean, I... I've, like, tried to learn 800 times to write shaders myself, and I'm not good at it. So when it worked and it was done, I said, fine. That's fine. That's a okay with me. So I think the most exhausting answer and the correct answer to this is it depends. If it's something you care about, it's absolutely worth still reading the code. And if the question that, well, if it works, does it matter? Well, just because something works doesn't mean it's good. Lots of shit works that's no good.

So works is not the bar and works has never been the bar.

But again, dev's gonna be arguing about stuff when they should be talking about what their users need and want.

Definitely.

Yes. Okay. I think we can get off this one. CJ, let's keep it moving here. Syntax Live weekly, every single week. Wes is at the cottage, probably just hanging on the dock. Actually, I think he might be in New York. He's doing something with his family. He's not here today. He's on vacation as CJ and myself. We're talking all things new on the web here. CJ, what else you got for us today? I have for you something very exciting. It is a brand new HTTP

method. So if you're not familiar, the HTTP methods are, like, git, post, put, delete.

Well, give me some other ones, Scott.

Patch? I only I only use git.

I only use git and post. Those are the only two because I... Because the other ones just kind of are there, and I never even consider them. I don't know why. Yeah. Well, they... Yeah. So they exist. And the thing is they've existed for a very long time. So the idea that there would be a new HTTP method is kind of interesting.

But this is... RFC one zero zero zero eight is currently a proposed standard. It hasn't made it into any web browsers yet, but Node. Js has actually implemented this in their server side HTTP module. So if you're implementing a server, you could actually listen for it.

But the idea is... So it's called query.

So now in the long list of methods, so you've got git, put, post, patch, delete, and now query would be a new one. But the idea is sometimes you might have a request that you're cramming data into the query string because you want it to be a a git request.

So in the example here in the introduction, the common query pattern is, like, slash feed, which is some endpoint, and then question marks, you have the query string, and then a bunch of query parameters, like q equals foo, limit equals 10, sort equals minus published. And this is essentially how you craft a request that has some data inside of it. Basically, the data is in the URL Mhmm. And then the server can act on that data. But this is and could be a...

I think the right term is idempotent idempotent request. Basically, it's a request that doesn't modify anything on the server side. It's just a request for data. The server returns something.

And we do this a lot. And the reason we do this is because git, the git method, does not officially support putting data inside of the body of the request.

So typically, if you do have some more complex data that you want to send, but you still have an idempotent request, you would use a POST request. And we actually see this in, like, GraphQL.

If you've ever built a GraphQL API, you do, like, slash... I think it's slash query. It's always a POST request, and then it has a big massive payload of all the things you're requesting or reading.

But that's the reason they use a POST request is because they need more than just the URL state. They need actual data in the body.

And so HTTP Query is here to solve that. Essentially, it's an HTTP GET, but it can have a body. So you can put those query params in the body as, like, form URL encoded params, or you could have JSON inside of the body. You could set the content type to whatever you want. But the idea is this will still be classified as an idempotent request. Like, it doesn't modify anything on the server. It's really just requesting data.

I have this other blog post that shows some more concrete examples.

So, yeah, in practice, essentially, like, GraphQL would be one of the things that could adopt this. So instead of Mhmm. A post to slash API slash GraphQL, they do a query, and then that query includes the GraphQL query in the body.

Similarly, like, they show an example here where instead of using form URL encoded body, they actually use a JSON body. So you have a query request to an endpoint, include JSON, and it's essentially just a JSON version of the query string. But it can get more readable because you can have, like, array types inside of there.

Typically, like with query strings, if you want an array type, you'll have, like, multiple of the same query parameter.

So query. It's coming. It's exciting.

And like I said, it's only supported in Node. Js HTTP module so far. But the idea with an RFC is it's a request for comments.

Implementers of browsers and everyone else can kind of chime in to decide, should this thing exist? Should we kind of change the spec a little bit? And eventually, this will make it across the web. I don't know how long it's going to take, but eventually, if everyone buys in, it will make it across the web and you'll be able to use Query instead of POST or GET.

Interesting.

Yeah. Yeah.

I mean, this is the type of thing where I think... And, you know, what's this gonna do for us devs on a daily basis? But I I think it's neat and it's... Feels modern. It feels nice. Yeah. I don't really have too much other than it's interesting. But... Yeah. I have some comments from

Hacker News I can show. Oh,

good. Good. That's what we need.

The the main take that I think a lot of people have is query is just Git, using Git with a bodywork. So this is one one take that's like...

You may not know this, but you actually can put a body inside of a GET request.

The issue is not every HTTP server can handle that. Not every client can do that. And so that that's the whole idea is, like, you're not supposed to use Git with a body. It's a hack.

So having an explicit method makes sense because it... Yeah. And and their comment here is just because it works doesn't mean it's the right way. But I think that's the the general idea is most people will be like, why do I even care? Why couldn't I... Why don't we just use post request? But I think having something explicit for something we do all the time is the reason why why stuff like this exists. So...

And and honestly, being additive, you know, it's not some game breaking. It's not gonna destroy anything. It's just additive.

You can use it. But... Yeah. Exactly.

Yeah. So, Scott, what do you got for us next? Yeah. I got something

very fun. In terms of very fun where the Internet decided it was going to be giant babies for one day, GitHub, they decided to have a fun little promotion just because the Sony PlayStation announced that they are going diskless.

I had to make sure I I focused really hard when I was saying that word just now, diskless, and that they will no longer be shipping disks in packages. And so GitHub said, oh, we heard you, and we agree in light of recent developments in physical media. GitHub is proud to announce that you can obtain your public repo on a CD ROM.

And they even had a little link here where you can go ahead and get one.

And the the Internet had a very normal response to this where everyone just started complaining about it.

What in the world? Why would we ever want that? What? Why don't you fix your infrastructure? As if the marketing team at GitHub, who's probably just a couple of people putting this promotion on, are the ones going to be single handedly fixing your infrastructure.

Like, oh, let's let's redivert that energy and money. Like, this is costing any kind of money that would then cause GitHub to somehow not be able to fix their infrastructure.

It is crazy. And I had people arguing with me left and right about this thing. I said, this is just a fun promotion. They're like, you gotta think of the optics. It's like, brother, like, people are just in such a dang grumpy complaint about anything that, like, I I I cannot comprehend being mad at this. They're like, you gotta think of the timing and the optics.

I I... Those two takes, like, fine. I can understand the optics of it that GitHub hasn't had the best uptime lately. But the people who are saying, like, it's diverting funds from infrastructure or this is why GitHub is down all the time, Like, you people are so out to lunch.

And and and I don't know. I got somebody grumpy at me. I'm gonna I'm gonna put them on blast, actually. Me even... Let me let me do that. Let me go through my...

Oh my gosh.

Yeah. Let's find this. Let's find this because this makes for good content.

Yes.

This guy here. You YouTubers are so out of this world that you can't understand the importance or ways to deliver a better product by all means. You got numb to people's real problems. The performative marketing is the only thing you see and appreciate.

Theater people, YouTube people, influencers.

Brother, I'm not a theater person.

Like, what do you what do you think I... I spent my whole career as a developer building, and you're gonna say that all I understand is performative marketing because I understand that the three people at GitHub that it takes to produce a promotion like this absolutely influence their infrastructure 0%.

Zero. Big old zero.

So you're on my you're on my list.

Nice. You're on my... Yes. And I... And to be clear, I mean my my shit list, not not any other kind of list. Okay.

I I will say, Scott, for... I I saw this news story in my RSS feed. So I'm subscribed to the the GitHub, like, blog posts and stuff. So I saw it. I clicked the link, and I signed up. Done. Because it sounded cool. It's like, let's let's get the the syntax repo on a CD. That'd be really cool. So I was not there for all the all the discourse, but I I I think people always find something to complain about.

I I I could see it. But, yeah, you have to understand just like... It's not... And also, we're like, I'm not backing big, big corpo here, but you do have to understand the nuances of a large corporation. Like, there's so many internal organizations, so many things happening that, like, I don't think the marketing team talks to the infrastructure team to be like, hey. Do you think people will be mad if we release repos on a CD? Like, nobody would even care to have that cross organization communication. So I don't know. I think it's a cool idea. Like, physical physical media is back too. I think the marketing team was on the right track, but it's potentially maybe the tweet itself. Like, one of the chats just said, I'm just a bit confused about we heard you, we agree, which is the first sentence or first sentence of the tweet, which, you know, maybe people people didn't necessarily say they wanted GitHub on a CD, but there was... They're trying to tie in, like you were saying, trying to tie in to all the news about PlayStation and no more physical media. Yeah. It's a direct call to the PlayStation stuff, which had blown up. And they assumed that everybody would would know that because that makes sense

because it's... It it was all over the place. And Exactly. Not only that, other folks were doing the same meme. This had been memed several times, so they weren't the first ones to respond to this and do something like this. Even other tech companies had made jokes about giving you stuff on DATs or or or tape or anything like that. So I I thought they they expected people to understand that and not make a joke about their uptime. I do wanna shout out Frankie for the... I understand the optics for a CD ROM is on point. Yes, Frankie. Absolutely. Optics, CD ROMs. My god.

Dude, I I just thought this was too ridiculous. It's like GitHub is always known for doing fun and funny stuff like this. That's, like, always been part of their brand.

The Octocat even as itself is a fun and funny thing. And I'm sorry that you are immune to fun and you don't get the joke, but I just don't get... I don't get getting grumpy about this. I don't... I'm grumpy about getting grumpy about this. I'll say that. Yeah. But I did see that because you were

backing up a large corporation, they did say that one of the tweets said they were gonna give you two CDs, Scott. So I think that's that's good for you as well. I don't know. Oh, yes. I don't know if they're the person in charge of it, but they're like, you Do did do do you know who that is? It was like a reply, I think, to your to your quote tweet.

Yes. It was somebody that works at GitHub.

Somebody that works at GitHub. Let me let me tell you who that is really quick, because it is not just somebody that works at GitHub.

It's Kyle Daigle.

Kyle Daigle is the COO at GitHub. Mhmm. So... Yes. And long time. He's he's quite the dude.

Nice.

Yes. You get two, which is cool. So... But I think the... For... And a part of the other news as well was only the first 1,000 people to sign up were able to get one. I don't know how many sign ups they actually accepted.

But, like, that's the other funny thing about all of this is, like, literally only a thousand people are gonna get a CD, but the uproar

triggered, like, tens of thousands of people, it seemed like. So Yeah. The first 1,000. It maybe seems like the first 998 because I'm getting two. That's right. Yeah. Exactly. Sick.

Okay.

Alright. That's all I got here. Just a little grunt... Little

grump list. Little rant. Scott's thoughts. Nice.

Let's keep moving. So if you're just joining us, this is Syntax Weekly. We're talking about news stories, new libraries, new news in the world of web development.

And I wanna let you know that this is brought to you by Sentry.

They are error reporting that is considered not bad by millions of developers. Essentially, throw it on your app running in production. If any errors happen, if anything goes wrong, you can check the Sentry dashboard. It'll tell you exactly what went wrong. You can see a stack trace from the front end to the back end. It also has profiling, so you can nail down, like, slow database queries. We use it on the Syntax app. It's fantastic. Check them out. Syntax...

Sentry.io/syntax.

You can get two months free on the team plan.

And now I'm gonna tell you about a brand new JavaScript framework.

If if you don't already have AI fatigue, here comes the JS fatigue.

But this framework is called g e? It's spelled g e a. How would you say that? Gea? Gea? Gea? Gea's a good middle ground. I like that. Gaia? Gaia? I'm gonna go with Gea.

But their tagline is write JavaScript, get reactivity for free. Now, I... This actually... I saw this a few weeks ago, but didn't pay too much attention to it. But it it got on the front page of Hacker News. I started looking into it. It looks very interesting.

It says they're the... A compiler first UI framework turns ordinary classes and functions into surgical DOM updates. No virtual DOM, no hooks, no signals, just your code wired at build time. And you know what this tagline sounds like? Sounds like Svelte. Yeah. Sounds like Svelte. It's like what Svelte tried to do. And so, like, looking through the docs and, like, looking at their examples, it very much seems like Gia is kind of like a middle ground between Solid JS and React.

Because even Solid JS tries to do a similar thing that Svelte does, which is, like, compile ahead of time.

But you can look at their their charts, and they show you that a simple hello world of Ghia is only 214 bytes. Whereas a hello world in Solid is 10,000 bytes, Svelte is 23,000 bytes.

So they're really trying to harp on the idea of, like, we have a really optimized compiler that only ships what's needed, no extra stuff. Because I think even Svelte now ships, like, a tiny runtime for, like, reactive variables using proxies, and there's a there's a little bit of runtime code. But in this case, Gia is thousands of bytes smaller than what you would ship with Svelte.

And Mhmm. They also have a chart that's not just a hello world, like a a to do app, because that's where the real stuff comes in. But this also shows that it's a lot smaller. So Gia with Minify JS is 15,000 bytes, Solid is 16,000 bytes, and Svelte is 38,000 bytes. And so that's what I saw as interesting to me is, like, you can see how close it is to Solid. And I'll show you the code and talk about the code in a second because it uses JSX.

But this was kind of the idea behind Solid as well. Like, write code that looks a little bit like React, but a lot of it's going to get stripped away. There's no virtual DOM. It uses signals.

So it's very interesting.

Any thoughts so far, Scott?

My thoughts are a little bit of I hate the text treatment on this website. I'm sorry, GFolks.

Yeah. It makes it very difficult for me to read this page. No.

I I think it's cool. I like this, obviously, because I like Svelte. But in the same regard, I don't think this is moving the needle enough for me.

That said, when I looked at the code, I did like the way that it looked, and it felt very organized in the way that I like to write code.

I don't really love JSX, so for me, that's a bummer.

But how they handle stores just being classes, how they handle components just being classes, I like all that.

The fact that you're really shipping nothing, that's all good. Do I see this going anywhere? Don't know. But I do think it's a good... A cool thing to try, and I'm down for people trying this kind of stuff. One thing I saw was interesting was there was a...

We're all just gonna be saying this differently, I guess.

Gia UI, which is based on Zag dot j s, which I didn't know about anything like that. So one thing I gotta love is a framework taking UI components seriously.

Yeah. And that that Zag dot JS, which I'd never heard of before we... You showed me this, is a UI components powered by finite state machines.

So it's a state machine based UI components library. Now granted, when I went to look at Zag, I didn't really like how the components looked. This felt used, like, use language from React. It used writable stores instead of hooks or not hooks, runes. And in general, like, it's doing a lot of spreading. So Zag, I didn't really love, but I do love that this framework took UI components as being an actual part of the framework.

I I love it because that's one of the things that I don't like about the React ecosystem is there's just so much choice around it. I mean, you could say that nowadays people have kind of settled on using something like SHADCN or... And, like, that's built on top of base UI.

But a framework launching and thinking about that is a good thing. So they have things like a button component, a card component, input component. And then in terms of interactive components that use Zag JS, you've got, like, dialogues, tabs, accordions.

So I think it would make sense. Like, if you're shipping a new framework in this day and age, like, you have to... It's kind of gotta be a bit batteries included if you wanna even slightly compete with some of the other frameworks out there. Yeah.

Anri's asking about the Brotli versus g a bit, Brotli being compression algorithm in the browser. And think what that's saying on their website is that it's saying that here is the size of Gia pre Brotli, here is the size of gia without broccoli, and here's how much compression greatly improves gia.

Or it

That's how I read it as well. I I think that's one of the aspects is it's also potentially more compressible for whatever reason. But I would I would read this third column as, gia with brothly is 30 times smaller than solid, and it's 70 times smaller than Svelte. That's how it works. That's what I'm thinking as well. Yes. Yeah. It's a little confusing because the column title says Brotli versus Gia, but I think they mean comparing Brotliad Gia size to given framework size.

Yes.

Yeah. Yeah. Let's talk about the code, though, because that's that's the thing that a lot of people care about. And I will say, like, this is one of the other things that I like about it as well. I will say I've I've been a recent critic... A loud critic of React, and I will give you more details because one of the things I don't like about React is the entire hooks system.

The... Every hook that you write inside of a component is run on every single render. Not necessarily invoked, but it's recreated on every render. Basically, everything you put inside of React function component has... That code has to run on every rerender, and I don't like that. I think it's a very silly model, and Solid JS solved this where essentially you write your Solid JS component.

It runs once, and then you have effects that can potentially run later. But you don't have this whole idea of this component runs over and over again.

And Yeah. Gia does that as well. So they they don't run over and over again. And the idea is if you're gonna build a component that needs internal state, you actually use a class component. So it kind of goes back to, like, the old React way of class extends component.

And then instead of a render function, you have a template function.

But what that means is you can have class methods. So you can have, like, state update methods or effects, but you just call them as instances on the class.

And I actually like that. I... It's a better mental model for me in terms of what the code is actually doing versus how I write it. Because in React, you have all these useEffect, useMemo, useCallback, and it's very hard to reason about, like, what order does it get called in, where does it live, that kind of thing. So you essentially... If you want a component that has state, you have to create a class that extends component, but they also support functional components, but purely for presentational UI. So the... A functional component looks exactly like a function component would in React, except there are no hooks. You can't have any useEffects.

You can't have any variables or state inside of here. It's purely presentational.

And so I like that split where, like, if you want interactivity, if you want state, you have to put it into a class component, and then you have to create methods on it.

So I... I'm I'm I'm I'm a big fan of that. They have an example... Like, there's a doc on their site called React versus Jia. I would say take a look at that if you're a React developer to kinda see the differences.

But there's a to do app here in React, and is kind of what I'm talking about. Everything is defined above the return. You've got your use state. You've got your methods.

Whereas if you contrast contrast that with Gia, your state are just properties on the class, and then your methods to affect that state are are just methods on the class. And I guess they actually separated that out into a store. So they... You can have this stuff inside of a class component, but you could also have a separate object store that has all those methods on it and then use that store inside of your component.

So

I'm a fan. This feels... Yeah. This feels like old React mixed with Svelte, and I think in a nice way, in the UI stuff, like it being very CSS variable focused is great.

They're they're having some nice little examples inside of here.

It's interesting, and I'm happy that someone's taking an approach like this.

So I think it's fascinating. Am I gonna reach for it? I I mean, I'm I'm so firmly... My tooling and everything is so firmly embedded in this felt world that it's like, I'm... I'm gonna have a hard time using anything else at this point, but it's still cool. I think it's cool. And I think this is the type of lesson I think other frameworks should pick up or people who are looking for something to build in an ecosystem could think of like, all right, what is stuff like this doing that my framework is either missing or I would like to have in a bundled up all nice kind of way.

I think It's cool. Yeah. I think, yeah, I think just having people thinking about how to do this better is great because this is another, like, argument I have about React is we've kind of stagnated.

There's not a lot of innovation.

AI is just spitting out the same old React. And so in a sense, that kind of feels like we're stuck. Like, even if something like this comes along and it does it better, it doesn't matter because it doesn't have the critical mass. And AI is just gonna poop out, like, bad React code with a bunch of use use states and use effects in it anyways.

But something better might come along. I I like that people are at least taking the time to think about it, and I do... I I like the mental model here. I think going back to class components is is a good play, especially for being able to structure your code in this way. I like it. Word.

Yes. Cool. Alrighty. Well, let's keep it moving, folks. Syntax weekly, we're bringing to you all the cool stuff.

I wanted to talk a little bit about Fable. Let me even just show this. So last week, we got Fable, And, we received notice that the Department of Commerce has lifted export controls on Fable five and Mythos five.

We'll begin restoring access. And then, again, it took towards the end of that day. I know this because I was checking.

And Fable was restored.

And I gotta say, I have used all of my Fable credits as of this morning. So I'm officially booted from Fable because that takes me up until past the deadline at which they will be removing it, which I believe is the seventh, so tomorrow, even though my, my usage limit said it would reset Thursday. Either way, no longer have access to Fable. I burned through all my Fable credits. I'm here to tell you that on a vibes level, it's definitely the best model that I've used. It's done a whole lot of stuff.

And one thing that I really liked was the ability for it to execute large things really reliably.

But again, one thing that I have not used it on, CJ, is I have not used it on any projects where I actually care about the code.

Been using on my Vibe Coding Slopfest stuff, and I had to go back and forth with it less. It was able to do more complex things and it did so better and with less handholding.

So again, as somebody who feels like I've used everything that's come out, I think the hype around Fable was real. In fact, I can even show you some of the stuff it built for me. That's it.

Yeah. It... So papers made shaders. I think it was paper shaders. They released open source shaders.

It...

One thing that it did for me... Where is the water? Water effect. One thing that it did for me was port it to my WebGL project here.

And...

Actually, this is not... It's WebGPU, not WebGL. I get those messed up here. And so I'm building a programmatic...

What do you call this? You'd call it like a programmatic video interface to generate video. So whether that is whether that is Think titles Act Act After Effects style things as well. Yes. Yes. Think After Effects with sound effects and all this kind of stuff. So I'm building it to be programmatic that AI agents can create these things or you can create... Every single one of these examples can be done in JSON. So these all exist as JSON, and they all have various different things. And it it one shotted to me, which this one actually I've tweaked recently, but it one shotted for me this kind of stuff where I said, take me mermaid diagrams and turn it into a timeline and then have several different themes for it or whatever. But it one shotted the ability to translate this application into mermaid diagrams and have them look nice, which, again, Opus to me... Or Opus. Claude models to me remain goaded on having a better aesthetic...

Just a better aesthetic barometer.

But it did a quite a bit of restructuring this large repo, which this repo, very large, very interesting.

And it did a lot to take every single thing that I had working as just animations and turn it into something that could be manipulated by the UI, something that allowed for keyframes.

Oh, yeah. Built a whole keyframing system for me. And these demos right now, CJ, I will say these demos are are are just kind of, like, tossed together demos to have a demo.

Let me do let me do for keyframes. It built this whole keyframing system that is like, let's see, like a DaVinci Resolve style key framing where you can modify various properties on the key frames and have them...

I mean, it's it's DaVinci Resolve esque. You know? It... It's pretty crazy that it was able to do this. So I I personally...

I mourn the loss of my Fable credits because I think I was really enjoying my time with it. Did you get a chance to use it? I can talk a bit about my experience with it. And

I'm sharing my screen now to show my Copilot usage because I'm all out of Copilot credits.

But over the weekend, I was building a physical media management app. So I've been ripping... I've been finding CDs at thrift stores and record shops and ripping them. I'm trying to create my own, basically, streaming server of music.

And I was planning out that project, and I thought a good test would be to use all of these four models to plan that project. Essentially, I have a folder of artists, albums, files. I need to I need it to scan that, and then also sync with Music Brain's API to show me metadata about the actual albums and everything.

So I I wrote out a big prompt, copy pasted it into all three.

One of... One aspect of this is Kimi k k 2.7 is now available in GitHub Copilot, so I was able to test with that. But I basically pasted that prompt in. I described what I wanted to build. I described my my tech stack.

And this chart isn't exactly right because both Opus 4.8 and GPT 5.5 were used for building it. But I will say, you see this bar graph here for Fable? That's how much usage it took to do the same amount of planning. Now, I will say, like, the the one piece of it that made it feel better was it went really deep. So for the plans that were generated by GPT 5.5, Opus 4.8, and Kimi 2.7, basically took the prompt that I wrote, maybe did a few documentation lookups, and was like, okay, this is the plan that I'm gonna present to you.

But Fable just went...

Just started researching. It was like, okay, this is what you wanna build, but I see you also wanna talk to the Amazon API. And so it started reverse engineering the Amazon Music API, and, like, it was just tool call after tool call. So it definitely is more agentic.

Basically, the way that they've trained it is it it will try and try and try more before it's done. So that's really the only thing that I could see before I completely ran out of usage credits on on GitHub Copilot.

But I will say comparing comparing the four models, that was the main difference. Like, it it took the prompt and also rolled with it. Like, it basically did things that I had to later prompt the other models for, but it just went ahead and started doing it.

Yeah. So I could I could see myself planning with Fable five and then maybe implementing with GPT five five or or Opus four eight.

But, yeah, that was my experience with it. And like I said, I ran completely out of credits.

If we're talking about AI usage, I actually found that it's cheaper cost wise to pay a $100 a month for codecs, which gives you access to GPT 5.5.

Because I've been running some some agentic flows, building out that music app over the weekend, and it barely touches that usage for Codecs.

Whereas I was able to code for, like, maybe two hours, and then it completely ate through all the usage of my GitHub Copilot.

Yeah. Copilot, That usage, even without even without using Fable is not that much. So that's not that surprising.

I do, like I said, yeah, I agree with you. I think it does a really good job of having a wide view of projects just like it said it does. In my experience, does way better when you have a big project and you want to plan and make big changes across that project.

And I feel like when I asked it to do something that was more likely to affect many things other than one localized spot, I found it personally to be much more reliable in the end result. So that that said, the next big news on the clock is that Soul is going to have ultra version available in the codex...

In your codex app. So Soul, the latest biggest model from OpenAI that is not yet released will be available in its most juiced up form, its most roided out form in the Codec subscription. So for me, I'm I'm I'm kinda stoked about that because what is it? GPT five Pro isn't available, and I like to use the biggest, baddest model at any given point to do some testing. So I'm gonna be excited to see whenever this drops. I get the personal feeling that it's going to be available very soon here. Like, this week. Saw That's

based on vibes. And I saw news about Five Six. Is that grouped in with the news with Soul Ultra, or is that a separate release? GPT five six?

Isn't five six Soul? Five six is Soul. Oh, it is Soul. Okay. Okay. Well, Soul is... Sorry. GPT five six is in three different models. It's Okay.

Soul, Terra, and Luna.

Yes.

I believe Luna being the smallest. Yes. Terra Earth. Yes. Got it. I see. I see. That makes sense then. And I've... I... Like like you mentioned earlier, I do prefer the Anthropic Claude models.

But now when it's coming down to, like, token usage and pricing, it's like I'm I'm settling for gbt $5.05 because it's like, don't wanna pay for the the Claude the Claude usage tax.

So it'll be nice to see $5.06 to see, is it on par with Opus? But, again, it it also comes down to vibes. Like, the the vibes of Opus output is just so much... I I... It's like I I can't describe it because it's just vibes versus the output of g p d five five. Like, g p d five five feels rigid.

It feels less creative.

Feels exact. And that that can be good, but it also feels like it wants to write is record over and over again and have one function call another function that calls another function that calls another function that eventually does the work. Like, that's the reason why I have a hard time with 5.5 because to me, I feel like I have to babysit its results more, but maybe that's just the tools and how that I have mine set up. The thing I do love about GPT models is that I can use them in my dearest OpenCode, and I do like my OpenCode setup significantly more than I like Claude Code. So for me, I will be stoked to try it out because I do... Right now, I use GPT 5.5 for some things, and I use, like for instance, my robot.

I find the robot programming to be way better with GPT 5.5 and I don't know if it's because there's a lot of Python involved or what, But I just have not found Claude to do a good job at this dang thing. So, yeah.

I use them both.

I think they're different. And I think I think that's kind of what you gotta like, that's why I like having a Copilot subscription is because I can try both the OpenAI and Anthropic models.

But like I said, now I'm kind of leaning into just the Codex model specifically because I can use it with OpenCode. And that's where I've figured out all my, like, agentic flows is with OpenCode, and you can't use Cloud Code with it. You have to use an API key.

Yeah.

Yeah.

Do we wanna do a robot update? Somebody said my robot looks good. Yeah. Let's talk about it. Yeah. So for those of you listening in, Scott has this cute little handheld robot. It's about... Was it like a foot tall? How tall is that thing? Yeah. He's a couple... Yeah. A foot and a half maybe with the antenna. A foot tall without the antenna.

So, Randy, if you wanna show my screen, I... We named it Marshmallow. I let the kids name him. And Marshmallow, I have now built in this this... You can tell I've been using GPT for this design. This is a GPT s design right here.

And I've built this whole thing where you can... Let's see if I can make him dance it. Let's see if this actually works. Oh, wait. Is he is he not recovered? Every single time I show the robot on stream, it doesn't work. Okay. It's my fault here. I... It's the demo part. Oh, there he goes. Oh, wow. Yeah. He's moving his head.

Yes.

He's moving his little head. Oh, so this is the... You have emotes. This is the curious emote.

This is the curious emote. Yes.

Yes. Oh, displeased. I wonder what displeased looks like. Either way, this is the Ricci Mini. He's built by Paulin and Hugging Face. We talked about him before.

And inside of him is Wi Fi and a camera and a speaker and all kinds of stuff.

And I built in, like, wake listening so you can say, hey, Marshmallow, and he'll respond to you.

You can do start conversation.

Hey, Marshmallow.

How are you? Oh, well, some... I found the timing to be the hardest part about this because you're trying to do...

Gosh. Darn it. Every single time.

Every single time, folks. It it it... Like, it works perfectly fine. Hey, Marshmallow. What's up? You you thinking now? Oh, there we go.

Yay. I'm up and ready.

Yes, Marshmallow. Yes.

That's so great. We're so happy you're up and running.

I gotta fix this timing. Got it, Ricky Marshmallow. Yes.

Yes. Got it, Ricky Marshmallow. Yes. Okay. We're gonna stop the conversation.

Marshmallow is up and running, folks. And, man, this has been a fun project, but I gotta say the Up and running, folks. Yes, you are. You are up and running.

It's been very fun to work on a project, but the back and forth with like this type of thing has been tough because it's like, all right, how you debug the, like, latency between how fast he responds? I'm using GPT something mini, I think 5.5 mini even.

But it's only whatever is available in Hermes. Because this bad boy is hooked up to Hermes. That means he's got a memory system. He's got access to a whole bunch of tools that does blow up the context a little bit. It is going to increase the latency.

But if I ask him like, hey. Do you know who my kids are? He's gonna know who my kids are, and then he can remember things about them. He's got a favorite color that he came up with himself. And as a fun little thing for my kids, this has been a blast. They were doing math with Marshmallow.

They were doing math with Marshmallow yesterday, and they were just having the dang most fun with it. And I didn't even tell them to start doing math with Marshmallow. They just started doing it. So re team mini, folks. This is a cool project. You have to build it, though. And then, again, it like...

You have to build it. There's no internal things, so it has to be connected to Wi Fi to a computer to run the daemon. But, yeah. Nice. It's a robot update. A robot update for y'all. Love it.

Yes. Getting a little bit better every single day.

Another thing I wanted to talk about was Junior.

Yeah. I have long been a hater of Slack and agents.

And I checked out Junior just because this is another Kramer project over at Century. This is from Century Labs, junior.century.dev.

And I definitely have never been one to really want any kind of agent system inside of Slack. And then I talked to Dax. And when we interviewed Dax, he mentioned that their team, the way they collaborate talking to agents, and I thought it was really interesting. So I said, oh, you know what? I know Kramer's working on a Slack bot, so I made one for us using Junior.

And I gotta say, it's been awesome.

So Junior connects to all of your stuff, the plug ins that come with it. Again, this is more... You could think of this as more like a work tool for developers inside of your Slack channels.

The plug ins that they have are Cloudflare, Datadog, GitHub, Hexlinear.

There's a memory plugin, Notion, Scheduler, Sentry, Vercel.

And I have connected this thing to our YouTube analytics so we can ask you questions about YouTube.

I've connected it to our our linear and our notion, our email marketing stuff.

And you can have all these things, guys. It's got a database so it can store things in a database. And man, I gotta say, it... It's been kind of cool. Like, what? Was it today we were like, we need to be reminded of when we have holidays off. So I said... And by the way, I named our agent Tasty.

I said, Tasty, give us a reminder every Monday for any upcoming holidays in The Netherlands, Canada, and The US. And Tasty is just like, no problem. We'll remind you on Monday.

So... Based on our own company's internal stuff.

Yeah. And so we're actually working on a holiday. You're all welcome for that.

So does it also, like, modify its own code? So when it said, yes, I will do that, did it create a PR with that skill, or did that get stored as a memory somewhere? Like, how is that gonna actually... It's a cron... Okay. And so when when we talked to it to do that, it literally just talked to this plugin to schedule that thing to happen? Correct. Yes. I I see. Okay. Yes. I have been working on it via

GPT five and with Claude models to add in the YouTube analytics plugin.

I'm adding in a podcast analytics plugin itself. And because they have all these plugins already here, it was pretty trivial to get this up and running.

But I gotta say, I'm kind of into the idea of having agents in Slack on your work team.

I... Yeah. I I mean, it created a PR for the syntax repo that was really nice and simple, and it did so for first try, gave you a preview URL, checked it out, and, like, yes, that's not that much different than using an agent.

But, like, the fact that as a team, we could talk about it in chat and somebody could say, oh, I wonder we should do this. And just right there be like, hey, Tasty, go and do it. And Tasty's like, no problem.

Yeah. I like it. I I like the... Just the fact that it integrates with all these things. Because so many times we're jumping between between services because we use one thing for our email scheduling.

We publish videos to YouTube. We wanna also see podcast analytics.

We use linear for task tracking. We use Notion for documents. Like, all of the things we use to work as a team are spread across all these places. And so what an agent is really good at is getting, like, API access to all of these things and then kind of mashing them together based on what we're talking about in the channel.

So I really like that aspect of it. I will say... Yeah. Hate I hate linear or Notion. Sorry.

Notion. Yeah. Yeah. But I I'm very security minded. So the fact that we've given this bot access to all of these things, I wanna figure out how to break it. I probably shouldn't have said anything because I wanna make a video about it.

CJ,

you're fired. If you do that, you're fired. Don't change your prompts. No. Because the the whole thing is, like, I'm I'm going to break it, but also make a PR that will fix it.

Because when you give an agent access to lots of systems like this, like, it has write access to certain things, it could potentially be prompt injected. Like, if there... If it... Like, right now, I already looked at it. It it only has read access to YouTube. It has read access to YouTube analytics and and YouTube information.

But if it had write access, there could potentially be a prompt injection in one of the comments left on a YouTube video. So somebody could prompt inject Yeah. If it had write access. If if it had write access, and it doesn't. So, like, that's a good security posture is, like, least amount of access as possible.

But I will say this is also why I'm hesitant to, like, make my own personal AI agent. Like, I haven't gotten in the in the world of of Hermes or Quadbot or whatever it's called now because of all this potential for injections or exfiltration of data?

Yeah. Yeah. You know, for me, it's all about what it can read and what it can access. Yeah. I I think there's definitely threats and and whatever, but if I'm not having it just automatically read all my email or letting other people essentially get access to things that it can read, yeah, sure, you could prompt inject it by visiting a site or something like that. But I think Hermes is doing a good job of being very cautious and cognizant of all that stuff. Again, I think it's all about how much you wanna give it access to. Yeah. The junior stuff is interesting.

And again, I thought, I think I even said I will never wanna want to code from Slack. I think I said that directly on this show.

And this Friday, or even today, I coded from Slack on with Tasty, and I feel I feel okay about it. That's crazy. Yeah. Yeah. I mean, especially,

like, getting back to the first thing we talked about in this video that, like, if it opens a PR and we're happy with it, great. Like, we... That was literally a time saver because otherwise we would have had to spin up an agent locally directly open a PR. So the fact that Junior has access to our repos, has access to the the history in our Slack channel. So, like, you can basically have a discussion about what new feature you want or what thing is missing. Junior has all of that context, and then it can go off and start building. So...

Yeah, I'm... I like it. Yeah. I will say

it would be really cool for, like, producer Randy. Sometimes we get in a situation where the site's not building, and the site won't build because maybe there's a syntax error in a markdown file or something. And now Randy can just say,

because it has access to the Vercel logs, you can just say, hey, why did the latest build break? Can you fix it? And then it can go and create that PR directly there. And now CJ doesn't have to stop doing what he's doing to go and fix it. So that's awesome. This is the exact type of workflow we were promised when when AI was super hyped up, because that that literally is something that I used to do. Like, Randy would be like, hey, the PR won't merge. There's a failure, a syntax error, if you will. Yes. And then I would go in and be like, oh, it's this. We can ignore it. Or, oh, I just pushed a fix. But those are like little one off things that I actually would trust an agent to do because a lot of times it is a one line fix or it is just a simple look at some Vercel logs. So this is the future we were promised.

Yes.

Cool. Folks, we are Syntax Live. We're talking about all the new things on the web here. CJ, do you have something else for us today? Well, I've I've got several things. The first thing

is good news for the JavaScript ecosystem.

So this was a tweet from Colin Hacks, the creator of Zod.

But they show that in all of the tools you use in the JS ecosystem to manage your dependencies, whether it's npm, pnpm, bun, or Yarn, Now, every single tool supports the minimum release age property.

And it's spelled it's spelled differently across every tool, but every tool now has that as an option where essentially you can say, install... Let's say you do a pnpm install for a new package.

If there is a recent publish of that package, with this setting, that package, that new version would have had to have been published for a specific amount of time based on this setting. And this is to prevent certain supply chain attacks. Right? Because a lot of times when a package is compromised, it's actually caught within the first few hours.

And if you have this setting set, that means your code would not have even tried to install or update to that version because it basically waits a certain number of days or hours after a certain release has been out out in the wild.

And so this is one thing that your teams should adopt to prevent the spread of supply chain attacks.

So Only you prevent the the spread of supply chain attacks. Giant worms. Yes.

Throw this in your config. And so that's one piece of good news, but I'm actually linking this up with a post from GitHub where... And the title is npm ads preventative account protection for high impact accounts.

So the idea is if you are the owner and maintainer of a package on npm that gets millions of downloads. I don't know what their exact classification of high impact account is, but basically, just think some of the most downloaded packages on npm. Anybody that is a publisher for those accounts, if the accounts running those packages uses one of their two factor authentication recovery codes, those are the codes that you, like, write down on paper or save to a hard drive when you first sign up to a service, not the ones generated by your authenticator app. And the idea is if you're using a recovery code, that means you lost access to your authenticator app. So if you use one of those codes, if you change... Or if you change your email, that account is placed into a 72 read only state. And again, this is to help prevent the spread of supply chain attacks, because a lot of times people lose access to their account... Accounts in this way, whether they were phished or maybe they got hacked and got access to those recovery codes.

And this will now prevent whoever potentially got access to those things from publishing malicious packages. Now it's a little bit of an inconvenience for the person, because let's say you do legitimately wanna change your email.

Now you just have to plan for that and know that for the next seventy two hours, you won't be able to publish new versions.

So another another good win for the world of of npm and preventing supply chain attacks. I think these are some much needed things. We've been waiting for, like, what is Microsoft going to do? What is npm going to do? And I think this is a good a good step in the right direction. This is a good step. I just wish

everybody would have adopted the same stinking property name for this. Come on. Yeah. So for our podcast listeners, for npm,

it's min dash release dash h. For pnpm 10, it's minimum dash release dash age. For pnpm 11, it's minimum release age in camel case or Pascal case.

And then bun is also Pascal case, and then yarn is npm minimal age gate in Pascal case. So Yes. They're all they're all different different properties for doing the same thing. Yeah. Yes.

I love it. Yeah. Alright. What else do got, CJ? Yes. This will be a quick one, but Chrome

has introduced the user media HTML element. So if you're not familiar, if you're writing a JavaScript app and you want to get access to the user's camera or microphone, there is a get user media JavaScript API.

Mhmm. But this will allow us to request access to a user's webcam or microphone with simply having an HTML element. It's just the user media element.

It's very similar to the geolocation element that got added.

But essentially, you can add this to your page, and instead of having to call JavaScript to request access to the user's camera or microphone, you can just use the HTML element itself.

And so this is much less, I guess, intrusive. And there's also... They they talk about it in this article, but a lot of times, that API for get user media is a little bit buggy. Right? You might land on a website and say, no, block this request, but then the site breaks because it accept... Expected you to have access to it. The idea with this element is that there'll also be, like, a more centralized way of managing that access on the page. Your scripts are less likely to error out if, like, it doesn't have access or it's easier to, like, retrigger that that request for access if needed.

So

it's pretty cool. Had you seen this, Scott? I had not seen this. And this is something that I feel like, yeah, it makes perfect sense. Why don't we have this? So I'll I'll take a a user media element all day. Yes. Absolutely.

And right now, this only exists in Chrome. I don't even know it's in... If it's in Canary or which one. But basically, this is how new features get shipped to the web. It's going to be tested out quite a bit in Chrome, and then other browsers will will potentially adopt it once they settle on the API and behavior. So

it's a fun one. Another fun one. User media is a fun fun stuff to play with. It's a... Yeah. I'm big fan. I... I've been working on my screen recorder app for a long time. So Oh, yeah. I've been deep into that world.

Yeah. Because that basically lets you record camera microphone to separate files, but you're using electron. Is that accurate? Or I am using electron. Yes. And and you can record cameras,

mics. You can record infinite amount of... Maybe not infinite amount of sources, but as many sources as you want. It'll kick them out as separate separate files.

And then also there's like I added a simple mode recently where you can just have it all wrapped up into one file automatically for you if you want just because I need that sometimes.

Nice.

Cool. What what else you got? Yes. I have two things related to Claude code.

Yes. And I use Claude code at work. I don't use it for personal stuff. Interesting. But this was this was a bug that was filed five days ago.

And it says there was no response after sixty seconds, continued without an answer. So if you're not familiar, Claude has the ability... And a lot of these other coding, agentic coding tools have the ability as well to ask you a question to get clarification on something. So maybe you're writing a plan. It'll ask you, oh, do you wanna use this versus that? Or how do we want... Do we wanna approach it this way or that way? And you can answer that question with a prompt or by choosing from multiple choice.

But the Claude team secretly added this feature where if the user does not answer within 60, it just automatically chooses an answer and keeps going. Wow. The recommended one? Yeah. Well, yeah, it chooses like whatever. Yeah. Because a lot of times they'll be like, I recommend you choose this answer, but here are some other options. And so, it'll choose the recommended option or whichever option it thought and just keep on coding. And there's a massive thread on GitHub that filed this as a bug that was like, this should not be on by default.

I agree with that. Yeah. There are multiple stories in the in the GitHub comments of like, this happened to me. Like, I was running three different sessions and I don't always have every session in focus.

So it just kept on coding and then, like, did some stuff in production I didn't want it to.

And I think, like, that's the other aspect of this. They actually had detection to see, okay, if the terminal is not focused, meaning, like, you're using the web browser or some other app, that's when this will kick in. So it's never if you are... If you directly have your your your your terminal focused.

But, yeah, people went wild in the Yeah.

And I never have my terminal focused when it's cooking on something. I just let it go and then go look at something else. Oh, I'm looking at something else now. Yes. And on macOS, at least, even Cloud Code running in the terminal has notifications. So like, if it does ask me a question, I can see, oh, a notification pops up. I'm gonna go take a look at that in a second when I'm done with whatever else I'm working on. I would never want it to just keep on coding if I don't respond for sixty seconds.

So I do believe they they... And here's the other issue. They fixed it, but they they left it on by default, and then people kept complaining more and more. And finally, it's off by default, I do believe.

All they had to do was prompt their model to to fix it. And, you know, if nobody takes a look at it, it will fix itself. Right? That's

the feature. Yeah. Exactly.

So, yeah, this is...

We've talked about this before, but the fact that Anthropic owns the harness, right, they own Cloud Code, they can kind of decide how it works. In a sense, auto continue after sixty seconds makes them more money because it just starts consuming tokens.

You would expect that...

I mean, and this also gets into what we were talking about at the beginning of the video of, like, if you don't review it or if you don't have the chance to review it, it's just gonna keep on coding. So it's kind of you pushing you in that direction anyways.

And then I have this related story, which it's something else that Claude Code was doing in their code base.

And the title is Claude Code is Steganographically Marking Requests.

K. That's a word. What's that word mean? So steganography

is when you hide information inside of something. Typically, you see it with images. So, like, steganography can, like, hide a message inside of an image or something like that.

But they use that word to say that the way that Claude code, the CLI, is writing its prompts is allowing them to do certain things on the back end.

And the... They basically reverse engineered the the Claude code locally. But the idea is when you send a prompt with Claude code, it has a piece of text at the top that says today's date is year dash month dash day.

And that's the standard format. But Mhmm. There is some code that will detect, like, if you're running Cloud Code from the Asia Shanghai time zone or the Asia... Urum...

Yarn... Yarn... Yarn... U R I M... U R U M K Q I. Yarnki? I don't know where that is. Is that, like, Russia? Or I don't know. Go ahead and say I do not know. Yes. Okay. I'll I'll I'll look it up. I'll let that run-in the background.

Northwest... Oh, it's Northwestern China. So they're actually just two different Chinese time zones. So, basically, if it detects that you're in either of these two chi... Chinese time zones, it changes the prompt to have slashes instead of dashes, and then it changes the apostrophe to use a different Unicode value instead.

So if you were working on code in China and you you were even... Let's say you were just watching the request that Cloud Code was making, you would kind of have no idea that it basically just fingerprinted you as someone using Cloud Code in China. But the way it fingerprints is it uses a different apostrophe character and uses slashes instead of dashes.

The other thing is it can... It detects, I think, like, what domain you're running from. And this is essentially to help prevent distillation attacks, where some of these Chinese labs, DeepSeek and some of the others, like z AI, are potentially prompting Claude, saving the responses, and then using that as training for their own models.

So it detects where you're running from in terms of your domain. And there's a whole list of, like, DeepSeek, Moonshot, Minimax, and all of that is is passed in in the prompt as well.

So all of this to say that the Cloud Code harness that you're using locally is able to do things like this, like auto accept your code after sixty seconds if you don't respond, or let their API know on the back end that you're running this code from a specific part of the world or from a specific company, which is fascinating. I mean, like, it's... They built the tool. They have every right to do that. But the fact that they're doing it is interesting because they could be doing it for other things as well. For sure. Yeah. Yeah. And I'm sure they are. Yeah.

Shout out to Mitchell Wilson, by the way, in the chat. I made a chat in your terminal that is literally a single bash script.

I explained it on my blog. Alright.

It's called ask stupidly simple and useful.

Ask.

Dude, I I... How do you feel about the ask UIs in these chat tools? Do you prefer it to be a quick... Do you prefer the one, two, three, four, pick an option, or do you prefer just a normal chat box to write in your response?

I like both, and and ClockCode lately has been giving me that. Basically, it'll give you, like, three options. Do you wanna do it this way, that way, or that way, or write your own response? Mhmm. And so a lot of times, I'll I'll choose that. Like, what the options you gave me aren't exactly what I want, but let's talk about this a bit more.

Yeah. Yeah. I like the UI. In fact, I get grumpy when it doesn't give me the UI. It's like... Especially when it gives me, like, pick one of these four things just in the text, but it doesn't give you the UI to click them. I see. It's so stupid. One, two, three, or four. Yeah. Yeah.

So stupid. I prefer the UI.

Yes.

Nice.

Cool. So I think- Yeah. Were they sharing a site that they built?

It's on CS. I wouldn't... Should probably make sure of what We'll this site is

double check it, and we'll come back to it. We can show it. But, yeah, thanks again to Mitchell for the the $10 donation. We appreciate that.

Yes. Okay. I verified the site is just fine.

Or at least on the surface, it looks fine. I've not It's good enough for me. Let's share. Let's take a look. Okay.

You got your screen up, CJ?

Yeah. What... So what... I was just... What is it? Posted it in chat. Csimw.com.

Cool stuff in interest Can of Mitch

you share your screen?

You don't trust

Mitch Wilson? Here's the thing that Mitch Wilson could do. He could he could grab my IP address, and he already has yours. So just share your screen instead so he doesn't have to Let's get mine check out his network request here. Mitch, you're... You... I'm trusting you, Mitch. Yeah. But it's... It more it more so comes down to, like, the server side because the request originated from your IP address. I don't know. I'm having Internet issues. I don't wanna have more Internet issues. I'm on a VPN, Mitch, so don't try anything. I'm behind six firewalls. And I'm not on one. So Scott, go ahead and... Yeah, I can't. I'm sorry. I lost the dang screen, the share screen. Oh, okay. In classic

new fashion, I got too many dang links open.

Yes.

Hold on one second. My god. Video Ninja. I I got so... What... MacOS, like, groups them all together now. So when you do, like, the expose to show all of them, I, like, cannot find anything I'm looking for. So sorry, Mitch.

Ask. Chat with your AI tool.

Oh, you are tracking me, Mitch, but I blocked it. I blocked that. Blocked.

It just like a a Google analytic script or something? 100% certain. Oh, Azure. Okay. Application Insights.

Yes.

Okay.

Okay.

You know how many times you're in the terminal grinding way and suddenly need to know some random thing. Like, how do I grep for that specific pattern? What's the flag for that tar command again? Yes.

So it's basically a quick little ask CLI tool that prompts through the OpenCode Zen API and prints the response directly in your terminal. That's it. Easy. Yeah.

I've thought about building something like this before, but, like, with the local model. Because, yeah, like, I don't know the number of times I've gone to clod or chat gbt, just like, remind me the syntax for this command.

Yeah. That's pretty cool. I I thought of, like, also pairing this with, like, natural language as well. So you, like, prepend your prompt with the name of whatever CLI tool you build or whatever it is, and then plain text. Like, I wanna list all files, including hidden folders, and show the size in human readable format.

And then it instantly figures out the right command and runs it.

See, that's kind of like... I mean, without the commands, that's kinda what I want the robot to do. I want the robot to just be like, hey. What's this? Hey. What's that? And and just have him on my desk in, like, voice prompt at any point. I actually might hook him up to my foot pedal.

I've been loving my foot pedal to prompt and stuff. Maybe I could have a specific trigger for Marshmallow. That way, I don't have to rely on the wake word detection, and I could just say, hey. What is this terminal command? And do it Mitch Wilson style.

Nice.

Yes.

Cool. Well, thanks, Mitch. Thanks for sharing that. Yeah.

Alright. I got two... Last two things to show you. These ones are a little more fun and interesting.

And the first one is an app called Organic Maps.

So in the realm of being privacy conscious and not letting Google own all my data, I've been searching for a new Maps app.

And if you use Android, you typically are just using Maps that's built in, Google Maps. If you're using iOS, you're probably using Apple Maps. But No. You aren't. You know who's using Apple Maps? That's Do you use Google Maps on on iOS? Absolutely. Yes. Oh, wow. Okay.

Okay.

As you could assume, Google is tracking absolutely everything about you when you're in the Maps app. It knows your exact location. It knows the places you visited. Like, the number of times... I I know you can turn this on or off, but I've gotten notifications of, like, oh, I saw you visited this restaurant. Would you like to leave a review? There's also... Like, there are settings to turn that stuff off, but organic maps is completely disconnected from all cloud services and allows you to download maps offline. That's the other thing is you typically might wanna use this if you're, like, hiking or biking or maybe you're going to an area that doesn't have cell service. Like, technically, Google Maps allows you to download areas of the maps. But the nice thing about this app is it's all based on WikiMaps data.

You can select a city or entire country or a state and have all of those maps downloaded, and that also includes points of interest.

So Yeah. The offline maps in Google Maps, I believe, is kinda just like streets and stuff like that. Once you've downloaded the maps, you can also search for search for places. And one of the killer features that I've yet to see in in a lot of these free map apps is navigation.

Now I haven't used it yet, the navigation piece, and that's one of the most finicky parts of these apps that are Google Maps. Like, Google Maps has navigation tuned. Like, it it... Like, the... I remember using, like, the old, like, physical GPS devices and trying to figure out when to turn. Like, is my turn now or is my turn Yes. 10 feet from Google Maps, in my experience, has that dialed. Like, I... I've I've... I can now gauge where I need to turn. So that's the one thing I haven't I haven't tried yet. But just putting this on your radar because I also like to go hiking or camping. Sometimes I don't have service, and so this app is really great.

And I've been using it on Android. Also supported on iOS and and all the other places. So... Yeah. You know, I used Offline Maps and Google Maps quite a bit when I was in Greece, and they did have places of interest as far as I know. At least maybe I was connected or something without knowing it. But there were times where I was getting at least that that bit of stuff still working. So offline maps, man. It's a low key feature that I I feel like that's really great that that... Like, if I were to use something like this, I would be upset if it didn't have offline map support or navigation support.

Yeah. Oh my gosh. Do I have a sandwich delivery? Sandwich delivery.

Thank you, Court.

Got some peaches too. My god. Some nice Thank you, Court. Some bread. It's got, like, oats and... Wow. Oh, yes. It's

butter lettuce. We love some butter lettuce.

Nice. Alright. I only got one more thing to share, and then we can let Scott eat a sandwich.

And this one is a site called Starring the Computer. So it's at starringthecomputer.com, and it's a index of a bunch of different types of computers. So like Acer, Alienware, Mac. And it has screenshots of when those computers have appeared in movies. So I thought this was fascinating. Like, for instance, if we go to the the MacBook, you can see that even going back to, like, 2009, there were movies that that featured a MacBook. So you see screenshots from the movies using that tech.

So this is a fun little browse.

Also, like a trip down memory lane because, like, some of the older movies you might remember.

And you can see people using that that old tech.

I do believe... It might be movies and TV shows. Yeah. Says movie and TV. I did see Young Sheldon on TV.

Do you like that show or what's it? No. I don't. No. I I couldn't catch me dead watching that show. I'm sorry. If you're like young Sheldon folks, that's not for me. But I I love this. You know what you could even do is you could hook this up to something to pull clips of these.

Like, oh, I want a Honeywell h 200.

Let me pull that clip from Casino Royale 1967, and then it can find that clip and pull the clip front. I always just think about clipping, like... Because I'm I'm deep into this, like, programming video space right now. So not like building programming videos, but like, oh, what could I do to, like, make finding clips easier?

That's funny. Yes. And I think, like, maybe even Randy could could use this because we've done, in the past, like, reacting to hacker clips, but this site is, like, a massive index of computers being used. So I'm sure it has

hacking movies that we could we could react to. Yeah. Jackie Chan has a GE six thirty five inside of his Subaru in Cannonball Run 1981.

I did not know that. Nice. I would have just guessed that was a fake ass computer. So shout out to Jackie Chan and Cannonball Run. This is cool. This is very old web, CJ. Yeah. Yeah. But I I found it on Hacker News. I I love it. I'll be perusing that quite a bit. And so I got just a out. Went back in time.

Farinda, who just donated 500 Kenyan shillings. So thank you so much. Thanks for tuning in. Thanks for the donation. All the way from Yeah. Thank you so much. I'm guessing you're in you're in Africa and Kenya. Amazing.

Sick.

Cool. I don't really have anything else, CJ.

That's all I got. And I'm not just saying that because I got a sandwich here.

Henri asked if I was a teenager in 1981.

No. I was not a teenager in 1981.

I was a teenager in the nineties. I was a nineties kid. So, yes.

Nice.

Yeah. Donnie says every time CJ mentions Hacker News, we drink. I did mention it quite a bit today. CJ.

See, we gotta have some digital, I don't know, digital frowny faces anytime Hacker News gets mentioned. Yeah.

Yes. Alright. Well, I don't have too much else.

Ready to get out of here then? Let's do it. Alright. Well, thank you so much, everybody, for checking us out. We will catch you next week for another Syntax Weekly. And who knows? Maybe we'll have a giant sun sized AI model to talk about. Who knows? Definitely. Fingers crossed.

Cool. Peace.

Peace.