David Mytton

Moving to NYC! 🇺🇸 Packing the essentials

Dynamic Validation | TanStack Form React Docs In many cases, you want to change the validation rules based depending on the state of the form or other conditions. The most popular example of this is when you want to validate a field differently b...

Today's the day!

We're releasing a new major feature of @tanstack.com Form for all adapters that allows you to change the validation mode based on submission.

(For React nerds that's how RHF works OOTB)

No breaking changes, trivial to implement; try it out!

tanstack.com/form/latest/...

Wow - CNN’s front page is the investigation “Inside North Korea’s effort to infiltrate US companies.”

4 months ago covered this same threat in @pragmaticengineer.com with exactly this AI filter.

If you’re hiring full remote as a tech company, you NEED to expect NK to try and infiltrate

🔥 The MacOS Stickies app is so underrated.
- Little floating windows to take notes throughout the day
- Can pin/float on top of whatever you're doing
- Can color-coat to organize thoughts

...Probably hasn't been changed since the 90s, but you can't knock stable software

GitHub - 9001/copyparty: Portable file server with accelerated resumable uploads, dedup, WebDAV, FTP, TFTP, zeroconf, media indexer, thumbnails++ all in one file, no deps Portable file server with accelerated resumable uploads, dedup, WebDAV, FTP, TFTP, zeroconf, media indexer, thumbnails++ all in one file, no deps - 9001/copyparty

Reviewed github.com/9001/copyparty for the @console.dev newsletter this week. Makes anything a file server with resumable downloads/uploads + web UI.

Also a great example of a super comprehensive README!

The many, many, many JavaScript runtimes of the last decade This last decade has seen an inundation of new JavaScript runtimes (and engines in equal measure), enabling us to run JavaScript in all manner of contexts...

Great writeup: buttondown.com/whatever_jam...

So many JS runtimes. Node.js. Edge runtime. Bun. Deno. workerd. At least one of these has already been deprecated, which is an issue if you've built your entire app around its APIs!

Announcing TypeScript 5.9 - TypeScript Today we are excited to announce the release of TypeScript 5.9! If you’re not familiar with TypeScript, it’s a language that builds on JavaScript by adding syntax for types. With types, TypeScript mak...

TypeScript 5.9 is now available! 📣

This release brings:

✅ An updated tsc --init
✅ Type-checking for the new 'import defer'
✅ Actual summaries in more DOM APIs
✅ Expandable quick info hovers (✨preview✨)

and more! Read up more on our blog:

devblogs.microsoft.com/typescript/a...

The S in MCP stands for security

A prize to anyone who can name all my laptop stickers 👀

www.youtube.com/watch?v=Cuem...

Useful security assumptions for 2025:

- All your personal data has already been "lost"
- A random dependency has been compromised with a malware post-install script
- Your washing machine has a zero day and is now part of a botnet

Three HTTP versions later, forms are still a mess The last few weeks I've been working on adding an HTTP 1.1 stack to the standard library of Inko as part of this pull request. The work is still ongoing but the initial set of changes will include an…

That you need to use react-hook-form to do anything more than the most basic form...

The next Next.js <Form> component is a good first step, but it only supports POST requests right now

yorickpeterse.com/articles/thr...

With Tom Lehrer's passing, I suppose this is a moment to share the story of the prank he played on the National Security Agency, and how it went undiscovered for nearly 60 years.

One of the best examples of LLM developer tooling I've heard is from a team that supports software from the 80s-90s. Their only source of documentation is *video interviews* with retired employees. So they feed them into transcription software and get summarized searchable notes out the other end.

Join us at another episode of Tech on the Rocks, this time with @davidmytton.social of Arcjet. We talk about security as code, security in a world of AI and dev tooling.

Check the episode here: https://buff.ly/4ggWGeO

A friend got her (Android) phone stolen and the thieves were able to quickly pivot into her Google account and then bank.

I’ve been wondering how they did that and my best guess is SMS password resets (aka SMS 1FA).

So yeah, SIM PINs (or eSIMs) might help. Also no text body on lock screens.

'AI Engineer' means you build things that contain AI - LLM chains, agents, multi-modal stuff.

So, what is its opposite? What do we call a 'normal' software engineer?

Creating an email parser requires combining local part parsing with domain parsing to ensure we validate the syntax against the RFCs...but of course just following the RFC doesn't quite work in the real world!

👋

Isn't that's something AI should be able to help with? 🤔

How can we improve the DX?

- Meet developers in their workflow - the code editor e.g. Trunk & Semgrep.

- Idiomatic toolkits that feel natural where developers work - in code e.g. Clerk & WorkOS.

- Interact with developers where they're comfortable - the CLI e.g. Trufflehog and Socket.

2) The product team forwards a customer security questionnaire or has a compliance certification requirement.

Developers are forced into a rapid sprint to rebuild, reimplement or refactor as quickly as possible to close a deal.

1) The security team finds a problem. Developers are forced into painful refactoring or installing bad security software.

Things break, usually in production because you can't test locally.

Developer <-> security interaction today is pretty negative. After coding, testing, deploying...they get hit from 2 angles:

iCloud Mail web UI

Love the minimalism of iCloud Mail on the web especially now it has primary inbox, and dark mode that works properly. Gmail's "dark" theme really is terrible - the web UI is such a mess.

Production-grade Turborepo template for Next.js apps A monorepo template designed to have everything you need to build your new SaaS app as quick as possible. Authentication, billing, analytics, SEO, database ORM and more — it's all here.

The ultimate Next.js SaaS template: next-forge.com

ORM, auth, billing, analytics, website, blog, cron jobs, dark mode, email, testing.

Built with @nextjs.org @vercel.com @prisma.io and a great set of amazing tools

Go is the best

Arcjet - Security as code Implement bot protection, rate limiting, email validation & more in just a few lines of code. Developer-first security for Node.js, Next.js, Deno, Bun, SvelteKit, NestJS, Vercel, Netlify, Fly.io

Building arcjet.com to help full stack developers integrate security features as code with native support for modern platforms & frameworks.

Using Rust, Wasm, Go, gRPC, Next.js, Astro

🫠

Yeah I've seen it being dropped into quite a few new projects recently. And it's not just 1 tool, there's an ecosystem of other useful tools that all work nicely together