Top all-time · #9284
Tao Bojlén
Personal blog · btao.org · on HN as tao_oatsecurityphilosophyprogramming
Tao Bojlén's personal blog at btao.org covers security, philosophy and programming. Since 2020, 8 different Hacker News readers have linked it 14 times, most often “NPM install is curl – bash”. It is still writing: the last post was on 2026-08-17, and you can follow it by feed.
Too few sampled comments (1) to say how often HN recommends it.?
Why HN links it
One HN comment links this blog's post on coding agents and code review, and discusses the limits of current code review practice. The commenter disagrees partly with a paper the thread covers.
Summarised by Claude from a sample of 1 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
Software engineer interested in philosophy, security, and using technology for social good.
Most-linked posts?
- NPM install is curl – bash4 people · 4 mentions · first linked 2021-11-05
- The Forge We Deserve3 people · 3 mentions · first linked 2026-05-13
What Hacker News says?
I wrote a [similar post]( https://btao.org/2021/09/09/npm-install-is-curl-bash/ ) recently, and I think it's worth sharing this part: > When installing an untrusted package, run `npm install` or `yarn add` with the `--ignore-scripts flag`. If, like me, you tend to forget this, you can set npm/yarn to never run scripts with ` {npm,yarn} config set ignore-scripts true`. This disables install scripts, which is a primar…
Comment linking /2021/09/09/npm-install-is-curl-bash/
on “$ sudo rm -rf / === NPM install”Submitted Removing my site from Google search as a story · 215 points
HN discussionI do think there's some real limits to code review as we do it and that we need to figure out what is next, to some degree. That's just my belief here. Orgs keeping to the past are going to be kind of miserable; leads already had a ton of responsibility for understanding it all, and it feels like that just isn't feasible to keep on with. That's a pretty bike take, but I think a bit less than what this paper is sayin…
Comment linking /posts/2026-05-09-the-forge-we-deserve/
on “The End of Code Review: Coding Agents Supersede Human Inspection”Submitted A web of trust for NPM as a story · 143 points
HN discussionSubmitted I don't enjoy the Internet any more as a story · 56 points
HN discussionSubmitted Feel-Good Security in ProtonMail as a story · 4 points
HN discussionSubmitted The Forge We Deserve as a story · 2 points
HN discussionSubmitted Just One More Prompt as a story · 2 points
HN discussionSubmitted Everything Changes, and Nothing Changes as a story · 2 points
HN discussionSubmitted NPM install is curl – bash as a story · 2 points
HN discussionSubmitted NPM install is curl – bash as a story · 2 points
HN discussionSubmitted The Forge We Deserve as a story · 1 points
HN discussionSubmitted NPM install is curl – bash as a story · 1 points
HN discussionSubmitted Sometimes-on security: on mixing plaintext and encrypted messages as a story · 1 points
HN discussion
