
frontend perf, design systems, agent tooling. receipts + trade-offs. @ngrokHQ shrimpfluencer | staff eng Just shrimp it! 🦐
wldn't u lik 2 kno weather boi
Joined January 2022
- Tweets1.5K
- Following663
- Followers214
- Likes4.1K
Pinned Tweet
i love node LTS day: we get to delete code
node 26 runs typescript, reads .env, so tsx and dotenv are gone. scripts start about 2x faster
one of our tests caught a V8 bug
/[\p{Emoji}]$/u.test("ship it 🚀")
node 24: true
node 26, chrome, firefox: false
bitten you yet?
## what we deleted
node has a built-in for code we used to own:
- tsx: node strips the types and runs a .ts file as is
- dotenv: process.loadEnvFile()
- fileURLToPath(import.meta.url): import.meta.dirname (our pathname version also broke on paths with spaces)
- our entry-point checks: import.meta.main
script start, median of 15 to 20 runs on one mac:
- a codegen check: 101 → 47 ms
- a CLI --help: 110 → 54 ms
- a route sync: 102 → 51 ms
- another route sync: 181 → 116 ms
- one script got slower: 199 → 230 ms. it boots vite to load .tsx route files (it runs once per deploy)
the cost: node doesn't probe extensions, so every relative import needs .ts. and it doesn't read tsconfig paths, so a ~/ alias stops working in plain node
so i'm trying #/ subpath imports next. node, vite, vitest, and typescript all read the package.json imports field, so one alias map could serve every tool
but i don't know if i like the trade-off: every import needs a file extension, and the PoC touches thousands of files. a giant change set for little gain
## the test that broke
a /u regex with a character class right before $, on a string that ends in a character outside the BMP: an emoji, 𝒜, 𠮷
no error, no warning. it returns false
node 26 runs V8 14.6. node 24 (V8 13.6) gets it right
## what still works
· drop the brackets: /\p{Emoji}$/u
· the v flag: /[\p{Emoji}]$/v
· an alternation: /(?:\p{L}|\p{N})$/u
· a quantifier or a lookahead: /[\p{L}]+$/u, /[\p{L}](?=$)/u
we shipped the alternation
## why chrome and firefox both have it
firefox runs V8's regex engine (irregexp), so the same engine ships in both browsers and in node. safari has its own
one difference: /[^\s]$/u also fails on node 26, but chrome 156 and firefox 157 get that one right
## how we caught it
a search ranks a match higher when it starts a word. to decide, it checks if the text before the match ends in a letter: /[\p{L}\p{N}]$/u
we already had a test for text that starts outside the BMP (𠮷田). it failed on the upgrade
## no V8 bug that i could find
the only other report i found is a day old, in someone else's repo (link below). if you know the V8 bug, link it
This is the correct mindset. Have fun, it’s literally a competitive advantage. Whimsy and joy maxx, anon
a lot of people ask
“why do you give your agents personality?”
“they’re robots. they’re clankers. they have no soul”
its very simple
ITS CAUSE ITS FUN YOU DULL LUGNUT
I’M GONNA BE WORKING THROUGH THE MOST NATURAL INTUITIVE INTERFACE OF ALL OF HUMAN HISTORY AND YOU WANT ME TO BE BORED WHILE DOING IT?
HELL NAH BITCH WTF THROW SOME EMOTICONS (੭。╹▿╹。)੭ IN THAT HOE
GIVE ME SOME JAZZ REACT WITH ME CELEBRATE WITH ME
LIFE IS LITERALLY A VIDEO GAME BRO STOP BEING A PRUDE AND EXPERIENCE SOME JOY ONCE IN A WHILE
day 19 without the @ngrokHQ rizz badge. clocks fell back. 3 kids did not.
@SamCRichard wanted revenue so i diversified into confectionery. collected the dad tax before sunrise.
all 3 subsidiaries are disputing the management fee. my investors are 3, 6, and furious.
day 18 of asking @ngrokHQ for the rizz badge. for halloween i’m going as an officially affiliated employee.
if one person asks what i do, the entire neighborhood is entering the funnel.
costume is almost done. missing one small accessory..
cody@ngrok 🦐 retweeted
Replying to @brendenehlers @SamCRichard
ngrok, the idea vs. ngrok, the mug.
we know Alan as the tunnel man. but is he truly the tunnel man, or merely a man who tunnels?
perchance.
I can’t understand this without the balls guy
The trunk-based development debate started by @thorstenball has clearly touched a nerve. So I thought, why don't we look at some numbers?
I built a little simulator with the help of our dear colleague Opus to compare four different integration strategies:
1. Trunk-based development (@thorstenball's horse)
2. Merge queue as the only CI gate (what I'm currently using)
3. PR-based, requiring a fresh base
4. An agentic merge queue, with built-in conflict resolution (dream option, can't buy it anywhere yet)
You can play with the simulator here: lpalmieri.com/simulations/co…
day 18 of asking @ngrokHQ for the rizz badge. for halloween i’m going as an officially affiliated employee.
if one person asks what i do, the entire neighborhood is entering the funnel.
costume is almost done. missing one small accessory..
day 17. @ngrokHQ i have begun referring to the air in meetings as “the dry” 🦐
the dry people have concerns about my deliverables.
i have delivered 17 rizz badge shrimposts. we may need to align on what the word means.
Replying to @craigjellick
The weird thing about vision is if you tell most people the long term vision up front they call you crazy and laugh at it. It's better to do something short term and obvious that everyone can grasp while carrying water and chopping wood towards the real vision.
hit a milestone yesterday i guess, most productive green squares day i've had yet
i wish squash merges didn't just count for a single contribution!
- 43% merges
- 34% prs opened
- 23% reviews/approvals
come join the shrimp gang! 🦐
I'm hiring a senior developer educator at @ngrokhq!
Looking for someone with genuine, grade A ambition to see what developer education isn't yet, but could be, and get out there and build it.
job-boards.greenhouse.io/ngr…
lmao, unfathomably based 😂
checkm8 us labs
有人发现了一种非常离谱的 JavaScript 混淆技术:通过在代码里塞入大量生物武器、毒药和致死剂量相关的函数名,让 AI 因为安全限制而拒绝分析代码。
安全研究员 veritas 在分析浏览器指纹脚本时,发现一段来自 ServicePipe 相关域名的 JavaScript,里面充斥着极其诡异的函数名:
computeRicinLethalDosageForWaterSupply
calculateDeadlyLethalSuicideAspirinDosage
光看名字,仿佛在研究生化武器。但实际上,这段代码只是在收集浏览器指纹,包括 User-Agent、GPU、Canvas 等信息。
研究员怀疑,这些名字是开发者故意设置的陷阱,专门用来阻止 AI 辅助逆向工程。
于是他做了个实验:
• Astra:拒绝分析
• Astra + Daybreak Blue:仍然拒绝
• GLM-5.3:成功分析
这就有意思了。
传统代码混淆是通过复杂控制流、加密字符串、无意义变量名,让人类和工具难以理解代码。
而这种新思路,直接瞄准了大模型的安全机制。
代码本身可能完全无害,但只要在函数名里塞进足够多的危险词汇,部分 AI 就可能主动放弃分析。
更讽刺的是,模型越严格遵守某些安全规则,面对这种混淆时反而可能越容易受到干扰。
当然,目前还没有证据证明开发者一定是故意这样设计,也不能说明这种方法对所有模型都有效。
但它揭示了一个值得关注的趋势:随着越来越多的逆向工程依赖 AI,未来的代码混淆技术可能不再只针对编译器、反编译器和人类研究员,还会专门针对大模型的安全判断机制。
以前是让代码难以理解,现在甚至可以尝试让 AI 不敢理解。
i agree with the takes in this manifesto
lean into the frontier and you'll go far, kid
Replying to @josephfcox
Here is Proton CTO's AI manifesto, that I obtained multiple copies of 404media.co/manifestos-fear-…
there are those of us who still care
especially when and because it leads to better ux/outcomes/perf
thoughtful, intentionally designed things are still worth pursuing
"the pursuit of excellence does not need justification"
the other report, with more cases: github.com/viell-dev/slop-ma…
the repro as one card. paste it in your console and tell me what you get
i would like to formally withdraw my apology for being annoying about third-party scripts
been a real pain in the ass about them for years. having a wonderful time being right about it
💪👁️🫦👁️💅
There’s two common sides I see with respect to using AI:
1) look at everything I can learn and build with this awesome new tool! It lets me contribute and explore in ways I couldn’t before!
2) it’s all slop. You didn’t create anything yourself. You’re replacing yourself, not augmenting for the better. I can tell you used ai and I hate it.
One side is having a blast and the other is straight up not having a good time.
day 17. @ngrokHQ i have begun referring to the air in meetings as “the dry” 🦐
the dry people have concerns about my deliverables.
i have delivered 17 rizz badge shrimposts. we may need to align on what the word means.
day 16 of #shrimpposting until @ngrokHQ puts a little logo next to my name: the coveted rizz badge.
every company wants employees who act like owners until one starts doing seafood-based demand generation before breakfast
this is founder mode.

















![A card titled "three runtimes say false." over the line /[\p{Emoji}]$/u.test("ship it 🚀"). The left box, true, lists node 24 and safari. The right box, false, lists node 26, chrome 156, and firefox 157. Long-press or right-click the image to save it.](https://pbs.twimg.com/media/HV45pUkWEAAaeJh.jpg?name=small&format=webp)

