
Steven Savold
674 posts

Steven Savold
@atoi6664
Software Engineer working on VR/AR technology. Passionate about making software faster and more stable. Opinions are my own.




The time has come. TaskSlinger launches into open beta today at 15:00 UTC. A faster, cleaner task manager replacement for Windows, built from scratch for people who care about performance. Get the free beta: taskslinger.net

Thanks @LinusTech and @luke_lafr for the shoutout on the WAN Show! Glad File Pilot could contribute to some good news around File Explorer performance! youtu.be/ie0GY7wAqF0?t=…





Just found out an active File Pilot community member @thomasklemenc made a task manager inspired by it! Handmade from scratch, C++, win32, D3D custom renderer, 1.55 MB. More of this in my feed, less AI slopware.



I just learned that this style of OO programming is still taught in 2026 that's 200k views, 2months ago, "Rebuilding Pokemon with Object Oriented Programming"




std::vector always heap allocates. std::array can't change size. For decades, there's been no standard container that gives you a dynamically sized array with a compile-time capacity limit and zero heap allocation C++26 finally adds std::inplace_vector. Guess where they got the idea 🧵👇


Just found out an active File Pilot community member @thomasklemenc made a task manager inspired by it! Handmade from scratch, C++, win32, D3D custom renderer, 1.55 MB. More of this in my feed, less AI slopware.


std::vector always heap allocates. std::array can't change size. For decades, there's been no standard container that gives you a dynamically sized array with a compile-time capacity limit and zero heap allocation C++26 finally adds std::inplace_vector. Guess where they got the idea 🧵👇



SECURITY ADVISORY — TanStack npm packages A supply-chain compromise affecting 42 @tanstack/* packages (84 versions total) was published to npm earlier today at approximately 19:20 and 19:26 UTC. Two malicious versions per package. Status: ACTIVE — packages are deprecated, npm security engaged, publish path being shut down. Severity: HIGH — payload exfiltrates AWS, GCP, Kubernetes, and Vault credentials, GitHub tokens, .npmrc contents, and SSH keys. If you installed any @tanstack/* package between 19:20 and 19:30 UTC today, treat the host as potentially compromised: • Rotate cloud, GitHub, and SSH credentials immediately • Audit cloud audit logs for the last several hours • Pin to a prior known-good version and reinstall from a clean lockfile Detection — the malicious manifest contains: "optionalDependencies": { "@tanstack/setup": "github:tanstack/router#79ac49ee..." } Any version with this entry is compromised. The payload is delivered via a git-resolved optionalDependency whose prepare script runs router_init.js (~2.3 MB, smuggled into each tarball at the package root). Unpublish is blocked by npm policy for most affected packages due to existing third-party dependents. All 84 versions are being deprecated with a SECURITY warning, and npm security has been engaged to pull tarballs at the registry level. Full technical breakdown, complete package and version list, and rolling status updates: github.com/TanStack/route… Credit to the security researcher for responsible disclosure.



I will simply trust everyone to produce good modular code







