Shellsharks Blogroll - BlogFlock

Greyscale in Doodle Scan - Robb Knight • Posts • Atom Feed

2026-09-09T13:46:28.000Z

Last night I was reading this excellent post about scanning pencil artwork and the first step the artist mentioned is setting the pallette to greyscale. This made me realise how useful that would be on Doodle Scan — the black and white mode is good but only in some circumstances where the drawing is just lines, greyscale would be much more useful for illustrations with colour or shading.

Like all the other features on Doodle Scan, it wasn't immediately obvious to me how to do this. After some digging and experimenting with changing RGB values, I realised the relative luminance value I use to check for if the colour is light or dark can be rounded with Math.round to get the value I need. So 253.123 becomes 253 and I set the RGB value of that pixel to 253,253,253.

Below are examples of the three colour modes with default settings from Doodle Scan and if you want a drawing a bit like this or anything you want really you can donate to St Jude.

Colour version

Greyscale version

Black and white version

A “proof” of Fermat’s Last Theorem that fits the margin - Trail of Bits Blog

2026-09-09T11:00:00.000Z

Fermat famously claimed to have a “truly marvelous proof” of his Last Theorem, but he never wrote it down, insisting the margin of his page was too narrow to contain it. A few centuries later, Anthropic announced a complete formalization of Fermat’s Last Theorem using 13 million lines of Lean code (clearly not what Fermat intended). Luckily, we found a wonderfully cursed Lean bug, shown below, that suggests the proof may have fit the margin after all. The issue affects all stable versions of Lean up to 4.33.1, and the patch is incorporated in v4.34.0-rc1.

A “checked” proof of Fermat’s Last Theorem using Lean 4.33.1

The blue checkmarks in the screenshot above would suggest that Lean considers this proof correct. This seems odd given the amount of work Sir Andrew Wiles put into this problem and the vast size of Claude’s proof. So what is going on?

The “proof” clearly doesn’t make any sense and exploits an issue in Lean. We found the issue while using GPT-5.6 to experiment with a new skill for code review. We want to clarify up front that the issue is not a kernel soundness issue, but it happens to nicely fit any discussion of strings, lengths, and substrings.

The issue affects String.Pos.Raw.extract, Lean’s low-level string-slicing function. When asked to extract a one-byte slice at an astronomically large position, Lean’s logical definition returns the empty string. But the compiled native code returns the entire original string. That disagreement is enough to manufacture a contradiction. Lean’s ordinary evaluator “proves” that the tiny slice was empty, while native evaluation “proves” that the very same slice contained “a truly marvelous proof.” Put those together, and Lean concludes that the empty string equals a non-empty string. And once you have a contradiction, you can prove anything, including Fermat’s Last Theorem.

On the bright side, the Lean team was considerably faster than mathematical history. About 90 minutes after we reported the issue, hargoniX opened a fix for the memory-safety problem, and it was merged roughly three hours after filing. The remaining semantic mismatch was fixed by Rob23oba five days after the report, closing the issue. We’d like to give a huge shoutout to hargoniX, Rob23oba, and the Lean team for the fast turnaround.

As a reminder, when dealing with external proofs, follow Lean’s guidance for validating a Lean proof. In our proof-of-concept code above, #print axioms flt shows 'flt' depends on axioms: [propext, Classical.choice, Quot.sound, flt._native.native_decide.ax_1_1]. The extra axiom native_decide adds the compiler to the trusted boundary, and therefore needs to be used with care. Machine-checked proofs will increasingly enable an unprecedented level of trust in mathematical results and critical software. However, more work is needed (e.g., lean4lean and alternative kernel implementations) to ensure that proofs aren’t deemed correct through exploitation of issues in theorem provers.

Fermat’s theorem took 350+ years to prove. If you don’t want to wait that long for your code to be audited, contact us.

JD CLI updated: now creates filesystem folders - Johnny.Decimal

2026-09-09T07:35:50.000Z

The JD CLI has been updated.

It's migrated from using environment variables to the new configuration file.

Now if you try to jd 11.11 to a folder, and that folder doesn't exist, and your JDex is readable by the CLI – i.e. Markdown files on disk, i.e. Obsidian - then it'll create the folder for you.

The MCP server has been updated to understand this tool and the configuration file. Just ask it to help me install the jd cli.

Here's a short video walkthrough.

If you installed the CLI before today

Pull:
```
git -C ~/.jd/cli pull
```

In your .zshrc or .bashrc, find these lines. You might only have the first.

source ~/.jd/cli/jd-nav/jd-nav.sh
source ~/.jd/cli/jd-prompt/jd-prompt.zsh

Replace them both with this line.
```
source ~/.jd/cli/jd.sh
```
Start a new shell.

Second year - James' Coffee Blog

2026-09-09T00:00:00.000Z

I woke up in excitement this morning. Today is the day I can start to access my course materials for next year. My second year of university doesn’t officially start for another few weeks, but from today I can start reading through the introductory material. I spent the morning reading about the structure of the year in the art history and creative writing modules that I am taking: the course overview, how assignments are structured, the referencing requirements (which are going to get more intense in art history in particular, because I will be citing more artworks), and more.

I am writing this in the afternoon, when the excitement from this morning still has not waned. If anything, it has grown more intense. I am so excited for the next year. I started reading the introduction to my creative writing textbook and already started to feel challenged in exactly the way I want. The course overview for the art history module – Art and life before 1800 – piqued my interest in several places. In October we’ll be starting with a block on Art and its Environments, where we’ll be studying landscapes and forests and snowscapes and more. I was just thinking yesterday how much I love snowscapes. I wonder what I will learn about them next year. Across all of the art history work for next year, I am especially interested in learning about the role art occupied in society through history, a key theme throughout all of the blocks we will study.

In creative writing, the main focuses will be fiction, poetry, and life writing. I am excited for all of these areas. The course also touches on building a writing practice. While I write often anyway, I have already found the exercises in creative writing have pushed me in new ways. This is precisely what I want from studying: to challenge myself and grow my skills in areas that interest me. There will also be materials on professional publication, which, while not a goal I have right now, will surely be interesting.

After I caught my breath after a morning of reading, I realised that my first year of university is essentially complete. It will be a few weeks before I get the results from my final assignment, but there is no more work to do for my first year. I did it! I finished my first year! It feels somewhat surreal for my first year to be over, but here we are. Time flies. I am proud of all the work I did in my first year, and am looking forward to the next one.

My first year, which was structured as a foundation in the humanities with opportunities to start exploring the subject area(s) we found most interesting in more depth toward the end of the year, was a whirlwind through art history and creative writing and history and religious studies and more. Every week there was something new to study. I studied Jane Eyre, Antigone, the Benin bronzes, Van Gogh, the foundations of Buddhism, and more. While I was eager to get to the art history topics last year, I loved the approach my school took to covering a wide area. It was the inclusion of creative writing in my first year that helped me build more confidence in my writing, especially in fiction, and ultimately led me to change my degree from a sole focus on art history to studying both art history and creative writing. This combination feels right for me.

Here’s to another year of studying!

Less YouTube, Bandcamp Friday, Silksong returns - W36 - Joel's Log Files

2026-09-08T21:50:00.000Z

This was one of those weeks where I kind of expanded upon most of the main topics on their own blogposts already, so all I can do is summarize and share the links here! A couple extra things here and there too.

Here’s some notes on what happened from September 1 to 7, 2026.

📺 I have decided to limit my YouTube usage to one hour per day on my phone. I used the Unhook extension on both my phone and my computer, to remove the algorithmic feed and stick to subscriptions only.
✂️ Unfortunately that also means I’ve had to cutdown on my Subscriptions! There were a lot of constant videos from certain types of channels that flood that page for some reason. I need to categorize a little more. Of course, I should also use YouTube as a search engine instead of relying on titles and thumbnails to grab my attention.
🎙️ Thankfully, no YouTube means I have returned to a few podcasts to have in the background (or while walking) this week! Including Revolutions and The Rest is History.
📰 Since I was already cleaning up my YouTube, I also spent some time checking my FreshRSS subscriptions and cleaning up some of the old ones. It is honestly kind of weird to have so many blogs I follow go 404 in the six or so years I’ve been around this bubble. I hope I can continue writing here for many more years.
📱 A few weeks ago I switched away from KISS Launcher. My search for an ideal replacement is still undecided, right now I am switching between OLauncher and Minimo Launcher, but I still miss KISS…
📞 My phone line was blocked by the government! This is a new measure taken to combat crime, by making every citizen in the country register themselves with their ID card and a bio-scan. I am still refusing to partake in this mess, by the way, I will write on some of that offline experience soon.
📻 Bandcamp Friday happened! and I got myself a couple new purchases, some videogame soundtracks once again for some titles I have played, and one I have not!
- TOEM Original Game Soundtrack by Jamal Green & Launchable Socks
- Dicey Dungeons Original Soundtrack by Chipzel
- Neva Original Game Soundtrack by Berlinist

My 3DS with Fire Emblem Awakening, gameplay of Silksong and Party House, Coyote vs ACME's poster, and some leaves from a tree

Watching

Coyote vs ACME - This one was a great watch. Even as a kid of the 2000s, public TV channels in Mexico aired reruns of the original Looney Tunes for many, many years of my childhood. The Coyote and the Roadrunner were one of my favorite segments, and I’m incredibly happy to see how they used that concept and developed it here. This one gets my thumb of approval, it really managed to capture that nostalgia and use it for something truly awesome. Also the history behind the production of this movie is kind of crazy, and it even reflects on the themes of the movie itself, a must watch.
Ad Astra - I only watched this one partially, I will finish it today since my weeknotes are late. It’s a bit of a more serious Sci-Fi movie with a future humanity that is only starting to conquer the solar system, until some mysterious energy starts messing with electricity, ships and stations all over the place. It really reminded me of Planetes, featuring people born outside Earth, space terrorism and the like. The main plot focuses on Brad Pitt trying to find his missing Dad, Tommy Lee Jones, who was the best astronaut but went missing ages ago.

Reading

Blue Lock - Chapters 357-359. The match against England is proving to be rather interesting! With Blue Lock adopting a unique formation and Isagi trying to fit into it. The England team is a menace, a team that can’t be read or overcome in the same way that any other team has been before. It is kind of impressive to see that this far into the series.
My Wife is from a Thousand Years Ago - Chapters 287-288. Returned to this rom-com and it’s been pretty cozy and nice to read lately. The wedding feels closer than ever, and family shenanigans are happening too! But I still have 150+ chapters left so, we’ll see how it goes.
Spy x Family - Chapters 138-140. As reliable as ever, I love the humor and the dynamics of this manga. We returned to the Eden Academy and had some very fun and wholesome Anya moments there.
Centuria - Chapters 48-50. A bit of an unexpected battle ensued and a weapon is unveiled which is rather surprising. It is kind of epic!

Gaming

Hollow Knight: Silksong - This game has gripped me all over again now that Act 3 has gotten started. The sequel to the beloved Hollow Knight continues to be an absolute masterpiece, and I’ll probably have to gush about it on a separate post, especially since it’s been a whole year since it’s release on September 4th, 2025. Looking forward to that! For now, I am looking for some Ant Queen boss or something like that, if what I hear of the rumors is true, there may be a super cool battle waiting for me.
Fire Emblem Awakening - After a little hiatus I finally decided to give attention to this game, and I have managed to make some decent progress on Chapter 19! unfortunately I ended up dying and having to reset. But well, now I know the truth. Besides the main story I also did the paralogue that unlocked Cynthia, the daughter of Somia, so I have another Pegasus Knight to level up! I still have a few relationships to develop though, we’ll see how it goes.
UFO 50 - On Sunday I had a bit of a fun time with a friend who visited my place. I don’t often get to do 2-player gaming so I decided to go for this one once more. We played a few interesting titles! Including:
- Party House - An awesome game about inviting people to your party, collecting popularity and money, and being able to host bigger and better parties, until you can fulfill an objective! There are a lot of mechanics and scenarios here, it’s a bit of a Deck-Building game, trying to invite certain people that have certain effects on your score and such. Incredibly fun and simple, I want it on my phone!
- Pingolf - This is a very interesting 2D golf game with a bunch of courses to complete. It doesn’t have a lot of uniqueness going for it, but the aesthetics are great, the mechanics are very good and the score-chasing element will definitely make me return to it.
- Lords of Diskonia - A turn-based game where your army is represented by pucks (like those from Air Hockey). The objective is to slide your pucks and hit enemies. Whoever pushes them off the map wins. Each chip has a certain amount of damage and some skills it can use! We only tried it once and had a fun time.
Mario Party 3 - We had an incomplete session with three friends that was going very well! One of them had to leave halfway through, which is why we switched to UFO 50. You can never go wrong with MP3!

Around the Web

Blog Posts

The 5 Ws of Reading - an interesting challenge for people who like reading books!
Let’s stop buying new phones - I couldn’t agree more, but I’m still tempted sometimes.
SciFi Books: The Golden Oldies - Jules Verne and H.G. Wells are an absolute must!
Let’s talk retro doodads! - Lots of cool gaming handheld emulators mentioned here, enjoy!
My last few weeks in Germany - lovely write-up from Daniel talking of his experience in another country and community.

YouTube

The Golden Age of Mobile Gaming - Scott The Woz - A trip down memory lane.
How Rocky’s Models Were Made for Project Hail Mary - Some cool practical props!
Why the Mariana Trench Still Terrifies Scientists - Good documentary about sea exploration.
What Edge of Tomorrow Understands About Aliens That Hollywood Doesn’t - Cool monster design is cool.

This is day 31 of #100DaysToOffload

Reply to this post via email | Reply on Fediverse

Note published on September 8, 2026 at 8:51 PM UTC - Molly White's activity feed

2026-09-08T20:51:29.000Z

made some tiny stamps out of lino scraps to make labels for my jam jars

Your TV is spying on you, and it's worse than you think. - Werd I/O

2026-09-08T16:33:41.000Z

Link: LG TVs caught spying even when offline or on standby, by Dominic Preston in The Verge

This is an enormous abuse of trust:

“LG smart TVs are almost constantly logging and uploading data about owners and their homes, even when offline or on standby mode. […] Packet captures showed the TVs scanning the local area network for nearby hardware like phones or smartwatches, as well as logging location data and details of nearby Wi-Fi networks, and feeding the information back to LG Ad Solutions. Perhaps more concerningly, the TVs were capable of recording microphone audio when in standby; this continued even after the TV was disconnected from the internet, with audio files stored offline and uploaded once a connection was restored.”

Most households invite at least one television into their homes. It’s almost impossible to buy one without smart TV features; because most television shows are streamed over the internet these days, they’re usually online. You could leave the TV offline while connecting it to a separate box like an Apple TV, but it’ll keep nagging you to connect.

The contract should look like this: you pay for a TV and it shows you stuff. The idea that it will scan your local network for devices, determine what content you like to watch, and maybe even listen to you using a built-in microphone is not something that anybody signs up for. Someone somewhere at LG has been so incentivized to make a graph go up and to the right that they have decided that basic ethical tenets like privacy and transparency aren’t worth holding on to.

That’s particularly important in a world where the Department of Homeland Security has created Minority Report-style Predictive Intelligence Targeting Teams who instruct police to pull people over based on profiled data like their financial activity, despite there being no evidence that they have committed a crime. Data from disparate sources is routinely bought by law enforcement and agencies like DHS in order to create these sorts of profiles; a connected TV in your home could easily contribute. Are you watching the wrong kind of content? Automatic Content Recognition could rat you out. Are the devices connected to your home network outside of the norm? Up goes a flag.

So that’s homes. But most offices have TVs installed somewhere, too. Consider that an installed smart TV could easily be snooping on network devices, content, and even video calls conducted over these screens. Some more sophisticated offices will have them set to a less privileged network or insist on them remaining offline; most will dutifully connect them up. The result is a live microphone and content recognition tech installed in newsrooms, universities, non-profits, and businesses around the country.

Manufacturers like LG can sell this data. They will likely argue that it keeps TV prices down – and maybe that’s true. But this reporting comes after LG promised regulators in Texas to stop collecting viewing data without informed consent; there’s a second mic that may continue recording even when the main microphone setting has been turned off. They’ve shown they cannot be trusted. This kind of invisible data gathering should be illegal. Nobody signed up to be spied on; they just want to watch TV.

ActivityPub - Is it worth defending against replay attacks and message/signature time skew? - Terence Eden’s Blog

2026-09-08T11:34:51.000Z

Here's a problem that I've found with ActivityBot - my little ActivityPub server. Sometimes it receives messages which were originally sent months ago. Why does that happen and is it risky to accept and process them?

My tl;dr is that it probably isn't worth worrying about. But I'd love someone to tell me why I'm wrong.

Here's my thinking:

Causes

All ActivityPub messages should have a "published" timestamp in their body. Some will have an "updated" timestamp. That tells you, unsurprisingly, when the message is alleged to have been originally published or updated. That time might be very different to the time you receive the message.

There are, I think, three different reasons why a server might receive a message which has an out-of-date timestamp.

The first is that sometimes servers are just slow. Processing thousands of messages at the same time means that some of those messages take a while to send. ActivityPub is one big chain-mail so it can take several minutes for a message to be sent to all your followers.

Similarly, your server might be slow. If it doesn't acknowledge receipt of a message, the original server will try sending it again. Sometimes that can take a while.

Finally, some servers take a relaxed view of standards. They send an update to an old message but keep the original publication date. Ideally, they'd use an "updated" timestamp but quite often they don't.

For the purposes of checking the legitimacy of the message, you do not need to check when a message says it was published or updated. You might want to check it isn't an obviously bogus date like far in the future or impossibly far in the past - but that's up to you.

It is normal that your server receives messages which appear to have been published at a totally different time from now.

Is that a problem?

Probably not.

As described above, there are various reasons why a message may be delayed in transit - or may appear to come from the distant past.

What we can check is when the message was cryptographically signed by the sending server. This is independent of its published or updated timestamp.

HTTP requests to your server will have a date header which looks like Tue, 01 Sep 2026 15:54:21 GMT - this is in the slightly peculiar and Anglocentric RFC 5322 format.

New style RFC 9421 headers will also have a signature-input header which will contain something like created=1788278061. That uses the slightly obscure UNIX / POSIX time which counts seconds since the "Epoch" of 1st January 1970.

If you convert the UNIX time to something more modern, you should get an identical value to the date header.

But that isn't always the case. For example, the RFC 9421 standard gives this example:

Date: Tue, 20 Apr 2021 02:07:55 GMT
"@signature-params": ("@method" "@authority" "@path" \
  "content-digest" "content-length" "content-type")\
  ;created=1618884473;keyid="test-key-rsa-pss"

Converting 1618884473 to normal time gives Tue, 20 Apr 2021 02:07:53 - a two second difference.

If the date and created values differ significantly - that may indicate that the message is untrustworthy. Or that there was a delay between the signing and the sending.

The spec says:

The Date header field value represents the timestamp of the HTTP message. However, the creation time of the signature itself is encoded in the created signature parameter. These two values can be different, depending on how the signature and the HTTP message are created and serialized. Applications processing signatures for valid time windows should use the created signature parameter for such calculations. An application could also put limits on how much skew there is between the Date field and the created signature parameter, in order to limit the application of a generated signature to different HTTP messages.

7.2.4. Choosing Signature Parameters and Derived Components over HTTP Fields

But, of course, it doesn't tell you how much skew is problematic. It's up to you how much skew you're prepared to accept.

So that's the difference between the sent time and the signed time. The next time to check is your own. As we've discussed, sometimes servers are slow sending things out. Would you accept a request that was signed five minutes ago? Five days ago? Five months ago? What amount of difference is dangerous?

Here's what various services and sages have to say:

Mastodon

The request contains a Date header. Compare it with current date and time within a reasonable time window to prevent replay attacks.

How to make friends and verify requests

What is "reasonable"? The source code suggests one hour.

Grishka

Time in the Date header must differ from the recipient server’s clock by no more than 30 seconds

A bare-minimum ActivityPub server from scratch

Evan Prodromou

static #maxDateDiff = 5 * 60 * 1000 // 5 minutes

activitypub-bot

SWICG

The standards don't give a concrete time window to use for this comparison. In practice, an hour plus a few minutes buffer in either direction may be a good value, to account for both clock skew and differences in time zone/daylight savings time configuration across systems.

How To Verify a Signature

Others

Without naming names, it looks like a bunch of popular servers don't check whether there's a significant difference between the date the request was signed and the date it was received.

Summary

Various documents and implementations recommend anything between 30 seconds to "a bit more than 60 minutes". Or they just ignore any date difference.

What's the right answer? What happens if the signed date is significantly different from the current date?

What are we trying to protect against?

Replay Attacks. Suppose someone is listening to the communications between the sending server and your server. They copy the message that is sent to you. Later they send it again!

At this point, you might be thinking "so what?" and… I'm inclined to agree with you!

What's the worst that could happen if you received the same message multiple times? Two things that I can think of.

Firstly, it might not be the same message. It is possible to send a new message but with old headers. An attacker could make someone post "I hate Taylor Swift" against their will and watch as legions of fans disembowel the victim.

Except, I don't think this is likely. The signature in the header contains a hash of the message being sent. If you are properly validating the signature, a changed message will have a different hash from the one in the original message. You don't need to check timestamps, you just need to check if the hashes match.

Secondly, idempotence. That's a fancy word for "pressing the button multiple times should only result in one action".

What happens if a user appears to send you multiple "like" messages for a single post? You only record one like.

What if they send multiple messages with the same content? Well, each will have a unique ID in the message - so you only post it once.

What if they send multiple anythings? I can't think of any ActivityPub action which would not be idempotent.

About the worst thing I can think of is this:

Alice sends a message to you saying "I want to follow Bob".
Mallory intercepts this message.
You record Alice is now following Bob.
Alice sends a message to you saying "I want to unfollow Bob".
You record the severed relationship.
Mallory replays the original follow message.
You record Alice is now following Bob.

It's also possible the following could happen:

Alice posts a message saying "I love The Beatles".
You record Alice's message and display it on the timeline.
Alice updates her post to say "I love the Rolling Stones".
Mallory intercepts this message.
You record Alice's updated message and display the new version on the timeline.
Alice updates her post yet again to say "I love the Spice Girls".
You record Alice's updated message and display the new version on the timeline.
Mallory replays the original update message.
You now display that Alice loves the Stones rather than Spice Girls.

Perhaps the same can happen with like/unlike, block/unblock, boost/unboost.

But none of that is significantly prevented by checking the date.

Ultimately, it is up to your sever to check the unique ID of each message and refuse to action any repeated messages. You may not want to trust the unique ID which is sent with the message. If that's the case, you can calculate your own - perhaps using a hash of the contents, the signature, or some other process which will generate an ID based on the message.

Putting it all together

Here's what you need to do to prevent replay attacks:

Independently calculate the hash of the message received.
Validate that your calculated hash matches the hash sent in the message's HTTP headers.
- If not, this is a potential replay attack and the message must be ignored.
Verify that the signature received in the message's HTTP headers includes the message hash and is cryptographically valid.
- If not, the signature is invalid and the message must be ignored.
Has the received message's unique ID already been processed?
- If so, refuse to process it again.

I don't see what checking the timestamp of the HTTP signature has to do with anything. Someone who has access to the original messages and their headers could send them milliseconds after the original delivery.

I think it is probably pragmatic to give messages 60ish minutes grace before dropping them. Delays happen, but anything more significant than an hour might indicate a attack. But, equally, might just mean that the Internet is having a slow day.

If you are correctly checking signatures and hashes, I don't think you need to worry about skew between signature date and delivery date.

No! You're wrong and I can prove it!

Please tell me where I have erred! Stick a comment in the box or drop me an email. If I've made a massive or subtle mistake, I'd love to know what.

Wonders of Web Weaving, Episode 18 - James' Coffee Blog

2026-09-08T00:00:00.000Z

The eighteenth episode of Wonders of Web Weaving is out:

In Episode 18, I chat with Ava, the author of blog.avas.space about, among other things, data protection and privacy, consent in the context of privacy, the armchair of great blogging, and more.

I hope you enjoy the episode!

Wonders of Web Weaving also has an RSS feed you can use to follow along from wherever you get your podcasts.

Ava blog.avas.space The eighteenth episode of Wonders of Web Weaving is out Wonders of Web Weaving also has an RSS feed

SBS meeting schedule: Tue 15/Sep moved +3h - Johnny.Decimal

2026-09-07T22:25:07.000Z

We've moved next week's Small Business Zoom session forward 3 hours.

This is the slot we designed to suit Decimals in the Americas, but at 15:00 the scheduled time doesn't suit those on the west coast who are still at work.

This session only has been moved to:

18:00 Mon 14/Sep – Los Angeles (UTC-7)
21:00 Mon 14/Sep – New York (UTC-4)
01:00 Tue 15/Sep – UTC
10:00 Tue 15/Sep – Tokyo (UTC+9)
11:00 Tue 15/Sep – Canberra (UTC+10)
13:00 Tue 15/Sep – Wellington (UTC+12)
View a timezone chart

Your calendar should update

If you're subscribed to the events calendar (Business members only) this slot should have updated in your calendar.

If it hasn't:

Refresh the subscription.
Confirm you're subscribed to the calendar and that you didn't import a point-in-time copy instead.

Feedback welcome

We try to pick times that suit the most people. Let us know if this doesn't suit, and what does. We'll keep experimenting.

2026-09-07 20:39: Do you know what the hardest thing to do on earth is? Quantum physics? No.... - Kev Quirk

2026-09-07T19:39:00.000Z

Do you know what the hardest thing to do on earth is?

Quantum physics? No.
Solving world hunger? Nope.
Getting Trump impeached? Nah.

It's climbing the stairs on leg day! 🦵🏼

Thanks for reading this post via RSS. RSS is ace, and so are you. ❤️

You can reply to this post by email, or leave a comment.

Skiing in Tūroa - The Weblog of fLaMEd

2026-09-07T08:32:09.000Z

What’s going on, Internet? This is a later post. It’s been a minute since I’ve been skiing. We left the kids at home with their aunty and headed south to Ohakune.

Was made aware before the trip that Ohakune’s main water pipe was recently damaged during an earthquake. Repairs were being made but this weekend the township was without water. Restaurants had to close, hotels and motels had to close and cancel reservations.

We wanted to stay at the Powderhorn this trip for two nights, but the Monday night was fully booked so we couldn’t. Ended up working in our favour as they had to cancell all bookings.

We ended up in a rental house that was owned and managed by a local couple. No running water, but we were able to flush the toilets with water from the spa pool and was hands etc with bottled water supplied by the council.

The view of the mountain from the rental house.

Not much was open in town for food but a few of the takeaways were open so we were able to get a decent feed.

Weather wasn’t looking too flash for Monday up the mountain but it held out in the end. Sure visibility was rubbish off and on during the day, it snowed around lunch time, a great time to take a break, but the snow was pretty good up there.

Like I mentioned, it had been a while (three years) since my last time up the mountain, I went up the top of the Movenpick chair lift and had a rough time getting down. The visibility was horrible up there for the first run.

Visibility for the first run.

I made it down to the top of the Park Lane chairlift and spent the morning at the Wintergarden tow rope and it’s gentle slop getting familiar with the skiis again.

The view from the Wintergarden, tow rope on the right.

After lunch I head back up to the top of Park Lane and spent the next couple hours heading down the Park Lane chairlift.

Once I was confident with that run I headed back up to the top of the Movenpick. The first part of the slope was a bit of a challenge but I struggled through and made it back to the top of Parklane to finish the run.

The base of the mountain, with the Movenpick and Parklane chairlifts heading up.

One day up the mountain is not enough. Next trip I want to spend at least three days on the slopes, a couple hours of private lessons would do me well.

Hey, thanks for reading this post in your feed reader! Want to chat? Reply by email or add me on XMPP, or send a webmention. Check out the posts archive on the website.

Standard zero .05 now reserved for 'AI' - Johnny.Decimal

2026-09-07T04:58:04.000Z

Standard zero .05 has until now been reserved for expansion. I am claiming it for use by your AI agent. I'll duplicate the section from that page below.

⚠️ This blog post is frozen in time. If you're reading this later than September 2026, view the latest text on the standard zeros page in case it has been updated.

.05 AI

A place for your AI agent.

Agents work best when you write things down. Your JDex is an amazing communication tool: both you and your agent can read and write anything in it. Best memory ever.

Sometimes it's useful to have a dedicated space that the agent controls. This is a place that it can store persistent information for recall across sessions.

You can also use it to provide per-system instructions to your agent. For example at 00.05 I have a 'style guide' that tells it how I like my frontmatter properties to be organised (alphabetically).

The skills and MCP server both assume they have control over AC.05.

Emoji ✨

The standard emoji is – obviously – ✨

Note published on September 6, 2026 at 5:27 PM UTC - Molly White's activity feed

2026-09-06T17:27:48.000Z

make bad art

Deleted YouTube again - Joel's Log Files

2026-09-06T13:53:52.000Z

For a little while I have been using YouTube way more, and even paid for the Lite subscription model, simply to test it out.

Honestly, it hasn’t been too bad, and I actually really, really enjoy a lot of the videos I’ve gotten through the algorithm.

But of course, YouTube Shorts have caught up with me and continue to be a very annoying problem, wasting seconds, minutes and hours of my time at every moment.

The algorithm does show some interesting things, or funny content I enjoy, but things go downhill pretty quickly with the usual AI-generated slop videos and recycled content.

A few of the saving graces I’ve seen is shorts made from genuinely awesome videos that came out like 5 years ago, so I think it’s an interesting way to bring life to evergreen videos about science and the like.

With Outer Wilds playthroughs and essays running rampat, my feed slowly phased into more space and astronomy themed topics, which has been pretty fun to get into until I realize half the videos are way too long for what they have to say and use genAI graphics for everything.

So whatever, I just deleted YouTube and cancelled my subscription now. I will continue to use it via Fennec Browser and Newpipe, though maybe a full YouTube detox would be a good idea to try.

Yesterday alone I wasted almost 6 hours on the platform, and I think like 4 of them were just Shorts. Even now I just had to have a video on the background while writing this, what is going on?

You know what, I will try it, I will limit my YouTube time to one hour a day for the rest of the month. It’s possible I’ll fail completely, but hey, at least you will know if that happens and you are free to bully me for it. The weeknotes next Monday will also be the last ones where I share YouTube links this month, as I also feel like a part of me watches more videos because I have a need to find stuff worth sharing here. The less excuses I have the better!

Alright, let’s do this.

This is day 30 of #100DaysToOffload

Reply to this post via email | Reply on Fediverse

The purpose of DNS is to spread scams - Terence Eden’s Blog

2026-09-06T11:34:20.000Z

I imagine everyone here has received an unsolicited message telling them that their tax is overdue and that they urgently need to visit Genuine-Tax-Payment-Website.fart or that a parcel is delayed at customs and you can pay a small sum for its release at Almost-The-Right-Acronym.ak

You know it is a scam. Most people just mark as spam and move on with their day. But a significant number of people don't. They hastily visit the site, tap in their credit card details, give it their mother's maiden name, confirm address, upload a nude selfie, and only then realise that they've been had.

The Internet works at pretty close to the speed of light. You can register a .uk domain and a minute later it's accessible from the other side of the planet. Brilliant for users who want to quickly launch a website. Also brilliant for abusers who want to launch a spam campaign.

By the time enough people have reported the scammers' domain as suspicious, it is too late. In the time it takes for a registrar to disable the domain, or for its name to make its way to the Safe Browsing List, a million messages have already been sent and enough people have handed over their details.

We're told that "the purpose of a system is what it does". At the moment, the Domain Name System's purpose seems to be a vector for criminals to run scams on people at a terrifyingly high rate.

How big is this problem?

BIG!

There's a great blog post by Andrew Campling which reports on this startling claim:

The study found that at least 10% of all new gTLD domain names registered during the year had subsequently appeared on security blocklists by the time of analysis. It estimated that, taking account of subsequent blocklisting and associated domains not themselves blocklisted, the share of names registered by malicious actors may be closer to 20%.

DNS Abuse and Criminal Infrastructure: Beyond Definitions and Blocklists (emphasis added)

That links to a presentation by Interisle which contains some rather shocking statistics (albeit with disputed methodology). It looks at generic Top Level Domains (gTLD) - those are things like .com and .fun rather than country code TLDs (ccTLD) like .uk and .de.

It says 85 million new registrations of gTLDs were made in 2025. Of those 8.5 million were added to blocklists by May 2025. It reckons that a 10% abuse rate is the likely floor for these numbers and it's probably closer to 20%. One in five newly registered domains with a gTLD are scams. That's a bloody crisis.

13 TLDs had more than 50% of their registrations blocklisted.

I can understand why .bid and .loan are popular with scammers. But why .mobi?! What did I ever do to you, eh?

Who are the scammers registering these through?

Ah, our old friends at NameCheap. See Why do scammers love NameCheap?

If those five registrars had more effective policies, it might significantly dent the scammers' ability to ply their devious wares. Or they might just move on to other registrars.

As the report points out:

suspension rates for blocklisted domains were 7.4% to 16.3%.

The full report is on the Interisle website.

What can be done?

I don't know.

In the first instance, it might make sense for registrars to do strong Know Your Customer (KYC) checks on anyone buying a domain. But that stops anyone who wants to anonymously register I-Hate-Nintendo.whatever without risking the wrath of Intellectual Property lawyers.

Also, criminals have access to stolen money and stolen cards. They can convince a hapless mule to register a domain on the criminals' behalf.

Registrars could ask for an escrow payment. Pay €9 for the domain name put €900 in escrow. If your domain appears on a blocklist within the year, you forfeit the money. Criminals with stolen funds are unlikely to care but it would probably put off lots of people from getting a new domain.

There are various banned words and phrases depending on the TLD. For example, South Sudan has a list of political words which they don't want associated with their .ss ccTLD.

But if one gTLD bans a word, a different one might not. A scammer doesn't care if the gTLD is .arse or .elbow - they just want the start of the domain to look legitimate.

Some registrars have strings that they don't allow. In fairness to NameCheap, when I tried to register dwp-payments-gov-uk.pizza it told me that domain was banned. It wouldn't let me get any gTLD with that name.

But all it takes is one registrar to be slightly lax and the scammers get through. Increasing the complexity of the rules is also a hell of a burden on smaller registrars.

Besides, it's pretty easy to get a generic enough looking domain and stick the confusing bit on a subdomain. Here are a clutch mentioned in the report:

https://gov.uk-dwpaph.bond/uk/
https://gov.uk-dwpcjh.bond/uk/
https://gov.uk-dwpclc.bond/uk
https://gov.uk-dwpclw.bond/uk
https://gov.uk-dwpclj.bond/uk/

Perhaps there ought to be a delay before a new domain goes live to allow people to object to it? That would give governments, banks, delivery companies, and a dozen more "important" organisations a right to veto any "dodgy" looking domain.

But suppose someone wants to register gov-uk-stole-my-horse.horse to protest the government's cruel policy of stealing horses - is that a legitimate use of a domain? What if the Darwin Pensioner Divas - a group of elderly singers - want to take payments for their new album of goth/punk covers, can the DPD delivery company veto dpd-payments.music?

Do we want a domain name system where powerful companies control exactly which domains we can register? If I have an idea for a domain on a Friday night do I have to wait until Monday before it can be launched? Are those companies realistically able to parse millions of domains per year and have a low false-positive rate?

All of these things are possible - but all of them come with an impact on legitimate users. To be clear, I don't know what the right answer is.

What is ICANN doing about it?

Lots! It has been a few years since I've been to an ICANN meeting, but even back then the topic of abuse was high on the agenda. They appear to be looking at ways to coordinate abuse reports between various entities, along with some other policies which should hopefully work.

There are two salient points from one of the discussions held at the recent meeting

If anybody thinks that in our current age of AI and as we move into different kinds of computing, DNS abuse is going to numerically stay steady and we will have a downward effect on that baseline 2027 number. I'm not sure that that's an accurate assumption. I think it's going to be the other thing, which is […] it's going to be easier to abuse the DNS.

And

Abusers are going to abuse because it's just too lucrative, because no matter what we do, they will find the way to make profit off of that, and will try to circumvent everything that we do. That is not a reason not to do it, though.

Quite!

As I said, I don't know the answer to this. What I do know is, much like Android's app ecosystem being a haven for scammers, DNS is facing a crisis. When trust in a system goes, only chaos follows.

I don't want to live in a world where I have to show my passport and pay thousands of pounds to register a domain which is only available after being vetted by private interests. But I also don't want to live in a world where scammers have effectively no deterrent from abusing millions of people.

The purpose of a system is what it does. I hope DNS's purpose can become less dangerous while still remaining open.

Complements: Art history, writing - James' Coffee Blog

2026-09-06T00:00:00.000Z

Earlier this week I was chatting with a friend about the skills I am learning from art history. One of the most influential concepts I have learned is to “look closely”. The idea is to spend time with a single thing – to study it closely – and think about what you see in more depth. This helped formalise an experience I was already having in galleries: I didn’t want to see every piece as fast as I could, rather I wanted to slow down.

⁂ ⁂ ⁂

Galleries, and the works within them, feel as if they have a certain magnetism, that magnetism sometimes varying over time. For instance, I was recently fascinated by a work of still life painted in the National Gallery of Scotland. I don’t usually gravitate toward still life paintings, but on that day I wanted to explore them more: to spend time with a genre with which I was less familiar, and to see what I could see.

Similarly, there are paintings that, no matter how many times I look, I see something new and beautiful: paintings that I only need to see in the corner of my eye before I stop and know I have to go over and look at the work in more detail. This year, the painting that has caught my attention the most is Turner’s sunrise over Norham Castle. The colours are transfixing. The scene is beautiful. The art is infinitely intriguing. I must have spent at least half an hour over several visits looking at this painting, and longer thinking about it.

I am studying both art history and creative writing next year. This is perhaps not as common of a mix as, for example, English Literature and creative writing, but mixing the study of art history and the theory and practice of creative writing feels right to me.

I haven’t coalesced a complete vision of the complements between these two subjects but, today, as I write, I feel like the concept – and application – of looking closely lends itself well to both my studies in art and my writing. Art history has helped me look closely. In writing, I similarly need to look closely at the world and capture as many details as possible, everything I see in the rhythm of the world, in Nature, in cities, and everything I feel, being a potential detail to use in a story.

⁂ ⁂ ⁂

Studying art has helped me refine my visual description skills. This starts with thinking about the artwork. The kinds of questions I may end up answering are things like: What do I see? What is the art about? How do I know? How is a work composed? How do different parts within a work of art relate? How does the work at which I am looking compare to others I have seen? As I think, I enjoy writing down what I see. Other times, I enjoy just looking at a work, knowing that I don’t need to write anything to get something out of the experience.

These visual description skills blend in with my writing: the more I know what to look out for, the more details I know that I can write down, and the better I can incorporate those details into my writing. This connects with my creative writing where details about what I see can be an integral part of both life writing (an introspective kind of writing, which I enjoy) and creative writing (poetry, fiction, and more). Using written descriptions of art as part of storytelling even has its own term: ekphrasis.

⁂ ⁂ ⁂

Art galleries have also helped me wander more: to slow down.

When I am in a gallery, I like to go towards whatever stands out, and spend time with it – to wander a room and see what works appeal to me, to get up close with a piece and spend time with it, to walk closer and further away from a piece to see what I see. In many cases, I can see specific places I have seen paintings, my memories of the spaces being so vivid. Perhaps this is because I like to slow down in galleries. ¹

Slowing down complements the pace at which I write and code. When it comes to writing and coding, I am often moving quickly: capturing ideas on paper, thinking about and formalising logic in code. I am moving fast because I love making things. In contrast, studying art invites me to slow down. Indeed, one of the most delightful experiences in galleries is when I have been looking at a piece for a few minutes and I notice something new. It is delightful to feel the process of seeing new things as you spend more time with something.

I am excited for the next year of my studies as a time to refine my visual description skills, to learn more foundations of the history of art, and to see and feel how writing and art history combine for me.

If you are curious, I am the sort of person who likes to diligently look at every piece one by one in an art gallery, moving through the space slowly. I like slowing down.

[↩]

ekphrasis 1 [↩]

Note published on September 5, 2026 at 3:19 PM UTC - Molly White's activity feed

2026-09-05T15:19:08.000Z

Other platforms will soon follow, a senior administration official told POLITICO on Tuesday. “We got Lake America changed on Google Maps, and many other maps are changing in a couple days. And Wikipedia is going to change as well,” said the official, who was granted anonymity to speak frankly.

A Wikipedia editor put it well: "You almost want to pat them on the head and say 'Yes, of course it will' in the same way you'd tell a small child that Santa Claus will be delivering their presents."

Note published on September 5, 2026 at 3:05 PM UTC - Molly White's activity feed

2026-09-05T15:05:23.000Z

Huge congratulations to the US-based Wikimedia Foundation employees who voted with 92% support in favor of unionizing, and shoutout to the tireless work of the organizers.

Book Review: The Passing of the Dragon and Other Stories by Ken Liu ★★★★☆ - Terence Eden’s Blog

2026-09-05T11:34:47.000Z

This is a gorgeous set of short stories - and a good deal more accessible than some of the heavyweight prose Liu has previously been involved with. Some of the stories contain sentences which are complex jewels to be savoured.

What I particularly like is the way he moves between almost-prosaic Earth-bound stories to the the most extraordinary flights of fancy. One story might be set in a downtown art gallery, the next in the ice-rings of a far-off planet. The creeping feeling of senescence haunts the reader as they flit from story to story.

Much like his full-length novel All That We See or Seem, Liu has an incredible knack for tapping in to modern fears and weaving tall tales around them. There's a tenderness in all his character - even when a couple of the stories go nowhere, it is still pleasant to spend time in the worlds he has created.

It is, perhaps, missing a cohesive theme - the dragons come and go throughout the stories. Nevertheless, a compelling work chock full of fantastical ideas.

If you're in the mood for a wide and varied selection of stories, this is well worth picking up.

Many thanks to NetGalley for the review copy. Passing of the Dragon is available to buy now.