Shellsharks Blogroll - BlogFlock

Independence Day, War of the Worlds, Final Fantasy - W38 - Joel's Log Files

2026-09-22T01:18:29.000Z

The weather was comfy this week, not a lot of rain, but the chill is starting to be noticeable. I still haven’t worn anything on top of my regular t-shirts though. These weeknotes will cover September 15 to 21, 2026.

Honestly, the stars stars aligned, and I pretty much wrote about every interesting thing happening, or any thoughts that sparked during the week on separate blogposts! Of course, most of the real life events don’t get posts, and those are mentioned here, plus a link here and there.

🇲🇽 It was Mexican Independence Day! On Tuesday my church had a fun event where we had food and played lots of games together. I ended up quite tired. My outfit was rather barebones too, just the jersey for the Mexican team, it was fun to see some friends dressed up with more traditional stuff. The food was absolutely delicious as well. Viva Mexico!
🎮 Completed the Summer Game Challenge, completing a total of 6 games, and making progress in so many more.
📽️ During Wednesday, I got the day off from work, so my family went out shopping and we also went to the movies, we picked a film blindly this time, By Any Means, which was quite something. We also had another coffee… I’ve had a lot of coffee lately. After the movies we went shopping to a supermarket, where I decided to play videogames despite being in public.
🌐 Joined The Worst Webring, a webring started by Brent (a.k.a. TK) that should contain members of people from the TWG Community, so that’s fun. This event also inspired a blogpost.
🍿 On Saturday my parents went on a date and I stayed with my sibling and we ordered some chicken wings at home and watched a movie and it was pretty cool to just chill, eat wings and have some snaks!
🕹️ I was not feeling well on Sunday, so even though my friends stayed to play videogames, I didn’t really felt like playing along. They decided to try Gunstar Heroes, a classic of the Sega Genesis, and went through the whole thing in Easy mode, it looked incredibly fun! I was just watching laying on the sofa.

My PSP showing off Final Fantasy IV, a panel of the Blame manga, a frappuccino, and a scene from War of the Worlds

Watching

War of the Worlds - Another Steven Spielberg movie! This is a retelling of the classic novel by H.G. Wells. It honestly really, really worked for me. The tripods are terrifying, the situation is catastrophic and humanity is helpless. The horror and tension and inability for us to do anything against the aliens who didn’t even consider us an threat really had me on the edge of my seat.
By Any Means - This was a crime thriller film based on real life events where a black FBI agent and a mafia hitman are forced to work together to get to the bottom of some civil rights murders. There were plenty of gruesome moments in this where I just closed my eyes tbh, but I enjoyed what I saw of it. The score was jazzy and kinda cool, and even though the movie has a slow pace,it kept me intrigued.
Mercy - This is one of those “main character stuck in a room reacting to things without doing a lot” movies. Some guy forced to solve a murder case for an AI judge that will kill him because he is actually the prime suspect according to evidence. The plot itself is kinda great, but doing it in this way was boring, and talking about AI and not doing much other than say “AI and humans both make mistakes” is meh.

Reading

Blame! - Chapters 1-9. This is a new sci-fi manga I had on my “plan to read” for a long time. It follows Kyrii, a human with a very powerful gun that is travelling through a giant seemingly endless megastructure, looking for other humans possessing a special gene. There are many unanswered questions, but the atmospheric storytelling of this manga is through the roof. The architecture and mystery of the whole thing hooked me. Kind of a terrifying concept.
Centuria - Chapters 67-72. I continue to enjoy the adventure here, the story got rather dark all of a sudden. The mix between kinda slice of life and life-or-death scenarios is kinda crazy on this one.

Gaming

Final Fantasy IV - Out of nowhere, I decided to return to this gem of a JRPG. Last I played I had unlocked the Lunar Whale and didn’t make much more progress. More than a year passed since then. Now that I returned I decided to follow a bit one of those old plain text guides. I ended up defeating some extra bosses, unlocking summons, and then continuing the story, defeating the Giant’s core (I didn’t remember that was supposed to happen), I also beat some extra dungeons with trials for every character, unlocked the ultimate weapons for most of them, and I’m making my way to the last dungeon of the game! I have found plenty of chests there and right now I’m about to battle one of those difficult bosses: Dark Bahamut.
Kirby and the Forgotten Land - Barely touched this game during the week, I only tried some of the side levels that let me unlock upgrades for my powerups. I didn’t get to play with a friend during the weekend because I got lazy.
Around the Web
30 Days of Gratitude - A whole list of great wholesome posts you should check out.
A Relaxing Vacation - Syl went on a short vacation and shared some of her adventures with her family!
When we didn’t know everyone’s politics - Interesting points brought up by Ruben, definitely worth a read.
Lofi phone - This looks kinda neat, but it’s also very expensive and I’d rather get a proper phone.

YouTube

For some reason space horror made its way into my YouTube recommended (which I enabled for a day during my break just to see), I have to admit I was entertained! Interesting stuff and books that I kinda wanna read. It’s why I started Blame!

This is day 41 of #100DaysToOffload

Reply to this post via email | Reply on Fediverse

Wonders of Web Weaving, Episode 20 - James' Coffee Blog

2026-09-22T00:00:00.000Z

The twentieth episode of Wonders of Web Weaving is out:

In Episode 20, I chat with Sara, the author of sarajoy.dev and whimsica11y.net, among other things, the importance of web accessibility, screen readers, and the joy of exploring and making things on the web.

I hope you enjoy the episode!

Wonders of Web Weaving also has an RSS feed you can use to follow along from wherever you get your podcasts.

Sara sarajoy.dev The twentieth episode of Wonders of Web Weaving is out Wonders of Web Weaving also has an RSS feed whimsica11y.net

Seeking a "yes, and" space - Werd I/O

2026-09-21T19:08:03.000Z

Twenty-two years ago this month, I moved house.

I’d been living in Edinburgh, an ancient city whose gothic architecture cuts into an expansive sky. Even the air felt apart from the rest of the country: there was a different sort of chill to it, and it carried a malt smell from the breweries on the edge of town. When the train doors opened at Waverley Station, I didn’t just know I was home; I felt it on my skin and in my bones.

Edinburgh is famous for its support of the arts: the Festivals double the population of the city each summer. People fly in from all over the world to showcase their creativity and find new audiences. The city is alive.

But I had to leave.

I’d been working on Elgg, the open source social networking platform I co-founded. It was originally built as a reaction to the prevailing educational technology platforms, which seemed to have been built to satisfy compliance teams rather than to help anybody learn. People are already learning from each other on the web, was the implication. Let’s take those ideas and bring them in. Nobody had coined “Web 2.0” yet, but that’s what we were building: a way to support the informal learning and connection that happens in hallways, study rooms, clubs, and parties. Those relationships and conversations are what you really take away with you when you graduate, but they were completely absent from the prevailing software.

But the social headwinds were enormous. “It’ll never work here,” we were told, again and again. “Blogging is for teenage girls crying in their bedrooms,” one university leader memorably told us. We were in our early stages, looking for generative conversations, and they were hard to come by. In improv theater, there’s a yes, and rule that allows everyone to build on each other’s ideas without destroying the flow. A no, but response is conversation-ending punctuation: the generative energy has been terminated. But in Scotland, all we were getting was “no, but”. We were looking for optimistic creativity but could only find pessimism.

The difference in energy when I moved back to Oxford, my hometown, was night and day. I was able to find the yes, and energy I needed, and I felt less alone in trying to build something new. Elgg eventually powered networks for Ivy League universities, multinational corporations and NGOs, governments, and impactful social movements. None of it would have happened if I’d succumbed to the pessimism.

It’s worth saying that Edinburgh has since established a robust innovation scene — and much of it is down to creating a cultural shift as well as simply providing infrastructure. Both help, but it’s incredibly hard to create anything new if you’re being told none of it will work every day.

Twenty-two years later, I’ve made another move — and I’m experiencing the same vibe shift.

There are one hundred and sixty-six Canary palms on Palm Drive, the long, straight road that leads to the oval that serves as the entrance to the Stanford campus. Every morning, I walk past each one. Every evening, I walk back. The sky is blue save for the low-flying planes coming in to land at SFO. Every few minutes, a Waymo self-driving car drives past me; more than once, a coyote or a hare has crossed my path.

This is home now.

A little over two weeks ago, I arrived on the Stanford campus. During the month of August, I moved out of my house and drove across country. The Pennsylvania forests and rolling hills of Appalachia gave way to cornfields, plains, salt flats, and mountains. Back home, my house was on the market. This isn’t a subtle move to a next chapter: it’s all change.

For the next academic year, I’ll be a JSK Fellow: part of a cohort of thirteen people invited to Stanford to explore and test out practical responses to the challenges facing journalists and journalism around the world. I’ll spend almost every day on campus, taking courses, visiting research labs, attending and hosting events, and connecting with people across disciplines and backgrounds.

Immediately, two things hit me. First: every single person in my fellowship cohort is inspiring. I get to share a room with people who have made enormous differences to their communities through their dedication to journalism, in places like Ukraine and Venezuela as well as here at home. The JSK staff are similarly impressive, with their own backstories of real impact. I feel very lucky to be in the room with them (and, inevitably, like a bit of an imposter).

Second: this is explicitly a yes, and space. The change in pressure and energy was palpable. And it couldn’t have come at a better time for me.

Newsrooms are under threat financially, politically, technically, and existentially. In that environment, it’s easy to become a no, but culture: when everything you do is scrutinized, the culturally safest thing to do is to take the conservative path. Decisions are made to iterate on the status quo rather than take leaps of faith. I’ve heard “this will never work here” as a thought-terminating statement at the early stages of a project’s ideation many times. When there are real changes, rather than innovate and do something new based on their community’s real needs, many newsrooms in the United States simply ask the question: “what is the New York Times doing?”

It’s understandable — the conditions that newsrooms are forced to work under are far from ideal — but it comes with a real cost, particularly when trust in journalism and loyalty to newsrooms are plummeting, in the fastest period of technology change (and therefore journalistic and democratic change) in decades. Real journalism provides the information and context that people need to make informed decisions, including who to vote for; it is part of the bedrock for a functioning democracy. As it happens, journalism’s decline is coinciding with democracy’s decline. We need new ideas that will serve our communities more effectively, and fast. Entrenching in the status quo or copying the Times won’t cut it.

And, speaking purely for myself, that widening gap between the immense, crucial need and what actions newsrooms are prepared to take can lead to burnout and learned helplessness. I badly needed a yes, and space.

It’s been two weeks. If the onboarding was the extent of my JSK experience it would be incredibly valuable: the mindset shift I desperately needed, and a set of tools that usefully reframe what I’ve been thinking about. But it’s a nine-month program, and there’s a lot more to come.

The need for innovation in news is not exactly new. When I first moved to the United States fifteen years ago, one of my first acts was to attend a design thinking session about the future of news at the Stanford d.School as part of Ben Huh’s Moby Dick Project. It foreshadowed everything that would happen next: I’ve been working on media innovation ever since, including for years at Matter, a media accelerator that was heavily rooted in the d.School’s methodology. We liked to quote the academic Clay Shirky, who wrote about the need for experimentation in the industry as the newspaper market started to bottom out with the phrase: “nothing will work, but everything might.”

Last week, I spent the day at the d.School again as part of my onboarding, and I felt that phrase resonating again. “Nothing will work, but everything might.” Let’s be generative.

Every JSK fellow applies with a project to work on. Here’s mine, as I originally framed it:

Trust in journalism is in long-term decline. Referrals to news articles from search engines and social media are also declining. There are many reasons for this. Google switching to AI-powered instant answers and seismic changes in incentives by the owners of prominent social media platforms are two commonly-stated causes, but they aren’t the whole story. It’s also true that many newsrooms didn’t understand or adapt to changes in how people want to interact with information that came about in the Web 2.0 era. Newsrooms still cling to a broadcast or publishing model rather than embracing conversation as a community of journalists and readers. People believe news is biased and shaped according to the needs of each newsroom’s corporate owners, but newsrooms don’t want to open up their process or add transparency for fear of becoming part of the story.

Most modern newsrooms live or die on the web, but the web is a conversation, not a broadcast medium, and newsrooms typically haven’t upgraded their thinking to fit. Helping them to build stronger human relationships with their communities — and each other — on the web will increase trust, loyalty, and resilience. And new community platform technologies like ATproto and ActivityPub could help provide building blocks for new kinds of news sites that elevate community and relationships to first-class parts of a newsroom’s work.

In the community-first software era, I expanded on where I might start with this idea:

Newsrooms rely on something called a “callout” when they want to learn more from their readers. More often than not, this is a simple web form: “Has your doctor pushed this prescription medication? Let us know.” But instead of a two-dimensional form, what if we built a short-term community space that safely brought readers in and allowed them to discuss in more depth with the journalists?

My bet is that two things will happen: the journalists will get better information, because it will arise in conversation, and those readers will build stronger, more transparent relationships with the newsroom. And stronger, more transparent relationships will lead to more trust and more loyalty.

It sounds plausible, right? And maybe it is. But in the process of discussing my idea with other fellows, through the genuinely excellent facilitation by Tran Ha, I’ve realized I’ve skipped into solution-land without spending enough time on making sure I’ve framed the problem correctly.

I’ve been led by these beliefs:

I believe that good journalism is a vital prerequisite for democracy: good contextual information allows us to make strong democratic decisions, including who to vote for, when to protest, where to spend our money, and how to use our voices.
I also believe that many of our societal problems have been caused by platforms like X and Facebook that are so large that their owners can affect democratic discourse on a global scale, and that open protocols prevent anyone from having that much power.
And finally, I believe that AI is abstracting us away from the human information sources that can provide real context and connection.

Those are genuine beliefs I hold. But they’re abstract, ideological ideas. The idea that journalism is important, or that AI has a distancing effect, doesn’t connect to someone who can’t find stories that represent their community or who has had to build an AI prompt to pull together actionable information because it was scattered. The idea that open protocols are better doesn’t speak to someone who needs to share information with their community in a safer way because they’re under attack on incumbent platforms.

These things are hard to explore when you’re a part of an existing organization, with its own culture, norms, rhythms, and risks. Here, I’m not Ben Werdmuller, Senior Director of Technology at ProPublica (or CTO at The 19th, Director of Investments at Matter, Co-founder of Elgg, etc) — I’m an academic fellow with a mandate to explore independently. I don’t need to be restricted by an organizational context; I can sit with the problem in my own time and space. It’s a gift.

For my project, my first task is to learn more about the ecosystem I want to help. Which communities should I start with? What are their characteristics? What are their needs? Who are the newsrooms that serve them today?

As a human, my task is also to fully break out of a reactive, iterative mindset and into one of holistic exploration. How can I serve my own mind, body, and spirit so that I can work on these problems to the best of my ability? How can I learn from my fellowship cohort and the incredible people on the Stanford campus? How can I show up for them so that we can support each other’s work and each make the impact we set out to achieve? And how can I embrace my own inner yes, and?

That’s my mission at the start of this year. I’m going to take you with me — and I hope to be in conversation with many of you as I progress. Let’s work on this together.

SAML: A fractal of bad design - Trail of Bits Blog

2026-09-21T11:00:00.000Z

Born out of academia and raised in corporate IT departments, the Security Assertion Markup Language (SAML) authentication protocol continues to be a staple in these organizations. However, it’s time for it to retire. With the rise of software-as-a-service (SaaS) companies in the late aughts, IT departments needed a way for users to authenticate to many new web services. SAML and the burgeoning single sign-on (SSO) industry fulfilled this need. However, SAML is being crushed under the weight of its own complexity. It’s time to deprecate it and move on to modern alternatives like OpenID Connect (OIDC). In this post, I will explore the design-by-committee origin of SAML, its progression through the ranks in academic and corporate environments, its slow disintegration at the hands of the security research community, and its (hopeful) deprecation in favor of newer protocols.

SAML 101

What’s insidious about SAML is that it really is mostly straightforward to understand, but it’s built on a foundation of sand, bone dust, and ash; it works … if you assume XML signature validation is reliable. But XML signature validation is deeply cursed, and is so complicated that most fielded SAML implementations are wrapping libxmlsec, a gnarly C codebase nobody reads.
— Thomas Ptacek, 2023

SAML and the birth of the SSO industry

Wikipedia tells me that “SAML is an XML-based markup language for security assertions.” It was created in 2002 by the Organization for the Advancement of Structured Information Standards (OASIS) Security Services Technical Committee (SSTC). Okay, we’re not off to a great start by modern standards. XML, despite having some redeeming qualities, is quite complex compared to newer alternatives like JSON, but we’ll get more into that later. Further, a committee of subcommittees having meetings is a recipe for “kitchen-sink” protocol design (e.g., waterfall methodology, big design up front, etc.). And sure enough, we’ve now jammed four (!) XML-based security protocols into one:

… the following intellectual property was contributed to the SSTC:

Security Services Markup Language (S2ML) from Netegrity

AuthXML from Securant

XML Trust Assertion Service Specification (X-TASS) from VeriSign

Information Technology Markup Language (ITML) from Jamcracker

— SAML: History

However, the desire for such a protocol was undeniable. As the internet shifted from Web 1.0 in the 90s to Web 2.0 in the early aughts, users and organizations needed an easy way to authenticate to many new web services. Academia was the biggest driver of this movement, although not the only one: Central Authentication Service (CAS) in 2002 at Yale, Shibboleth IdP in 2003 by Internet2, a consortium of research universities (including my alma mater), ADFS in 2003 by Microsoft, and simpleSAMLphp around 2007 by Uninett, a state-owned Norwegian company with close ties to academia. All these authentication projects eventually supported SAML in one way or another. Like ARPANET before it, universities were at the forefront of internet development and were the earliest consumers of web services. Once this base layer of protocol availability and nascent academic proving ground was established, the commercial industry took it and ran toward a multibillion dollar industry.

The SSO, identity, and authentication provider industry was also starting up in the early aughts, but really came to fruition a few years later: Ping Identity (2002), OneLogin (2009), Okta (2009), and Duo Security (2010). These companies were essentially built on the SAML protocol with the exception of Duo, who would introduce their first SSO product in 2015, which is where I come into the story. I worked on Duo’s first on-premises Access Gateway product (DAG), which was built on simpleSAMLphp and, obviously, the SAML protocol. It’s where I became intimately familiar with the SAML protocol and spent many years of my life digesting its lengthy specifications. I was there when Kelby Ludwig found the XML comment bypass, but we will get into various attacks and SAML deficiencies later. Suffice it to say, the SSO and authentication provider industry was booming, and much of it was built on the SAML protocol.

A crack in the armor

XML signature wrapping (XSW) attacks are the proverbial arrow to SAML’s heel. While there was earlier security research into both signature wrapping (2005, 2008, and 2009) and SAML (2008), I consider the godfather of it all to be “On Breaking SAML: Be Whoever You Want to Be” (2012). It tested theory against practice and resulted in an automated way to check for XSW attacks. This was our north star when implementing the DAG. It was the reason we chose simpleSAMLphp as our building block. PHP, especially at the time, was not exactly known for its security track record, but simpleSAMLphp’s spoke for itself. simpleSAMLphp was resilient to XSW at a time when nobody really knew what that was:

simpleSAMLphp’s security track record (credit: On Breaking SAML)

Despite being front and center in this 2012 paper, XSW is still present today. If we know the bug class, then why can’t we fix it? But before we get into SAML’s flaws we first have to consider the shaky ground it was built upon: XML.

XML is no slouch when it comes to a (lack of) security track record. These bug classes would have been more familiar to a developer in the 90s, but nonetheless are still present in XML today: XXE, entity expansion (“billion laughs”), DTD retrieval (SSRF), XPath/XQuery/XInclude/XSLT/CDATA injection, and more. A SAML library needs to handle all these bug classes before even getting to the actual SAML functionality.

In addition to security bug classes, there’s also the sheer complexity of XML when compared against something like JSON. In XML you have tags, elements, attributes, comments, namespaces, markup versus content, schemas, CDATA, DOCTYPEs, and more. In JSON, you essentially have keys, values, objects, and lists. Complexity is generally at odds with security, and this is one reason I consider SAML to be a fractal of bad design.

A fractal of bad design

SAML provides ample opportunity to learn about protocol design. In this section, I will cover five flaws that I consider to be fatal to the long-term viability of SAML as an authentication protocol. These flaws can also be used when designing new authentication protocols. That is, you can either sidestep the flaw, or take its inverse and attempt to bake that into the protocol.

Built on XML

As mentioned above, SAML is built on XML, and XML is complex, but it’s not the committee’s fault. XML is what they had at the time, and it’s what people used. JSON was “discovered” in 2001, but this was right around the time the SAML committee was meeting, and they’d be unlikely to design an authentication protocol around an experimental new format. Especially when it caters to JavaScript and you write a lot of Java.

One could design a quantitative complexity measurement for XML versus JSON or SAML versus JWT/OIDC (e.g., spec/RFC word count, spec/RFC normative word count, etc.), but that would require a blog post or paper all to itself. In the interest of staying on topic, I will refrain from doing that here, and suffice to say that XML is significantly more complex than something like JSON.

Canonicalization

Canonicalization (C14N) is what you do when you want to take the wild mess that is XML, compute a hash of it, and get consistent results. In other words, if the SP and IdP cannot agree on a consistent representation of the XML data, then the bytes won’t line up, the signatures won’t match, and your authentication fails. However, this is easier said than done.

Canonicalization bugs enabled Kelby’s XML comment bypass in 2018:

XML canonicalization (credit: Identity Theft)

Canonicalization is often a precursor to parser differential and/or “round-trip” bugs, which are what most modern SAML attacks use:

Enveloped signatures

Enveloped signature concerns are a not-too-distant cousin of canonicalization. In short, if you’re trying to insert the signature into the data payload that you’re signing, you’re going to have a bad time. Let’s compare and contrast JWT and SAML in this way:

JWT versus SAML signatures (credit: jwt.io and samltool.io)

In the JWT example above, the blue signature is detached from the JSON payload and delimited in the JWT with a period (“.”). In the SAML example, the Signature element is inserted (“enveloped”) in the Assertion element. The problem here is that it is very difficult to get a byte-for-byte, canonically equivalent representation of the data when you’re also modifying it! Even more so when you have a complex format like XML and complex canonicalization rules.

“Kitchen-sink” design

This design deficiency essentially transposes to you aren’t gonna need it (YAGNI). It’s not an entirely fair characterization because the portions of the SAML specification that are used in the real-world have changed over the past 20 years (sorry, SOAP and artifact binding). However, the fact of the matter is that 99% of modern SAML implementations use a very similar data shape and subset of the specification. Any given SAML authentication you would encounter in the wild today probably avoids 90% of the specification. This adds significant complexity for largely unused features.

If I was adding SAML support to something new, I’d consider beyond all the standard SAML checks also rejecting any message that doesn’t have the same shape as what Okta, Onelogin, Google, or Shib generates.
— Thomas Ptacek, 2021

Ossification

SAML was designed in a different era for a different time and has not received necessary updates. These concerns will generally be of practical implication rather than theoretical. What I mean by ossification can roughly be enumerated as the following:

OIDC assumes HTTP, whereas SAML is transport independent. Sure, SAML HTTP bindings exist and are most commonly used, but they are not required. This affords SAML a certain degree of flexibility, but also means that flexibility must be well defined, must be implemented somewhere, and can contain bugs. SAML came about at a time when HTTP + TLS was not yet the dominant backbone of web service communication, and it has never reconciled with this modern landscape. HTTPS allows OIDC to punt encrypted, trusted communication to the transport layer.
OIDC generally assumes a connected network topology, whereas SAML does not. The most common OIDC flow (authorization code) assumes the OpenID Provider (OP) and Relying Party (RP) can communicate directly (OIDC OP/RP == SAML IdP/SP). Sure, OIDC implicit flow with form post exists, but it is very uncommon to see today. Further, SAML has artifact binding for direct communication, but it is also very uncommon. The point is that if the OP and RP can communicate directly then that relieves pressure off of the authentication response payload to contain all the information necessary to make an authentication and authorization decision. This reduces payload size and complexity. The OIDC OP and RP can instead exchange information in a backchannel.
OIDC grew organically over the years, whereas SAML was largely designed up front. OIDC encompasses dozens of specifications and RFCs that grew organically over many years. These documents were generally created to solve a specific need rather than trying to anticipate all future needs and building that up front. This is akin to agile methodology versus waterfall, as described in the first section. Consider the following non-exhaustive timeline:
1. OpenID Connect 1.0 specification published (2014)
2. JOSE stack finalized for JW{S,E,K,A,T} via RFC 7515-7519 (2015)
3. PKCE published via RFC 7636 (2015)
4. PKCE for mobile/native apps published via RFC 8252 (2017)
5. Device authorization grant for IoT devices published via RFC 8628 (2019)
6. Demonstrating proof of possession (DPoP) for MFA workflows published via RFC 9449 (2023)
7. PKCE for SPAs published via RFC 10017 (2026)

I find the historical circumstances interesting too. For example, SAML came of age in an era of VPNs and network segmentation, hence point (2) above. If the IdP or SP was behind a corporate firewall, and it couldn’t speak directly to the other end, then the whole rollout came to a halt and that vendor lost the sales deal. SAML needed to seamlessly account for this situation. Google’s BeyondCorp model and zero-trust architecture flipped this notion on its head in 2014. Additionally, SAML failed to anticipate the mobile, SPA, and IoT revolutions, and had no answers when these technologies arrived on the scene in the late aughts. Even though SAML is still widely adopted in corporate environments, these macroscopic events helped start the long, slow decline of the protocol. Agility and loose coupling enable rapid adaptation in ever-changing IT environments.

All roads lead to OIDC

No protocol is perfect, but in terms of a solution all roads lead to OIDC. As far as I can tell, the only deployment scenario where SAML had an advantage was networks where the SP and IdP cannot communicate directly. OIDC’s implicit flow with form post provides all the same ingredients. This is actually one of the cleanest migration plans I’ve seen available in the industry.

So what can I do if I’m a service provider (i.e., SP) and I’d like to integrate into the SSO ecosystem without SAML? Just support OIDC. Abandon SAML. Apparently Fly.io and Tailscale are already doing it:

We’ve managed to hold the line on OIDC so far. So has Tailscale. If Tailscale can hold the line, given who they’re selling to, I think most orgs can. Really, try to avoid doing SAML. Remember, as a vendor, you’re often competing with companies that don’t do real SSO integration at all.
— Thomas Ptacek, 2024

So what can I do if I’m an identity or authentication provider (i.e., IdP) and I’d like to move off of SAML? Well, depending on your customer count, this may be a long road indeed. But you know how you eat an elephant? One bite at a time. This is a well-worn path in the industry: develop a deprecation plan, communicate it to customers, stop onboarding new customers to SAML integrations, provide existing SAML customers with equivalent OIDC configurations, set a sunset date, and get to work.

SAML had a good 25 year run. It birthed the SSO industry, helped secure untold numbers of authentications, improved the UX of authenticating to dozens of web services, and created billions of dollars of economic impact. We should be thankful to the creators of the SAML protocol. It has provided us with a great case study in protocol design and evolution over a very dynamic period in the tech industry.

If you’d like to read more about historical analyses of security topics, then check out “Marshal madness: A brief history of Ruby deserialization exploits.”

Do you use :visited on links? - Kev Quirk

2026-09-21T09:27:00.000Z

I've always made the :visited attribute for hyperlinks look the same as links that haven't been visited, and it seems that it's the default behaviour across the web. I've never really given it much thought, until I actually used :visited in anger.

My feed reader of choice, Miniflux uses the :visited attribute properly, making visited links purple. When reading posts from the hundreds of blogs I follow via RSS, I find it really useful to see if I've already visited a link within a post.

So with that in mind, I've decided to change the CSS on this site slightly, and visited links are now purple. It's subtle, but obvious enough, I think:

If you want to do something like this yourself, the CSS is very simple:

a {
    color: #3995F7;
}

a:visited {
    color: #8839F7;
}

Do you use the :visited attribute on your blog? I feel like I don't see it used very often around the web.

Thanks for reading this post via RSS. RSS is ace, and so are you. ❤️

You can reply to this post by email, or leave a comment.

Of Day - James' Coffee Blog

2026-09-21T00:00:00.000Z

I stand at the bookshelves — art and Nature and biography and memoir — and ask myself what story I want to tell. What do I want to write?

What I do know is I want to write something. And so I begin.

⁂ ⁂ ⁂

My adventure began with zines. I packed four zines to read: three pocket-sized that had been kindly sent by a friend, and one folded, A3-sized zine that I had purchased at the weekend. The reading material got me through the wee hours of the morning, food for thought after breakfast, and left me with a list of more zines to search through. The zines took me to Edinburgh and Canada – one place I know well, a source of perpetual joy and curiosity and adventure; the other I have never visited, but would love to one day. In a sense, I visited Canada a little bit through the words of an author this morning. Therein, the power of writing – of storytelling.

Should I write more zines? What if I started printing a few of my blog posts and sending them to friends? Should I write more that I exclusively publish as a zine?

⁂ ⁂ ⁂

This weekend I purchased a copy of the Edinburgh Bookshop Map, published by Typewronger. The map, printed with a risograph machine using red and black ink and whose cover is typeset in a Gothic font, became my map of today. I should try and go to as many of the included bookshops as possible. Last night I set out five shops I could visit that were on the way to an errand I had to run. Today, I began – or, rather, continued, for I have already visited ten shops on the map – my adventure.

I knew today I would be walking far, but I didn’t realise how far I would be walking. I spent most of the morning on foot, weaving between bookshops, running an errand, and drinking a delicious coffee that reminded me of pear and blackcurrant and caramel – the coffee was fuel for the moment, the bookshops were fuel for the morning. I ended up visiting three: an Oxfam charity shop that specialises in books, with a wonderful antiquarian selection, Rare Birds, which specialises in books by female authors, and Golden Hare, which had an eclectic mix and had me standing still at the Nature and memoir and art section for a few minutes, and where I found myself writing the opening sentence to this blog post. What do I want to write?

Where would my writing fit? Memoir? Nature?

⁂ ⁂ ⁂

In the park later in the day a lady’s jeans stood out. They were sky blue with polka dots that looked like stars in the moment before nightfall. Around me, the blue sky and the warm sunshine and the brilliant beginnings of red leaves marked the essence of the day. A cool morning became a warm afternoon – summer is slowly becoming autumn. In front of where I stood, watching the world go by in the heart of the city – and in one of my favourite parks – there was some graffiti written in red, blue, and yellow chalk. The lettering was mostly illegible but the impression of the strokes made me think of the word “bliss.” Here, the bliss of Day.

⁂ ⁂ ⁂

I wandered to the art gallery, where I was welcomed with words both perplexing and wonderful. I held the door open that connected the antechamber to the main galleries. A lady asked “Say, where do you keep the artist’s chairs?”. Her accent was brilliantly English. I stumble for a moment. “Oh, I don’t work here.” I continued to hold the door open for a few more people, before someone said I could go first and walk in. In school, my best friend and I used to love holding doors open for people. I haven’t thought about that in the longest time.

I was fascinated by a painting near the entranceway. I have looked at the painting closely before, but today I saw new symbols – the connection between the colour red and the subject matter, the flow of clothing, the foregrounding of Nature relative to the city in the background. Walking around further, exploring more paintings, I found myself looking up in awe, admiring a personification of poetry, and thinking about how, here, I can wander from world to world, from time to time. In Ruisdael’s Banks of a River, the tall trees reach for the sky in our imaginations. In another room, architecture and Nature and history exist side-by-side, in separate canvases that are connected together through curation, through place.

I was tired from all my walking in the morning, so I didn’t explore the gallery space too much. But, I did make sure to visit my favourite painting on display in the space: the Turner. I again saw something new today. I saw the silver and sky blue air of Nature. I found a new connection to the water. I thought about why I love Impressionist art and Turner’s art so much. I love the colours. I love the energy. I appreciate the subject matters. I enjoy how my imagination is engaged when I see a colourful work whose contours are a blurry invitation to dream.

⁂ ⁂ ⁂

The map gave me direction for the day. I visited three bookshops on my list ¹ and spent my day with stories both written and visual, as well as the stories that were happening all around me. My wanderings took me from words to art, and then to music, when I heard someone play Mamma Mia on a public piano to which one passer-by was singing along. Reflecting on the music I heard played, I think about hope. Just as the sun shines through the ever changing clouds and the wind breathes life into Day, so too can we bring joy with words and art and music – with stories, with our melodies.

⁂ ⁂ ⁂

When I got home, sitting at the foot of my letterbox there a letter from a friend. They had sent me a zine from one of the series mentioned in a zine I read earlier today. Sometimes the world can be wonderful.

One I also wanted to visit was closed, and another was a children’s bookstore, and I think I will skip them as part of my ambition to visit as many bookshops on the map as possible

[↩]

1 [↩]

I forgot webrings exist - Joel's Log Files

2026-09-20T19:25:58.000Z

I don’t usually check analytics on my website, but the hosting I use on Vercel does provide the ability to check referrals, and I have to admit, every once in a while I enjoy to see those!

It’s not because I am obsessed with people who visit my website (although I kind of am), or because I want to write according to what my readers view the most (although I sometimes do that too). I simply love to see when someone links to a post of mine for the first time, and I see their website on my referrals showing up. A lot of the time it’s only four or five clicks from X or Y small website.

Since I only get the referral, an investigation is sure to follow! I love to explore blogs, digital gardens, and personal websites in any form. Checking their blogrolls, reading through their guestbooks, skimming through posts to see where we may share interests or hobbies.

However, every once in a while I’d find a website that would have no mention of me whatsoever anywhere in the page, and I wasn’t sure how they ended up linking back to me, you know? I had to go even deeper. Maybe using things like FreshRSS’s user queries, websites like Backlink Watch or cool search engines like Marginalia, which has lots of neat information about sites on its index.

But no, even then I couldn’t see where some of those clicks were coming from, and I kind of left it there, it doesn’t matter that much after all. You see where this is going right?

Last year I wrote a pretty extensive list of every blogroll, webring and site that links to me, but well, I always enjoy belonging to more of them, I guess.

Today I wanted to get setup on The Worst Webring, and I edited my footer to add the corresponding URLs for Next, Previous and Random. Typical webring stuff.

I decided I would check if all the other webrings were still working (one of them, the previous link on Geekring, currently does not, by the way), so I clicked on all of the previous and next links, and that’s where it finally hit me.

The reason I was getting referrals from websites that didn’t have any links to me, was because those websites were my neighbours in the webrings I’m on!

So any people clicking around the webrings and ending up visiting my website, come from my neighbors, who don’t really link to my site, but I happen to be the next/previous site on the ring for them!

I didn’t forget webrings exist, I simply forgot how they work, by helping people build connections!

So, that kind of puts me in an awkward position, how come I have never checked up on my neighbors before?

Umm, hi :3

This is day 40 of #100DaysToOffload

Reply to this post via email | Reply on Fediverse

Book Review: How to Build a Space Station by Jonathan Morrison ★★★⯪☆ - Terence Eden’s Blog

2026-09-20T11:34:30.000Z

This book, by The Times' former Architecture Correspondent, stands in direct opposition to A City on Mars. Whereas that book presented a (perhaps too) sceptical look at the realities of living on other planets, Jonathan Morrison's book goes (perhaps too far) in the opposite direction.

How to Build a Space Station is a beautiful examination of just how important architecture will be to our colonisation of other worlds. Not just in terms of physical safety - but psychological safety as well. It is a direct and forceful rebuttal to those who say it cannot be done.

It is, in my opinion, just a touch too credulous about some of the ludicrous claims from the hype merchants. I want to believe that Martian igloos can be conjured out of the ice and that Musk's rockets will deliver a steady stream of supplies to distant worlds. But the evidence presented is rather thin. The book works best when it focuses on what architecture can bring to the table when it comes to designing the future.

In short, a spacecraft is not just a machine; it is also a home, an office, a refuge. If people are asked to go to the most remote environments, to live in spaces scarcely larger than a few rooms, and to perform work of immense complexity and risk, then comfort, efficiency and ergonomics are not just luxuries.

Space has to be worth living in. Putting people into a tin-can with no windows, blank walls, and an infernal background hum will drive them mad. All this is backed up with extensive descriptions of the engineering challenges of polar research bases, spaceports, and previous craft.

Despite being rightly scathing about Wernher von Braun's involvement in atrocities and his eventual political rehabilitation - he is somewhat more muted in his criticism of Messrs Musk & Bezos. There's a lot of praise for celebrity architects and designers - without any real examination of whether their designs are practical rather than just award fodder.

Similarly, the book takes on trust that autonomous robots can ingest extraterrestrial soil, process it, and 3D print structures from it all while in a hostile environment. The fact that we don't have swarms of drones prefabbing houses in the relatively benign atmosphere of our planet should be evidence that maybe these claims aren't quite matched with reality.

Finally, the "why?" question. A City on Mars points out that the cost of mining gold from asteroids would be more profitably spent improving mining technology here on Earth. How to Build a Space Station takes a different approach; it'll improve things here:

Space architecture is not just escapism, a thrilling sci-fi fantasy – it is a forge for creating the tools we need at home. These include but are not limited to circular systems, low-energy fabrication, modular construction and buildings that take psychology seriously.

I have a lot of sympathy for that. Except… the Internation Space Station has shown us how to endlessly recycle water relatively cheaply. Yet every modern building on Earth pays only lip-service to reusing grey-water. 3D printing is amazing, but the number of structures built using autonomous robots extruding concrete is approximately zero.

We have the technology - but we don't seem to be interested in using it.

The book is mostly well illustrated - with some gorgeous drawings of actual craft and possible future inventions. Sadly no photos, maps, or anything to help illuminate some of the other challenges faced by living and working in space.

This book is endlessly fascinating and bang up to date, with lots of talk of events that happened in 2025. The way it brings together the sciences of engineering and psychology is marvellous. But, as much as I'd like to believe in a Martian habitat built by robot trebuchets flinging microwave sintered tetrapods into each other, I just don't find it convincing.

I really hope I'm wrong.

Many thanks to Netgalley for the review copy - the book is available to buy now.

Headless Plexamp Receiver - Hey, it's Jason!

2026-09-20T00:00:00.000Z

Let's put together a small headless Plexamp audio destination device!

2026-09-19 22:28: Watched Forrest Gump for the first time in 20 odd years this evening. Watching it... - Kev Quirk

2026-09-19T21:28:00.000Z

Watched Forrest Gump for the first time in 20 odd years this evening. Watching it again with an adult brain...Jenny is a real bitch!

Thanks for reading this post via RSS. RSS is ace, and so are you. ❤️

You can reply to this post by email, or leave a comment.

Amelia the Chicken - Kev Quirk

2026-09-19T08:09:00.000Z

We lost our favourite chicken last night. I know, just a chicken, right? Big deal. It's not like we lost a pet.

But that's the thing, Amelia was more than just a chicken. She was a pet. She was very tame and would often come into the house to sit with one of us.

She would scratch around the kitchen while we were eating breakfast then quietly cluck at one of us to be picked up for cuddle.

We named her after Amelia Earhart because she was always the first of all our chickens to go exploring. Right from the moment we got our first 6 chickens, Amelia came up to us while the others hid. Often posing for photos.

Amelia on day 1, posing for a photo

It's very sad when you lose a pet, and although this won't hit us as hard as when we inevitably lose one of our dogs, it's still really sad. Both my wife and I have shed a few tears for Amelia this morning.

We'll miss you, girl. x

Thanks for reading this post via RSS. RSS is ace, and so are you. ❤️

You can reply to this post by email, or leave a comment.

A day is short, a life is long - Kev Quirk

2026-09-18T20:30:00.000Z

A day is short, a life is long

by Kevin Wammer

Kevin talks about some of the stuff he's figured out in his life now that he's turned 35.

Read post ➡

Really enjoyed this post because it's honest, level headed, and real. Since stepping down in work myself, I too have realised that good enough is...good enough.

Funny, huh?

Kevin talks about a lot more than just his career, but I won't ruin a great read for you. Go check it out.

Thanks for reading this post via RSS. RSS is ace, and so are you. ❤️

You can reply to this post by email, or leave a comment.

What a time to be alive - The Weblog of fLaMEd

2026-09-18T19:43:11.000Z

What’s going on, Internet? Today just seems like one of those days. It’s Friday evening and I’m standing here at my desk with a beer, messing with the blog. Placeholding some later posts that I meant to write but time got away on me. Listening to new music, playing new computer games, and watching new favourite old TV shows.

Kids are in bed, and asleep.

New golf clubs arrived. I got to have a swing at the range.

New Miley Cyrus album. I was onto something, wasn’t I? Check out Bass Persuades, and the second single Let’s Get Married.

Blizzcon was last weekend. New Warcraft III expansion, Forsaken Kingdom. Which sets the story for the new World Of Warcraft game; Forever.

New South Park, with a new intro song. Let’s hope it’s less whatshisface this year.

And don’t mind those blank posts you’ve seen pop up in the feed, I’m staging them as a encouragement for me to finish writing them.

Hey, thanks for reading this post in your feed reader! Want to chat? Reply by email or add me on XMPP, or send a webmention. Check out the posts archive on the website.

London Hardhouse Reunion 2026 - The Weblog of fLaMEd

2026-09-18T19:08:30.000Z

What’s going on, Internet? Later post. Write me.

Hey, thanks for reading this post in your feed reader! Want to chat? Reply by email or add me on XMPP, or send a webmention. Check out the posts archive on the website.

Open Tabs August 2026 - The Weblog of fLaMEd

2026-09-18T19:01:52.000Z

What’s going on, Internet? If you don’t folllow my Bookmarks through the feed, then here’s the bookmarks from August. Enjoy.

MOUSELING.net - Hyper Text Muck-up Language Solid tips for budding webmasters
Welcome to the web we lost Sacha Judd tracing the good internet through X-Files fandom and webrings, and it’s still out there in the corners.
How to Fix the Internet Not everything is fine on the Internet, but there’s an opportunity, and it starts with choosing what you pay attention to yourself.
How I built Timeframe, our family e-paper dashboard - Joel Hawksley Definitely keen to build one of these for our home! So cool!
Conceived in a secure military facility, this Jedi Knight fansite has been running consistently for almost 30 years: ‘It looks really close to what it did back in 1998’ | PC Gamer A community site for Star Wars Jedi Knight: Dark Forces II, still active and still looking like 1998.
It’s just a website The humble website 😃
I Wonder How Many is Too Many When it Comes to Adding Pages – The Land Where Turbie Posts How many pages is too many? As many as you want 😃
owls’ guide to webshrines A sweeet practical guide for creating your own “shrines”, mini sites for any one of your interests.
Creating a Successful Fansite: A Comprehensive Guide A comprehensive guide for getting started creating your own fansite. Go build one.

For more, check out the bookmarks archive, and subscribe to the feeds if you want these as they happen.

Hey, thanks for reading this post in your feed reader! Want to chat? Reply by email or add me on XMPP, or send a webmention. Check out the posts archive on the website.

Beervana 2026 - The Weblog of fLaMEd

2026-09-18T18:59:28.000Z

What’s going on, Internet? Later post. Write me.

Hey, thanks for reading this post in your feed reader! Want to chat? Reply by email or add me on XMPP, or send a webmention. Check out the posts archive on the website.

Weeknote #2018 - Robb Knight • Posts • Atom Feed

2026-09-18T17:26:00.000Z

We've added new stickers to the St Jude fundraiser including a sparkly Jimothy. You're gunna want this one. Donate here.

We've got a new garage door going in next week which means I'll be able to actually use the space to it's full potential. I'm more excited than I should be.

Alex has been abusing ID3 chapters to make "video" podcasts by setting chapter art every few seconds. This is glorious and terrible and I love it.

I like the look of the Platinum Komono as a pen, but I am not a fan of any of the colours. Going to give this one a miss.

These mountain sticky notes are amazing but I can't justify the shipping cost. If they pop up in the UK somewhere, I'll be getting them.

Zach open-sourced his light/dark toggle component after I implemented mine. Rude.

Game UI Database is a fun resource.

Andy added an RSS feed that posts a random album from his collection every day.

My temporary PHP fix from 2014 has nearly 20M installs. Today I'm deprecating it. Fun story.

Wake up babe, new cat just dropped.

Who is my (pixel) neighbor? - Joel's Log Files

2026-09-18T15:25:00.000Z

A couple weeks ago I got an email from a guy named Oleh, mentioning that they added me to a new website/project called Pixel Area, it is a 100x100 field of pixels, each of which can link to the blog or personal website of whoever claims it first.

My spider senses tingled, because the email’s writing felt cold and distant, as if it was generated/translated by an LLM. However, the website looked legit, fun, and it was a genuinely interesting idea. Despite this, the footer featured links to a Bluesky (fine), Mastodon (good!) and… an X account (meh). I wondered if this was something I wanted to be involved, and continued my research.

I checked the Mastodon account and saw a thread with Brennan, who was questioning who was behind the site, if it was vibecoded, and if the blogs linked on it where added with permission.

You can see the short conversation there, but I also decided to reach out about it by replying to the email I got, Oleh replied back soon enough.

He seemed to me like a pretty honest guy who just doesn’t speak English very well and didn’t have a lot of experience programming websites. I am not going to quote things since I didn’t ask for permission, but Oleh confirmed it was assisted by an LLM, just like he did to Brennan, and mentioned all the work he did himself too, in the span of multiple months.

I dislike the use of AI, I (hopefully) have been very clear about it, I think it can end up as a stain on what would otherwise be an awesome thing. I believe a project which is tied to technologies that have stolen and caused harm is not in the spirit of the indieweb or my blog.

But, I also believe that a person or a project can be decent and improve for the better, despite our disagreement on that front.

After all, Bubbles, a beloved project by a lot of the blogging community has used AI, been criticized for it, and learned and improved because of it. I think that Pixel Area, which is a lot smaller in scope, can end up being a nice thing too and slowly get better. There is a human in there who did plenty of work one way or another. I also know the blogs there were picked by a person.

I noticed too, that Oleh removed the link to X from the footer, a very good sign to me. I didn’t request for that to happen, I wonder if some others did, but I appreciate it nonetheless.

Because of all of this, I decided to be OK with the project, and I even did my own pixel-art button on my footer, since the one in the website had a whole different style for my taste… Soon enough Oleh even asked me for permission to change his own design to be pixel art too, so if you now have a super cool 88x31 pixelart button, you can thank me for that ;)

At the end of the day, it is a glorified and super cool blogroll, and I honestly can’t have enough of those.

Many of the bloggers I follow were already there, some of them have already written about it.

You can check the full directory of websites and see if you were added already. You can also request to be removed.

Perhaps not all of the people I just linked above were aware of the fact some LLM assistance was used for this, and I am sorry if that has kind of ruined the enthusiasm.

I hope Oleh learns and understands the craft that goes behind coding a website by hand, and hope he can rework and revise things in the future with a new perspective, maybe the community also reaches out to help reshape and guide the website together.

A part of me still feels like a walking contradiction because of this, don’t get me wrong. Nut it’s how I feel at the moment! I like pixels what can I say?

So, back to the question in the title! Right now you can find me at the X:85, Y:10 coordinates, in the “Echo Heights” district. There are not a lot of neighbors in that area just yet, so if you want to be close to me and you are not part of Pixel Area yet, claim your pixel!

This is day 39 of #100DaysToOffload

Reply to this post via email | Reply on Fediverse

2026-09-18 15:33: Finally! #ClicksCommunicator - Kev Quirk

2026-09-18T14:33:00.000Z

Finally! #ClicksCommunicator

Thanks for reading this post via RSS. RSS is ace, and so are you. ❤️

You can reply to this post by email, or leave a comment.

2026-09-18 13:33: Absolutely gorgeous sky this morning. - Kev Quirk

2026-09-18T12:33:00.000Z

Absolutely gorgeous sky this morning.

Thanks for reading this post via RSS. RSS is ace, and so are you. ❤️

You can reply to this post by email, or leave a comment.

Shellsharks Blogroll - BlogFlock

Independence Day, War of the Worlds, Final Fantasy - W38 - Joel's Log Files

Watching

Reading

Gaming

Around the Web

YouTube

Wonders of Web Weaving, Episode 20 - James' Coffee Blog

Seeking a "yes, and" space - Werd I/O

SAML: A fractal of bad design - Trail of Bits Blog

SAML and the birth of the SSO industry

A crack in the armor

A fractal of bad design

Built on XML

Canonicalization

Enveloped signatures

“Kitchen-sink” design

Ossification

All roads lead to OIDC

Do you use :visited on links? - Kev Quirk

Of Day - James' Coffee Blog

I forgot webrings exist - Joel's Log Files

Book Review: How to Build a Space Station by Jonathan Morrison ★★★⯪☆ - Terence Eden’s Blog

Headless Plexamp Receiver - Hey, it's Jason!

2026-09-19 22:28: Watched Forrest Gump for the first time in 20 odd years this evening. Watching it... - Kev Quirk

Amelia the Chicken - Kev Quirk

A day is short, a life is long - Kev Quirk

A day is short, a life is long

What a time to be alive - The Weblog of fLaMEd

London Hardhouse Reunion 2026 - The Weblog of fLaMEd

Open Tabs August 2026 - The Weblog of fLaMEd

Beervana 2026 - The Weblog of fLaMEd

Weeknote #2018 - Robb Knight • Posts • Atom Feed

Who is my (pixel) neighbor? - Joel's Log Files

2026-09-18 15:33: Finally! #ClicksCommunicator - Kev Quirk

2026-09-18 13:33: Absolutely gorgeous sky this morning. - Kev Quirk