Shellsharks Blogroll - BlogFlock

Scattered thoughts on social geolocation - Terence Eden’s Blog

2026-07-22T11:34:12.000Z

I want to be able to share my location with my friends on social media. Twitter (RIP) had a way to attach an optional location to a post. Facebook still lets me check in to venues. But neither ActivityPub (Mastodon) nor AT Protocol (BlueSky) allow me to do that.

I've been banging on about this for a while so was delighted to be invited to chat with the GeoSocial Task Force on their monthly call.

But, before I start, please remember that these proposals are not mandatory. If you don't want to share your location, then please don't share your location. This is an optional feature which shouldn't be used by people with a strong need for privacy.

We were primarily discussing the nascent Geographical Microsyntax proposals.

Firstly, I love the idea of being able to share my location. I want my friends to know I'm in town for a gig. I want people to think I'm cool because I'm seeing some experimental theatre. I want to virtue signal that I'm giving blood.

Similarly, I want to be able to find social media posts by location. What's happening right now in Paris? Did anyone else hear that sonic boom in London? Which cool people are also at this gig with me?

But, I do think these proposals have some issues which need to be addressed.

User Research

The primary thing missing from the proposal is any form of understanding what users want to do with a geotagged post.

You see a post like:

Hanging out with friends. I just checked in to Leicester Square.

What do you expect to happen when you click that link?

See who is at the location?
Read more information about the place being discussed?
Find all posts at that specific address?
Discover posts which are close to there?
Something else?

What other things do people want to do with geotagged posts?

Find all posts within 5Km of me?
Discover users who have posted near me?
Get emergency alerts for the city I'm in?
See what's trending in a specific country?

Without knowing what people might want to do with this information, it's rather hard to design a service which meets their needs.

To micro or not to micro?

Where I disagree with the proposals is the idea of using inline text as a form of microsyntax.

Proposals like "I am in /London/ eating ice-cream" or "Checked in to Leicester Square L:N123456" fail for a couple of reasons.

Things like #hashtags and @mentions developed organically on social networks before they were eventually adopted by the platforms themselves. It is rare that a top-down diktat can be used to tell people how they should be formatting their posts.

More importantly, people are crap at formatting things consistently! Every event I go to has people using #Event alongside #Event2026 or #Event26 or a hundred variations.

Even if users could format it consistently, names are ambiguous. Is 🌐:Paris the one in France or Texas?

I'm strongly of the opinion that text is for text, not syntax.

Openness 🆚 Centralisation

Saying that you're on a specific point on the globe doesn't always provide useful information. Even with altitude, it isn't always possible to work out if your in the Starbucks or the Costa next door. Do you want to say you're in a train station, or a distinct platform, or even a specific train journey?

There are various services which offer unique IDs per loosely-defined place.

Google Maps provides a Place ID for every thing that it knows about. There's a similar service from FourSquare. But both of those are closed and proprietary systems - they can only be updated by the company that creates them.

Wikipedia's Wikidata has IDs for lots of places, similarly OpenStreetMap has nodes with names which can be used to identify locations.

But all of these suffer from the same flaw; they are centralised.

If Google kills its service then all those Place IDs die.

This has happened before. Yahoo used to run the Where On Earth IDentifier service but discontinued it.

While OSM and Wikipedia are great projects, they're still centralised. If you're banned from OSM, you can't create a new node.

So, to my mind, the primary way of identifying a place has to use a fully open, globally agreed, and unrestricted standard.

Location Plus Plus

The obvious choice is latitude and longitude as defined by WGS 84. It allows for arbitrary precision anywhere on the planet.

No one can stop you issuing lat/long just because a country is under sanctions. The standards community can't revoke your access to it. The co-ordinates are well understood by almost all software.

There are some alternatives. Google's Plus.Codes build on top of lat/long to make something more human readable. But, crucially, human readability is not the issue here. This is metadata which should never be shown to a human. If a user interface wants to format a lat/long they can do so as a Plus.Code or any other format.

GeoJSON

There are dozens of competing ways to mark up a location.

It seems sensible to me that, given most major social media protocols use JSON, adding GeoJSON would be the simplest way to add geographic information to a post's metadata.

At its most basic, a single "Point" can be shared like so:

{
    "type": "Feature",
    "geometry": {
        "type": "Point",
        "coordinates": [-0.13005,51.5103]
    }
}

It can have as much or as little precision as needed.

If the place being checked into has a name, it can also be added - this could be used for display purposes within the message

{
    "type": "Feature",
    "geometry": {
        "type": "Point",
        "coordinates": [-0.13005,51.5103]
    },
    "properties": {
        "name": "Leicester Square"
    }
}

The properties can be as complex as the sender wants. For example it could add Wikidata references, OpenStreetMap IDs, telephone numbers, or some cool new thing which hasn't been invented yet.

Here's a maximalist example of checking in to a park:

{
    "type": "Feature",
    "geometry": {
        "type": "Polygon",
        "coordinates": [
        [
                [-0.1303791,51.5099976],
                [-0.1295305,51.5100444],
                [-0.1297077,51.510947 ],
                [-0.1308786,51.5105859],
                [-0.1308893,51.5105793],
                [-0.1303791,51.5099976]
            ]
        ]
    },
    "properties": {
        "name": "Leicester Square",
        "WikiData": "Q848912",
        "OSM": "4082589",
        "GooglePlaceID": "ChIJPcTFENIEdkgR94E58rgB69o",
        "PlusCode": "9C3XGV69+4X",
        "Quinfrob": "🌐89451_𰻝",
        "address": {
            "road": "Leicester Square",
            "neighbourhood": "St. James's",
            "quarter": "East Marylebone",
            "suburb": "Covent Garden",
            "city": "City of Westminster",
            "ISO3166-2-lvl8": "GB-WSM",
            "state": "England",
            "ISO3166-2-lvl4": "GB-ENG",
            "postcode": "WC2H 7NA",
            "country": "United Kingdom",
            "country_code": "gb"
        }
    }
}

What's Next

My personal opinion is that the following needs to happen:

Talk to some users - find out what they might use this for.
Work with privacy advocates to reduce possible harms (for example, being able to redact a location from a previously shared post).
Discuss with developers about how they'd work with this metadata.
Clients should start adding GeoJSON metadata to their posts, even if it can't be displayed yet.

You can read the minutes of the meeting and I'd encourage you to join the next call.

People are transcribing your conversations without asking. That puts you at risk. - Werd I/O

2026-07-21T02:40:50.000Z

Link: This Conversation Is Being Recorded. They All Are., by Katherine Bindley at the Wall Street Journal

I’ve been thinking about this story for days.

“A Zoom call isn’t complete without an artificial-intelligence note taker. Phones are out at meetings, capturing every word. During impromptu conversations with co-workers, someone might turn on the Granola transcription app, which can turn the interactions into one-page summaries or a list of action items. Even at bars and on dates, people are using AI-infused listening apps to analyze conversations later on.”

The story goes on to talk to a woman who uses Granola to record her dates, then pours the transcripts into Claude to give her feedback about how she could have done better. And there’s account after account of people using it in meetings without asking for consent or revealing that they’re recording.

Certainly in Silicon Valley, a societal shift seems to be underway. It’s likely much more widespread than that. I’ve been present in meetings outside the tech industry where Granola’s watermarking was visible but I wasn’t asked to consent. The watermarking is optional; I have to assume I’ve been in meetings where I’ve been recorded without my knowledge.

Pair this trend with the story that the Trump Administration actively sought the phone records of journalists — and their families — who reported on the new Qatari-gifted Air Force One. Subpoenas were issued to the phone carriers, and the Department of Justice notified the newsroom a week later. In some cases, subpoenas can be issued to carriers and service providers privately, allowing the data to be retrieved without the newsroom’s knowledge; in this case, the DoJ did try to gag the phone company from alerting the newsroom.

A world in which every conversation is recorded and transcribed is one where every conversation can be subpoenaed or surveilled. Here, the surveillance is decentralized through people who actively want to conduct it for their own benefit, but the data is still stored centrally and available for authorities to subpoena or someone else to mine. Granola’s security page makes clear that the data is accessible to them — and therefore to a third party that compels them to hand it over — and notes that:

“Granola trains on your anonymized data so we can keep making Granola better. You can opt out of this in your Settings.”

Granola makes a point of saying that audio is not stored, but given that transcriptions are, this seems moot: the words in a conversation carry its meaning. Subpoenas for your conversations go to it, not to you, and you may never know they were served. If you record someone’s conversation without letting them know, you’re putting them at risk.

Don’t get me wrong: I would love to have an automatic summary of meetings I’ve taken part in. I have also run meetings on non-sensitive topics where I’ve asked for consent before starting transcription. It’s the ubiquity and covert nature of the transcription that bothers me, paired with its central storage in what amounts to a honeypot for subpoenas and hackers.

Recording a conversation with someone without their consent is illegal in many states and countries, so this behavior may be forced to change. California is one of them, and Granola appears to be thriving there, so there is a world where the law changes to meet the new ubiquitous surveillance norm. Until the dust settles one way or the other, anyone who wants to talk about a sensitive topic, particularly in Silicon Valley, will need to be more wary than usual.

Wonders of Web Weaving, Episode 11 - James' Coffee Blog

2026-07-21T00:00:00.000Z

The eleventh episode of Wonders of Web Weaving is out:

In Episode 11, I chat with flaMEd, the author of flamedfury.com about, among other things, web communities around games and television shows, sharing music interests with a personal website, community in the indie web, and more.

I hope you enjoy the episode!

Wonders of Web Weaving also has an RSS feed you can use to follow along from wherever you get your podcasts.

flaMEd flamedfury.com The eleventh episode of Wonders of Web Weaving is out Wonders of Web Weaving also has an RSS feed

The Odyssey, air bubbles, and Monument Valley - W29 - Joel's Log Files

2026-07-20T22:40:00.000Z

The World Cup final is over, and justice has been made. As much as I love Messi as a player, Argentina just fell off this tournament and I didn’t want them to win at all. Spain managed to play fair and attack during the whole game, and even though two of their goals were invalidated, they still managed to score and snatch victory at last.

I would like to apologize for becoming a football fan all of a sudden. I’m actually surprised how little I mentioned the World Cup back in 2022 since I actually followed it quite a bit, but alas, To the weeknotes we go!

🎂 My dad’s birthday happened this week! So we went out to have some food and also shopping for gifts! I even got out of my workplace early so I didn’t double my lunch intake. My siblings made him get a couple of free things from some mall shops because of his birthday, so that was fun.
🪟 Took the time to install screen protectors to my XTEINK X4 and to my Nintendo 3DS… I didn’t take the time to do it… properly. Now every single screen on those devices has one (or more) bubbles on it, and I’m sure a lot of you will feel extremely annoyed by the thought. I just wanted to let you feel uncomfortable out of nowehere, yes I am that evil. I will keep playing Fire Emblem Awakening and happily ignore such little things.
🎮 In case you didn’t read my post about tracking my gaming, it was all just to share a PSP homebrew called GameDiary, which let’s you track your gaming on the PSP! It’s super cool and quite reliable so far, a great tool that gives the 3DS’ Activity Log a run for its money!
🤖 Wrote about the AI-generated webinar about using LLM for work and yeah, in case you missed it, it was a pain! though I had fun laughing about how ridiculous it was.
🍿 I was completely unaware that my family was going to kidnap me to go watch The Odyssey on Friday, but at least this time my sibling paid for the tickets, and I got a single popcorn bucket for everyone, which served its purpose well.
🍗 My family bought some food before the movies—it’s why a single popcorn bucket worked out—but I had already eaten lunch at my workplace, so I was a little mad about it, but still ate a bit out of everyone’s plate without paying a cent, I am not sorry.
📚 The movie got me interested on the original works by Homer, I’ll be reading a Spanish translation since it’s still my native language and it might be fun for a change of pace. I went for the translation in prose by Carlos García Gual, by Editorial Alianza… I may read the Illiad first though.
☕ My mom actually invited my friend—the one I invited to the movies a couple weeks ago—out of nowhere and without me knowing it, not to the movie, but to meet up later with everyone (especially my siblings who hand’t seen her in a while). Hovever, the movie was so long she ended up waiting for like an hour. I didn’t realize this until the movie ended, and was a bit upset my mom didn’t even bring it up. At least she brought a book. We all got some coffee afterwards and had a nice conversation. I made a couple discoveries that made me think this will only ever stay as a friendship, which is probably for the best.
🚲 On Saturday I went to the gym by bike again! This time was not as painful as I only did some back exercises. I locked my bike a bit better than last time, where my back wheel could have been totally stolen, so that’s nice! I am yet to go consistently for four days a week though, I keep missing here and there.

Watching

The Odyssey - Well well well, I found this movie to be really enjoyable! Being almost three hours long, it managed to catch my attention the whole way through. The visuals were fantastic, the mix of fantasy and reality was rather amusing to me. I have seen a lot of discussion online about how it botchered the original work and the character of Odysseus, so I have made it a goal of mine to read the original works soon enough. As a standalong work of fiction and cinematography, I have to say it’s probably my favorite of the year. Even the all-star casting somehow worked for me, yes, even the choice of Zendaya for Athena felt fitting by the end. I want to hear your thoughts and talk about it though.

Gaming

Finished

Monument Valley 2 + The Lost Forest - After beating the last DLC of Monument Valley, I had to continue on my geometry defying adventure. The sequel added a couple of great mechanics, such as controlling multiple characters at once. Most of the levels are still amazing pieces of art and puzzle design, with a story too! Music and sound design continue to be great. A great continuation to the story and it ended up with one of the most difficult puzzles of the trilogy too!
Monument Valley 3 + The Garden of Life - The latest entry to the series, this is the one with the most amount of actual story and narrative behind the puzzles! I really enjoyed the new mechanics added here, such as curved and spherical shapes, portals and mirrors, and a few other surprises! There was also a bunch of extra single-screen levels that ended up unlocking the most innovative and complex puzzle of the game. Won’t say more, a trilogy worth experiencing, in my opinion.

Started

The Legend of Zelda: Ocarina of Time - Well, I was chatting with Syl the other day and she mentioned playing this game on her 3DS! So, of course I decided it would be a good idea to play along. She has only finished the first dungeon, so I asked her to wait for me to catch up. I played to the point where I find the Kokiri Sword, and I’m collecting rupees to buy myself a shield. You know how it goes, let the adventure begin!

Ongoing

Fire Emblem Awakening - I’m on Chapter 17 of the story now! I spent some time doing a bunch of the paralogues and leveling up the character support levels of many people to get them to marry! I also restarted a bunch of those battles because I kept making somewhat clumsy mistakes. Still really enjoying the mechanics of this game, though I must admit I’ve been craving a different tactics RPG, maybe returning to Jeanne D’Arc, or trying something new like Unicorn Overlord. I want to finish this though, and the story is still excellent.
Black Rock Shooter - I finished all the missions of the first stage! Including the first real boss, which was another cool/cute anime girl who even said some things in Spanish—reminding me of Asuka’s Feliz Jueves! meme—so that’s neat. After losing once, I defeated her, which unlocked a cool cutscene, as well as the free roaming mode to grind XP, including an extra boss. I ought to play so more still.
Ys I & II Chronicles - What a surprise this was! I decided to return to yet another PSP action rpg title, and after talking to a bunch of people in town I finally realized where I’m supposed to go next. Looking forward to what this game has to offer, at some point.
Ridge Racer - Tried a couple of course tracks of this wonderful game once again. I was unable to win the last race of the tours though.
Lumines - Played it like five minutes, still rocks but I was only testing GameDiary.

Reading

Leviathan Falls - Up to chapter 11. Finally managed to make progress, a single chapter of this epic book… Yeah barely anything but whatever. I am returning to this now that the World Cup is over, you’ll see next week, I will definitely reach chapter 18 or even 20.
Uncle from Another World - Up to chapter 22. Somehow I returned to this! The adventures of Uncle continue on this fun reverse-isekai manga, the gags just keep working for me and getting me to laugh too much, even after leaving this for months, cool stuff! I need to find more manga to read though.

Around the Web

Blog posts

On ethics and usefulness - Linus Torvalds, the guy who made Linux, has always shown a certain “pragmatism” to things which made me feel he would eventually embrace AI, not great stuff, but I saw it coming. Manuel shares some thoughts.
What’s a computer? - Dom is back with an update post of his shenanigans, his job and life has kept him away from most news in the tech space, and that has been a blessing for the most part. Good for him!
I’m Volunteering for My Library! - Syl is doing wonderful things as she now does some work in the local library. That’s so awesome and I am yet to visit mine! If I ever do so I’ll write about it for sure…
I Spent 2 Weeks Without Video Games - Josh did what the title says, and concluded that videogames don’t affect him negatively in any significant way. I am on a similar boat, they are just a way to pass time for me and would easily be replaced by any other hobby of mine if I had to abandon them.

YouTube

Lots of videos this time around. They are all genuinely great, so I hope you give them a watch!

Why Japan and China See Handheld Gaming So Differently - Short video, straight to the point.
I found the next best thing - Handheld console review + slice of life stories recreated with paper cutouts.
The Best Games Are Kinda Bad - Featuring Tears of the Kingdom, over/underrated games and the like.
Yea… no wonder it won the Oscar - About the Rocky movie, its history and place in cinema.
the moment you realize the technology doesn’t exist yet - On Shrek, its evolution and animation.
I rebuilt this PSP from scratch - A whole redesign from scratch with CNC machining and custom PCBs
The Giant Monster Design Pacific Rim Got Right - Analysis on Kaiju monster design
Can A Game Be Objectively Bad? - Featuring Final Fantasy XIII and other titles.
How Civivi is doing the impossible - 275 years of bizarre, brilliant folding knives - Evolution of long knives that fold.

This is day 99 of #100DaysToOffload.

Reply to this post via email | Reply on Fediverse

Note published on July 20, 2026 at 10:14 PM UTC - Molly White's activity feed

2026-07-20T22:14:02.000Z

alcoholic trying to get sober after a relapse tells Google's "Health Coach" about it.

it tells them to drink every hour and messages them to make sure they're drinking as soon as they wake up.

Disabling Siri - Posts feed

2026-07-20T21:59:00.000Z

I only ever use Siri to set timers and turn on Do Not Disturb. It's pretty good at those things. It is very, very bad at many other things.

I'll often have one AirPod in for music or podcasts when I'm doing chores around the house (I tend to function better with background noise). But, increasingly, Siri has taken it upon itself to activate itself for no apparent reason. It could be a stray noise, a show, one of our kids — it happens a lot. At best, this is annoying, at worst it's calling someone in my contacts I haven't talked to in ages.

So, given Siri's extremely limited utility, I went about figuring out how to shut it off.

In the Settings app on any of Apple's platforms, you can scroll to Apple Intelligence & Siri and flip Apple Intelligence off. Then, you can scroll down and disable all the invocation methods in Talk & Type to Siri. This mostly does it — but if you press and hold the big button on the right hand side of your iPhone, it'll prompt you to enable Siri.

To address this, go back to settings, navigate to Screen Time, then Content & Privacy Restrictions. Enable said restrictions, tap on Intelligence & Siri and turn off everything you can.

Congratulations, your phone is less annoying.

Feedback on mailmaint OAuth Profile for Open Public Clients - Articles by Aaron Parecki

2026-07-20T17:39:06.000Z

Hi all,

I owe the working group a review of the "OAuth Profile for Open Public Clients", and apologies for sending this so late after the last IETF meeting, and the night before this IETF meeting.

Please note that I have not followed all of the discussion about this draft on the mailing list or recent meetings. If any of my suggestions have already been discussed and decided against, the justification for the decision would be worth noting in the draft for future reference.

My feedback is ordered most significant to least significant.

Overall, this spec is in good shape. It avoids defining new OAuth mechanisms, it establishes no new relationships between OAuth roles and it uses the standard Resource Owner / Client / AS / RS model.

Client Registration

My largest piece of feedback is about the use of Dynamic Client Registration. The use of DCR in "open world" OAuth will lead to significant operational burden. I believe I already shared this feedback a couple of years ago. Since then, there has been another large scale deployment of DCR that has since moved away to an alternative.

The initial version of the MCP spec from March 2025 required MCP clients register using DCR. Many of the authorization servers that immediately added support for it have since come to regret the challenges with operating it long term, and there are many other authorization servers that refused to add support in the first place, requiring manual configuration instead.

In the time between then and now, the OAuth working group has adopted Client ID Metadata Document (CIMD) https://datatracker.ietf.org/doc/draft-ietf-oauth-client-id-metadata-document/ which provides a way for a client to publish its metadata at a URL and use that URL as the OAuth client_id. Both the BlueSky/atproto ecosystem as well as the MCP ecosystem now recommend CIMD as the default client registration option. Since both of these ecosystems are also "open world" OAuth like the email ecosystem, it would also be a natural fit here.

While it is not yet an RFC, it is already getting quite a lot of adoption, and I expect that to continue.

Despite the client_id being a URL, this works just fine with desktop and native apps. The URL would be hosted on the app's website, and since most apps have a website you can download them from, this isn't a problem in practice. And for the clients that are already web based, this is a natural fit. Which also leads me to the next point...

Client Authentication

I realize that most of the clients that will implement this spec are desktop/mobile clients, so will be considered public clients since they won't have a way to be provisioned with credentials. However there will also be clients that are running on a web server, in which case they do have the ability to manage credentials.

Paired with CIMD, a web-based client would publish its public key and link to it from the jwks_uri property in the CIMD, and would then be able to strongly authenticate all outgoing requests using private_key_jwt (described in Section 8.2 https://www.ietf.org/archive/id/draft-ietf-oauth-client-id-metadata-document-02.html#section-8.2). For these clients, it means the client metadata is not only hosted at a URL, but the metadata can actually be considered to be authenticated so is much more trustworthy than both unauthenticated CIMD metadata and especially DCR metadata. The other nice thing about this is if an authorization server doesn't care about client authentication it can just ignore the header and process the request identical to a client that doesn't use client authentication.

`offline_access` scope

The offline_access scope is not defined in any OAuth RFC, it originates from the OpenID Connect Core spec. Using it in a non-OIDC OAuth profile is fine, but registering it in the IANA "OAuth Scope" registry is probably not appropriate. I think you can just remove this from the IANA registration section and the references to it in the scope sections are sufficient.

DPoP

Requiring DPoP would provide meaningfully stronger security, as token theft is a realistic threat against long-running desktop clients. The draft acknowledges DPoP's value but leaves it optional. Given that the minimum access token lifetime is one hour (see below), a stolen token has significant value. DPoP substantially limits the risk.

Combining with the feedback above, an option could be to require DPoP for public clients, but leave it optional for clients using client authentication published in the CIMD.

Token Lifetime

Most OAuth security guidance recommends short-lived access tokens, in the order of minutes, not hours. Setting a minimum of 1 hour in the spec is unusual and goes against the direction of most OAuth security profiles. This isn't necessarily a dealbreaker, but is at least worth justifying in a little more detail.

If you are using DPoP, you can also generally justify longer-lived access tokens, so another option is to have different recommendations depending on whether DPoP is used.

Pushed Authorization Requests

Pushed Authorization Requests (RFC 9126) prevents authorization request parameters from appearing in browser history and eliminates certain parameter-manipulation attacks. For this use case, where the client constructs the full authorization URL locally before handing it to the browser, PAR would provide meaningful additional protection. To my earlier point, if there was a conscious decision to not require PAR, it would be worth noting the reasons at the very least.

Discovery from Email Address

There is a mention in Security Considerations that "The issuer is expected to be autodetected from the user's email address", but there is no description of how this is expected to be done. I see that this mechanism is described in the "Automatic Configuration of Email, Calendar, and Contact Server Settings" draft, but there should probably be a reference to that from somewhere in this profile.

Missing reference to RFC 9700 (OAuth Security BCP)

The spec references RFC 6819 as the OAuth threat model but not RFC 9700 (OAuth 2.0 Security Best Current Practices, published 2025). RFC 9700 supersedes much of RFC 6819's threat analysis and is the current normative security reference. This should be added.

Thanks, and I am happy to discuss any of this further during the meeting or if you find me during any breaks this week.

American AI is locked down and proprietary. It's losing. - Werd I/O

2026-07-20T14:15:38.000Z

Link: China delivers a one-two punch to America’s AI dominance, by Robert Hart in The Verge

AI models, as a product in themselves, have very little moat beyond what amounts to brand loyalty and superficial switching costs. Instead, the moat is in the enterprise services that sit around them: the deals and contracts, connectivity with enterprise systems, and quality of life features in an enterprise context.

If we consider the models themselves, it’s easy to switch between them: someone could be using ChatGPT today and Claude tomorrow, with very little impact on their workflows. This is particularly true in the engineering world, where models are accessed via API: you can swap out the API and use the same prompt.

Those companies can make deals to lock their customers in, but in practice there’s very little long-term technical incentive to use one vendor over another. You pick the best model for your needs and change models and vendors if another one becomes better.

The US government has placed export controls on GPUs. There are also strong regulations that (reasonably) prevent sharing certain kinds of data with Chinese servers. The result is that while Chinese companies have enough compute to train models, they can’t really provide the kinds of global-scale centralized services that we see from OpenAI and Anthropic — at least, not in the same way.

And open almost always wins when it comes to infrastructure adoption. Open technologies can be used permissionlessly and therefore can be at the center of more innovation. You can host them where you want, experiment with them, alter them, and tweak to fit your use case. Open weights models are not open source, but they are portable and permissionless.

With all this in mind, it makes sense for China to release its AI models openly. It turns a US-created compute disadvantage into a distribution advantage; it commoditizes the layer where American companies make money; and it creates a far more effective global ecosystem than could be established through locked-in, centralized services. It’s obvious to me that there are ecosystem benefits throughout China, from manufacturing to scientific research; every sector can just plug in these models.

The saving grace for American companies has been that US frontier models have outperformed open ones. That gap is now closing:

“Moonshot and Alibaba unveiled models they claim can go toe-to-toe with the best from OpenAI and Anthropic at a fraction of the cost. The rapid-fire releases suggest America’s lead at the AI frontier is increasingly tight, just as the technology is becoming central to national security, economic power, and geopolitical influence.”

Even without these new capabilities, the strategy has already been working. a16z partner Martin Casado noted in the Economist that there’s an 80% chance that any given startup is using Chinese models, and Chinese models are poised to take the lead.

It’s worth taking a step back and considering the surprising underlying dynamics. We think of China as being a locked-down society — and it is in many ways. I have serious concerns about how these models might reflect Chinese government perspectives (try asking them about Tiananmen Square). But it’s American companies that are keeping tight control of their technology rather than releasing it as openly as possible. This is in stark contrast to the strategy behind US government support for the open internet, for example.

Locked-down business practices for a technology with no real moat but significant potential ecosystem benefits is an obviously losing strategy; permissively releasing it with an open, collaborative approach is obviously a winning one. But the incentives in the US aren’t there: instead, these companies are forced to chase first-order profits rather than ecosystem benefits, and the government tries to put its finger on the scale through forcible measures like tight export controls. We should consider what would need to change to make those incentives more aligned. That’s particularly important given how much of the US economy is currently driven by AI spending. If the bottom falls out of that spending — and I think it clearly will, given the dynamics — the outcome could be severe.

I care about having open technology that can be run in the public interest, aligned with the public’s values. Threads like public AI, federated services, and open research have traction but need backing. Getting there in the US needs more nuanced strategy and support than we’re seeing today.

Public Transport - Don't Make Me Think! - Terence Eden’s Blog

2026-07-20T11:34:23.000Z

In the last year, I've been through over a dozen cities and used public transport in all of them.

It is wild just how confusing and complex buying a ticket can be. While some cities obviously take a user-centred approach to ticketing, others appear to take a Kafkaesque delight in a bureaucratic maze of zones, apps, and intricate restrictions.

One of the seminal texts in computer systems design is "Don't Make Me Think". Every time a service forces the user into making a decision, it is placing a cognitive burden on them. Computers' jobs are to make things easier for us fleshy meatbags.

There are some intractable problems with navigating unfamiliar spaces (looking at you Kyoto Station!) and a transport authority can't publish signs and make announcements in every conceivable language, but there's one thing they can control - ticketing.

Let me take you through some of the public transport ticket experiences I had - and explain how easy or hard they were to use.

Basel, Switzerland - free

Upon checking in to our hotel I was given a free Basel Card. It entitled me to free public transport across the city.

Zero extra cost. I didn't have to remember to take a physical card with me - the details were emailed as a PDF directly from the hotel on check-in.

I didn't have to show the bus driver when I entered a tram. If a ticket inspector was present, they could have asked to scan it.

This is close to the platonic ideal of "Don't Make Me Think" public transport. I didn't have to work out zones, fares, or timings. I didn't need to interact with people or machines. I didn't worry that I was somehow doing it wrong and was going to get shouted at.

Milano, Italy - contactless

I tapped my credit card on the reader. Whether it was a bus, tram, or metro the process was the same. Tap, wait a few milliseconds, beep. On the metro the gates opened automatically. On the tram, I just sat down after the beep.

The fares have a bit of complexity based on how frequently you travel. If you catch another bus within 90 minutes it only counts as one fare.

I didn't care because the daily price was capped.

Once I'd taken a few journeys it wasn't going to cost me any more. With a fee-free credit card it was simplicity itself.

If I had been on an extremely tight budget, I might have done some thinking - but as the daily cap was less than the price of a cocktail, I didn't bother.

Warsaw - paper ticket validation

I walked up to a touchscreen kiosk, selected the 🇬🇧 flag, and bought a 3 day paper ticket for a few € using contactless. The machine spat out a small paper ticket.

I hopped onto a tram, shoved the ticket in a slot and the machine printed a timestamp on it. Well, in theory. It didn't work the first few times for inscrutable reasons.

From then on, I didn't have to do anything. I jumped on whatever public transport I wanted. Only once did a ticket inspector come round demanding to see everyone's proof of validity.

The ticket was a slightly inconvenient size for my wallet - being much smaller than a credit card - and I think the kiosk should have validated it automatically. But, for general transport purposes, it was great at not forcing me to think.

Tallinn - scan the app

Install an app, choose ticket type, pay, done.

Every time I entered public transport, open the app, click the ticket, wave the resultant QR over a scanner.

Obviously choosing a ticket type is a little thinky. Do I want a single ticket, a day pass, something longer?

I'm not averse to installing an app when necessary. Thankfully, this transit app worked on GrapheneOS. There was an optional registration step which I skipped because I was unlikely to come back any time soon.

Riga - scan the bus

OK, this was just weird!

Much like above, install app, choose ticket, pay.

Despite buying an all-you-can-eat ticket, I still had to register on every bus/tram I got on. That meant hopping on, finding a QR code, opening the app, and trying to scan it while the driver attempted a new land-speed record.

Paris - ridiculous

Fuck Paris. The only way to buy a metro ticket is to download an app. Fair enough. But, after downloading the app it tells you to install another app!

What the actual fuck? A convoluted, messy, and frustrating situation which has resulted in awful reviews for them.

Trains and metro travel require separate tickets at different prices. You can't easily hop from one to another. You need to think carefully about the route you're taking. A more convoluted route may be significantly cheaper because it doesn't involve swapping between services.

Madness!

The ticket readers use your phone's NFC chip to validate. So there's no technical reason why they can't just use contactless payment cards.

To be fair, change is coming… in 2030!

So what's best?

In an ideal world, all public transport would be free and plentiful. In our less-than-ideal reality, it seems obvious to me that public transport should above all be simple.

Tourists don't want to grapple with the complexities of zones, split tickets, random charges, and a different app for each city.

Regular travellers don't want yet another piece of plastic tat in their wallets, or to work out in advance what precise combination of journeys they need to take in order to optimise their spending.

One app is fine. Having to install a different app for each city you visit - even within the same country! - is infuriating.

Visitors should not have to think about how, where, when, or why they need to validate their tickets. Nor should anyone need to figure out which modes of transport are inclusive or not.

For the casual visitor, contactless payment with a daily / weekly cap is the simplest possible charging mechanism. It's cheaper for the cities to not have to build, develop, and support apps.

If you've come across a better public transport ticketing system - please let me know in the comments.

📝 2026-07-20 08:10: Yup. Goat-proofing the chicken door really worked a treat. FML. 🤦🏼‍♂️ - Kev Quirk

2026-07-20T07:11:00.000Z

Yup. Goat-proofing the chicken door really worked a treat. FML. 🤦🏼‍♂️

Thanks for reading this post via RSS. RSS is ace, and so are you. ❤️

You can reply to this post by email, or leave a comment.

Music - James' Coffee Blog

2026-07-20T00:00:00.000Z

the direction of music; the music of direction.

Note published on July 19, 2026 at 11:13 PM UTC - Molly White's activity feed

2026-07-19T23:13:51.000Z

Just had to patch a bug on the Tech Influence Watch Michigan House District 13 election page, stemming from Shri Thanedar reporting -$1.1 million in receipts.

Why is Thanedar reporting negative receipts? He put $3.7 million of campaign funds into crypto.

📝 2026-07-19 19:09: Today was spent goat-proofing the automatic chicken door. We recently moved it to ground level... - Kev Quirk

2026-07-19T18:09:00.000Z

Today was spent goat-proofing the automatic chicken door. We recently moved it to ground level and now the goats use it as a scratch post. 🐐

Thanks for reading this post via RSS. RSS is ace, and so are you. ❤️

You can reply to this post by email, or leave a comment.

I've Moved Back to GitHub - Kev Quirk

2026-07-19T12:25:00.000Z

Back in May, I wrote a post about how I'd migrated all my repos away from GitHub. This ended up being a combination of my self-hosted Git server on my Synology (for my private repos) and Codeberg for my public ones.

Well, since then Codeberg has just given me problem after problem. I had issues working with repos via SSH for weeks. It just kept timing out, or taking an age to actually do anything. So I switched to HTTPS instead, which seemed a little better, albeit still generally very slow.

This morning I came to do a bit of work on some issues and PRs that have been logged against the Pure Comments repo and (unsurprisingly at this point), I was greeted with this:

I've been trying to get to the repo for around 30 minutes now, and it just keeps failing. I can't work like this - I'm a busy guy, so when I do get time to work on these fun side projects, my shit needs to work.

People give GitHub a hard time for outages, scraping, etc. but in all the years I've used it, I've never had an issue. It has always been quick, and it always worked.

In my boredom while waiting for Codeberg to sort themselves out, I decided to peruse my RSS feeds and I came across this post by Sal. It seems he's been having similar problems with Gitlab.

Moving back

This was the final straw. I've had enough of battling with Codeberg, so I've switched back to GitHub. Some may not like this decision as Codeberg is generally considered the more community friends code hub, but I need to make a pragmatic choice here as the constant issues are sapping most the fun out of these projects.

I'll continue to host my private projects on the Synology, as that works great. But as of right now, we're back on GitHub for all [my projects. I think I've caught all references to Codeberg across the various sites and docs (thanks to Gemini), but if you see a problem, please log an issue.

There is 1 final update on Codeberg for both Pure Blog and Pure Comments. This points the updater back to GitHub, from then on, subsequent releases will be on GitHub.

What about...

I'm bound to get some comments and suggestions about other options other than moving back to GitHub, so I'll try and hit them before you take the time to comment/email with recommendations:

What about a self-hosted Forgejo instance?
Absolutely not. I don't have time to maintain something like that. I'd rather spend my free time working on fun projects than managing infrastructure.
But GitHub are really bad because of [reason(s)] what about [other tool]?
Nope, sorry. I don't want to use other platforms that potentially introduce the same issues I've been having with Codeberg. Look at Sal's post further up - he was on Gitlab and having similar problems to me.
This is disappointing, are you sure about your decision?
I'm very sure. It is disappointing, I agree. But I've given it a lot of thought over the last few weeks and I'd rather go with the tool that I know will work, than the one I have to battle with. Plus, this is all public code, so I don't think I'm giving anything away by switching back.
I'll NEVER use GitHub. I'm gonna stop using [project] now.
That's a shame, but it's your call.

Thanks for reading this post via RSS. RSS is ace, and so are you. ❤️

You can reply to this post by email, or leave a comment.

Of Day - James' Coffee Blog

2026-07-19T00:00:00.000Z

I close my eyes and listen to the church bells reverberate through the city — the air, the street, the park; the hearts.

Usually when I go into a bookshop, I find myself looking at all the books. Often, for nothing in particular, but rather to see what is new. Who knows what I might find; what stories might stand out today. My time spent wandering around the walls of words today, however, was characterised more by writing than by reading. The books were my anchor. The word was in my spirit. My disposition was to capture what I heard and saw and felt; to let my thoughts flow onto a new page.

I took notes on art galleries, places where we can feel both oriented and lost; where we can discover and ponder discovery; where we can let the present pass while considering the past and the future; where the colours of Monet and the shadows of Rembrandt exist a few rooms away. What does it mean that I can see Rembrandt and walk through a few rooms to see Monet?

I realised I was lost, not in place but in thought. I recognised the shelves in front of me while I stood at the frontier of my imagination, asking questions with increasing momentum – questions of magnetism and enchantment and on the nature of significance.

“My dream is to have one of each of these.” “The classics?” “Yeah.” “We should do it as a wee Christmassy thing: each of us should pick four or five that we like…” — a gift exchange? “Oh, that’s the one you keep telling me to read.”, as one of the three friends points to the shelf. The conversation flowed. “So you’re having a book stand in your next [flat?]”. I realised they spoke in the kind of sentences where you don’t need to finish for your friends to know what you mean – therein, the language of friendship.

I learned today that I can be in a bookshop and an art gallery at the same time, and that I can move between them; that the sounds and physicality of stories can ground me as my mind wanders. A book of poetry caught my eye. Opening the book to a page at random – Serendipity being my guide – I pondered the literal shape of the words in poems. One poem was a rectangle of aligned text. Another poem was written in couplets. One was short. Another, long. How does form influence what we read? I wonder. This is why I love bookshops.

After having walked around all of the shelves of fiction at a slow pace, I went back outside and let my legs take me where they wanted to go. I wandered, on my journey seeing Georgian architecture, hearing the roar of a lion from a parent entertaining their child, and feeling the fresh air of Scotland rush through my lungs as I looked up to the blue and white sky.

Eventually, I made my way to the National Gallery of Scotland, not the gallery of I was imagining earlier – that one was four hundred miles away – but one in which I always feel enchanted immediately after walking in. I found myself standing in front of works of Turner and Lievens, Da Vinci and Gainsborough, thinking about the nature of the space I had on my mind since the hour of wandering through the bookshop, and my imagination.

Book Review: A City on Mars - by Dr. Kelly Weinersmith and Zach Weinersmith ★★★★⯪ - Terence Eden’s Blog

2026-07-18T11:34:18.000Z

I'm pretty sure this book is a psyop designed to demoralise a generation of starry-eyed dreamers. It is obviously written by the same people who told us not to land on Europa. A malignant energy designed to limit the scope of human ambition and thwart our plans to colonise the universe.

The problem is, I can't find fault with any of their logic.

The Weinersmiths make a compelling case that space is much harder than any of the propagandists are willing to admit. Even if it were faster, safer, and cheaper - there's still very little point. Any of the technologies we could point at the skies would be infinitely more useful (and profitable) pointed back at our pale blue dot.

Along the way they take in biology (is it even possible to breed in space?), legality (OK, but what jurisdiction will it be under?), and moral philosophy (will we actually become more enlightened beings?)

And yet, space is cool. I know that "because it is there" isn't a logical argument; but it is a hell of an emotional pull. In amongst all their (justified) snarky cartoons are occasional pearls in the rubble:

As with the cathedrals of Earth, those of us who cast the first few bricks may not be around to see the spire placed on top, but we might nevertheless want to start building.

They excel at making the dull delightful. There are a lot of big and serious facts to get through, but they have a gift for communicating them simply and eloquently. I just wish they'd've come to a different conclusion.

WwJD: Spend less time doing boring admin (video) - Johnny.Decimal

2026-07-18T06:22:15.000Z

A 'Working with Johnny.Decimal' video.

This video shows how my system helps me calmly complete two simple, infrequent tasks. They're far enough apart that I forget how to do them, and they've previously caused more disruption than necessary. One of the benefits of Johnny.Decimal is that it takes the edge off my computer use, turning it into a neat room where I can work efficiently and spend less time doing boring admin.

Finished reading Gideon the Ninth - Molly White's activity feed

2026-07-18T02:00:13.000Z

Finished reading:

The Locked Tomb series, book 1.

Gideon the Ninth

by Tamsyn Muir.

Published 2019. 448 pages.

Started July 16, 2026; completed July 17, 2026.

Self hosting a PDS isn't hard (so far) - Posts feed

2026-07-17T21:23:00.000Z

Due to my compulsive need to self-host whatever I possibly can¹, I decided to set up a self-hosted PDS. All that's on it so far is my Bluesky profile data, but it was a surprisingly painless process.

Why bother? Well, I get to own my identity (DID) and my data. The relay and AppView remain Bluesky's, but the authoritative copy of my account is mine. I already syndicate from my site to Bluesky and controlling the PDS is the last part of this infrastructure I can reasonably control.

I've been bolting features on to my own CLI to manage my infrastructure for a bit². I use Hetzner for hosting and it wraps their hcloud CLI for my own convenience. I spun up a CX23 box with backups turned on and then ran another CLI command to bootstrap the server.

The server is running only two things: the canonical ghcr.io/bluesky-social/pds container maintained by Bluesky and Caddy. I use forwardemail.net for transactional emails.

With the server provisioned, I updated the _atproto record for my domain and added a pds A record. I use DNSControl to manage DNS records, so this only took a few minutes.

The migration

Migrating my data from Bluesky's PDS to my own was the only part of this process that made me a little nervous. I needed to preserve my DID, followers and just over 1,000 account records. I used Bluesky's goat tool to manage this process.

I generated a recovery key using goat key generate --type k256
Logged in to my old (Bluesky) account: goat account login -u <username> -p <app-password> --auth-factor-token <email-code>
Created a PDS invite for myself using my CLI (or SSH into the box and run pdsadmin create-invite-code).
Ran the migration — it pauses and emails a PLC confirmation code that you paste into the prompt:

goat account migrate \
    --pds-host <host> \
    --new-handle <username> \
    --new-password "<password>" \
    --invite-code "<pds-invite-code>"

Added my recovery key to the identity so it's my highest-priority rotation key (this also emails a confirmation token): goat account plc add-rotation-key <recovery-pubkey> --first

It ran faster than I expected and worked without any issues (shocking, I know). I syndicated a post, opened my profile in an incognito window and it loaded without issue. I also verified that DID doc #atproto_pds pointed at my new host and threw my private recovery key in my password manager.

Cleanup

The last step was to add support for a custom PDS URL to my site and the PWA I built myself to browse Mastodon and Bluesky simultaneously. This consisted of a migration to update the database schema to save the URL and the corresponding field in the UI. The app passwords I use for both also needed to be recreated on the new PDS which I did from the aforementioned CLI.

I have yet another server running which, at this point, I'm starting to collect like trading cards. My ATProto data sits on its own server, free to be used with any apps that support it (for my purposes that's only Bluesky — for now). It was a surprisingly straightforward process and I'm thankful for that.

I'm still getting my head around ATProto, but I appreciate that you can own your own data, if not all of the application infrastructure. I was used to the Mastodon mental model where, while you can migrate between instances, not all data comes with you. You own the identity but, perhaps, not all of the content. You can't own everything in either case, for now, but it feels like we're heading in the right direction.

Except email. ↩︎
More on that in a future post, probably. ↩︎

One of those webinars - Joel's Log Files

2026-07-17T14:15:00.000Z

Don’t worry, it was fully optional.

I assisted to a webinar about “the potential of AI” in the workplace, and you can already guess what sort of conference I had to go through yesterday. I shared a livestream of my thoughts on my Polymaths’ profile in case you want to see my reactons to what was said there, it’s hilarious stuff.

Something I didn’t mention on that thread was a little quizz at the start, where people filled out polls and the like, and one of the pages was actually a word cloud, they asked “what words come to mind when you think about AI?”.

Of course, I typed a few: “Wasteful”, “lazy”, “slop”, “unethical”… there was no limit I found to how many I could add, but I stopped with those. They didn’t even show up in the word cloud.

“Useful”, “automation”, “future”, “tool”, “assistant”.

Each word got bigger as more and more people typed them in real time.

This wasn’t a multiple choice question, they were chosen and submitted by many.

It is unfortunate, and undeniable, how many people today are perfectly okay with all this, even when they are aware of the bad they caused and continue to cause—they simply look the other way.

“It’s a necessary evil now, there’s nothing we can do about it.”

“We need to catch up with the times, it’s the same as the calculator or the personal computer”

One of the common themes during the presentation was how “you should learn how to use it, don’t stay behind”, because “you will not be replaced by it, but by those who know how to use it”.

Honestly though, as grim as it sounds, I couldn’t help but cringe at every example and slide showed through the whole thing. The generated graphics, the generated prompts, pretty much all the information there was not made by the presentator, none of the examples or problems solved were real.

It’s such a big charade, and the fact everything started with how much running these things can cost and how “it’s not that the AI is inneficient, it’s just that you don’t prompt it properly” let me know it’s all just a joke.

At some point the host shared their screen and started to copy-paste example prompts, while the sidebar featuring a chat history was in full display. “Answer this email”, “summarise this email”, and almost out of frame… “I’m doing a webinar about[…]”.

Check the thread if you want, it’s a good laugh. Watching the bubble pop will be fun.

This is day 98 of #100DaysToOffload.

Reply to this post via email | Reply on Fediverse

Shellsharks Blogroll - BlogFlock

Scattered thoughts on social geolocation - Terence Eden’s Blog

People are transcribing your conversations without asking. That puts you at risk. - Werd I/O

Wonders of Web Weaving, Episode 11 - James' Coffee Blog

The Odyssey, air bubbles, and Monument Valley - W29 - Joel's Log Files

Watching

Gaming

Finished

Started

Ongoing

Reading

Around the Web

Blog posts

YouTube

Note published on July 20, 2026 at 10:14 PM UTC - Molly White's activity feed

Disabling Siri - Posts feed

Feedback on mailmaint OAuth Profile for Open Public Clients - Articles by Aaron Parecki

Client Registration

Client Authentication

offline_access scope

DPoP

Token Lifetime

Pushed Authorization Requests

Discovery from Email Address

Missing reference to RFC 9700 (OAuth Security BCP)

American AI is locked down and proprietary. It's losing. - Werd I/O

Public Transport - Don't Make Me Think! - Terence Eden’s Blog

📝 2026-07-20 08:10: Yup. Goat-proofing the chicken door really worked a treat. FML. 🤦🏼‍♂️ - Kev Quirk

Music - James' Coffee Blog

Note published on July 19, 2026 at 11:13 PM UTC - Molly White's activity feed

📝 2026-07-19 19:09: Today was spent goat-proofing the automatic chicken door. We recently moved it to ground level... - Kev Quirk

I've Moved Back to GitHub - Kev Quirk

Moving back

What about...

Of Day - James' Coffee Blog

Book Review: A City on Mars - by Dr. Kelly Weinersmith and Zach Weinersmith ★★★★⯪ - Terence Eden’s Blog

WwJD: Spend less time doing boring admin (video) - Johnny.Decimal

Finished reading Gideon the Ninth - Molly White's activity feed

Self hosting a PDS isn't hard (so far) - Posts feed

The migration

Cleanup

One of those webinars - Joel's Log Files

`offline_access` scope