Shellsharks Blogroll - BlogFlock

Implementing webmentions - Posts feed

2026-08-25T20:57:00.000Z

I've been working on a number of connection points between my site and the broader web. Part of that effort has been webmentions (which are a fairly small spec). You advertise an endpoint and someone posts a source and target and, from there, you do with the information as you please.

What expanded the scope of my implementation was that I wanted to pull in similarly shaped data from Mastodon and Bluesky. To receive a webmention, you have to advertise the endpoint in the head of your document: <link rel="webmention" href="/webmentions">. From there, the flow looks like this:

I receive a post to /webmentions and verify that both the source and target are either http or https. The target must be on my site and the source isn't on a blocklist I maintain.¹
I rewrite the target to my site's canonical host before I store it. This site was once served at the apex and is now served at the www subdomain, so mentions of the legacy, bare hostname are updated to include the subdomain.
New mentions are stored as pending, queue a background job with River and return a 202 Accepted. I tell the sender that I received the mention and move on.
The background job fetches the source of the mention and looks for the link back to the sent target. If there is no link, the mention is marked invalid.
If the link is there, I pull the rest: the title, author name, a snippet of the text on the page, publish time and the mention type.
- The mention type is informed by microformats: u-in-reply-to for a reply, u-like-of a like, u-repost-of a repost and u-bookmark-of a bookmark. Anything else is a generic mention.²

Gotcha!

Fetching an arbitrary URL posted to your public webmentions endpoint is a vector for server-side request forgery. When I go out to fetch a supplied URL I need to first resolve it to an IP and then open a TCP connection to that IP. If I validate the domain name up front, it's resolved a second time to actually connect. I could get a public address the first time and a private one the second. Instead, I validate the IP when the connection opens.

All things in moderation

The first iteration of this made any webmention received live on my site. The lack of friction was nice, but also meant that anything anyone sent could be rendered on my site without any intervention on my part. Don't do that.

I threw together a widget on my dashboard that queues up incoming link mentions so I can approve or block them as they come in.

Mention paths

In addition to my /webmentions endpoint, I populate mentions from my site's ActivityPub inbox³. I also have a poller that checks for interactions on posts syndicated to Mastodon and Bluesky. Most of my one-off posts originate as a status here that's syndicated out — when I thread status items here, they're threaded at the destination.

Activity from all three sources is written to the same table. Same schema across the board, with a column identifying the source. If someone removes their like or deletes their reply, the next poll notices it's gone and removes my copy.⁴

Posts to my endpoint are verified as discussed above, ActivityPub activity is signed and my poller fetches only my posts. Verified interactions are written to the table.

Mentioning things

I link to things (a lot). When I post something here I've built in options to syndicate out to Mastodon and Bluesky. Sitting alongside those platforms are the options to send webmentions, publish to the site's ActivityPub outbox and publish to standard.site.

When I send webmentions, a job pulls apart the published item to find external links, finds each site's webmention endpoint (if they have one) and sends the same source and target data I accept. Timing can be a factor here (network topology blah blah hostile blah). If something times out during the back and forth here the job will retry it.

Rendering externally supplied stuff

Rendered replies and bare mentions means rendering input someone else provided. When I render it, the text is escaped and the URL is validated (don't send me javascript: nonsense). Outbound links have rel="nofollow ugc" thrown on them.

So, yes, in theory this is a simple spec and one that takes in little data. But you're dealing with external writes, I elected to add additional sources and then tacked moderation on top. It works and, so far, it works well.

This was originally targeted at my contact form, but webmentions now leverages it as well. ↩︎
I'm extracting content with regexes like an animal, not with a microformats parser. ↩︎
More on this later — yes, this site exists on the Fediverse. ↩︎
Fediverse removals are sent as an Undo and delete the row without polling. ↩︎

Theatre Review: Cats at Regent's Park Open Air Theatre ★★★★☆ - Terence Eden’s Blog

2026-08-25T11:34:22.000Z

Cats is so silly!

In the olden days, after a wild animal was slaughtered, the tribe's shaman would wear the skin and re-enact the hunt. As he became one with the beast, the people slowly understood the ways of nature.

Cats is a similarly spiritual experience wherein we watch androgynous sylphs gyrate across the stage and believe (if only for a moment) that the human has become feline, all in service of better understanding the mysteries of our moggies.

Does there need to be so many sequins? So much dry ice? Such a quantity of pyrotechnics?

No, probably not. But it all adds up to a spectacular which will keep you grinning.

The deficiencies in Cats are somewhat inherent. The scrapbook story doesn't make a lick of sense. It is more like a variety show than musical theatre. The lyrics are, at times, utterly asinine. The music soars, until someone starts playing what sounds like a genuine 1980s Casio keyboard - and all you can hear is squelch.

But then Gary Wilmot (!!!) comes on as Gus and all is forgiven on a haze of metatextual glory.

The choreography and dancing are exemplary. The singing occasionally gets muddled but is mostly delightful. The stage is perfect - the wind blowing through the trees and the moon gently rising only helps to accentuate the atmosphere.

The pre-show is good. As well as a variety of food stalls, patrons are encouraged to bring their own food and drink for a picnic. There are plenty of tables and a couple of selfie points.

The programme isn’t horrendous at £6 but still feels like it contains more advertising than content. The queues for the loos were outrageously long and the stalls weren't particularly clean.

There's nothing to do post-show except trudge back through the park. The selfie point is still illuminated if you want to queue for that. Even the t-shirt sales stopped after the interval.

I first saw Cats in the West End some time in the 1980s as a child and loved it. Afterwards my parents asked if I wanted to see a ballet or an opera next. "Eurgh! No! Boring!" I said. They politely informed me that I'd just seen both in one show and my juvenile mind was blown.

A few decades later I saw Cats on Broadway - shortly before it closed, I think. The C90 cassette they used to play the music was warbling like a demented bird and the sets looked equally tired. Despite the half empty auditorium, the cast attacked the songs with vigour. I still loved it.

And, today, I still had goosebumps. Maybe it was the unseasonable chill in the air, maybe it was the moonlight, or maybe it was the magic of Cats!

State divergence enables unauthorized access - Trail of Bits Blog

2026-08-25T11:00:00.000Z

We found and reported a bug in Provenance Blockchain, a public proof-of-stake chain built on <a href="https://docs.cosmos.network/">Cosmos SDK</a>, that lets any user grant themselves admin control over marker accounts without holding a single token. Provenance covers a range of financial services, including on-chain tokenized loans, private equity tokens, bridged assets, and asset registries. Our bug affected 82 markers representing live financial assets on mainnet. We found the bug, which affects versions before 1.28.0, in March 2026, and reported it to Provenance on April 1. It was fixed in <a href="https://github.com/provenance-io/provenance/pull/2627">PR #2627</a> (commit <a href="https://github.com/provenance-io/provenance/commit/c81fd65f8ad48de42d5a6d68e761a0851c7e72c4">c81fd65</a>), which shipped in v1.28.0 on May 1, 2026. <h2 id="what-is-a-marker">What is a marker?</h2> The marker module is Provenance’s core primitive for fungible tokens. Chain participants can issue a new asset on Provenance by submitting a <code>MsgAddMarkerRequest</code> transaction; the chain creates a dedicated account for that asset, called a marker. Each marker is a special account type that controls: <ul> <li>A denomination (e.g., <code>uusd.trading</code>, <code>cusd.deposit</code>, <code>cguaranteedrateomni</code>)</li> <li>An access control list governing who can mint, burn, withdraw, deposit, or administer the token</li> <li>A supply field recording the canonical token count</li> <li>An escrow balance (the marker account can hold any asset, not just its own denomination)</li> </ul> Markers are either <code>supply_fixed</code> (the supply field is enforced as a hard cap) or non-fixed (the bank module is the source of truth; the supply field is informational). This distinction is central to the bug. <h2 id="the-bug-an-access-check-anyone-can-pass">The bug: An access check anyone can pass</h2> <a href="https://github.com/provenance-io/provenance/blob/488b8a73e292043910aaf0ec485fac961b5e2c97/x/marker/keeper/msg_server.go#L139-L159"><code>AddAccess</code></a> is the Cosmos SDK message handler that processes requests to modify a marker’s access control list. It checks whether the caller is authorized using three conditions, any one of which is sufficient: <ol> <li>The caller is the marker’s designated manager and the marker is in <code>Finalized</code> state.</li> <li>The caller already holds <code>ACCESS_ADMIN</code> on the marker.</li> <li>The caller controls 100% of the marker’s circulating supply.</li> </ol> <figure class="highlight"> <pre tabindex="0" class="chroma"><code class="language-go" data-lang="go">case types.StatusFinalized, types.StatusActive: if !(caller.Equals(m.GetManager()) && m.GetStatus() == types.StatusFinalized) && !m.AddressHasAccess(caller, types.Access_Admin) && !k.accountControlsAllSupply(ctx, caller, m) { return fmt.Errorf("%s is not authorized to make access list changes against finalized/active %s marker", caller, m.GetDenom()) }</code></pre> <figcaption>Figure 1: Authorization check in <code>keeper.AddAccess</code> (<a href='https://github.com/provenance-io/provenance/blob/488b8a73e292043910aaf0ec485fac961b5e2c97/x/marker/keeper/marker.go#L94-L100'><code>x/marker/keeper/marker.go#L94–L100</code></a>)</figcaption> </figure> Condition 3 is implemented by <code>accountControlsAllSupply</code>: <figure class="highlight"> <pre tabindex="0" class="chroma"><code class="language-go" data-lang="go">func (k Keeper) accountControlsAllSupply( ctx sdk.Context, caller sdk.AccAddress, m types.MarkerAccountI, ) bool { balance := k.bankKeeper.GetBalance(ctx, caller, m.GetDenom()) supply := m.GetSupply() // ← bug return supply.Equal(sdk.NewCoin(m.GetDenom(), balance.Amount)) }</code></pre> <figcaption>Figure 2: The vulnerable <code>accountControlsAllSupply</code> function (<a href='https://github.com/provenance-io/provenance/blob/488b8a73e292043910aaf0ec485fac961b5e2c97/x/marker/keeper/marker.go#L866-L875'><code>x/marker/keeper/marker.go#L866–L875</code></a>)</figcaption> </figure> The <code>m.GetSupply</code> function reads the supply field stored directly on the marker struct. For non-fixed supply markers that were activated with zero supply, that field always stays zero. The live circulating count lives in the bank module, and non-fixed markers never write back to the marker struct after minting. So for any non-fixed supply marker, the authorization check reduces to the following: <figure class="highlight"> <pre tabindex="0" class="chroma"><code class="language-text" data-lang="text">supply = Coin{denom, 0} // stored marker field, always 0 balance = Coin{denom, 0} // attacker holds no tokens 0 == 0 → true</code></pre> <figcaption>Figure 3: Authorization check result for a non-fixed supply marker when the caller holds no tokens</figcaption> </figure> The check intended to restrict access to 100%-of-supply holders becomes unconditionally true for any caller with zero balance. <h2 id="exploitation-two-transactions-to-mint-or-drain">Exploitation: Two transactions to mint or drain</h2> An attacker sends a single <code>MsgAddAccessRequest</code> transaction: <figure class="highlight"> <pre tabindex="0" class="chroma"><code class="language-json" data-lang="json">{ "denom": "uusd.trading", "administrator": "<attacker_address>", "access": [ { "address": "<attacker_address>", "permissions": ["ACCESS_ADMIN", "ACCESS_MINT", "ACCESS_WITHDRAW"] } ] }</code></pre> <figcaption>Figure 4: <code>MsgAddAccessRequest</code> granting the attacker admin, mint, and withdraw permissions on a target marker</figcaption> </figure> No existing tokens are needed for exploitation. The authorization check passes immediately via the broken condition 3. From there, the attacker has two paths: <ul> <li><code>MsgMintRequest</code>: to mint new tokens of the marker’s denom and send them to any address</li> <li><code>MsgWithdrawRequest</code>: to drain any assets held in the marker’s escrow balance</li> </ul> The whole attack is two transactions: one to gain permissions, and one more to act on them. <h2 id="impact-what-was-at-risk">Impact: What was at risk</h2> At the time of discovery, 82 active markers on Provenance mainnet had a stored supply of 0 while carrying real circulating supply or escrowed assets, every one of them exploitable. These markers span multiple independent parties on the chain, not a single application. Escrow withdrawal was the most direct path. Among the affected markers, those holding nhash (Provenance’s base token) in escrow accounted for roughly 30 × 1015 nhash, or around $500,000 at HASH prices at the time of discovery. The three largest markers are shown below: <table> <thead> <tr> <th style="text-align: left">Marker</th> <th style="text-align: left">Owner</th> <th style="text-align: left">Escrowed nhash</th> </tr> </thead> <tbody> <tr> <td style="text-align: left"><code>grant0051</code></td> <td style="text-align: left">Provenance Foundation grant program</td> <td style="text-align: left">19,230,770,000,000,000</td> </tr> <tr> <td style="text-align: left"><code>provenance.validator.incentive.program</code></td> <td style="text-align: left">Chain validator incentive fund</td> <td style="text-align: left">8,561,225,000,000,000</td> </tr> <tr> <td style="text-align: left"><code>grant0077</code></td> <td style="text-align: left">Provenance Foundation grant program</td> <td style="text-align: left">2,486,556,736,909,250</td> </tr> </tbody> </table> The three markers shown above are all chain governance programs operated by the Provenance Foundation: one holds validator rewards, and two hold community grant funds. Supply inflation was a broader but more constrained vector. The 74 vulnerable markers spanned bridged stablecoins and wrapped assets (<code>uusd.trading</code>, <code>uusdc.figure.se</code>, <code>nbtc.figure.se</code>), consortium deposits (<code>cusd.deposit</code>), tokenized mortgage participations (<code>cguaranteedrateomni</code>, <code>chomebridgeomni</code>), and yield tokens (<code>nuva.ylds</code>, <code>uylds.fcc</code>). An attacker with <code>ACCESS_MINT</code> on any of these could issue arbitrary new tokens of that denom. The practical harm depended on the token type. For restricted tokens with KYC requirements, it was primarily a solvency and integrity threat; for non-restricted coin-type markers, it was a more direct inflation risk. We confirmed the affected markers and their balances by querying mainnet via the Provenance CLI and the public REST API. <h2 id="the-fix-read-live-supply-and-guard-against-zero">The fix: Read live supply, and guard against zero</h2> <a href="https://github.com/provenance-io/provenance/pull/2734">PR #2734</a> shipped the fix, which changes one line: <figure class="highlight"> <pre tabindex="0" class="chroma"><code class="language-go" data-lang="go">// Before: reads stale stored field, always 0 for non-fixed markers supply := m.GetSupply() // After: reads live circulating supply from the bank module supply := k.bankKeeper.GetSupply(ctx, m.GetDenom())</code></pre> <figcaption>Figure 5: The one-line fix (<a href='https://github.com/provenance-io/provenance/pull/2734/changes#diff-bc1ca0afea7f4545a016207811d6f040977cf4ccbd57245b5373f7d4e5adfa40R898'><code>x/marker/keeper/marker.go</code></a> in PR #2734)</figcaption> </figure> A zero-guard was also added: if the live supply is zero, <code>accountControlsAllSupply</code> returns false. This correctly handles the edge case where a marker exists but no tokens have been minted yet, so no one can self-admin an empty marker via this path. <h2 id="authorization-must-fail-from-the-default-state">Authorization must fail from the default state</h2> The root cause of this issue was state desynchronization. The marker struct and the bank module both represent the token supply, but only the bank module is kept current for non-fixed markers. The authorization check read from the wrong one. The check wasn’t just wrong; it was bypassable by default because of the zero-equality shortcut. Because the stale field was always 0, the comparison <code>0 == 0</code> was always true. An access control check that compares against a value that is always the same as the attacker’s default state is trivially bypassable. Switching to the live bank supply alone doesn’t fully close the hole. A freshly deployed marker with no tokens minted yet also has live supply of zero, so an attacker could self-grant admin by targeting it before it’s funded. The fix handles this with an explicit zero-guard: <code>accountControlsAllSupply</code> returns false whenever live supply is zero, regardless of balance. The broader pattern: an authorization predicate must never be satisfiable from the attacker’s default state. A check of the form <code>balance == supply</code> hands access to everyone when supply can be zero, whether because the state is stale or the marker is simply unfunded. Two things would have caught this before it went live. First, the access-list authorization model was never specified. Writing the rule down forces both questions that point straight at the bug: which supply, and what happens when it’s zero? Second, the property is easy to state: <code>accountControlsAllSupply</code> should only return true when live supply is positive and the caller holds all of it. A property-based test or fuzzer that generates random sequences of marker operations, such as minting, transferring, and creating empty markers, and checks this property after each step would find both failure modes automatically.

2026-w34 - Joel's Log Files

2026-08-25T01:47:37.000Z

Today I was on vacation and I have been watching YouTube videos all day long for some reason. I could have finished a videogame or a book in all this time. However, I was watching a long playthrough of Outer Wilds. Because I have finished that game and I am absolutely thrilled about it. What a videogame, please play it. Well, will talk more of this on my gaming section. In any case, here’s some other things that happened this week from August 18 to 24, 2026.

Think it’s fair to say I ain’t making 31 posts for Blaugust this year! I can always try some other time.
These weeknotes will be super lazy because I was super lazy the whole week. There were visits and I didn’t get a lot of time for myself to sitdown and write, these weeknotes so they’ll also be short.
Went out shopping to the mall with my sister, her boyfriend and my parents… I didn’t actually buy much this time other than a frappe.
Wanted to get a physical edition of The Odyssey but I couldn’t find a good translation at the mall’s library. I’ll just stick to digital I think, no big deal.
Still not going to the gym at all, I haven’t even gone cycling this week. I’ve been lazing around like crazy.
Studied more of Land of Eem’s TTRPG system so I can be a better GM for a future playthrough, didn’t manage to play again this weekend.
Literally read nothing the whole week. Definitely got absorbed by Outer Wilds and its lore, man…

Gaming

Completed

Outer Wilds - A game I started in January that took me by storm and was abandoned for months, only to return in August and get me through a whole hurricane. This game was an incredible undertaking and I am absolutely floored by every single thing that happened here. The search for knowledge provided the answers, and that finale tore me apart and built me back up. This is a one of a kind experience. You must play it. I need and will play Echoes of The Eye in the future.

Ongoing

The Legend of Zelda: Ocarina of Time 3D - After finally being freed from the hold of Outer Wilds, I’m currently making progress on Jabu Jabu’s Belly! Haven’t finished at all but managed to beat the miniboss, which was a pain until I once again remembered Deku Nuts exist.
Hollow Knight: Silksong - I’m gathering the materials necessary to unlock Act 3 and reach some of the extra stuff this game has to offer! Looking forward to that, but not a lot of progress otherwise.
Super Smash Bros - Played once again and this time we unlocked a couple of characters. Yes, believe it or not I am yet to unlock all the characters in the game, My deepest apologies.
Fire Emblem Awakening - I am still unable to beat Chapter 19, enough said!

Around the Web

Blog posts

Youtube

This is day 22 of #100DaysToOffload and day 16 of #Blaugust2026

Reply to this post via email | Reply on Fediverse

Wonders of Web Weaving, Episode 16 - James' Coffee Blog

2026-08-25T00:00:00.000Z

The sixteenth episode of Wonders of Web Weaving is out:

In Episode 16, I chat with Nic, the author of nicchan.me about, among other things, using the web as a design tool, web accessibility, learning from others' code, and more.

I hope you enjoy the episode!

Wonders of Web Weaving also has an RSS feed you can use to follow along from wherever you get your podcasts.

The sixteenth episode of Wonders of Web Weaving is out Wonders of Web Weaving also has an RSS feed Nic nicchan.me

Why do audience members choose specific shows at the Edinburgh Fringe? - Terence Eden’s Blog

2026-08-24T11:34:45.000Z

On our recent trip to the Edinburgh Fringe, I was bemused by just how little effort performers put in to finding out why people had selected their show. Taking a show to the Edinburgh Fringe is ridiculously expensive with some performers paying tens of thousands of pounds. The way performers recoup the costs of performing is by getting people to pay to see a show.

Acts are spending huge amounts on flyers, posters, and other promotional activities. But is any of it worthwhile?

The performer Danielle Solof has a fascinating blog post "My Real Fringe Budgets, Line-by-Line" which details the actual costs of her taking two solo shows to the Fringe. She meticulously details the price of everything from transport and food, to advertising and graphic design. She says:

I paid for outdoor ads because absolutely no one in Edinburgh knew who I was. They did help, but you still have to grind to get an audience in.

My question to her - and all performers - is how do you know what drives an audience member to see your show?

It can't have escaped your attention that everything we do online is tracked. If you buy so much as a toothpick, the retailer knows which YouTube reviews you watched, which words you searched for, the other products you considered, and the specific adverts you clicked on.

In Edinburgh, no one knows nothing.

At the end of nearly every show the performer begged us to leave a review on the Fringe website and to tell our friends. In absolutely none of the shows did the performer ask why we were there, how we found out about the show, which poster or leaflet attracted us, or whether we followed them on social media.

All that money spent on posters and no one knows if they work. As the old saying goes "Half the money I spend on advertising is wasted, and the trouble is I don’t know which half.".

So, in an attempt to bring a little data to proceedings, here are how we chose the 26 shows we saw. I don't claim this is representative of everyone, but I think it might be illustrative. In rough order of importance were:

Proximity

The EdFringe app has a "nearby now" feature. Click on it and you get a list of shows starting soon which are only staggering distance away.

I cannot stress enough how much of a motivator that was. When you've spent all day traipsing, the last thing you want to do is another 20 minute walk uphill to see a provocative new piece of challenging theatre told through finger puppets.

About 20% of the shows we saw were via that feature.

Roughly another 40% were because the show was close to something else we really wanted to see. We knew that we wanted to see show X, so we looked for shows which weren't too far away from that venue. Yes, Edinburgh is a compact city with decent public transport, but it is much easier to walk round the corner or stay to have a drink in the venue's bar.

You can really want to see a show, but if it is a 20 minute walk between venues and it starts 15 minutes after your last show ends, you'll skip it. I'd say that location was the key driver in most of our choices.

I guess my top tip to any performer would be to be as near as physically possible to a bigger act!

Friends

A quarter of the shows we went to were because either a friend-of-a-friend was performing, or a friend booked tickets and asked if we wanted to tag along.

You are morally obliged to go to your friends' shows. Similarly, if a mate says "Oh, my friend has a show on this year", you have to make the effort to go.

Perhaps it is a bit blasé to say that word-of-mouth works, but it's a cliché becausé it is trué.

Flyers and Leaflets

We collected approximately 5,374 different promotional leaflets during our week there. Most of the time we were handed a leaflet by someone paid to hand out leaflets. They were either wordlessly stuffed into our hands, or delivered with a monotone "wanna see improv comdy?" Bleh.

A few actually spoke to us about the show when we asked questions, which was a deciding factor in seeing a couple of performances.

The best flyerers were, undoubtedly, the performers themselves. Kat Ronson in her Millennial Girl guise drawled at us "You look thin and pretty. You're allowed to come to my show." Instant sale!

Similarly, one rather famous comedian walked up to us and said "You look like theatre people!" and proceeded to pitch their show - which was a delightful encounter and would have sold us a ticket if we weren't leaving that day.

Some flyers had a QR code or URl on them so we could watch a trailer of the show. We didn't watch any of them. Perhaps we should have?

Posters

Surprisingly effective at drawing the eye! The ones which were just a photo of the comedian looking a bit "whacky" were dull. The ones of performers in their most seductive poses were a little naff. The ones which were just a close up of someone's face only really work if that person is incredibly famous, otherwise you're just left thinking "who?"

But a few posters made us stop and immediately search for the show. Graphic design is a professional skill and one worth investing in.

Some posters were everywhere. I took an instant (and uncharitable) dislike to one poster featuring a smug-looking twat and I swear he followed me around town. Some posters only appeared near the performance venue.

Incidentally, there were a couple of posters which had clearly just been fed into an AI generator. Lazy and off-putting.

Reviews

The Fringe doesn't allow weighted star reviews - so you can't immediately see if the consensus is that the show is a hit or a miss. Several of the shows we didn't enjoy got excellent reviews (from morons) and some of the shows we loved were panned (presumably by the same morons).

In truth, I don't think the reviews influenced our decision to see anything.

What Stopped Us Going To Shows

For every action there is an equal and opposite reaction. I think it is important for performers to know what stopped someone clicking the "buy" button for their show.

Ticket Cost / Value For Money

Mondays and Tuesdays saw lots of shows doing a 2-for-1 promotion. I didn't mind spending £30 for two of us to take a risk on something. Come Wednesday, I wasn't prepared to pay £60 for a 45 minute show.

I know "surge pricing" gets a bad rap, but dynamic pricing of underselling shows might help. If you've only sold four seats for today, perhaps drop the price? I don't know if the Fringe software supports that - but it seems obvious to me that having 10 people paying a fiver is better than four people paying a tenner.

Crap Signal / Long Queues

We tried to get in to a circus show. My phone didn't have enough signal for the app to work and the nearest box office had a massive queue. So we bailed.

If the venue had WiFi (not a given, weirdly) it would have gotten them an extra sale. If the ticket staff could take contactless (lots of performers did) we'd have happily paid.

You have to make it easy for people to give you money.

Not Enough Time

This is completely out of the performers' control. We had 6 days and saw about 4 shows per day. We could have seen more, but we needed to eat, explore, and sleep.

Speaking of which, there were several midnight performances which looked excellent - but I also needed to get up the next day to see more shows. Sleep won!

Too Famous

I'd love to see that guy who's on the telly. But I can watch him on the telly. That show looks like a massive success, so I'm sure it'll tour round London soon.

Sell Outs

A few shows sold out before we could get tickets. Good for them! If that was your show, you probably don't need this blog post.

Better Art Through Commerce

Art should be driven by passion.

But every performer I know listens back to their shows to see what works and what didn't. If a joke falls flat, it's cut. If a riff gets a big laugh, it's incorporated. That's the essence of data driven decision making.

I wish every performer at the Fringe had a sell out audience and were able to recoup their costs. But that is never going to happen unless they spend time understanding what gets bums on seats.

So here are a few scattered thoughts on how they could do that.

QR code at the end of the show leading to a survey. Literally ask people "what made you choose this performance?"
In the queue before the show, or as people are taking their seats, hand out a paper questionnaire.
Talk to the audience after the show. See if you can gain any insights about what made them attend.
As people are coming in, have a poster asking people to tick a box based on how they heard about the show.
Give each leaflet a unique code (or a code per person handing them out). Ask people to bring the leaflet with them so you can see which area/person/leaflet was most effective.
Each poster can have a unique QR code on it. Track whether the one by the station led to more ticket sales than the one in the underpass. Did the one in the gents toilets get any scans at all?

Of course, all of the above rely on talking to people who made the choice to see you. This is classic Survivorship Bias. Sure, it'll help you work out what was successful, but you won't know why people looked at your show and chose something else. That said, it is hard. How do you find people who ipso facto aren't at your show?

That could be as simple as asking people what they dislike about the leaflet when you hand it out.
Each poster or leaflet can have a unique QR code on it. Which ones cause people to scan, but then abandon the idea of buying a ticket?
Speak to people who came to the venue for a show other than yours. They obviously like the location, so non-confrontationally ask them why they didn't pick you?

Some of these are easier than others. By themselves, they might give you a slightly misleading view of the data. But surely anything is better than looking at a half empty venue and wondering if those huge advertising costs did any good at all.

2026-08-24 11:01: A friend asked for help setting up a blog, so I went with #Pureblog (obviously).... - Kev Quirk

2026-08-24T10:01:00.000Z

A friend asked for help setting up a blog, so I went with #Pureblog (obviously).

We went from nothing to fully working blog, with all the customisations she wanted in about 25 minutes.

I know I'm bias, but I love how flexible and powerful Pure Blog is becoming.

Thanks for reading this post via RSS. RSS is ace, and so are you. ❤️

You can reply to this post by email, or leave a comment.

First moments - James' Coffee Blog

2026-08-24T00:00:00.000Z

When I got out of bed this morning, I felt a chill from the autumn air that had been flowing through the room since yesterday evening. The air was cooled by midnight and would soon be warmed by the burgeoning sun rising over the hills. The seasons are changing. I can feel it.

I opened the window and looked onto the white horizon sky; so intense was the white sky it took me a few moments to notice the faint blues that were already above me and extended across most of the rest of the sky. I love this time of year, when I wake up closer to the sunrise now that it happens a bit later in the morning. The sunlight illuminated the rusty leaves on the tips of a tree outside, a tree still green in its core but, like all trees, starting to change as summer becomes autumn.

I thought about the first moments of the day. I found great joy in looking out the window for the first time this morning, the same joy as I feel every time I see the sun rise. I revelled in noting the sights and feelings and sounds of the first moments of the day – of seeing the sunrise, feeling the chill in the air, and hearing pouring the boiling water from the kettle into my favourite tea cup, of feeling the warmth of the tea as I cusped my hands around the cosy cup, of enjoying all the light coming through the windows, of appreciating how green the hills are at this time in the morning.

With every step, illuminated by daylight, thinking about how every day is new, I felt ever more ready for the day ahead.

Dungeon Crawler Carl - Kev Quirk

2026-08-23T12:03:00.000Z

Dungeon Crawler Carl

Author: Matt Dinniman
Genre: Fantast, Sci-fi
Released: 2020
Rating: ★★★★★

You know what’s worse than breaking up with your girlfriend? Being stuck with her prize-winning show cat. And you know what’s worse than that? An alien invasion, the destruction of all man-made structures on Earth, and the systematic exploitation of all the survivors for a sadistic intergalactic game show. That’s what.

Join Coast Guard vet Carl and his ex-girlfriend’s cat, Princess Donut, as they try to survive the end of the world—or just get to the next level—in a video game–like, trap-filled fantasy dungeon. A dungeon that’s actually the set of a reality television show with countless viewers across the galaxy. Exploding goblins. Magical potions. Deadly, drug-dealing llamas. This ain’t your ordinary game show.

Welcome, Crawler. Welcome to the Dungeon. Survival is optional. Keeping the viewers entertained is not.

Learn more on Goodreads ➡

Started reading this book after a couple of friends in work recommended it to me. Couldn't put it down and read it in a couple days. I've gone straight onto the next book in the series, and I'm really looking forward to seeing where it goes.

The book has Hitchhiker's Guide To The Galaxy vibes in that it doesn't take itself too seriously, and is a lot of fun to read. Highly recommended.

Thanks for reading this post via RSS. RSS is ace, and so are you. ❤️

You can reply to this post by email, or leave a comment.

Death to px, long live ch! - Terence Eden’s Blog

2026-08-23T11:34:52.000Z

Pixels are a lie. Even if you think you're drawing something with "pixel perfect" accuracy, your monitor is lying to you. There is no grid of platonically perfect squares.

In CSS, pixels are a double lie:

Note that 1px doesn't necessarily equal one physical device pixel. On HD displays, it may span multiple physical pixels. Similarly, 1cm in CSS often doesn't correspond to one hundredth of SI meter. On a large TV screen, it typically is longer than that. The lengths are perceptual: 16px looks roughly the same on a phone, laptop, or TV screen at typical viewing distance.

This blog is primarily text based. I want the width of the text to be readable for the average human. So, rather than setting the main width to be a percentage of the screen, I set it based on character width using the ch unit - which isn't exactly a character but good enough for my purposes:

--width-content: min(75ch, 100%);

main {
   max-width: var(--width-content);
}

When it comes to padding and margins, the same is true. If I want a gap around an element, I want that gap to be in proportion to the text inside it.

For widths, it makes sense to re-use the ch unit. I want the gap to be in proportion to the text.

But for height, perhaps it doesn't make sense to express vertical distance on character width? In which case the ex unit can be used. It is the size of a typical lower-case letter.

Just like my idea to eliminate CSS classes from my HTML, it's possible to go too far with this. I haven't changed every reference from em to ch, I'm just experimenting to see if it works.

There's nothing wrong, immoral, or evil about using px - or any other measure unit. Using ch and ex fit with my particular proclivities.

Automated organisation is here - Johnny.Decimal

2026-08-23T04:12:30.000Z

Originally sent to the mailing list.

The last of the week's big updates is that you can now connect your AI to Johnny.Decimal. Now Claude or ChatGPT or whatever else you use has access to:

The site documentation, blog posts, and 5+ years of my forum posts.
- So it can give you advice on the system and how it should be used.
The Life Admin and Small Business Systems – all 50,000+ words of explanatory text, exceptions, examples.
- So it can tell you where to file stuff.
The Workbook process
- So you can build your own system.
Transcripts of all of our videos.
- So it can point you to a specific video that answers your question.

Your existing Pro account just got an upgrade: all of this just works for you, today. To read the SBS, you need a Business account. Free and Personal accounts can read the documentation including the Workbook. (Get a free account on the home page. Upgrade your account at Products.)

I can ask it a question about planning a new range of banana-coloured clothing and it can map it out in the Small Business System.

Using your tool's 'cowork' feature you can connect it to your local filesystem and JDex. Now you can ask it questions about your own data. Here, it correctly notes that I've deviated from our published advice on filing receipts! I'll update that guidance in the Small Business System…

Automated organisation is here

This is the beginning of truly automated organisation. Point Claude at your downloads folder and it'll tell you what needs filing, and where it should go.

I find myself not doing that, if I'm honest. I like knowing where my stuff goes: and Johnny.Decimal makes it easy anyway. I'm still faster than Claude at filing my receipts.

I have found that working with Claude in a very structured environment is a revelation. The other day I had it write a script to monitor my Obsidian vault for conflicts. Now when me and Lucy edit a file at the same time it sends me a Telegram alert. Magic.

This is the future: we'll all write our own custom utilities to help us stay on top of stuff. But that script … where is it? It still has to be somewhere. Having Claude connected to my JDex means I can tell it to "document the script at 23.12" (my ID for Obsidian, as a tool in my business) and it does that, wiki-linking to 14.11+ Curium (the server the script runs on).

Having these short, consistent, unambiguous numbers that I can use to refer to anything in my life or business is proving to be a superpower. I can't imagine working without them.

How to connect

This is documented at the MCP server page. Updates will be published there, and on the blog.

Here's a 10-minute video showing you how to connect your agent to the server. This is still young technology, so it's a bit of a fussy setup. If you need a hand, use the MCP server support post on the forum or in the #AI channel on Discord.

Also see the skills and config

The server works great with my agent skills, and they in turn work well with the new configuration file.

Lots more coming

We think we're going to record a 'Learn with Lucy – AI' series. She has no idea how this works, and she'd like to. We'd like to show you how you can use these tools safely and effectively to manage your life and business. No hype, just useful advice. Let us know what you need.

This will all appear on your Pro account as it's released. Buy it once, and we'll keep making it more valuable.

Privacy

I say it on that page, and in the video, and I want to reinforce it here. When you connect to an MCP server – any MCP server – your agent necessarily has to send that server some of your data so that the server knows what to send back. And of course the server knows who you are, because you're authenticated to it.

I do not and will never log any of this data. It hits my server, a function responds, and nothing personal is ever saved, logged, or viewed by me. Not your user ID, name, email, IP address, or any of the text that your agent sent.

I log exactly two things: the name of the agent (e.g. claude-code/2.1.240) and the name of my tool that was called (e.g. list_documentation). This helps me troubleshoot connectivity issues.

When you connect to an MCP server the dialog says "ensure that you trust the owner of this server". That is absolutely the case: you need to trust me. If you don't, don't use the server.

🇯🇵🚅🐄

Big week! We're going on a trip to Hokkaido, Japan tomorrow. We get to go on the Hayabusa Shinkansen, then I plan on eating my own weight in dairy products. :-)

Organising physical artefacts - James' Coffee Blog

2026-08-23T00:00:00.000Z

I love admiring spaces and thinking about how they work but, when it comes to the physical spaces I use most or every day – my bedroom, my desk, my bookshelves – I haven’t spent as much time thinking about decoration. When an environment functions, I don’t often think about how I can make it beautiful. Indeed, I have never been particularly adept at decorating.

This evening I had a discussion about organising mementos from trips: museum maps and guidebooks, and all the other little things I have picked up that I don’t already keep in my scrapbook. I have a paper bag from the British Museum in which I keep my museum maps and other paraphernalia, but it isn’t particularly organised; indeed, despite being red, I seldom look through the bag.

This has me thinking about how I can keep some of my physical collectibles – zines, museum maps, clippings, and everything in between – more organised. I made a few immediate choices: to get a letter rack for my zines, to get a new scrapbook because my current one is full. But I would like to do more.

As I said to my friends, somewhat inelegantly but spoken from the heart: “I don’t want to keep all these memories in a bag.” One suggestion was to get a pinboard, which I love. I may also look through my museum maps and order them, so that at least I can remember what I have so I can decide what to do next. I would love for the maps not to be sitting in a paper bag, but to be part of something else. Maybe I could have a space on my bookshelf dedicated to museum maps? (I really need another bookshelf too!)

One thing I love about bookshelves is that all the titles are visible. I can look to my bookshelf and be proud that I have read Moby Dick even though it took a long time, and look at my anime and think about for how many hours and days a particular series has kept me entertained, or to look at my art books and know I can pick one up at any time and look at pictures that will undoubtably make me think. I can recall the memories associated with each book or series. I would like this for physical paraphernalia too. Having shelf space might be just what I need, and a corkboard too.

I love that I can curate bookshelves: by subject, by theme, by space. The more I write the more I realise this is what I want to do with physical paraphernalia too. I also want to move the zines I have made from where they are stored, on a shelf I don’t often look at, onto my main bookshelf, to elevate them in my space because I am proud of making them.

How do you organise physical artefacts you have collected? I would love inspiration! If you have any ideas, please feel free to email me.

email me

Finished reading The Last Devil to Die - Molly White's activity feed

2026-08-22T04:29:11.000Z

Finished reading:

Thursday Murder Club series, book 4.

The Last Devil to Die

by Richard Osman.

Published 2023. 421 pages.

Started August 19, 2026; completed August 21, 2026.

Saturday morning - James' Coffee Blog

2026-08-22T00:00:00.000Z

Before I leave this morning, I have to pack some things to read. I picked up a zine and a book on colour and set out to a coffee shop to ease my way into the weekend. I purchased the zine and the book following my reflection on reference works earlier this week, which had me thinking that I wanted to vary the kinds of books on my shelf.

This year I haven’t read many fiction books. Most of my reading has been devoted to textbooks and what I read online: blogs and the news and articles and everything in between. I would love to read more fiction, but I often find it hard to stay focused on longer works, especially when my mind is busy. I used to read often on Saturday mornings, finding comfort in the tradition of some quiet reading times while the world was waking up, but I haven’t followed that tradition in a while. That is, until this morning, where I found myself sitting in a coffee shop, reading my zine and studying my book on colour.

The zine I was reading was called “Books as Art Practice”, a reflection on what it means to create printed works. This zine comes at an apt time for me as I reflect more on what we gain and lose from different mediums and, in turn, come to appreciate each medium in more depth. I love the focus that I feel when I am with a book, but I also love the abundance of snippets from the world that I find on the web. When I think of mediums, I think less about their merits and drawbacks so much as their affordances – what does the web allow that other mediums don’t? What does the web make more difficult that are inherent in other mediums?

When it comes to the web, I have been thinking about time, especially in the context of blogs. Blog posts have published dates. But what if those dates were hidden? Available, but hidden. My thought was that words are already steeped in time, being written in and of a moment. I experimented with a “timeless” mode on my website that hides all the publication dates of works, and I admit I am intrigued. Scrolling through my archives without seeing publication dates, my anthology of self speaks not in years but in moments, in seasons. Presented in this way, my writing is still a blog in that entries are printed in reverse chronological order, but each entry is without a specific date.

ALT

My archive page for the Nature category, listing blog posts without dates. The top five posts, in reverse chronological order, without dates, are "Change; anchors", "Autumn", "Afterflow", "Sunset", and "Eclipse".

⁂ ⁂ ⁂

The book on colour that I was reading, published by the National Gallery in London, featured works of art through the centuries grouped by colour. This book was different from most I have read: it was predominantly visual. While engaged with the book, I was moving between reading and visually analysing, between understanding concepts through words and appreciating details communicated through colour and depth and shadow and tint.

I started at the end of the book, on the chapter on monochrome. Works with few colours appeal to me. I love seeing how much detail you can add to a work with few colours. One of my favourite works is mostly monochrome, except for a blue flower in the centre of the painting. And yet despite my love of monochrome works, I also love the Impressionists, among whose defining characteristics is their use of colour.

While I was aware I couldn’t see as many details as I might be able to see if I were studying a painting in a museum, I did enjoy how much I could study each work from its printed version. I appreciated that the book magnified particular aspects of images so I could study features in more depth, like the boats in Peter Balke’s The Tempest that I didn’t discern until seeing them up close.

Closing the book after being immersed in art for some time, I started to think about technology; this is a relationship that pops up every so often in my mind, even when I am not necessarily studying the intersection of the two.

We live in time with a rich visual culture, enabled in large part by technology. The book I was reading was enabled by technology: high-resolution photography, the ability to print with such detail. Indeed, art and technology are not separate; today, many aspects of our visual culture are intertwined with the technologies we have.

⁂ ⁂ ⁂

After my reading, I ran a few errands and went for a long walk, listening to a podcast about reading and enjoying looking at the leaves and the trees and the fields and the distance. Then, I did as I do: sat down, with a beverage – in this case, a glass of water, having been sufficiently fuelled from the cup of coffee I had consumed earlier – and looked through my notes of the day, with wonder and curiosity and reflection, ready to start writing.

anthology of self reference works National Gallery in London Books as Art Practice

Streak of procrastination - Joel's Log Files

2026-08-21T20:50:00.000Z

Sometimes you have such a great idea, a post that you need to write and share with everybody and you just keep meaning to get to it.

Then reality hits and it doesn’t quite let you make that post in a way that feels right for the subject.

In the end, you end up writing nothing at all, or with a draft that is quite big and extensive but still not completed.

And welp, you have many smaller ideas for posts you could do in the meantime, but you don’t want to because you gotta dedicate all of that time to that great post idea.

Except you don’t, work shows up, distraction shows up, life shows up, and you end up procrastinating both the main post and doing anything else.

At this point, I would rather have something out, something complete and ready to be posted on this evil blogpost of mine.

Worst of all is that this is also in the middle of Blaugust (pretty much ending in just ten days now) and now I’ll have to play catch up! If this wasn’t the case I could simply let it happen, I literally post at least twice per week anyway, not that that means something.

The only good thing is that there’s a couple drafts that should be done very soon. I rarely publish thouse but the desperation on my side is on that level already.

In any case, I just want to get some post out there to break the procrastination streak and call it day.

That’s a good title, I’ll use it, hope you enjoy it. The original title was actually “When a blogpost stun-locks you”, but perhaps that is too much of a gaming reference for some.

I really want to write a little less about games too, but also not, because I love to talk about games, confusing stuff!

Perhaps I am just playing way too much Outer Wilds this week and my brain can’t process everything properly right now. Too many mind-bending moments.

The blogpost in question is my retelling of my session of Land of Eem with friends by the way. Though my review of Gris is also pending…

This is day 21 of #100DaysToOffload and day 16 of #Blaugust2026

Reply to this post via email | Reply on Fediverse

Book Review: An Immense World - How Animal Senses Reveal the Hidden Realms Around Us by Ed Yong ★★★☆☆ - Terence Eden’s Blog

2026-08-21T11:34:36.000Z

This is a detailed examination of the various senses possessed by animals. Some will be intimately familiar to you - like sight and sound - whereas some will seem strange and uncanny - like magnetic detection and electro-sensing. Some straddle an almost understandable space like echolocation or tetra-chromatic vision.

This isn't a game of Top Trumps where all the animals are ranked by power. Instead there's a gentle and passionate exploration of what these senses might mean to their owners. It is refreshingly candid about what we don't know, while always trying to convey a sense of wonder about the inherent Umwelt experienced by the animal.

But goodness me is it long. It seems that every time the editor told the author to cut out a paragraph, he stuck it in a footnote instead. The text is well referenced, but so are the footnotes, which means occasionally encountering sentences formatted like this:

Despite several frustrating false leads, nobody’s ever found them.^{fn11,36,37,38,39}

Speaking of which, the general formatting of the eBook is poor. The CSS contains all sorts of weird stuff which I needed to turn off, and is full of comments which probably should have been stripped before the book was distributed.

Science publishers still haven't grasped that eBooks don't need to relegate glossy images to the back of the book - they can go inline with the text!

This is a funny, heartfelt, and (perhaps overly) thorough book. It will gleefully send you down rabbit holes - even if you're ill-equipped to see in the dark and sense the bugs around you.

'Project' section of 'Task & Project Management' course re-recorded - Johnny.Decimal

2026-08-21T06:35:47.000Z

Our Task & Project Management course is, perhaps unsurprisingly, split into two sections: tasks, and project management. (Perhaps to our marketing detriment, I have a tendency to name things literally.)

We just re-recorded the entire project management section. If you watched the previous version, you should watch these new videos. Start from feedback from the future.

Updated based on real-world use

Everything we produce is a result of real-world experience. I can't teach you how do to a thing if it's not something I do myself.

The previous projects section was the best that I knew at the time. But since releasing it late last year, I continued to refine the method. The re-recorded episodes reflect 6 months of further work, and are exactly how we run our own business.

It's a great update. I'm really happy with it.

Also see: Work packages

See the previous blog post, '50-59 Portfolio of creative outputs' becomes 'W0000-9999 Work packages'.

'50-59 Portfolio of creative outputs' becomes 'W0000-9999 Work packages' - Johnny.Decimal

2026-08-21T06:35:43.000Z

With the release of the Small Business System last year we introduced a new pattern. Area 50-59 Portfolio of creative outputs was an expanded area with numbers ranging from 50000 through 59999.

The extended numbering is required because you're expected to have more than 100 'creative outputs', so the usual restrictions don't work. This numbering was always a bit weird, not least because 50-59 as a parent folder name didn't accurately describe its contents.

Expanding the concept

This concept was originally for 'creative outputs', as its name says. For our type of business that's blog posts and video course lessons. For a restaurant it might be the photo shoot for their latest Instagram campaign.

But the more we used it, the more we realised that it was a useful pattern for all work. If you have a broad Johnny.Decimal ID like 21.34 Small Business System, it gets crowded if you try to do work in there.

One solution would be to promote that thing to its own category: 61 Small Business System, say. You could do that, but now we've pulled this specific product out of the list of products into its own place. And we still have the limit of 100 things to consider.

This 'place to do work' turned out to be a really nice alternative. With this pattern, you leave the core thing where it is: 21.34 Small Business System never changes. Each piece of work you do gets a new number in this 'work world', and we link it back to 21.34.

Introducing 'work packages'

At this point I realised I'd brought the established concept of work packages into Johnny.Decimal. And that's a good sign: well-established patterns are probably correct. Let's not invent something new for the sake of it.

So that's what the 'creative pattern' has grown into: each of these jobs is now a work package, and they're no longer limited to creative-like things. They're useful for any work.

For example, you might need to conduct a large audit as part of a compliance exercise. That audit could be a work package, linked to the SBS ID 11.13 Compliance.

Fixing the numbers

A design principle of Johnny.Decimal is that you must always be able to give a stranger – a new starter at your business, say – a number, and they must be able to find it easily. So the parent folder name needs to accurately explain what's in it.

The existing area pattern A0-A9 doesn't work here. Work packages are so different, we've given them a completely new scheme. They start at W0000 and continue to W9999.¹ So we call the folder that contains them W0000-9999 Work packages. This sorts them below all of your regularly-numbered Johnny.Decimal areas.

They must link to an ID

Crucially, work packages may not exist in isolation. They must belong to an ID. We indicate this in the title like: W0011~11.13 Compliance audit. Here, we've linked W0011 to ID 11.13.

This link-to-parent-ID-in-title is required. You can and should cross-reference these entries using links in your JDex, but trust me: you'll forget to do that. If you always link every work package to its parent using this simple notation, you can never lose anything.

This is how our Small Business example now looks.

How do I migrate from `50-59`?

If you've been using area 50-59, I recommend switching to this new scheme. Start the numbers where you left off: if your last creative job was 50106, your first work package is W0107.

You could renumber your old entries. We didn't: the nature of these things is that, once done, they're rarely referenced again.

We've also retitled `40-49`

While we're at it, we've tweaked the title of the Small Business System's area 40-49. What was your Library of creative inputs, previously mirrored by the now-defunct Portfolio of creative outputs, has been renamed to 40-49 Creative assets. Same thing, simpler name.

See more at the updated Task & Project Management

We just re-recorded the entire second half of the course. You'll find a full explanation of this concept starting at this episode. See the blog post that follows this one for more information.

Just like every other part of the system, you should leave the first 10 for standard zero-like IDs. Start your own WPs at W0011. ↩

Small Business System – '50-59 Portfolio of creative outputs' becomes 'W0000-9999 Work packages' - Johnny.Decimal

2026-08-21T06:23:04.000Z

This is the changelog entry for this update. See blog post 0240 for full details.

Note published on August 21, 2026 at 12:29 AM UTC - Molly White's activity feed

2026-08-21T00:29:31.000Z

delighted to discover that a) Jimothy has a Wikipedia picture and b) it's this