Shellsharks Blogroll - BlogFlock

Quinceañera, Metal Gear Solid, Book shopping! - W16 - Joel's Log Files

2026-04-20T21:30:00.000Z

Welcome, to my week notes! Can you believe that we are almost done with April already? There have been a lot of things going on lately, but hey, at the very least I keep reading on my XTEINK X4 and nudging other people to buy it too, because it sparks joy.

Jokes aside, here are some of the things that happened between April 14 to 20, from the year 2026!

📕 Discovered a super cool plugin for Koreader which let’s you modify the UI in a really awesome way. It basically fixes the biggest caveat with the software, as it’s now much simpler and user-friendly! I switched on the spot, not looking back now. The plugin is SimpleUI, go and get it! I decided to modify the layout on mine and it displays some stats now, very neat.
🔋 Thought for a second that my PSP was dead. It wouldn’t turn on, I tried plugging it and the charging indicator wouldn’t light up. Thankfully, I still have my original battery—I replaced it with an Ostent one a while back—and that let me turn it on to charge, then swap back to my current battery. I think simply connecting the AC adapter without a battery would have worked too, alas, it’s more than alive and well.
🎮 Messed around with my Anbernic RG35XX SP, using PortMaster to install Fallout on it! Unfortunately, the control scheme depended on analog sticks, which my handheld lacks. I also setup AM2R, which works wonderfully after messing around a bit with the screen ratio. I am looking forward to trying it that one, but I also want to continue with Fallout on my laptop at some point.
📺 My YouTube algorithm was on a roll this week, if you usually skip my video links, or don’t even scroll down that far for these posts, I encourage you to check this time, I actually learned quite a bit from these videos, and I’m sure at least one of them will be interesting to you too.
🟩 Returned to play daily word games, which I was very into not that long ago. I still prefer and play Tiled Words the most! Although I haven’t made a streak yet, I keep forgetting to play every once in a while.
🎂 There was a Quinceañera party for one of our church members! It was a fun time. There was party and a small ceremony to celebrate! I edited a video compiling memories of her life, which took me longer than I’d like to admit, the family sent me lots of photos.
📚 Purchased a few books from the Kobo store. I must say a lot of the time my purchases were through… “unofficial”… means. But not this time! Here is a list, let me know which one to start first:
- Aurora by Kim Stanley Roninson
- Dawn by Octavia E. Butler
- The Old Man and the Sea by Ernest Hemingway
- The Dispossesed by Ursula K. Le Guin
- Hyperion by Dan Simmons
- The Screwtape Letters by C.S. Lewis
- Welcome to Night Vale and
- Alice Isn’t Dead by Joseph Fink
- The Pearl by John Steinbeck

Reading

I continued my reading of Clarkesworld Magazine #211, and I’m halfway there with The Indomitable Captain Holli, a novella that I thought I’d hate at first, and then it kept unraveling and revealing some incredible stuff going on and well, it hooked me real good.

As for manga, Fly Me To The Moon remains fun. I’m on chapter 262 and there’s this little arc with a mock exam competition that I’ve enjoyed a bit. Also a relatively new character about to uncover a certain secret that is very intriguing to me!

Also catched up on the weekly chapter of Spy x Family and Blue Lock, as awesome as ever.

Gaming

I’m not sure what took over me, but I started Metal Gear Solid: Peace Walker on my PSP! I tried this title a long time ago, around 2017 or so when I first got into PSP gaming. Unfortunately, I pretty much played the game wrong, I guess, and I got to a boss fight that I just couldn’t figure out. I decided to start over and get used to the game again. So far I’ve had a lot of fun. The game is divided in short mission segments. Between each mission you can also do some base management and from there develop new weapons and items.

Anyway, the main gameplay is stealth, and so far it’s been fun. The controls took a bit of getting used to but I stuck with the “Hunter” control type (based on the Monster Hunter games) and haven’t looked back. The latest mission I’m doing is a boss fight against an unmanned vehicle, the same one that I never completed years ago. I’ll definitely do it this time!

I continued my playthrough of Terranigma too, where I completed the last tower, which was the first serious boss fight of the game, against a giant scorpion-like creature. Before that I got a new armor given to me by my childhood friend. and after defeating the monster, I’m looking for the secret areas in the underworld. I already found one of them!

Last but not least, I actually continued with Pokémon Emerald Legacy for a bit, up to the first battle against my antagonist! In case you are wondering, I chose Torchic as my starter by the way! I am happy to have my running shoes now too, although I wish there was a way to always toggle them instead of keeping the button pressed. It’s alright though.

Around the Web

This time I mostly watched YouTube while doing a lot of chores, and I gotta say, the video selection this time was super interesting! I hope you check them out. Of course, first I gotta share some good old blogposts from some people I follow!

Blog posts

My Workspaces - This is such a good idea for a blogpost but I’m afraid that I don’t think I have more than two pictures of different things. What a trip though… perhaps I could draw from memory? Anyway read it.
Back In Space - Why do you have to tempt me to try Gemini—the web protocol, not the other ugly thing—again? I will not convert all my markdown posts into that format, nope.
I won’t save you but I’ll show you how (2026-W16) - After a long hiatus, Cassie is back to blogging, and she has some wonderful news to share. Her weeknotes were sorely missed during these trying times, all the best!
This isn’t March - Guess the theme for these weeknotes will be “websites on hiatus that suddenly returned”, so, yeah, nice to have you back Jack, not enough gaming updates.
Fits on a Floppy - Creating code is an art too, so I enjoyed this post which was inspired by some modern programs that would fit on a floppy disk from back in the day!

YouTube

What Did Ancient Humans Do at Night? - This was an incredibly interesting video, and it explains so much. I am actually kind of interested on experimenting with the information shared here.
Why Bad Art Makes Great Games - What an essay this was, and I highly agree. The title is a bit wrong though, it’s more about art direction and being willing to not just go for realism, which is where a lot of modern games default to nowadays.
When Graphics Changed Forever - This was an awesome mini-documentary detailing the technology and improvements between 1996 and 2006 in graphics on both consoles and PCs. It explains a lot in a very approachable way and with a lot of comparisons and visuals which I enjoyed. Always nice to see Resident Evil on a thumbnail.
Air Powered Segment Display: 3D Printed Microfluidic RAM? - My engineering brain was tickling while watching this vide. This is such a fun technology, and I wonder what other applications it may have.
I Solved Connect 4 - I rarely watch videos that deal with pure Math and board games, but this one was a welcome surprise, the extremely satisfying graphis and animations helped out a lot.
Making the most pickproof lock yet - Another wonderful video with a lot of engineering on it. I am no lockpicker, but I am sure Jill, the Master of Unlocking, would have no problem.
Chill Gaming for Busy Adults - A fun Tech Dweeb video that shares some tips and tricks to actually play videogames when you are a responsible adult, or something. I just play videogames idk.

Reply to this post via email | Reply on Fediverse

My Best Sub £100 Purchase - Kev Quirk

2026-04-20T16:50:00.000Z

I was recently listening to an episode of The Idea Roastery about personal life gamechangers and toward the end of the episode, Herman asked Jason:

What is the best purchase you've ever made for less than £100?

For Jason is was an egg poacher, and for Herman it was a coffee grinder. This discussion got me thinking about what mine was, and I really wasn't sure at first. But after some thought, it hit me.

It's my dog, Tia!

She's getting old now, at nearly 14 years of age. But my wife and I got when she was 9 weeks old, after being taken from the litter at just 6 weeks old by some scumbag who ended up dumping her.

She cost us £80, and for that £80 we've had years of love, affection, and friendship from her. She's definitely my game-changer.

She's pretty cool too...

I absolutely love everything about this dog. She's my best friend in the world. She's kind. She's gentle. She's the best at spooning too. Seriously, the best.

As I look back at a life well lived and she heads into her twilight years, we know we don't have long left with her, but my goodness the years we have had have been incredible.

So yeah, Tia is by far the best sub £100 I've ever spent, and probably will ever spend.

Love you, T-bone. x

Thanks for reading this post via RSS. RSS is ace, and so are you. ❤️

You can reply to this post by email, or leave a comment.

Note published on April 20, 2026 at 12:40 PM UTC - Molly White's activity feed

2026-04-20T12:40:26.000Z

ghoulish

Book Review: Up - A scientist's guide to the magic above us by Dr Lucy Rogers ★★★★★ - Terence Eden’s Blog

2026-04-20T11:34:38.000Z

My mate Dr Lucy Rogers has written a book! This is a charming and thought provoking exploration of everything that goes on above our heads. This isn't an impersonal and imperious manuscript, it's a deeply personal and joyful book filled with science, anecdotes, and the thrill of discovery.

It's spectacularly accessible. Written in a relaxed and casual tone, it encourages domestic science. I don't mean bakery, I mean the sorts of observations you can do at home without access to a multi-million pound laboratory. The afterword of the book contains dozens of resources for people who want to get involved in science. Dr Rogers eloquently makes the case that you don't need to dedicate yourself full time - it's perfectly acceptable to engage with it on your own terms.

What I liked most about it was that she gets her hands dirty. It would have been easy to write a literature review from the comfort of a safe and dry office. Instead we get a travelogue of all the places she's been - each trek through the forest, every laboratory, and all the foreign festivals are brilliantly recounted. It's a proper adventure from America's tornado alley down to the Vatican Archives.

I find it remarkable how slow some modern science is. As she points out, "there have been only eight transits of Venus since the telescope was invented" - our knowledge rests on the shoulders of giants, but they can be slow, lumbering beasts.

If, like me, you only have a hazy memory of the science you learned at school, this book will top up your knowledge (and vocabulary). It will reignite your passion and curiosity about the world around you - and make you want to buy a round the world ticket to chase solar eclipses!

How we lost the living Now - Westenberg

2026-04-20T01:01:22.000Z

In 1840, England’s Great Western Railway started running the trains on “railway time” - a single standard, set by Greenwich, instead of the local // solar time each town had kept, independently for centuries.

Before the railway, noon in Bristol happened roughly ten minutes after noon in London, and nobody much gave a damn - they had no reason to. Time was...time. After the railway, people had to care - because a train leaving Paddington at 12 couldn’t mean one thing in London and another thing in Reading, or the passengers would miss it, or the signalmen would have no ability to coordinate, and the whole apparatus would fall apart.

That moment is, I believe, when we started losing our hold on the present.

Before the railway, time belonged to the place where you stood. Your noon was the noon of the sun over your head; a farmer in Wiltshire and a clerk in Liverpool would share a year, and a season, but they didn’t share a minute. The minute was solely the possession of your immediate surroundings, and you owned it.

But the railway needed a common minute - or it couldn’t run.

And then - once we had the common minute - we discovered that it could be commoditised. It could be bought and sold.

In 1911, Frederick Winslow Taylor turned the commoditisation of the minute into a science when he published The Principles of Scientific Management - which he had assembled by standing over the shoulder of various factory workers, wielding a stopwatch, breaking their labour into fractions of a minute. He calculated how long it should take to lift a pig iron bar, and how long to carry it across a yard, and how long to drop it onto a pile. He paid workers more, if they hit his numbers, and less if they “whiffed” - and he wrote all of this down in tables which became, eventually, an entire philosophy of industrial productivity...

Taylor’s “innovation” - if we can call it that - was treating a human’s time, and by extension their very mortality, as a commodity priced by the single second; and building on that foundation the idea that time, left unoptimised, was “theft.”

After Taylor, time was something you either used, or you wasted - no third option. The present moment became a quantity.

The telegraph had started this work 70-odd years before. Samuel Morse’s first public transmission in 1844 (“What Hath God Wrought”) collapsed the time between Baltimore and Washington, from days into seconds. The phone would collapse it further, and radio would collapse it for everyone all at once...

Every technological acceleration is framed as a gift of time to all mankind, but every acceleration arrives, in practice, with increased expectations, with increased demand, with more and more pressure. The letter you could answer on your time, because the telegram you had to answer today. The phone call you could ignore in 1950 (because you simply weren’t home to take the call) became a call you had to return in 1985 because the answering machine upped the ante. Then the answering machine was replaced by your mobile phone and (insert montage of technological advances here) by 2026, a 2 hour delay replying to a Slack message became a social failure...

Hartmut Rosa, the German sociologist, wrote a book in 2005 called Beschleunigung - translated as Social Acceleration. It traces this pattern across 3 layers: tech acceleration speeds up the machines, acceleration of social change speeds up the rate at which institutions and relationships change, and and the acceleration of the pace of life speeds up how much we can (or are forced to) cram into a single day. Rosa’s argument is that these layers feed off each other; faster machines let us change faster, which means we need faster machines to keep up, and the loop tightens, and so...

Well, here we are.

The original promise of acceleration was always more free time. Washing machines would give us more leisure, email would cut our labour, automation would give us a 4 day work week, and so on. None of this really happened; a rising floor of expected output swallowed the gains, and so we signed up for more, and we ended up running faster to stay in the same damn place.

And somewhere in the early 2000’s, this crossed a cursed threshold. Before that point, tech was mostly compressing the time between events - the telegram, and the fax, and the email and the IM each shortened the gap between when you sent something and when it arrived; the gap was the thing getting smaller and smaller.

After the smartphone, the gap just...vanished. The feed became real-time, and the notifications constant. Information stopped arriving as discrete, gapped packets and started arriving as a continuous drip, and then a steady flow, and then a firehose, timed by the network’s ambient activity and no longer by anything you happened to be doing. And suddenly, you weren’t receiving mail anymore. You were drowning in a raging river of information.

Paul Virilio, the philosopher, called the condition of real-time media an accident of time itself; he argued that when everything happens at once, nothing actually happens at all, because events lose their distinguishing temporal edges, and the past // present // future collapse into a single undifferentiated smear. A 2021 RescueTime study found that the average knowledge worker checked communication tools roughly every six minutes; other studies put the average smartphone user at around 2,000-3,000 touches per day. We interrupt ourselves, or we get interrupted, enough that sustained attention has become a minority activity. It no longer happens naturally; if it happens at all, it must be scheduled.

Each notification is a tax on the present moment - pulling you into either a micro-past (what did I just see?) or a micro-future (what should I do about this?) while the here and now is skipped over like the intro to a Netflix show. And ironically - we consented to this. We signed up for it without thinking twice. The telegram was imposed on us by commerce, the factory clock by management, but we installed and embraced the push notifications ourselves, app by app, in exchange for convenience - in exchange for acceleration - in exchange for collapse.

If the Now has any place at all, it’s as “content.” We watch an event happen, and we’re already narrating it for a future audience, for a draft post, for a video - as if the event itself isn’t quite real, until it has been recorded in some way. Call it what you want; but it describers a condition in which our tools have trained us to convert the present into its sole acceptable format. It becomes raw material for a feed. You’re standing inside it and outside of it, holding a lens and prepping a caption.

The French sociologist Henri Lefebvre wrote in 1947 about the colonisation of every day life. He saw the structure of a world that would eventually (perhaps, inevitably) produce Instagram. Commerce, and then bureaucracy each laid claim to a bigger piece of the ordinary every day, until the ordinary itself became a product. A few decades later, we started calling that product “content.” Not a bad word for it, actually, considering that Content only has to be Contained - it doesn’t have to offer anything of value on its own.

We know this is happening - all of us. We talk about it constantly - I just did, and you just read it, and we both probably felt briefly quite pleased with ourselves for noticing and that’s part of the problem too...every other bestseller is about mindfulness and slow living, digital detoxes and offline retreats, sabbath practices and meditation apps that send you push notifications reminding your to experience the moment.

Silence is a malfunction. Grief is harder now, because to grieve means to sit inside a moment, and we’ve lost the practice of it. Joy is thinner, because joy needs a present it can occupy, and the present has been divided into micro-slices already claimed by the next scroll, the next ping, and the next thing we should be looking at instead...

The generational data is looking bleak.

In his 2024 book The Anxious Generation, Jonathan Haidt argued that the cohort born after 1995 - the first to get smartphones before they were fully developed - show a sharp increase in anxiety, depression and self-harm; and the increase tracks against the rollout of social media. Haidt’s causal story might be contested, but the numbers aren’t. We’re all a little broken. We’re all breaking a little more.

My own take is that it’s not only about screen time, it’s about a generation who never had the chance to experience a present moment, without a second channel running underneath it all. The backchannel of the phone, the draft message, the group chat, the algorithm etc is all humming under whatever is supposedly happening in the room, until the hum gets so loud it takes over everything else. A childhood of partial presence creates an adulthood where you can’t watch Sabrina Carpenter and Madonna share the stage without the intermediate of an iPhone camera and screen...

The older generations lost the present slowly, and can still remember what it was like to have one. The younger are trying to reconstruct it from second principles, if at all.

I have no program to offer here. The essays that end with a neat 5-step plan to reclaim attention are almost without exception published by those who sell courses, and may my bank account forgive me, I still don’t have such a product. I do think the present can return in small pockets, and under specific conditions - when you make something with your hands, and the thing resits, when you’re looking after your friend’s dog, who is the best dog in the world, who has no opinion about the future, in the middle of a long walk and after the internal monologue has run out of fresh grievances...

It returns when the compressors and the accelerators are out of reach for long enough that your nervous system remembers it has other settings.

The railway clock runs across server farms in places you have probably never been and will probably never go. The minute is measured by atomic oscillation and shopped out, in real time, to the watch on your wrist, the phone in your pocket, the Tesla in your driveway, the smart fridge that can tweet better than it can moderate its internal temperature etc., synced to the same atomic pulse.

It’s the same common minute. But it’s only ever the minute gone by or the minute yet to come. The minute we used to have and hold is gone.

Westenberg is designed, built and funded by my solo-powered agency, Studio Self. Reach out and work with me:

Work with me

Custard creams - James' Coffee Blog

2026-04-20T00:00:00.000Z

Behind the counter in a coffee shop I visited last week there was a whiteboard which read [1]:

Sunday debate:

Custard creams or chocolate bourbons

There were dozens of tally marks on the board and counts from a social media poll. The results were:

Custard creams: 212
Bourbons: 171

I love both biscuits, so if there were a both option I would have voted as such; if I had to pick one, it would be custard creams, though. Otherwise, I might have said fig rolls, a biscuit I had for the first time in ages this week. Fig rolls may not have been an option, but they sure are tasty.

[1]: Given I saw the whiteboard on a week day, I assume the debate was going to run for a week, despite the title being "Sunday debate". In any case, any day is a good day to chat about biscuits.

The Technological Republic, in brief - Werd I/O

2026-04-19T16:35:10.000Z

[Palantir]

Palantir CEO Alex Karp wrote a book last year called the Technological Republic, but perhaps because it didn’t have the impact he hoped, the company posted a tweet thread (and LinkedIn post, etc) that summarizes its core points. Which are, to be clear, an argument for hard-right nationalism — complete with remilitarization and implied cultural hierarchy — and fusing Silicon Valley with the national security state.

In Karp’s world, Silicon Valley innovators have an obligation to build weapons through a kind of moral debt to the country. He also wants to see Germany and Japan re-militarized, escalating tensions that will see his company make more money through those arms sales — particularly as his manifesto declares that AI weapons, exactly of the kind he happens to sell, are an inevitable future of military action.

He says we should be more tolerant of billionaires and scrutinize their private lives less, while being less tolerant of other cultures. He declares that no nation has advanced progressive values more than the US (a tough sell in itself), but then recites a litany of anti-progressive ideas. He takes time to defend Elon Musk by name.

He also furthers the idea that people who further progressive ideas are some kind of “elite”, instead of what they actually are: people from all slices of life, including working class unions, who want to have a more inclusive, more peaceful society.

Bellingcat founder Eliot Higgins has a great Bluesky thread that lays out the issues plainly:

“Point 21 is the giveaway, some cultures produce "wonders," others are "regressive and harmful." Once you accept that hierarchy, you've quietly been given permission to apply different standards of verification to different actors. The form of verification stays, but the democratic function doesn’t.

This is what verification looks like once national identity sits above method. Rigorous when it's pointed at adversaries, conveniently absent when it's pointed at us. Symmetric, evidence-led investigation of allied conduct, exactly what Bellingcat does, becomes the thing the worldview can't tolerate”

In short, I find this offensive, often contradictory, and terrifying in equal measure. It makes clear that Palantir, its associates, and companies like it (Anduril, for example) are a threat to a democratic, peaceful, inclusive society. There’s no point in being cautious or pulling punches; it must be opposed.

[Link]

Reprojecting Dual Fisheye Videos to Equirectangular (LG 360) - Terence Eden’s Blog

2026-04-19T11:34:32.000Z

I still use my obsolete LG 360 Camera. When copying MP4 videos from its SD card, they come out in "Dual Fisheye" format - which looks like this:

VLC and YouTube will only play "Equirectangular" videos in spherical mode. So, how to convert a dual fisheye to equirectangualr?

The Simple Way

ffmpeg \
  -i original.mp4 \
  -vf "v360=input=dfisheye:output=equirect:ih_fov=189:iv_fov=189" \
  360.mp4

However, this has some "quirks".

The first part of the video filter is v360=input=dfisheye:output=equirect - that just says to use the 360 filter on an input which is dual fisheye and then output in equirectangular.

The next part is :ih_fov=189:iv_fov=189 which says that the input video has a horizontal and vertical field of view of 189°. That's a weird number, right?

You'd kind of expect each lens to be 180°, right? Here's what happens if :ih_fov=180:iv_fov=180 is used:

The lenses overlaps a little bit. So using 180° means that certain portions are duplicated.

I think the lenses technically offer 200°, but the physical casing prevents all of that from being viewed. I got to the value of 189° by trial and error. Mostly error! Using :ih_fov=189:iv_fov=189 get this image which has less overlap:

It isn't perfect - but it preserves most of the image coherence.

Cut Off Images

There's another thing worth noticing - the top, right, bottom, and left "corners" of the circle are cut off. If the image sensor captured everything, the resultant fisheye would look something like this:

I tried repaging the video to include the gaps, but it didn't make any noticeable difference.

Making Equirectangular Videos Work With VLC

Sadly, ffmpeg will not write the metadata necessary to let playback devices know the video is spherical. Instead, according to Bino3D, you have to use exiftool like so:

exiftool \
        -XMP-GSpherical:Spherical="true" \
        -XMP-GSpherical:Stitched="true" \
        -XMP-GSpherical:ProjectionType="equirectangular" \
        video.mp4

Putting It All Together

The LG 360 records audio in 5.1 surround using AAC. That's already fairly well compressed, so there's no point squashing it down to Opus.

The default video codec is h264, but the picture is going to be reprojected, so quality is always going to take a bit of a hit. Pick whichever code you like to give the best balance of quality, file size, and encoding time.

Run:

ffmpeg \
  -i original.mp4 \
  -vf "v360=input=dfisheye:output=equirect:ih_fov=189:iv_fov=189" \
  -c:v libx265 -preset fast -crf 28 -c:a copy \
  out.mp4; exiftool \
        -XMP-GSpherical:Spherical="true" \
        -XMP-GSpherical:Stitched="true" \
        -XMP-GSpherical:ProjectionType="equirectangular" \
        out.mp4

That will produce a reasonable equirectangular file suitable for viewing in VLC or in VR.

If this has been useful to you, please stick a comment in the box!

Finished reading Devil's Gun - Molly White's activity feed

2026-04-18T02:00:46.000Z

Finished reading:

Disco Space Opera series, book 2.

Devil's Gun

by Cat Rambo.

Published 2023. 288 pages.

Started April 14, 2026; completed April 17, 2026.

Note published on April 17, 2026 at 4:11 PM UTC - Molly White's activity feed

2026-04-17T16:11:15.000Z

as someone with an anxiety disorder who gets bad brain fog during very anxious periods, choosing software engineering and then writing as careers was certainly a series of decisions

Read "How Silicon Valley Humiliated the Democrats" - Molly White's activity feed

2026-04-17T13:37:40.000Z

Read:

“How Silicon Valley Humiliated the Democrats”.

Alexis Goldstein in The New Republic. Published April 16, 2026.

When will they learn? The party remains far too solicitous of an industry that’s rewarded their fealty with four years of Trump and untold damage to democracy.

Book Review: How To Kill A Witch - A Guide For The Patriarchy by Claire Mitchell and Zoe Venditozzi ★★★⯪☆ - Terence Eden’s Blog

2026-04-17T11:34:26.000Z

After reading The Wicked of the Earth, I wanted to understand some of the history behind the stories. Why were women⁰ accused of being witches? What really happened in those trials? What are the modern consequences of those events?

This is the story of the Scottish Witch Trials - with brief forays into England and abroad. It examines the central tension of whether witchcraft was real to the accusers, or just a convenient means to oppress troublesome women. The descriptions of the imprisonment, torture, and state-sanctioned murder is visceral and horrific.

It's also rather stark in its modern assessment of the historic context:

Nonetheless, it’s important to remember it was a proper legal trial, with evidence being put forward and the judge assessing it and carrying out legal tests. Some people think that witchcraft trials were carried out by angry peasants waving pitchforks. Perhaps this is a more acceptable way for a modern person to think about it. No one wants to think that a judicial system can get it so wrong. But it did, with catastrophic consequences for those accused.

The book is mostly good, it's a spin off from the Witches Of Scotland podcast and that's reflected in the writing. As with any parasocial¹ entertainment, it attempts to centre the authors and bring the audience along for the ride - so there's lots of descriptions of the libraries the authors visit, how things make them feel, how enamoured they are with their podcast guests. I found it a little distracting, but it's obviously right for their main audience.

Similarly, there's an attempt to bring the past to life by imagining a little monologue from various historic figures. I found that a little unconvincing; I dislike putting words in peoples' mouths. But with sparse primary documentation, that may be the best way to bring these characters to life. It's also well illustrated. Too many books eschew pictures - but this has a nice collection of woodcuts and portraits to contextualise what we're reading about.

One little nitpick, the book makes the claims:

Life was hard and life expectancy was around 35

and

Lilias was an old woman, at least 60 years old and possibly as old as 80. At a time when life expectancy was much lower than it is now, even the lower estimate was still a considerable age.

That's not quite right. Although the average life expectancy was low, that's the average at birth - with a large number of infant mortalities dragging down the average. When you look at the full data, you'll see people used to live long lives even in the distant past.

In a way, it reminds me of Invisible Women. A national tragedy hidden from view.

It builds to a rousing end. There are parts of the world where witchcraft is still taken seriously - with devastating consequences. The febrile atmosphere which led to unfounded accusations against women is still prevalent even in modern societies.

And a small number of men. But this is firmly focused on the overwhelming majority. ↩︎
As opposed to paranormal. ↩︎

We beat Google’s zero-knowledge proof of quantum cryptanalysis - Trail of Bits Blog

2026-04-17T11:00:00.000Z

Two weeks ago, Google’s Quantum AI group published a zero-knowledge proof of a quantum circuit so optimized, they concluded that first-generation quantum computers will break elliptic curve cryptography keys in as little as 9 minutes. Today, Trail of Bits is publishing our own zero-knowledge proof that significantly improves Google’s on all metrics. Our result is not due to some quantum breakthrough, but rather the exploitation of multiple subtle memory safety and logic vulnerabilities in Google’s Rust prover code. Google has patched their proof, and their scientific claims are unaffected, but this story reflects the unique attack surface that systems introduce when they use zero-knowledge proofs.

Google’s proof uses a zero-knowledge virtual machine (zkVM) to calculate the cost of a quantum circuit on three key metrics. The total number of operations and Toffoli gate count represent the running time of the circuit, and the number of qubits represents the memory requirements. Google, along with their coauthors from UC Berkeley, the Ethereum Foundation, and Stanford, published proofs for two circuits; one minimizes the number of gates, and the other minimizes qubits. Our proof improves on both.

Resource Type	Google’s Low-Gate	Google’s Low-Qubit	Our Proof
Total Operations	17,000,000	17,000,000	8,300,000
Number of Qubits	1,425	1,175	1,164
Toffoli Count	2,100,000	2,700,000	0

Table 1: Resource upper bounds reported in different proofs for circuits computing the correct output across 9,024 randomly sampled inputs

Our proof fully verifies when using Google’s unpatched verification code. It has the same verification key as their original proofs and is cryptographically indistinguishable from a zero-knowledge proof resulting from actual algorithmic improvements to the quantum circuit. We are releasing the code we developed to forge the proof, and a summary of our proof follows.

Circuit SHA-256 hash: 0x7efe1f62bb14a978322ab9ed41d670fc0fe0f211331032615c910df5a540e999

Groth16 proof bytes: 0x0e78f4db0000000000000000000000000000000000000000000000000000000000000000008cd56e10c2fe24795cff1e1d1f40d3a324528d315674da45d26afb376e8670000000000000000000000000000000000000000000000000000000000000000024ac7f8dd6b1de6279bcce54e8840d8eb20d522bf27dedd776046f6590f33add217db465201c63724e6b460641985543d2b79c3c54daeea688581676a786aafc1dba8604a361acdd9809e268b6d8bc73943a713bb0ed0d96221f73d26def6ea4041d05b077523d9351a48b2ecd984c686b6473df69d20a24296d0a1cba3cdbe92eb13a7cc0ecd92f27f7bf23f9ac859d4293e17216dcbd85d1c7f60a52f65a9d02faef077336acd39e845d534200b575b029d6e3f0afb4f90815557233eab70b0fe88919834dd9beb90d47241f1490dc202e0dce44e4894982b07073c8d4426513732d79e9af9913b254aa29471e1a98fa1b43a1886afb5dbd36988153217aa2

Verification key: 0x00ca4af6cb15dbd83ec3eaab3a0664023828d90a98e650d2d340712f5f3eb0d4

Zero-knowledge virtual machines

Google used Succinct Labs’ SP1 zkVM for their proofs. A zkVM is essentially a way to prove that you know which private inputs for an arbitrary guest program on the zkVM generate some public output. For example, consider this basic Rust guest program.

#![no_main]
sp1_zkvm::entrypoint!(main);

pub fn main() {
 // Read in private inputs a and b
 let a = sp1_zkvm::io::read::<u32>();
 let b = sp1_zkvm::io::read::<u32>();
 // Add them together
 let c = a + b;
 // Write the public output a + b
 sp1_zkvm::io::commit(&c);
}

A user can take the private inputs 2 and 3, run this program on the zkVM, and get a proof that the program ran successfully and that the output was 5. Anyone can verify the proof, but they would get zero knowledge about whether the input was (2, 3), (1, 4), or (6, 0xffffffff). Obviously, this toy problem is simple; real programs can be significantly more complicated.

Behind the scenes, the Rust guest program compiles down to a RISC-V ELF binary. This simple architecture allows complex program logic to be encoded into provable mathematical relationships. For example, the state of the RISC-V registers after executing an instruction is a deterministic function of their state before execution. Having to prove every step makes generating zkVM proofs resource-intensive and costly, but significant engineering work has enabled proving statements about complex programs.

Google’s zkVM guest

In the case of Google’s zero-knowledge proofs, the private input is the quantum circuit (in a custom assembly language), and the program is a simulator that checks the circuit. Note that these are “circuits” in the quantum sense, not the typical zero-knowledge definition. The public output includes bounds on the number of qubits and gate operations. In general, simulating quantum circuits is difficult, but the “kickmix” circuits defined in this paper refer to a specific subset that can be tested classically.

The following script, adapted from one of Google’s examples, increments a 3-qubit value. It includes three operations and a total of three qubits. Note that the first instruction CCX has two inputs (q0 and q1) and computes q2 = q2 ^ (q0 & q1). This is called a Toffoli gate. Toffoli gates are quite useful, but they’re much harder to implement on actual quantum hardware, so the complexity of quantum algorithms is sometimes measured in the number of Toffoli gates (or more accurately, non-Clifford gates). Circuits like this are serialized into bytes and sent to the zkVM simulator.

# Increment a value held in 3 qubits (q2, q1, q0). Sends
# (0, 0, 0) -> (0, 0, 1)
# (0, 0, 1) -> (0, 1, 0)
# ...
# (1, 1, 1) -> (0, 0, 0)

# If q0 and q1 are set, flip q2.
CCX q0 q1 q2
# If q0 is set, flip q1.
CX q0 q1
# Flip q0.
X q0

To verify that a circuit computes the correct function, the simulator deserializes the circuit, randomly initializes the qubits (e.g., to (1, 0, 1)), iteratively applies every operation in the circuit, and panics unless the final state is as expected (e.g., (1, 1, 0)). The simulator repeats this for many different inputs (9,024 times, to be precise), so proving that the simulator terminated without error is essentially the same as proving that the circuit is correct with high probability. In Google’s zkVM program, the circuit must compute one elliptic curve point addition, a critical subroutine of Shor’s algorithm for solving the elliptic curve discrete logarithm problem.

In addition to checking that the circuit computes the correct function, it also counts the total number of operations, the number of qubits, and the average number of Toffoli gates (some Toffoli gates are conditioned on classical bits and may be skipped during simulation). These performance metrics are checked to ensure they do not exceed specified upper bounds; if they don’t, the upper bounds are committed as public output.

Plan of attack

Since Google’s zero-knowledge proof comes from the results of running a Rust simulator on a private kickmix assembly script, we can create our own zero-knowledge proof by providing our own private input to the same program. If we find some input that causes the simulator to misreport the quantum costs, we’ll have successfully forged a proof. To beat Google’s results on any metric, we have the following goals:

Must compute elliptic curve point addition correctly
Preferably reports fewer than 17 million total operations
Preferably reports fewer than 2.1 million Toffoli gates
Preferably reports fewer than 1,175 qubits

This turns a quantum computing problem into an application security problem. Any deserialization bugs when parsing the kickmix circuit input are fair game, as well as any logic bugs we find in the simulator.

Vulnerability 1: Bypassing the Toffoli counter

One area of concern in the Rust source code was the use of unsafe blocks, disabling important memory safety checks. This was presumably done to reduce the overall cycle count of the zkVM guest program; each additional bounds check inflates the already substantial cost of generating a zero-knowledge proof, particularly checks that run millions of times. The vulnerability starts in the following two lines of code from program/src/main.rs.

let private_circuit_bytes = sp1_zkvm::io::read_vec();
let ops = unsafe {
 rkyv::access_unchecked::<rkyv::Archived<Vec<Op>>>(&private_circuit_bytes)
};

The first line shows that private circuit bytes (private_circuit_bytes) are directly read from outside the zkVM, and the use of the rkyv serialization library’s access_unchecked function instructs the library to assume that private_circuit_bytes corresponds to a valid serialization. But data from outside the zkVM is untrusted, so what happens if the bytes, which are meant to represent a vector of circuit operations, are malformed?

The answer is “not much.” There are relative pointer offsets and length fields in the serialization for the Vec type, but I couldn’t see a viable path from manipulating those to getting the prover to underreport resource counts. The Op type is similarly simple, consisting of seven 32-bit fields: one describes the OperationType, and six describe the identifiers of which qubits and classical bits to use as inputs and outputs for the operation. For a while, I was chasing down a bug in how the magic identifier 0xffffffff could bypass the qubit count and trigger an out-of-bounds write in the array of simulated qubit values. I was deep in the details of understanding the Rust heap allocator used by the SP1 zkVM before a colleague pointed out that Google was using SP1’s 64-bit RISC-V architecture rather than the potentially exploitable 32-bit architecture.

That left the kind field, an enum describing which of the 18 supported kickmix OperationType opcodes to apply. When simulating the quantum circuit, the guest program iterates over the vector of operations and determines whether to conditionally execute each operation; if so, it increments the count of Toffoli or Clifford gates, depending on the operation type, and executes the operation. This code is in Simulator::apply_iter.

match op.kind {
 OperationType::CCZ | OperationType::CCX => {
 self.stats.toffoli_gates += executed_shots;
 }
 OperationType::CX
 | OperationType::CZ
 | OperationType::Swap
 | OperationType::R
 | OperationType::Hmr => {
 self.stats.clifford_gates += executed_shots;
 }
 // Note: X and Z are not considered Clifford gates in the
 // stats because they can be tracked in the classical control system.
 // They don't need to cause something to happen on the quantum computer.
 _ => {}
}

match op.kind {
 OperationType::CCX => {
 let v = cond & self.qubit(op.q_control1) & self.qubit(op.q_control2);
 *self.qubit_mut(op.q_target) ^= v;
 }
 OperationType::CX => {
 let v = cond & self.qubit(op.q_control1);
 *self.qubit_mut(op.q_target) ^= v;
 }

What if op.kind falls outside of the expected 0–17 range because rkyv was instructed not to check this value during deserialization? This is undefined behavior, so to investigate, I used Ghidra to reverse-engineer the RISC-V ELF binary Google provided with their proof.

After identifying the location of this function in the binary, I discovered that the Rust compiler emits a pair of jump tables for these two match expressions. The first jump table determines which gate counter to increment, and the second performs the actual operation. But we maliciously control the value of op.kind, so what if instead of the normal behavior, we dereference past the end of the first jump table and directly jump to an address from the second jump table? Then an out-of-range OperationType could still perform the correct operation, but it would completely bypass the Toffoli counter!

Figure 1: In this simplified execution flow, providing an invalid operation type bypasses the Toffoli counter, giving the same functionality while hiding the true cost.

I calculated the necessary offsets, modified Google’s example prover code to inject the invalid operation types, and attempted to simulate a zero-knowledge proof of a simple 64-qubit adder circuit. To my surprise, it worked on the first try.

stdout: circuit.average_cliffords_performed() = 0
stdout: circuit.average_non_cliffords_performed() = 0
stdout: The circuit passed fuzz testing.

I had been concerned that the RISC-V registers would be in an invalid state when jumping into the wrong table, but this ended up not being the case. Now I had the primitive I needed to forge a circuit that misreports the number of Toffoli gates, and I just had to scale up my attack on the 64-qubit adder circuit to full elliptic curve point addition.

Building a quantum circuit

I now had a virtually unlimited budget for Toffoli operations, and the path forward looked simple. I could implement any kickmix circuit that correctly performs elliptic curve point addition without worrying about the Toffoli count, tweak the operation types before feeding the script to the prover, and then forge a proof for whatever Toffoli upper bound I wanted. I might use more total operations or more qubits than Google’s circuits, but it would be an amusing proof of concept. The only concern was that the prover’s running time is proportional to the total number of operations, so my circuit still needed a reasonably low operation count.

It turns out that programming a quantum computer is way more challenging than I anticipated, and this is because of the requirements of reversibility and uncomputation.

Requirement 1: Reversibility. A quantum circuit is made up of a series of reversible (unitary) gates. For kickmix circuits, think of these as reversible bit operations. For example, c’ = c XOR b is allowed because the original value of c can be recovered with c = c’ XOR b. On the other hand, c’ = c AND b is not allowed because if c’ and b are both 0, we cannot know if c was originally 0 or 1. By itself, AND is not reversible, but with an additional input in Toffoli gates, it is. The kickmix Toffoli operation CCX q1 q2 q3 updates q3 to q3’ = q3 XOR (q1 AND q2), and this operation can be reversed with q3 = q3’ XOR (q1 AND q2).

Requirement 2: Uncomputation. To avoid the undesirable effects of entanglement, any auxiliary (or ancilla) qubits used to store intermediate results of computation must be “uncomputed,” or reset to state 0. The reversibility requirement makes this a challenge, since the intermediate result may have been 0 or 1. The intermediate state must be uncomputed from the computation result in order to be reversibly cleared out.

As we try to build our reversible elliptic curve point addition circuit with uncomputation, a couple of tools are available. We could use Bennett’s trick, which involves preserving inputs and outputs in spare qubits, then running the full computation a second time in reverse to clear ancilla qubits. This approach isn’t ideal because it roughly doubles the operation count for each level of the call stack. Another approach is to use the more efficient measurement based uncomputation. Google has revealed that this is the technique their circuits use, but it requires a much finer-grained algorithmic analysis to apply correctly.

Vulnerability 2: Efficient operations with register aliasing

After struggling to implement elliptic curve point addition while keeping the operation count and qubit count low, I discovered another exploitable vulnerability: register aliasing. Recall the Toffoli (CCX) operation defined in Simulator::apply_iter.

OperationType::CCX => {
 let v = cond & self.qubit(op.q_control1) & self.qubit(op.q_control2);
 *self.qubit_mut(op.q_target) ^= v;
}

There’s no check that the qubit inputs (op.q_control1 and op.q_control2) are different from the qubit output (op.q_target), so tying all three together becomes q1 = q1 ^ (q1 & q1) = 0. That is, we can immediately reset a qubit to zero, violating the quantum requirement of reversibility and making uncomputation trivial.¹

Figure 2: By setting the output of a kickmix operation to the input, we can build circuits that violate quantum reversibility and implement arbitrary classical logic gates.

In addition, we can use this primitive to create any logical gate we want, like the classical AND gate that violates reversibility or the functionally complete NAND gate. Now that I don’t have to deal with the limitations of quantum circuits, it’s basically Nand2Tetris, except the goal is elliptic curve point addition. I implemented basic logic gates, followed by integer addition and subtraction, modular addition, modular multiplication, modular inversion, and, finally, point addition.

After exploiting a memory corruption issue in unsafe Rust code, implementing elliptic curve operations from the ground up using individual logic gates, and squeezing whatever performance I could out of the non-quantum aspects of the design, I finally had a working kickmix script that passed validation. 0 Toffolis, 8 million operations, and 1288 qubits. This beats one of Google’s two proofs but falls short of beating the other one by just 113 qubits.

If I wanted to truly claim that our zero-knowledge proof beat Google’s, I couldn’t leave it there. I needed to find some way to shave off 113 qubits, but I was all out of vulnerabilities.

The final challenge: Euclidean algorithm optimization

Profiling my circuit made it clear that the most expensive operation was modular inversion, and the same is true for many published quantum elliptic curve addition circuits. My optimized circuit required 4 field elements (1024 qubits) for the inversion, including some tricks to store intermediate field elements, and a handful of qubits for control flags and carry bits. If I were to beat Google’s proof, I needed to lose those tricks and do modular inversion using fewer than 2.59 field elements.

One idea is to use Fermat’s little theorem: $x^{-1} \equiv x^{p-2} \pmod{p}$. We replace inversion with exponentiation, which is just a sequence of modular multiplications. Each multiplication requires three field elements, and this approach requires hundreds of multiplications, well beyond our total qubit and operations budget.

What many quantum circuits use instead is a variant of the extended Euclidean algorithm (EEA). To compute $x^{-1} \pmod{p}$, this algorithm involves four variables $(a, u, b, v)$ initialized to $(x, 1, p, 0)$. The algorithm proceeds through several iterations to cancel out bits of $a$ and $b$, perform the same operations to $u$ and $v$, and (assuming $x$ and $p$ are coprime) the algorithm terminates with $(a, u, b, v) = (0, 0, 1, x^{-1})$.

I based my implementation on the binary EEA, a variant that involves canceling out the least significant bits of a and b rather than the standard most significant bits. Thanks to Thomas Pornin’s clear exposition of this algorithm, it was relatively easy to reimplement a high-performance version in my circuit, but the qubit overhead was still too high.

Next, I found this recent preprint by Han Luo, Ziyi Yang, Ziruo Wang, Yuexin Su, and Tongyang Li, which came out just days after Google’s announcement. It describes a method to compute modular inverses with the space equivalent of 3 field elements. Many of the techniques went above my head, but they open-sourced their code, so I had a much easier time understanding their paper. Their code included a Qiskit circuit, but I was unsuccessful in integrating this into my exploit. Despite these difficulties, the paper gave me the key term I would need to shave off the remaining qubits: Proos-Zalka register sharing.

The 2003 paper by John Proos and Christof Zalka recognizes that over the course of the standard EEA, the bit-lengths of a and b gets smaller, while the bit-lengths of u and v get larger. Their register-sharing algorithm saves space by limiting the number of qubits for each value at each iteration. This can fail with low probability, but rare failures are tolerable when doing Shor’s algorithm. I implemented a classical version of the register-sharing algorithm of Proos and Zalka, and I ended up with 30 million total operations, almost twice Google’s result.

Finally, I had the insight I needed. What if I combined the operation efficiency of the binary EEA with the space efficiency of the Proos-Zalka algorithm? The binary EEA doesn’t have the same bounds on u and v as the standard EEA, but a slight tweak (doubling v instead of halving u) does, and needs only a simple correction factor at the end. This idea is deeply connected to Kaliski’s method, which is considered in papers by Roetteler et al., Gouzien et al., Häner et al., and Litinski. Reversibility constraints require an extra qubit for each of about 512 iterations, but our implementation doesn’t need to be reversible.

Figure 3: The first 20 and last 5 rounds of the modified binary EEA depict how different variables can share space when performing modular inversion. A final correction factor is not applied here.

Thanks to register sharing, my final modular inversion requires the space of only 2.55 field elements, barely less than the 2.59 required. In total, my elliptic curve point addition circuit uses 8,288,880 operations, 1,164 qubits, 5,980,691 pre-bypass Toffoli gates, and 0 reported Toffoli gates. This is less than half the reported operations in Google’s circuits and just a few qubits fewer than their best variant. The source code for generating this proof of concept is available here.

What Google’s secret circuit (probably) does

The zero-knowledge properties of the proof makes this unanswerable, but framed in a different way, we can answer what problems are documented in prior work that Google would have to overcome to achieve their results.

Google’s circuit does elliptic curve point addition, which requires at least one modular division. In previous circuits, modular inversion is the most expensive step in terms of gate count and qubit count, so that’s where improvements are needed most. Our register-sharing implementation shows that 2.55 field elements of storage is enough for a nonreversible circuit, but prior quantum implementations of Kaliski’s EEA variant require an extra qubit per iteration to preserve reversibility. This adds 512 qubits of overhead to guarantee that modular inversion is invertible, and a circuit based on Kaliski’s method with Google’s qubit counts would need to solve this problem.

Even the most revolutionary scientific breakthroughs are rooted in published literature, and I think a healthy understanding of prior work can help demystify the risk of a shadowy adversary destabilizing cryptocurrencies with a secret algorithm.

The aftermath

Zero-knowledge proofs are a transformational new technology with wide-ranging impacts, and their application to vulnerability disclosure is still new. Without knowing the details of their circuit, it’s impossible for me to conclude whether Google’s decision to announce this discovery using a zero-knowledge proof is justified. However, I do have experience with both vulnerability disclosure and academic publishing, and this points to broader implications in the deployment of zero-knowledge technology.

One potentially overlooked aspect of coordinated disclosure is the importance of an embargo period. Current industry best practices recommend a 30-day buffer between a timely patch becoming available and full disclosure of the technical details. This allows time for patch adoption, benefits defenders who rely on the technical details, and prevents opportunistic exploitation by low-skill attackers. Zero-knowledge proofs can communicate the importance of patching, but they are not a cryptographic replacement for the benefits of eventual disclosure.

In academic publishing, the more details that are available in published work, the easier it is to improve upon that work. Papers that intentionally facilitate replication and have a clear statement of methods and claims are usually the ones that are later cited and have the greatest impact. Using a zero-knowledge proof still establishes improvement over prior work; it also indicates a confidence that no one else will independently develop the same improvement, and that no one but the authors will be able to improve upon the discovery in future work.

As a direct example of the value of open publishing, I want to highlight Google’s decision to release a well-documented kickmix simulator and thorough proof generation instructions. This is the sole reason I was able to find and demonstrate the vulnerabilities, and their patches simultaneously increase confidence in their zero-knowledge claims while preventing attackers from forging proofs of quantum breakthroughs that spread fear, uncertainty, and doubt.

Zero-knowledge systems are an incredible technology with many applications, but their use introduces a different set of risks than traditional approaches. They aren’t a magic wand that eliminates trust; instead, they redistribute trust from an original domain, such as the opinions of scientific experts, to trust in programming languages, compilers, proof systems, and cryptography experts. There are many frontiers that are considering the benefits of zero-knowledge, including electronic voting and age verification, but it’s also critical to consider the risks and make plans for what happens when this technology fails.

Acknowledgments

Thank you to Craig Gidney, Ryan Babbush, Tanuj Khattar, and Adam Zalcman from Google for their quick response and for putting up with my naive questions about quantum algorithms, and to Sophie Schmieg for putting us in touch. Finally, this would not have happened without Joe Doyle and the wider Trail of Bits cryptography team, whose suggestions and enthusiasm pushed this project over the finish line.

There’s a second bug in the HMR and R instructions, which are meant to reset a qubit to 0 while randomizing the phase. An error in conditional logic makes it possible to reset the qubit without trashing the phase, but register aliasing is a strictly better exploit primitive. ↩︎

On AI Images and Feature Images in General - Kev Quirk

2026-04-17T10:50:00.000Z

When is AI image slop ok?

By Gordon Mclean

Gordon stumbled across a post arguing that AI-generated featured images signals laziness, even if every word you write is your own, and it made him stop and think about his own blog.

Read post ➡

This post piqued my interest, and surprise suprise, I have opinions. 🙃

I've spoken about my opinions on AI and image generation before and my opinion hasn't changed on that. I have, however, switched from ChatGPT to Claude, for reasons.

Using AI for feature images?

Like I said in my previous post about AI, I don't think it creates art, but it can be useful for diagrams and some imagary. I listed some examples of my usage in that post, go take a look.

For feature images, I think it's fine, I suppose. I don't think it has a bearing on the writer's ability to write good content thought. I think most people can spot AI-generated prose these days. If my spider-sense starts tingling, I'll close the tab. But if I only see an AI-generated feature image, it's fine.

I think images creation and the ability to write nice words are two different skills. Using AI to create a feature image doesn't tell me that the person has a particular lack of creativity, as creativity comes in many forms. Ask Brandon Sanderson to create the cover art for one of his books, and I imagine he'd struggle. Does that make him any less creative? No. It just means he's a creative writer, not a creative artist.

For the record - I have no idea if Sanderson is good at drawing. It's just an example, okay. Please don't email saying "well ackchyually..."

Would I do it? Probably not. But I don't see the point in feature images anyway. I stopped using them many years ago, as generally they add nothing to the post, and are more for the writer to make the post look pretty than anything else.

So when I see these kinds of feature images, my first thought tends to be meh... and my assumption is that the writer probably didn't have the time, or lacked the skills, to create an image. I'd personally prefer they didn't add one at all if that's the case, but that's just me.

Maybe we should all be a little less judgmental. 🤷🏼‍♂️

Thanks for reading this post via RSS. RSS is ace, and so are you. ❤️

You can reply to this post by email, or leave a comment.

Notable links: April 17, 2026 - Werd I/O

2026-04-17T09:00:06.000Z

Most Fridays, I share a handful of pieces that caught my eye at the intersection of technology, media, and society.

Did I miss something important? Send me an email to let me know.

"Cognitive surrender" leads AI users to abandon logical thinking, research finds

I’m tired. Everyone’s tired. There are so many demands being made of us constantly that the output from an AI chatbot can seem like a godsend: rather than buckling down and doing yet more work, the machine can shortcut that for us.

Not so fast:

“Overall, across 1,372 participants and over 9,500 individual trials, the researchers found subjects were willing to accept faulty AI reasoning a whopping 73.2 percent of the time, while only overruling it 19.7 percent of the time. The researchers say this “demonstrate[s] that people readily incorporate AI-generated outputs into their decision-making processes, often with minimal friction or skepticism.” In general, “fluent, confident outputs [are treated] as epistemically authoritative, lowering the threshold for scrutiny and attenuating the meta-cognitive signals that would ordinarily route a response to deliberation,” they write.”

There are no shortcuts to doing great work, but if AI is used in this pressure-driven way, it becomes little more than a shortcut machine: a way to get to the end goal faster without really scrutinizing the thinking it took to get there. It’s no wonder that AI users didn’t examine the answers they were given; in a world where AI allows people to be saddled with more tasks, they might not have had the time to do anything else. Good enough; onto the next thing. Most people don’t want to cut corners, but under adverse circumstances, they will.

It may also be that they were rote learners who were less good at identifying the principles behind a solution. The people who bucked this trend were the ones who scored highly in “fluid reasoning” tests. I have to admit that this was new to me, but fluid learners are more able to find the underlying principles and links between topics and ideas in order to solve problems. The better people were at abstract thinking, the more likely they were to question outputs from the AI.

That makes some sense to me. AI can’t reason particularly well: it outputs convincing-sounding responses, but the underlying principles behind them aren’t necessarily fully-formed. If you’re used to just accepting something that looks right, perhaps because you’ve been taught to memorize rather than understand, it’s harder to discern when this kind of superficially intelligible, highly confident answer is right. If you scratch the surface and try to understand the underlying logic, that’s when it becomes clearer that the LLM doesn’t know what it’s talking about.

Managers that salivate about using AI to increase the workload / productivity of a team should consider this effect: the more you press people to use these systems, the more they might accept faulty reasoning from them. Hiring abstract thinkers — the people who are more likely to rise to be senior engineers etc — will help, but you need to give people the space, permission, and expectation to think for themselves.

The bottleneck shifts to distribution

This definitely gave me pause. In a world where writing code is something vastly more people can do, when even GitHub is struggling to keep up with the ballooning number of codebases out there, it’s going to be increasingly impossible to get recognition for your work.

“This is what it takes for your free and open source project to be recognized in 2026: you must secure the endorsement of legendary actress Milla Jovovich. You know, like a celebrity vodka.”

I kicked against this — who says Milla Jovovich wasn’t a first class contributor? The fundamentals of WiFi were created by Hedy Lamarr — but it’s true that the commits are mostly assigned to Sigman, the CEO of Bitcoin Libre. She is credited as architect, he as engineer, together with a contributor called Lu.

Regardless, it’s obvious that attaching her name to the project has drawn it more attention, and that this is a product that could result in a real financial outcome for both her and Sigman. I’m left feeling really glad that I released my first big open source software 22 years ago, when LLMs were an impossibility and big names didn’t attach themselves to open source. I was able to build a community with the funding equivalent of a can of Coke and a packet of crisps; if I’d been competing against Hollywood celebrities, I would have had no chance at all.

But I don’t quite agree with the thesis. Whether you’re famous or not, the way to get a following for your code is to solve a real problem better than anyone else. It’s true that distribution platforms can be kingmakers, but starting small by building real relationships with people you’re trying to help in ways that don’t scale is still a good way to get off the ground. That means building something genuinely differentiated rather than something that’s a few degrees off from what everyone else is doing. For small players with no networks and no names, that’s always been the best way to start, and I think it likely still is.

You Own Your Role, We Own The Outcome

This and its predecessor, One Consultative Decision Maker Per Lane, go beyond being sound management advice into almost being a manifesto for how management should work.

If people in your team stick to their lanes entirely, a lot can go wrong:

“The gaps between those lanes become the source of risk, and without a shared sense of ownership, those gaps go unaddressed until it is too late.

No one dropped the ball. But the ball fell between them.”

As Corey points out, roles and decision rights do matter a lot. If you don’t empower people to make real decisions in their respective lanes of responsibility and expertise, your team will grind to a halt (and, if you’re ultimately in charge, everyone will resent you). I’ve been in those teams and it’s always counterproductive; often that’s because there’s someone who wants to make all the decisions. By undercutting people’s decisions, they end up undermining the work of the team and making it impossible to make real progress.

But you also can’t encourage people to put blinkers on. Everyone needs to feel responsibility over the team’s end result — which also means they need to feel ownership over it. I’ve been there too: places where people want to be heads down and just look at a particular piece of code, for example. It doesn’t work on small teams. Maybe there are companies out there, really big ones with cubicles and campuses, where it makes sense. I’ve never worked in one.

There’s a productive tension here, obviously. You can’t go fully one way or the other. But if you treat a team as a community, and the team leader as the facilitator of that community, you can navigate these nuances more easily.

I wanted to share this piece because it ties together so many important ideas: a culture of open feedback, ensuring every voice is heard, framing the work as a learning problem, and leading with vulnerability. I like to create teams that embody these values, and work in places that share my belief that they are important.

So much of this is about trust in people. Trust in the expertise on your team to make sound decisions; trust that the collective can produce great work; trust that when you raise an issue or give feedback in good faith it will be received constructively. I think you have to start with trust as the default — and then vote with your feet if you find it isn’t there.

Google Broke Its Promise to Me. Now ICE Has My Data.

There’s an important distinction at the heart of this case.

The synopsis, from the EFF:

“In September 2024, Amandla Thomas-Johnson was a Ph.D. candidate studying in the U.S. on a student visa when he briefly attended a pro-Palestinian protest. In April 2025, Immigration and Customs Enforcement (ICE) sent Google an administrative subpoena requesting his data. The next month, Google gave Thomas-Johnson's information to ICE without giving him the chance to challenge the subpoena, breaking a nearly decade-long promise to notify users before handing their data to law enforcement.”

Subpoenas are legal orders compelling someone to either testify or produce evidence. They come in three broad flavors: civil, criminal, and administrative. Civil subpoenas arise from disputes between private parties (or between a party and the government in a non-criminal matter), typically over money, contracts, property, or rights. Criminal subpoenas are issued in the context of a criminal investigation or prosecution, where the government is pursuing charges against someone for violating criminal law. Administrative subpoenas are a legal grey area that sit in the middle. They’re issued by federal agencies (in this case, ICE, under the Department of Homeland Security) without prior approval from a judge or grand jury.

Statutory non-disclosure orders and national security letters are common in criminal and national security contexts; they’re rare-to-nonexistent in civil ones. If one exists, the subject can’t disclose that a subpoena was given or that they provided the information. Otherwise, they are free to notify.

The information here has often been given fewer Fourth Amendment protections under the third party doctrine. IP addresses, physical address, other identifiers, and session times and durations are metadata. US cell phone providers, too, will hand out this information with relatively little friction.

When your data is stored with a cloud provider like Google, prosecutors are most likely to ask Google for it, rather than you. If they’re issued a subpoena without a gag order, they’re supposed to notify you about it. If they’re issued one with, they can’t tell you about it in order to stay within the bounds of the law. Even without one, some companies may be tempted to comply in advance in order to stay on the government’s good side.

As is laid out in the linked piece, another student, Momodou Taal, was notified by both Google and Meta that his data was requested. Here, the system worked: because he was notified, he was able to fight off the order, and his data remained private. Amandla Thomas-Johnson didn’t receive the same courtesy.

Google is meant to notify users, if they can. If they didn’t, that’s a real problem. And it seems like that’s the case: that’s why EFF is going after them. The precedent here will matter a great deal for everybody’s privacy: commitments to notify should be enforceable. Hopefully regulators will hold that they are.

FBI Extracts Suspect’s Deleted Signal Messages Saved in iPhone Notification Database

This understandably made a few journalists nervous when 404 Media originally reported it last week:

“The FBI was able to forensically extract copies of incoming Signal messages from a defendant’s iPhone, even after the app was deleted, because copies of the content were saved in the device’s push notification database.”

This reveals a shortcoming in how Apple stores notifications rather than in Signal itself.

What happens is that if the text of a Signal message shows up on a lock screen, it’s stored in iOS itself, in a place where forensic investigators can gain access to it. That’s a really good reason to turn off lock-screen notifications for Signal, and to remove the text of Signal messages from its notifications entirely.

Here’s how to mitigate:

In the Signal app itself, go into settings, and then Notification Content. Depending on your level of comfort, select “Name Only” (which will still store the name of your Signal contact in your iPhone device memory) or “No Name or Content”.

Then, in your iPhone settings panel, find the Notifications pane, and scroll down to Signal. De-select “lock screen”.

Stop Flock

This is nice to see: a grassroots protest movement against the proliferation of Flock cameras.

From the site:

“Flock Safety markets AI surveillance that goes far beyond reading license plates; color, bumper stickers, dents, and other features are used to build databases and identify movement patterns. These systems are spreading rapidly, often without oversight, and are accessible to police without a warrant. They raise serious privacy and legal concerns, and contribute to a nationwide trend toward mass surveillance.”

There’s little evidence that they do anything meaningful to prevent crime. But they do certainly create a surveillance layer, and help establish a culture of surveillance across law enforcement. 404 Media reported last year that ICE has been tapping into these cameras, although they weren’t established for that purpose; local police have been proxy users for immigration enforcement.

Not only does the platform read license plates and track individual cars, but it tracks associations between vehicles — cars that are often seen together, for example. Which, of course, reveals associations between people.

I would echo what Brandon Mitchell said on Hacker News:

“I don't want to stop Flock the company. I want to stop Flock the business model, along with all the other mass surveillance, and the data brokers. If the business models can't be made illegal, it should at least come with liabilities so high that no sane business would want to hold data that is essentially toxic waste.

Without that, we are quickly spiraling into the dystopia where privacy is gone, and when the wrong person gets access to the data, entire populations are threatened.”

The Take Action section of the website is pretty good, with some common-sense tasks that include calling your representatives and supporting civil rights organizations like the ACLU and the EFF.

Earlier this year, TechCrunch reported that some people are going a step further, ripping cameras off street lights themselves. In Oregon, protesters left a note that read, “Hahaha get wrecked ya surveilling f*cks”. I couldn’t possibly endorse.

I May Have Killed My Framework 13 - Kev Quirk

2026-04-16T19:43:00.000Z

I was in the office today, working away, and I often have my personal laptop, a Framework 13 next to me so I do things like check notes and emails, listen to music, etc.

I reached over to grab something on the other side of my desk and managed to knock an entire fucking cup of coffee all over my beloved laptop. It immediately died, I assume because of some kind of safety net built into the device.

I cleaned my desk up, and headed straight home to strip it down, clean it up, and dry it out. My first pass at cleaning removed a load of coffee with a combination of contact cleaner (which is a solvent suitable for electronics) and my little air compressor to blow it all out.

I switched the laptop back on - it made a horrible noise, the screen flickered and it shut off.

FUCK!

Going further

Next thing was to remove the mainboard to get deeper into the guts of the laptop. Shock horror, there was more coffee behind there too! So I repeated the cleaning process again, only this time a lot more thoroughly.

Here's what it looks like now:

I then found a few little spots of corrosion on the board. I'm really worried it was a result of the spillage on live components, and have therefore ruined the mainboard.

So I took to DuckDuckGo to see what the best remedy is, and apparently it's isopropyl alcohol (IPA for short). I've ordered some for delivery tomorrow, and will continue cleaning it up to see if I can get this thing to live again. If not, I may have to buy a new mainboard (around £600).

In the meantime I'm back on my M1 MacBook Air and I'm hating it. The operating system feels almost user hostile. I know it isn't, because I used to love it, but now I'm so used to using Linux again, this feels horrible.

Hopefully I'll be able to get back to my Framework in the next couple days. Wish me luck!

Thanks for reading this post via RSS. RSS is ace, and so are you. ❤️

You can reply to this post by email, or leave a comment.

More confessions from a FOSS enthusiast - Joel's Log Files

2026-04-16T18:30:00.000Z

Well, it’s been about a year since my last round of confessions as a FOSS enthusiast and I do have a few more things that I thought I’d share!

This was in part tangentially inspired by a post by Adrian Perales on controversies around FOSS programs (in Spanish).

Well, controversial decisions happen on an individual level as well so, whatever, I’ll just share some more of those. Make sure to check the first one though, most of them are still valid…

📱 My phone is even less de-googled

Last time I still had a phone with a custom-ROM on it, and I rarely used the Google services on it, which were just a minimal set of GAPPS for my banking apps and similar. I didn’t have the Play Store or anything, and even then it felt wrong.

Well, now that I am using the stock ROM that came with my Nothing (3a), I just have the usual Google experience. I even logged in to my main account to access my paid apps, and I’ve purchased more apps since then! Back in the day I bought Play Store gift cards to get credit without giving them my credit banking info, but now that has changed too.

What have I become?

But hey, I have Balatro on my phone!

🔍 Sill using Google Search

For a while now DuckDuckGo has been my go-to for web search, and it has served me quite well. However, more than once, I end up appending the !Bang syntax for Google: !g, to get those results instead.

And of course, I’d often stick to the quick summarized answer instead of looking for an article or diving deeper. I simply don’t care that much, and for the stuff I need, the results are serviceable.

Besides, nowadays a lot of the big search engines have turned to a life of crime, not just Google. DuckDuckGo has AI-assisted quick answers too. Brave Search has the same plus all the crypto stuff of the brower itself. Kagi Search is paid and also has some AI stuff on it.

I will still find what I need from a regular search sometimes, clicking on a result that leads me to a website and in the proper way, but that rarely happens nowadays, and a lot of top results are slop anyway. Not sure what to do here to be honest.

Perhaps it’s better to stick to independent search engines like Marginalia or Clew.se when possible.

🤖 FOSS with AI on it…

As much as I hate it, there are a lot of FOSS programs openly embracing code not generated by humans. I appreciate those that are honest about it, even if it annoys me.

The truth is that a lot of these programs are just pretty good at what they do, so I still use KeepassXC, I still use Calibre, and I still use Firefox…

And there are also programs that don’t say anything, or that don’t even think twice about it. It’s weird to see how some have just accepted it, sometimes I wonder if the opinion of the fediverse affects me too much.

LLMs are being used in so much stuff now, I am kind of scared to look at the GitHub repositories, I don’t want to end up dissapointed by it, I don’t want to have to switch from even more.

Like, CrossPoint Reader—the beloved community firmware for the XTEINK X4—or Smolfedi—a lovely PHP-based fediverse client, both of those are new and young projects, both have a degree of vibecode on them.

How many new exciting ideas will develop that will be stained by AI in upcoming years? Too many…

💾 Self-hosting? Backups? What is that?

My Raspberry Pi is literally collecting dust, unplugged in exactly the same place where it has been for 3 or 4 years. I am absolutely serious, no exaggeration. I haven’t even bothered to store it somewhere safe, or to check if it still works. I see it on the bottom level of a corner shelf at the dining room next to the Wi-Fi router, every single day.

I’m not doing anything with any sort of private hosting either. This website is using Vercel’s free tier, I pay my email with a custom domain via Zoho, I use a publicly available FreshRSS instance. Jellyfin and Navidrome and whatever else simply vanished from my needs.

Now, it’s not all lost, I prefer to keep stuff local, but if I’m going to do that I should at least keep everything safe right?

Nope, no backups whatsoever.

There are some duplicate files on my phone and my laptop with Syncthing, there is a 2TB hard drive I got which contains some movies and some other things, sure.

But if I’m honest, if in this very second my laptop died, I would lose all of my data there, if the micro SD card of my Anbernic RG35XX SP died, I would lose all of my saves and games in it. Same for whatever is on my PSP. I am sorry y’all, but I’ve gotten lazy.

Finishing thoughts

It’s important to remember that practically speaking, none of these are actually that serious. I am not truly that ashamed or guilty by doing any of this. Sure I feel kinda bad, sure it is annoying sometimes, and there will be some people who become very judgy and point fingers at me for not sticking to an arbitrary measure.

Don’t get me wrong, there’s an ideal I seek to pursue as well, there are things I can do to align better with my goals, and perhaps I’ll take some time to do it. I will look for AI-free alternatives, I may end up hosting my own custom search engine, or at least disabling all the summaries and slop from whatever search engine I use. Maybe I’ll finally get a custom ROM for my phone and actually stick to a degoogled life again. Perhaps I’ll setup a NAS and host my own stuff once more. I still have an old laptop that I could turn into a server, after all.

I’ve done it before, I used to have backups, I’ve lived free of AI slop for many years, I’ve lived with subpar search results for ages. We’ll see what happens.

But I don’t really let things like this stay too much in my head. I have a lot of other things to focus on, maybe some are not as important, I still support and love FOSS. I still support and love software that is human-made, I still care about security practices and ownership of my data, but well, it’s all work in progress.

Reply to this post via email | Reply on Fediverse

Google Broke Its Promise to Me. Now ICE Has My Data. - Werd I/O

2026-04-16T14:25:31.000Z

[Amandla Thomas-Johnson for the EFF]

There’s an important distinction at the heart of this case.

The synopsis, from the EFF:

“In September 2024, Amandla Thomas-Johnson was a Ph.D. candidate studying in the U.S. on a student visa when he briefly attended a pro-Palestinian protest. In April 2025, Immigration and Customs Enforcement (ICE) sent Google an administrative subpoena requesting his data. The next month, Google gave Thomas-Johnson's information to ICE without giving him the chance to challenge the subpoena, breaking a nearly decade-long promise to notify users before handing their data to law enforcement.”

[Link]

You Own Your Role, We Own The Outcome - Werd I/O

2026-04-16T13:55:04.000Z

[Corey Ford at Point C]

This and its predecessor, One Consultative Decision Maker Per Lane, go beyond being sound management advice into almost being a manifesto for how management should work.

If people in your team stick to their lanes entirely, a lot can go wrong:

“The gaps between those lanes become the source of risk, and without a shared sense of ownership, those gaps go unaddressed until it is too late.

No one dropped the ball. But the ball fell between them.”

[Link]

RSS Club for WordPress - Terence Eden’s Blog

2026-04-16T11:34:10.000Z

What if I told you there was a secret social network, hidden in plain sight? If you're reading this message, you're now a member of RSS Club!

RSS Club is a series of posts which are only visible to RSS / Atom subscribers. Like you 😃

If you want this for your own WordPress site, here's what you'll need:

A blog post which is only visible in RSS / Atom.
Which has no HTML rendering on your site.
And cannot be found in your site's search.
Nor via search engines.
Also, doesn't appear on your mailing list.
Does not get shared or syndicated to the Fediverse.

(This is a bit more strict than the original rules which allow for web rendering and being found via a search engine.)

Start With A Category

The easiest way to do this in WordPress is via a category - not a tag.

After creating a category on your blog, click the edit link. You will see in the URl bar a tag_id.

Whenever you want to make an RSS-exclusive post, you select the category before you publish.

Disable Display

This code stops any page in the RSS Club category from being displayed on the web.

function rss_club_post_blocker(): void {
    if (    is_singular( "post" )
        &&  has_category( "rss-club" )
        && !current_user_can( "edit_posts" ) )
    {
        status_header( 403 );
        echo "You must be a member of RSS Club to view this content.";
        exit;
    }
}
add_action( "template_redirect", "rss_club_post_blocker" );

Editors can still see it, but everyone else gets a blocked message.

Remove From Site Search and SiteMap

Here's a snippet to stick in your functions.php - it removes the category from any queries unless it is for the admin pages or the RSS feeds.

//  Remove the RSS Club category from search results.
//  $query is passed by reference
function rss_club_search_filter( \WP_Query $query ): void {
    //  Ignore admin screens.
    if ( !is_admin() && !is_feed() ) {
        //  Find the RSS-Club category ID.
        $category = get_category_by_slug( "rss-club" );

        //  Remove it from the search results.
        if ( $category ) {
            $query->set( "category__not_in", [$category->term_id] );
        }       
    }
}
add_action( "pre_get_posts", "rss_club_search_filter" );

This code also redacts that category from the build-in sitemap. Note - the name of the category still shows up in the XML, but it leads to a 404.

My mailing list and social media posts are fed from RSS. So how do remove an entire category from an RSS feed?

Simple! Append ?cat=-1234 to the end!

A negative category ID will remove the category from being displayed. So my email subscribers won't see the RSS only content. Of course, they get email-only exclusive posts, so don't feel too bad for them 😊

Fediverse Exclusion

The manual way is easiest. Assuming you have the ActivityPub plugin and a the Share On Mastodon plugin, you can unselect the sharing options before publishing.

If you think you might forget to toggle those boxen, there is a filter for the share plugin:

function rss_club_mastodon_filter( bool $is_enabled, int $post_id ): bool {
    global $exclude;
    if ( has_category( $exclude, $post_id ) ) {
        return false;
    }
    return $is_enabled;
}
add_filter( "share_on_mastodon_enabled", "rss_club_mastodon_filter", 10, 2 );

Similarly, there's a filter for the ActivityPub plugin:


function rss_club_activitypub_filter( bool $disabled, \WP_Post $post ): bool 
{
    global $exclude;
    if ( has_category( $exclude, $post ) ) {
        return true;
    }

    return $disabled;
}
add_filter( "activitypub_is_post_disabled", "rss_club_activitypub_filter", 10, 2 );

Enjoy!

If you've set up your own RSS Club feed, drop me a line so I can subscribe 😊