Shellsharks Blogroll - BlogFlock

2026-10-29 14:56: Been having some fun with my 404 page. I love discovering little Easter eggs like... - Kev Quirk

2026-10-29T14:56:00.000Z

Been having some fun with my 404 page. I love discovering little Easter eggs like this on other people's sites. Just visit a random page, like https://kevquirk.com/mjkk

Thanks for reading this post via RSS. RSS is ace, and so are you. ❤️

You can reply to this post by email, or leave a comment.

Caching, bot defense and a CDN - Posts feed

2026-10-28T23:59:40.000Z

I've been wary of and interested in putting a CDN in front of my site. I had tools in place to block bots (and several countries), but they were fragmented and it was an ongoing rock fight. I had a Go job that banned IPs after too many 404s, a crawler denylist that mirrored my robots.txt, and an SQL-injection probe filter (regex). I also wanted the improved load times and other niceties that come with a CDN. The catch (and cause for my concern) is that I wanted my existing Redis caching, live routes (like the now playing block on the home and music pages), and other bot-related mitigations to keep working.

Setup

I've been using bunny.net to serve images here (and on my Mastodon instance) for ages, so it was a natural shift to put their CDN in front of the site itself. I pointed the domain you're reading this on to a new pull zone, while leaving the apex and my admin pointing at the origin server. The "public" origin is accessible only via requests from the edge through bunny. Each request has a header set with a shared key, and Caddy rejects any requests to www without it. Anything live is excluded from edge caching: now playing, my contact form, and a few other APIs.

Caching

I opted to have Go set cache lifetime per page with Cache-Control headers. There's a short default and longer ranges for pages that rarely change. I skipped bunny's Smart Cache (sometimes predictability is better than heuristics).

Cache invalidation is handled using tags (much like I do with Redis): every response has a CDN-Tag; saving things in my admin is debounced for a few seconds and then purges the appropriate tag. The cache is also purged at startup.

Redis caches database queries, bunny caches rendered HTML at the edge, and the page re-renders on every request that hits the origin.

Database migrations run when the new server starts. They write to the database directly, don't invalidate tags (or go to jail or collect $100), and benefit from the startup check that dumps the public content cache.

Blocking things

The important part! (Sort of.) I ran bunny's WAF in learning mode and tuned rules. If you block things outright, you block things you shouldn't (e.g. don't block contact form submissions in English). I maintain the list of crawlers I block in my CMS: each agent is a string tied to a path, and my robots.txt is generated, in part, from that relationship. These are now also synced into the CDN's rule set to block the same crawlers at the edge. bunny also provides their own block lists, and one of those lists blocked folks on Tor and VPNs (oops—that's set to challenge now).

Analytics

My analytics are hand-rolled and minimal. I have country data displayed in a graph, and that was previously populated using a GeoIP lookup. bunny, conveniently, supplies a country header, and the analytics now use that. I tweaked the implementation to record visits on page load rather than exit (exit events don't fire as reliably). Crawlers get excluded altogether (yay blocking!).

Reliability

bunny has a feature called Origin Shield that sets up an additional caching layer in front of my origin. Cache misses get consolidated into one point, and my origin server ends up seeing fewer requests. The added benefit (in addition to the performance) is that some of bunny's edge locations couldn't hit my origin (which is IPv4-only). Putting the shield behind an edge node that can reach the origin fixes that. The network topology is hostile and unknown and weird and unpredictable and magical.

Breaking things

Feed readers rely on If-None-Match to avoid redownloading unchanged feeds. I've left mine uncached so my (minimal) feed analytics can count polls. bunny drops conditional-request headers headed for the origin even for pass-throughs it doesn't cache, which means every poll is a 200. If I can't see the 304, I can't handle it properly, and, for that, I am appropriately apologetic.

Request coalescing: this will break live routes. It's super handy for near-simultaneous requests for the same relatively static thing where a single copy can be returned in a performant fashion. This is antithetical to the notion of things that return unique and/or live responses. I put in an explicit skip list for those routes.

When I deploy, visitors will briefly see 502s. A new copy of the Go binaries gets copied to the origin server, the app restarts, and Caddy hasn't reloaded its config yet (said config gets copied over as part of the deploy). There's now a short retry for Caddy to help mitigate this.

For my now playing display: a page cached on the edge could flicker when it rendered older album art next to a live stream. Stale vs. live data: bad experience. The new cover is decoded off-screen and swapped into the view.

Done, mostly

Hand-maintained IP banning is gone, crawler lists are out of Caddy, GeoIP is gone, and most of that now lives at the edge. Oh, and I added an analytics chart of blocked bots. They've been fucking off more over time, which is nice. Things should be faster, too!

Moving DMV.community home - Cool As Heck

2026-10-28T21:32:01.000Z

I moved my Mastodon server into my house

DMV.community has lived on a Vultr VPS for a while now. This week I moved it onto the server that sits in my house and already runs a few other things I self-host. It's a Ryzen 7 3800X with 32 GB of RAM and a fast NVMe drive, which is a lot more machine than the VPS ever was, and I'm already paying for the electricity.

It went pretty well. It also went sideways in a few fun ways I didn't see coming.

The move itself

The actual cutover was the boring part, which is what you want. Stop Mastodon on the VPS, pg_dump the database, restore it at home, start everything up, flip DNS. The plan budgeted 20 to 35 minutes of downtime for all of it.

A few choices made that easy:

Nothing is exposed from my house. Traffic comes in through a Cloudflare Tunnel, so there are no open ports on my router and nobody can see my home IP from the outside.
Media stays in the cloud. Images and videos already lived in an S3 bucket behind a CDN, so none of that moved. My home upload speed never has to serve somebody's cat video to every server that follows us.
Everything runs in rootless Podman containers, each one managed as a systemd user service. Postgres, Redis, Elasticsearch, the web server, the streaming server, and a handful of Sidekiq workers.

The search index had to be rebuilt from scratch on the new Elasticsearch, which took about an hour in the background. Search was a little dumb for that hour, and that was about it.

The security thing that surprised me

This was the part that took the most work before the move, and I'm glad I didn't skip it.

A Mastodon server spends all day fetching URLs that strangers hand it: posts from other servers, link previews, profile pictures, videos it has to process with ffmpeg. On a VPS, the worst case of something going wrong is that one VPS. In my house, the same server sits next to my smart home devices, and every device on my network.

And by default, a rootless Podman container can reach services on the host's localhost and the rest of the home LAN. That's a very bad default for software whose whole job is fetching arbitrary URLs.

So the stack got locked down pretty hard:

The database, Redis, Elasticsearch and the streaming server sit on an internal-only network with no route to the internet, the LAN, or the host. They can only talk to each other.
The web server and workers get a second network for internet access, plus a firewall inside Podman's network namespace that drops anything aimed at private address ranges, the host, or the LAN.
Every container drops its Linux capabilities, runs with no-new-privileges, and has memory/CPU/process limits, so a runaway media job gets killed by its own container instead of eating the machine.
New passwords for everything, Redis locked down. The old box had a couple of shortcuts I'm not proud of. They didn't make the trip.

Then it was slow

Day one, posting felt sluggish. Everything worked, but there was that little pause after you hit "Post" that makes you wonder if it went through.

The culprit was the disk, sort of. My home server uses btrfs, and the database was sharing that drive with everything else on the machine. Postgres is very particular about writing things to disk safely, and btrfs's copy-on-write behavior plus a bunch of neighbors all writing at once meant those safe writes would sometimes stall for seconds. A stalled write meant a stalled post.

The proper fix is giving the database its own drive with a plain old filesystem, so I ordered an SSD just for Postgres. Until it shows up, there's a temporary bandaid. I told Postgres it doesn't have to wait for every single commit to hit the disk before saying "done." The tradeoff is that a power cut could lose the last second or so of activity, which I can live with for a couple of weeks. I have the server plugged into a UPS

I also shut down my GoToSocial instance for now. It turned out to be the single biggest writer on that drive, more than Mastodon itself, so it's on ice until the new SSD is in.

The tune-up

Once it was running, I had my Hermes agent dig through the whole stack to see what else could be tuned for this hardware.

Some highlights:

The nightly cleanup job was killing the website. Mastodon needs regular cleanup of cached remote media, and that job was running inside the web server's container, sharing its memory limit. A long cleanup would use up the memory and the kernel would kill web server processes to make room. It now gets its own throwaway container with its own memory budget. Fun fact: the first cleanup run deleted 195,000 cached remote media files, around 346 GB worth, out of object storage. That's going to make a nice dent in the storage bill.

Every log line was being written twice. Podman was logging each container's output to the system journal, and systemd was also logging it, so every line showed up twice. Combined with the background workers logging every single job they ran, that was hundreds of thousands of lines an hour. The journal hit its 4 GB cap and was rotating out old logs early. Now each line gets written once, and the workers only log warnings and errors.

One database query was doing way too much work. The most expensive query on the whole server checked whether any account from a given server had a particular setting turned on. For big servers with no matches, Postgres had to look at every single account from that domain to answer "nope." One bridge server alone has over 150,000 accounts in my database. A small 7.6 MB index took that query from 352 ms down to about 8 ms.

Redis was allowed to throw away jobs. Redis holds both Mastodon's cache and its background job queue. It was set to evict any key when it got full, which in theory includes jobs. I switched it to only evict keys with an expiration time, which is all the cache stuff and none of the job stuff.

Push notifications broke for some people. About 30 users get notifications through ntfy.sh, and after the move ntfy.sh just... stopped answering my home IP. Everything else worked fine. My best guess is that a burst of backed-up notifications from a brand-new IP set off an abuse filter. The fix was a little relay: notifications headed for ntfy.sh now hop through another server I run in a datacenter. It's just passing encrypted traffic along, so it never sees the contents. Notifications started flowing again within minutes.

A few smaller things got fixed too: Postgres settings that assumed more RAM and CPU than its container actually gets, and a monthly cleanup job with a SQL bug that would have quietly done nothing.

What's left

The SSD. When it arrives, the database moves to its own drive and the temporary bandaid comes off.
A big cleanup. About half of the 24 GB database is leftover link-preview data for posts that no longer exist. Mastodon's own cleanup deletes old posts in bulk and leaves the link-preview rows behind. Clearing that out before the SSD move means the database lands on the new drive half the size.
GoToSocial comes back once the database has its own drive.

Was it worth it?

So far, yeah. The server has way more headroom than it did on the VPS, and I understand how the whole thing works even better than I did a week ago. Nothing like a server migration as a learning opportunity. Also, monthly hosting costs will drop significantly. The only thing left to pay for in the cloud is S3 and the media proxy. The trade is that it's in my house now. If the power goes out for a long time, DMV.community goes out with it. The status page lives on a VPS though, so it will always be accurate.

If you're thinking about bringing a Fediverse server home with you, my two cents: put the database on its own disk from day one, and assume your container runtime's network defaults are friendlier than you want them to be.

ChatGPT knows everything about its users. It will not be a good steward of that power. - Werd I/O

2026-10-28T18:23:24.000Z

Link: ChatGPT Is Building Detailed Psychological Profiles of Its Users, by Maggie Harrison Dupré in Futurism

It probably shouldn’t be a surprise that chatbots like ChatGPT are profiling their users. Still, there are some surprising numbers here:

“A staggering 96 percent of memories were created unilaterally by the chatbot, according to the study, meaning that the users had little overt control over the data points that ChatGPT logged as their interactions wore on. Stored memories were also deeply revealing about users. About 28 percent of the memories examined contained personal data as defined by Europe’s strict General Data Protection Regulation standards, and 52 percent contained rich “psychological insights” about users.”

I think back to Gina Chua and Adiel Kaplan’s three-layer cake analogy for the AI stack. In their analysis, the consumption layer profiles the user; this new report makes clear how deep that profiling goes.

As I said in my commentary then:

“Profile data is accumulated, private, and usually non-portable. The consumption layer also represents the greatest risk to creators from platform business decisions, both in terms of the business models of those platforms and which creators they choose to feature. Open portability standards and protocols — combined with full user control of their data — can scale, create useful competition, and empower users in the process.”

Nothing here dissuades me from that view. To be as useful as possible, AI tools need to dig into our most personal information, make inferences about who we are and what’s interesting to us, and maintain highly personal profiles. Our AI agents are not some kind of trusted friend: they are products owned by a third party that needs to justify a trillion dollar valuation and may not have our best interests at heart. All the major vendors provide services used by the military and law enforcement. What happens if one of those agencies wants to get hold of that profile information? These companies simply cannot be trusted with our most private information, and should not have access to it.

But, of course, legislators have also been negotiated into a position of alignment with AI accelerationism. We need to gather all of this personal information about individuals in a supposed democracy, they argue, because otherwise China will win! These concerns seem to trump the fact that privacy is considered a fundamental human right, for very solid and defensible reasons: it makes dissent, organizing, a free press, and a well-lived life possible.

I am not arguing that there are not legitimate uses for AI or that the technology is not transformative. But there should not be an argument that we should let go of our core human values or the fundamental protections needed to maintain a robust democracy — of which privacy is one — because this tech is cool and we need it to grow really fast and by the way it’s also now propping up our economy. Trading privacy for growth is not a smart long-term strategy: it will bite us.

As individuals, we can protect ourselves by using different tools. But privacy is a group inoculation. If the chatbot is profiling its users, I suspect it’s also profiling the people its users are talking about. We need to demand better behavior from our vendors while taking steps to also demand it from our friends.

Gadget Review: SoundPEATS CC3 Pro Bluetooth Headphones ★★★★⯪ - Terence Eden’s Blog

2026-10-28T12:34:54.000Z

These are easily the most comfortable headphones I've worn. I've literally had them clipped around my ears all day without noticing them.

The good folks at SoundPEATS have sent me their latest cans to wrap around my lugs. I'm a big fan of these new-style "clip on" headphones. Rather than encasing your ears, or sticking way down into the wax-mines, these clip over your ear. It isn't a tight grip like a paperclip - more like the gentle caress of a tender but firm lover who wants only to delicately pinch your ears.

Look - it's hard writing about this stuff, OK?! Grab a pair and try them; you'll see what I mean. Here's a picture of an attractive model to give you an idea.

Specs

All the usual things you'd expect from headphones. AAC and SBC audio codecs are standard, it'll also do LDAC - which will get you higher quality but at the expense of battery life and the ability to connect to multiple devices at once.

The case recharges via USB-C, the battery seems fairly chunky and will quick-charges the headphones. 10 minutes in the case will give them 3 hours of playback.

Each clip has a button - you can change what they do in the supplied app.

IPX6 should be good for wearing in the rain, but you can't go swimming in them.

Useful Features

We all know what headphones can do - play audio, provide a microphone, and let you control the audio coming from your device. The CC3 Pro also have a few other smart features.

Like most decent battery-powered headphones, they will automatically switch off after a predetermined period without use.

There's a privacy mode which adds an EQ filter to reduce sound leakage. It works, but does make the sound slightly murkier.

There's a button on each one - you can use the app to set actions for tap, double-tap, triple-tap, and long press.

The case supports wireless charging, so you can chuck it on any charging puck for a quick top-up.

Comfort

Outstanding. After a few minutes you will genuinely forget that you're wearing them. Shake your head as hard as you like and they will not fall off. Here's a genuine photo of me doing some manly exercises while wearing them.

Sound Quality

Excellent - with a couple of caveats. These are open-ear devices. You can hear the world around you. That is by design and is extremely useful if you need to be aware of your surroundings. You can't block out the world or do active noise cancelling. I was not a fan of the default EQ. The bass wasn't bassy enough for me. It's easy enough to change in the app - but that does require a login.

Voice quality when speaking on the phone was also good. The people I spoke to could hear me clearly and with minimal background noise.

Android

Piece of cake. Open the case, press the button on the back, they're ready to pair.

Sound quality was great, my voice transmitted just fine, and I could easily play/pause and adjust the volume.

Linux

Again, dead easy. Ubuntu detected and paired with them instantly.

The App

I've complained to SoundPEATS before about their lousy app. The best thing I can say about it is that you don't have to use it. It's handy for downloading the occasional firmware update and fiddling with the setting. But that's about it.

It obnoxiously insists on needing an Internet connection to change some settings. Stuck on a train in the middle of nowhere and want to adjust your EQ? Tough. Similarly, some functionality is gated behind a login wall - such as the custom EQ and custom sound effects.

Thankfully, the rest of the app is fairly simple to use and will work offline. You can adjust what the buttons do, for example:

Weirdly, you can also download other people's EQ settings.

There's also a firmware update and a bunch of other things to flick on and off.

Downsides

Other than the app, there are a few niggles which are only slightly annoying.

Firstly, they don't pause when you take them out of your ear. That's a feature which was on the first set of SoundPeats I had and is sorely missed.

Secondly, the default sound profile wasn't very bass heavy. A bit of fiddling in the app and they sounded much better.

While they do charge in either slot within the case, they're incompatible with previous SoundPeats cases. The risk with smaller manufacturers like this is that you won't be able to find a cheap replacement case if you need it.

Price

Launch price is about £75 / €80. That's getting towards the upper end of what I think is acceptable for headphones like this.

Readers of this blog can use code PRCC3PRO for an extra 10% off at Amazon UK or other international Amazon stores. The code should work from today until 30th November 2026.

Ultimately, these are ridiculously comfortable headphones. They won't block out the noise of the environment around you - but that's their selling point. You use these while cycling, wandering through the city, or any other time you need to be aware of your surrounding. If you can put up with the slightly shonky app, these are well worth the price.

Many thanks to SoundPeats for the review pair.

Trade zines with me! - James' Coffee Blog

2026-10-28T00:00:00.000Z

Over the last few weeks I have been experimenting with making more zines. I have been having so much fun!

If you make zines and would like to trade, please send me an email! You can also see a few of my downloadable zines in the Zines category of my website.

send me an email Zines category of my website

Read "ChatGPT's Advice to Cut Her Seizure Drug Led to Devastating Consequences" - Molly White's activity feed

2026-10-27T21:40:51.000Z

Read:

“ChatGPT's Advice to Cut Her Seizure Drug Led to Devastating Consequences”.

Teddy Rosenbluth in The New York Times. Published October 27, 2026.

The chatbot helped a woman taper off a lifesaving drug and hide the plan from her doctors.

Note published on October 27, 2026 at 8:24 PM UTC - Molly White's activity feed

2026-10-27T20:24:12.000Z

This is happening to me, but with "tips" about a huge range of crypto-related issues (or perceived issues) people are personally struggling with. The volume is genuinely challenging to deal with.

It takes fairly little effort for a person to tell their AI bot to research and draft an email, but it takes the recipients real time to dig into these tips and separate hallucinations from tips that might actually have some basis. They're basically DDOSing journalists.

I've basically had to start ignoring tips that come in with clearly AI-written emails, even though I know I risk missing stuff. I just don't have the capacity.

The Gate of the Feral Gods - Kev Quirk

2026-10-27T19:43:00.000Z

The Gate of the Feral Gods

Author: Matt Dinniman
Genre: Sci-fi
Released: 2021
Rating: ★★★☆☆

New Achievement! Total, Utter Failure. You failed a quest less than five minutes after you received it. Now that’s talent.

Surviving in a multilevel dungeon that also happens to be the set of the galaxy’s most watched game show has taught Coast Guard vet Carl and his ex-girlfriend’s cat, Princess Donut, that there’s only one thing they can count on apart from each they never know what’s coming next. And this floor is no exception.

A floating fortress occupied by warrior gnomes. A castle made of sand. A derelict submarine guarded by malfunctioning machines. A haunted crypt surrounded by lethal traps.

It was supposed to be easy. One bubble. Four castles. Fifteen days. Capture each one, and the stairwell is unlocked. Here's the thing. It's never easy. Going it alone is not an option this time, so Carl and his team must rely on the help of the low-level, I-can't-believe-these-idiots-are-still-alive crawlers trapped in the bubble with them. But can they be trusted?

Welcome, Crawlers. Welcome to the fifth floor of the dungeon.

Learn more on Goodreads ➡

Dungeon Crawler Carl is a fun series of book, but like number 3 this one felt like a bit of a drag up until the last 1/5 of the book, where I think it got better. I particularly like how Carl is starting to really establish himself in the dungeon now and continues to put two fingers up to the powers that be.

I felt that the story arc was really slow to get going on this book, but once it did gain momentum, it was enjoyable.

I've been reading these books back to back; there's other books I want to read, so I think I'm going to take a break from reading these books and will switch to something else.

I won't stop consuming the series though - my backlog of podcasts has dwindled lately, and lots of people have recommended the Dungeon Crawler Carl audiobooks. So I've started listening to book #5 in the car and on walks, and will switch to reading something else.

Thanks for reading this post via RSS. RSS is ace, and so are you. ❤️

You can reply to this post by email, or leave a comment.

Flight log - Joel's Log Files

2026-10-27T16:00:00.000Z

I have turned on airplane mode on all my devices, the plane is now moving, preparing for flight.

Waiting in the airport I played a bunch of Castlevania Symphony of the Night—I managed to reach the second boss fight which is a very cool encounter!—-but I plan to read during the flight ahead. Perhaps I’ll finish Dune Messiah.

I’m going to watch the flight attendants demonstrating safety measures. The emergency exits, the use of seatbelts, and other procedures.

The lights shut off at 6:04, perfect for my Kobo to shine

Each seat row had three seats. I was in the middle. But the person that was on the window didn’t show up! So I got to have unfettered access to the sky view.

The airplane is lining up, readying itself for takeoff. Weird noises for a few seconds, but it seems like all is going well.

We are speeding up on the track, the engine can be felt. I can see the wing of the airplane on my right side. The lights at the end of the wing pointing up.

A bit faster, a slight bump on the road, nothing major, we keep going, still on the ground. I don’t know why I imagine the scene of Back to the Future, waiting for the 88 miles per hour. But no, we are not traveling in time—I’m going to fly once again.

The way feels smoother now, the lights on each side of the street are moving along. It’s weird, I imagined feeling the speed more, but it’s rather comfortable inside…

Oh, we were just going to beginning of the actual track, and I feel kinda dumb. I can see the lights now, the engines roar louder than ever.

I feel the pressure on my body, we are actually fast now, beyong 88 for sure. The lights blinking, left behind, one after another after many more.

All the other airplanes left behind, waiting their turn.

WE ARE UP IN THE SKY

THE LIGHTS OF THE CITY ARE BELOW

I FEEL LIKE EVERYTHING IS GOING UPSIDE DOWN

BUT THINGS ARE NEATLY CALMING DOWN

NO MORE FRICTION AGAINST THE GROUND

ONLY THE AIR REMAINS, THE SPACE ABOVE

WE ARE STILL GOING UP AND UP AND UP

AND THE PLANE IS TURNING

WE ARE GLIDING IN THE AIR

TOWARDS OUR DESTINATION

I AM IN AIRPLANE MODE

THE CLOUDS. THEY ARE BY MY SIDE

I CAN SEE THEM

I AM GOING THROUGH THE CLOUDS

The pilot said how many feet we would go up, something like thirty thousand or more

I didn’t pay attention

But the scale is beyond my comprehension

I can see the whole city below me!

I’m flying!

I’M ABOVE

THE CLOUDS

ABOVE THE CLOUDS

THEY LOOK LIKE MARSHMALLOWS

LIKE COTTON I WANNA EAT

THE WING LOOKS GREAT

I WISH IT WASN’T IN THE MIDDLE OF IT ALL

IT DOESNT MATTER IT’S STILL SUPER COOL

CLOUDS EVERYWHERE

I only managed to finish one chapter before the descent was announced on the speakers of the airplane

I felt it all of a sudden on my stomach and my ears, the begining of the end. The sun is to my right on the horizon, no more darkness outside.

This is day 60 of #100DaysToOffload

Reply to this post via email | Reply on Fediverse

Book Review: You Could Do Something Amazing with Your Life [You Are Raoul Moat] - Andrew Hankinson ★★★★☆ - Terence Eden’s Blog

2026-10-27T12:34:53.000Z

It is hard to write a book in the second person. It is even harder to make it this good. It would have been easier to write a salacious cash-in with a dozen shocking revelations in each chapter. Instead, Andrew Hankinson attempts to use Raoul Moat's own words to build up a picture of the man.

You have nine days and your whole life to prove you are more than a callous murderer.

Go.

It is written with sympathy, but without being sympathetic. A stream of consciousness interrupted only occasionally by the voice of god [it probably isn't god] to provide clarity to an unreliable narrator. The paranoia and delusion come streaming off the page, couched in a tone of voice that exudes reasonableness. It doesn't glorify the man, nor does it make excuses for him, instead it asks you to consider what you choices you could have made under similar circumstances.

Almost every sentence is set up as a challenge to the reader. Is this man telling the truth? If so, are his actions understandable or explainable? If not, where is the truth and how would you know? When someone has such a fundamental disconnect from reality, when their model of the world and human interactions is so broken, what can society do to help?

From Moat's point of view, he is the Biblical Job. A callous god tests and torments him. Beset by challenges he never loses faith even after the all the world can throw at him. The god [in parentheses] is also an unreliable narrator. The author has built upon all the official reports, the suicide notes, the rambling messages, and interviews with contemporaries. But, as is acknowledged, we can never truly know what goes on in someone's head; we can only judge their actions and their aftermath.

A constant drumbeat is the way Moat claims he was repeatedly victimised by the police. Given all his other delusions, the reader might easily conclude that this is yet another piece of self-pitying nonsense. And yet, when discussing how Moat actually died there does appear to be a conspiracy of silence. The police's behaviour and attitudes are exactly what you would expect from people perpetrating a cover-up.

Naturally, this is a depressing and often upsetting read. It reminds me of the autobiography Mini and Me about a child arsonist. In both that book and this, we witness people being offered help and refusing it. Much like the parable of the drowning man it seems people often overlook the helping hand.

Are you responsible for this? The start of the book describes Moat reaching out for psychiatric help. He is offered an appointment but never turns up. He's offered another one, but still doesn't attend. Whereupon the offer of help is withdrawn. Our society strongly favours individual responsibility. Autonomy is to be persevered for all but the most extreme cases. Should Moat have been forcibly removed from home and made to attend his appointments?

Do you want to live in a society where missing a few meetings with a social worker results in you being detained against your will? Are you happy to accept his attacks as a price worth paying for your freedom?

If a journalist took words you'd written in the heat of the moment, would it paint you in a terrible light? How confident are you that you know the truth of any situation? Are you lying to yourself right now?

This is an excellent and provocative book. I picked this up after seeing Rob Manuel post about it. I like the idea of an informal online book club! If someone wants to set one up, please do invite me.

Backporting security fixes to stable releases - Trail of Bits Blog

2026-10-27T11:00:00.000Z

The software you are running is almost certainly riddled with known, unfixed security bugs. These bugs can be trivially and quickly exploited by modern AI agents. This is not merely theoretical; I saw this during my sandbox escape research, and an old vulnerability in stable software was used as a part of the recently disclosed OpenAI hack:

From the official hack description

To say it simply: whatever you are running is almost certainly easily hackable by advanced AI. Luckily, there is a fix, and we (not just at Trail of Bits, but in the security industry more broadly) are working on it. But first, how did we get here?

Stability versus security

Software has bugs, and some are relevant to security. We try to fix them when we can, and the first place the fix happens is in the latest version of the software. Unfortunately, that’s often the only place where the fix happens. The process of getting a fix from the latest source code to older versions is called “backporting.”

Fixes for big-name, critical bugs are indeed often backported quickly. But for many other bugs, the backporting process never happens. It is easy to understand why: software packaging is often done by volunteers who are already overworked, and backporting is frustrating, thankless work that gets little credit or publicity. For open source projects staffed by teams of volunteers, backports are (understandably) a low priority.

The lack of backports is a problem because almost no one runs the latest and greatest version of software that’s been freshly built with today’s code changes. People overwhelmingly prefer slightly older, more tested software packaged in “long term stable” releases. For example, about 95% of Ubuntu Linux installations are of the Long Term Support (LTS) variety. When looking at installed Linux kernel packages from Debian’s popcon, the overwhelming majority are based on older stable trees:

This is a Codex-generated graph of recently installed kernel packages from Debian’s popcon. The overwhelming majority (about 96%) are older, stable releases, and not the latest kernel series.

This puts users in a bind: They can either stick with a stable, familiar version of software that has security flaws, or upgrade to a newer version that fixes those flaws but introduces other changes and new features they may not want.

We should not have to make this choice.

Seeing no evil

Even three years ago, we could stick our heads in the sand and pretend the problem didn’t exist: backporting all fixes was a genuinely difficult, time-consuming job and any attacks were extraordinarily unlikely.

Now, both of those assumptions are false. A swarm of cyber-capable AI agents can cut through a network of stable, known-vulnerable software like a hot knife through butter. On the positive side, AI has significantly lessened the burden for identifying and backporting security-relevant bugs.

Of course, we should assume all software has bugs (because it does), and use the lessons we learned in our computer security classes: mandatory access controls, code integrity checks, sandboxing, and privilege separation. This works. Mobile platforms are much safer because they enforce these standards. But desktop and server platforms don’t mandate this behavior, and few voluntarily enable protections. And yes, everyone should update to the latest software. But many people purposely do not update to releases. I think that this normal end-user behavior is entirely justified. Just recently, I updated my Mac to macOS 27 and couldn’t use a printer that had worked flawlessly for years (until Codex wrote a new, compatible printer driver, on the first try).

Regardless, it’s good practice to assume that something may have bugs and that they should be contained; leaving known, easily fixed bugs is negligent. So, let’s backport all the fixes!

Accounting for security liabilities

Let’s quantify the scale of the problem. To make counting simple, we can limit ourselves to known bugs (with assigned CVEs) that are patched in the latest release but missing from stable packages. For this example, we’ll look at the Linux kernel, Ubuntu 26.04 LTS and Debian 13 Stable. I’m not singling out those projects—they are all run very well! I’m using them because they have documentation and accounting for unfixed CVEs. Other projects lack this transparency. The first step towards a solution is knowing that there is a problem.

Let’s look at the number of outstanding CVEs in the Linux Kernel, by stable branch. The table below shows CVEs per supported stable branch that do not have a fix in that branch, but do have it in a newer branch. (Hence, older branches by definition have more unfixed CVEs.) The source is the kernel CVE team’s vulns.git as of September 18, 2026. This is not an exact bug count, as it both over- and under-counts due to several technicalities. It is also not a measure of exploitability. Rather, it’s a measuring stick showing that a substantial amount of known CVEs have not been fixed in stable kernel branches:

Branch	Unfixed CVEs	% CVEs with an NVD Score	High or Critical Severity
5.10.y	2,006	55.8%	213 (19.0%)
5.15.y	1,889	51.5%	195 (20.0%)
6.1.y	1,329	43.9%	99 (17.0%)
6.6.y	1,012	35.6%	65 (18.1%)
6.12.y	686	22.3%	21 (13.7%)
6.18.y	337	15.1%	3 (5.9%)

The package landscape is not any better. These are non-kernel CVEs reported as open or affected in Debian 13 and Ubuntu 26.04 (raw data via their respective bulk CVE data feeds, compiled by Codex). These are distro-metadata findings, not individually source-confirmed vulnerabilities. Again, this is not meant to be an exact bug count, but more of a measuring stick indicating how many unfixed vulnerabilities remain in stable software packages:

Distribution	Source Packages with Unfixed CVEs	Unique CVEs	High or Critical Severity
Debian 13	1,128	4,562	1,822 (39.9%)
Ubuntu 26.04	1,028	770	335 (43.5%)

Fixing the bugs

We realized this was an issue and have been fixing it proactively. First, we started with the equivalent of finding $20 on the sidewalk: there are bug fixes to known CVEs which apply cleanly to the stable kernel trees, but the fix was just never pulled into the kernel. We used Codex with GPT-5.6 to find these fixes, and asked the maintainers to apply the existing patches. They did, graciously, and 142 fixes representing 90 CVEs in stable trees are currently applied; the list on our backport tracker just keeps growing. We are now backporting patches, starting with the most trivial to validate and review, and are slowly moving towards more complex changes.

We’ve done the same for Linux distributions: we used Codex and GPT-5.6 to identify known vulnerabilities in shipping stable packages, and then backport and validate a fix. We have begun reaching out to Linux distributions with an initial batch of patches. If you run an open source project or a Linux distribution and would like help backporting security fixes, please apply at trailofbits.com/patch-the-planet and we’ll be glad to assist.

The big upside of stable software that does not add features is that we can, in theory, fix all the bugs before the bad guys do. So, let’s continue to patch the planet!

Wonders of Web Weaving, Behind the Scenes - James' Coffee Blog

2026-10-27T00:00:00.000Z

After twenty-five wonderful conversations, Wonders of Web Weaving is, at least for now, complete. To everyone who has been listening over the last few months: thank you! It has been the greatest pleasure to not have terrific conversations with thoughtful web weavers, and to bring those to you every week.

When I started the project, I had a goal in mind: I wanted a show that would be fun to listen to on a train ride. A few weeks ago, when listening to the edited version of the second-to-last episode on a train, I thought to myself I did it!

Behind the scenes

In terms of how the project came to be, I emailed a mixture of people who I knew and people I didn’t, aiming to invite guests that would, together, represent a wide range of subjects related to the web. It was, and still is, important to me that the project was not a “tech podcast.” The web is about more than technology.

Before each conversation, I spent time with the guest’s personal website, scanning pages, looking at blog posts, and deciding on an “anchor” that would be the theme of the episode around which my questions would be oriented. For instance, I spoke about accessibility with Nic, as Nic has experience with accessibility. I also asked a few standard questions. Over time, I realised all my questions fit an arc: history, present, and future.

Through the course of the show, I had discussions on everything from writing on the web to the “web revival” to mathematics to accessibility (ep. 16 and 20) to magazines to books and more. And, in so doing, I was conscious to ensure that the podcast was not all men talking about technology. There were and are more voices to be heard who have stories I wanted to hear. To that end, I hope I played a tiny part in introducing you to some voices you may not have encountered on the web before.

In terms of the actual discussions, in every conversation, I started with five or so minutes of chatting with the guest and introducing them to the recording process, then we recorded for ~40-50 minutes – sometimes for less time, sometimes for more – and, in the remaining time, did wrap up and I communicated the logistics of transcriptions and releases. While I invited guests with the email subject “Podcast interview?”, I was conscious to communicate upfront and early on that I liked the episodes to be “conversations” or “discussions”, not interviews. After all, this project is all about celebrating the web.

At the end of every episode, I asked two questions, one on the theme of the future, and the other a “fun question.” As a result of the question about the future – which was some variant on “where do you hope the indie web will be in five years?” – we have a collection of potential futures. Indeed, especially now, I think it is important to imagine what we want the web to be. At this point I will invite you to be a part of the show and ask you: where do you hope the indie web will be in five years?

The fun questions went through phases, but eventually coalesced on a roughly-standard question where I asked the guest to share a fun fact about where they are in the world. I thought this was a nice way to end the show: with a smile, with something interesting.

Concluding the show

At the beginning of the show, I promised myself I would do 10 episodes. Because I was so excited about the project, the number of episodes planned became 15, and then 20, and then at least 25. With that said, I always wanted the show to be limited in its number of episodes because I know that it is challenging to keep something going on for a long time. Having an end number of episodes made it easier to commit to the project.

This autumn, I had began a new run of recording, but it was starting to get a bit much in addition to the other priorities I had. There were other episodes lined up, but I thought it best to pause on a high note than try to rush.

There may be another season one day, but, at least for now, the project is complete.

Thank you

To all the people who agreed to spend an hour chatting with me about the web, thank you so much for sharing your thoughts. I want to extend a special thanks to Zachary from Lunaseeker Press for transcribing the episodes. I decided I wanted a transcript for every episode from day one, so that people who prefer to read, or for people who cannot listen to a podcast, had a transcript available to them.

To everyone listening, thank you for spending time with me and the guests. This project has been a real pleasure to work on. And, if you haven’t listened before, good news: you have 25 hours of all things indie web to which you can listen!

Lunaseeker Press 25 hours of all things indie web books mathematics 16 accessibility with Nic web revival magazines 20 writing on the web Zachary

Wonders of Web Weaving, Episode 25 - James' Coffee Blog

2026-10-27T00:00:00.000Z

The twenty-fifth episode of Wonders of Web Weaving is out:

In Episode 25, the final episode of Wonders of Web Weaving (at least for now!), I chat with Emma, the author of emgoto.com about, among other things, blogging about coffee and hiking, the idea of a "hobby blog", projecting posts onto a map, and more.

I hope you enjoy the episode!

Wonders of Web Weaving also has an RSS feed you can use to follow along from wherever you get your podcasts.

Emma emgoto.com The twenty-fifth episode of Wonders of Web Weaving is out Wonders of Web Weaving also has an RSS feed

Solar is "offensively cheap". To live up to its promise, it also needs to be equitable. - Werd I/O

2026-10-26T16:41:45.000Z

Link: 'It's offensively cheap': How solar power is quietly becoming bigger than nuclear, by Jocelyn Timperley for the BBC

This is something we should all be excited about:

“The world's solar power is crossing a threshold. A decade ago, it barely registered on a global scale, providing just 1% of the world's power. In 2026, it will almost certainly increase to 10% of power, and overtake nuclear, a mainstay of electricity since the late 1970s.”

Solar energy is abundant, and the cheaper and more efficient it gets, the more electricity there will be to power anything we want. On that level alone, we should be cheering for its success.

But the other property solar energy has is relative decentralization. While not anyone can build a solar panel, anyone can plug one in — and, obviously, the sun belongs to everyone. It represents real energy independence, not just internationally, but from large energy companies (at every level from fossil fuel multinationals to utilities) that have enjoyed enormous influence for over a century.

Or it should. Energy companies have sponsored laws, rules, and regulations in the US and elsewhere that have made it harder for people to plug solar in. Those should be defeated, and our electrical systems should be upgraded to take decentralized solar into account.

But the power dynamics don’t end at the influence of energy companies: a large share of the polysilicon in solar panels is produced in Xinjiang, where there have been well-documented allegations of forced labor of Uyghurs and other minority groups. Batteries often contain cobalt, which is dug from the Democratic Republic of Congo, often by hand and often by children and slaves. They also contain lithium, drawn from brine operations that drain water from Indigenous communities in the Andes.

The next frontier needs to be freeing these technologies from harm — and there’s a long way to go. There’s some promise from tech like nickel-and-cobalt-free LFP batteries, more ethical lithium extraction, and recycling, but these need further investment, and the underlying issues require sustained attention. There is an energy revolution, but everyone should see the benefits.

Theatre Review: Opera UnTouched's "The Telephone" ★★★★★ - Terence Eden’s Blog

2026-10-26T12:34:15.000Z

Why shouldn't an opera be set in an office? Not merely set there; performed there! On Saturday night, a couple of dozen audience members were ushered in to a genuine office in Tooting to watch a short comic opera by Opera UnTouched. It was a burst of sunshine in a rainy day.

We're at Ben's leaving party. A flustered woman is busy on the telephone. Will Ben ever get her attention?

Both Grace Watkins & Stephen Whitford are astonishingly good opera singers. They cover all the tropes, hit all the notes, and interact well with the audience.

I know that every production now claims it is immersive - but here, it genuinely is! The audience wanders through the set to get to the seats scattered around the office, there's a naff PowerPoint presentation projected on to the wall, a leaving card is waiting for us to sign, the singers prance among us.

Just intensely joyful.

My only real criticism it that it is too short! I suspect it is designed to be a pop-up experience, fringe show, or performed during a break in the corporate drudgery. I'd've gladly watched a full length production and traipsed through a series of office spaces to get the the next scene.

You can watch excerpts on Instagram.

Pre- and Post-Show

As I've written about before, theatrical shows need to do something special to warm up their audiences. Opera UnTouched had a tough job with an audience drenched in London's rain.

The "office manager" ushered us in to the space and told us that it was Ben's last day, so we were all welcome at his leaving drinks. It being a modern office, we were each given a lanyard to wear throughout the show (which also sneakily doubled as an audience feedback QR).

As it was a party, as we wandered round the office space, we were each handed a glass of Prosecco - what a lovely touch! There's a reason your Chinese takeaway comes with "free" prawn crackers; receiving a gift makes you feel cherished. For the cost of a few dozen reusable plastic flutes and all of about 73p worth of fizz each, the audience were positively beaming by the time the show started.

Why can't more shows do that? OK, it might eat in to the takings at the bar. But a welcome drink on arrival is such an easy way to win over the audience.

As for post-show, there was the obligatory plea to fill in the feedback form. Charmingly, after receiving rapturous applause, the cast and creatives came back and were happy to chat to the audience and discuss the show.

Note published on October 25, 2026 at 11:59 PM UTC - Molly White's activity feed

2026-10-25T23:59:14.000Z

someone at Polymarket is drafting a tweet about how their users accurately predicted the Brazilian election result within one point

Finished reading A Darkness More Than Night - Molly White's activity feed

2026-10-25T16:42:14.000Z

Finished reading:

Harry Bosch series, book 7.

A Darkness More Than Night

by Michael Connelly.

Published 2000. 470 pages.

Started October 16, 2026; completed October 24, 2026.

Remove Valance Endcaps from Primrose Awning - Robb Knight • Posts • Atom Feed

2026-10-25T14:41:00.000Z

Warning: boring homeowner awning post.

The valance on my awning had come off the runner and was hanging out the end of the awning casing so I need to get the endcaps off. The instructions that came with it don’t mention the valance or end caps at all, and everything I saw online suggested there should be screws holding them in but there wasn’t.

I extended the awning slightly and shoved my phone camera in there to see what was going on and it turns out on full cassette awnings, the endcaps are held on with a 10mm bolt from the inside. Once I loosened the bolt, I was able to get the end cap off and rethread the valance.

Gadget Review: LiberNovo Omni - the USB-C powered office chair ★★★★⯪ - Terence Eden’s Blog

2026-10-25T12:34:01.000Z

Whenever a company asks me to review their gadgets, I always ask if it is USB-C powered. If not, I'm not interested. So, welcome to the future where your chair is USC-C rechargeable!

WHAT?!

The LiberNovo Omni looks like a standard office chair - but has two secret features.

First, is that it is exceedingly comfortable. Full foam cushions, lovely headrest, and a recline which almost gets you horizontal.

Second, it is USB-C powered. There's a small battery pack which plugs in to the chair. Why? Read on!

OK, let's start at the beginning.

Assembly

Flat-pack chairs like this are normally notoriously hard to assemble. The LiberNovo bucks that trend - not only does it include a how-to video, it prints the instructions on a MASSIVE piece of cardboard.

I'm used to peering at tiny black-and-white diagrams in a flimsy paper booklet. IKEA could learn a thing or two from this.

The screws are all labelled and a hex-driver is included. What's an even nicer touch, however, is some safety gloves:

That's the sort of thing which doesn't cost much to the manufacturer, but is such a thoughtful gesture. There's nothing too sharp as you assemble, but who wants to cover their new chair in blood, eh?

The parts come in two large boxes, but there aren't that many separate bits.

Building it took about half an hour. It's easier with a friend to help - as are most things in life - but doesn't require much skill.

Go Back To The USB-C Part Again Please?

The battery pack is a 2200mAh unit with a USB-C port to recharge. It connects in to the chair with this slightly unusual connector:

The internals of the chair have a USB-C cable to connect everything up.

LOL!

YES BUT WHY DOES A CHAIR NEED A BATTERY PACK??!?!

On the side of the left arm-rest are three buttons.

Two of them move the lumbar-support up and down. Depending on how your back is feeling and how far you are reclined, you can adjust the the back-support position.

And the 3rd button?

That's the build-in back massager, silly!

Is that useful?

Yes. Being able to instantly adjust the back support without having to twist around is fantastic, especially for those of us reaching a certain age.

The "massage" feature essentially just moves the support up and down for five minutes before returning to its previous location. When sat upright, it feels great. But the real benefit is when you're laying down.

How flat does this thing go?

160° - not quite flat, but good enough when you're taking a break from Typing Real Hard. You don't want a photo of me sprawled out, so LiberNovo have helpfully provided some stock photos of much better looking folk.

It is incredibly stable. At no point did it tip over or feel like it was going to deposit me on the floor. What really helps is the included foot stall.

No Feets On Seats

Unsurprisingly, this is not USB-C powered. A sturdy plastic footrest with a deeply padded leg rest on top.

Again, assembly was a cinch - follow the large printed instructions and clip it together. It's rated for 40㎏, so you shouldn't stand on it but it is more than enough to rest your weary legs.

Price

I hope you're sitting down for this.

Direct from LiberNovo, you can expect to pay around £700 - although there are bundles with extra batteries, the footrest, and even an eye mask which will shoot that price up. You can get the full bundle on Amazon for around £1,000.

There's two ways to look at that price. Firstly, youch. But, alternatively, that's still cheaper than a Herman Miller Aeron. And Herm's doesn't come with a built-in lumbar massage.

(There is also an upgraded version which has a built in fan under the seat. Personally, I suggest eating a healthier diet.)

I can't deny that's a chunk of change. If you're anything like me, you probably spend most of your day sat down. You might as well sit on something comfortable.

Final Thoughts

Having the back-rest adjustable via arm-rest buttons is a genius touch. I just wish it went further. I'd love a control panel (or, dare I say it, app) which let me adjust the seat height, recline, headrest position etc. Who can be bothered with fiddly manual levers when electricity can do the work for us?

Building this chair was a breeze - and it was delightful to get a pair of safety gloves with it.

The chair is extraordinarily comfortable and the back massage, while not on the level of a "shiatsu" style heated massage pillow, is delightfully pleasant. Would I lie all the way back and sleep in it? Yeah! Certainly more comfortable than an economy airline seat.

If you spend a lot of time sitting at your computer, your arse deserves something supportive. Your back deserves some love too. Yes, the USB-C power-pack is a little bit of a gimmick - but it is a hell of a good one.

In my opinion, this is worth splashing out on.