Shellsharks Blogroll - BlogFlock

Some thoughts on restaurant menu QR codes - Terence Eden’s Blog

2026-11-08T12:34:01.000Z

Is anyone else SICK AND TIRED of the way hotels now foist plastic "keycards" on guests?

No! I don't want tap to open my door!

No! I don't want to keep the card in my wallet!

No! I don't want electronics in control of my life!

What if I need to stab an attacker? Keys are great for that by flimsy plastic cards are useless

Gives us PROPER keys with big keyrings that we have to hand in to reception when we go out and then ask for when we come back.

That is exactly what you sound like when you complain about restaurant menus now being available by QR code.

My wife and I took a 7 week Interrail through Europe. While most places still had boring paper menu, a decent number had QR codes which allowed us to see the menu and order food. And they were brilliant!

An electronic menu offers so many advantages. Being able to instantly translate any terms by selecting the text is much easier than pointing a camera and trying to focus on a laminated bit of card.

That said, most of the online menus were already fully translated. They had all the legally mandated allergen information. Many of them showed when something was out of stock. We had much the same experience visiting Japan - getting to see a photo or video about the dish you're going to order is surprisingly useful.

The ones which allowed you to order were even better. So easy to select the right thing - no hoping that the waiter didn't mishear "no cheese" as "extra cheese". Notes to the kitchen about allergies were often supported. Oh, and no trying to catch the waiter's eye to let them know you're ready to order.

Speaking of which, no trying to catch the waiter's eye when you want to pay! Several of online platforms allowed for payment through the Web. Most supported splitting the bill between a group - so no more trying to work out who ate what.

So let's talk about the down-sides.

"What if there's no signal?!?!?" Get a roaming SIM, chief. But, as it happens, every restaurant had fast and free WiFi. Because, you know, they understand the service they're providing.

"I don't want a bloody app!!!!" Me neither. I didn't encounter any which required me to install a one-time app.

"Online ordering tries to upsell to me and I have no self control...." Sure. But waiters often recommend the most expensive wine to go with their cheapest dish.

"How can I flirt with a waitress if everything is mediated through a screen?????" Please reconsider your life choices.

"But I hate progress and love paper!" OK. In just about every restaurant I saw people being handed paper menus. Or wait staff explained what each dish was.

"Yes, but in the worst case scenario I've constructed in my head I have no signal, no phone, and no alternatives - and now I'm irrationally angry about that!" So walk out. Seriously, you'd leave a restaurant if the waiter was rude, or you saw a rat, or the food didn't come for an hour. Do the same if you're forced to use a service that you hate.

As I've said before, I love living in the future. I can't be bothered with fully grown adults throwing a tantrum over every bit of progress.

Does Money Buy Happiness? - Kev Quirk

2026-11-08T11:29:00.000Z

Does Money Buy Happiness?

by Tuesdays Child

Tuesdays Child talks about how they think money = happiness. It's an interesting debate with people on both sides of the fence.

Read post ➡

I found this post via this reply on Bubbles. Both are interesting takes, for different reasons.

For me, money doesn't buy happiness - it buys the removal of financial stress. What actually makes you happy is the people around you and the decisions you make with whatever you have. I've kinda talked about this before in my when was I happiest post.

I grew up in a very poor home. After my mum and dad split up, our house was repossessed and we ended up living in a rough area surrounded by gangs, drug addicts, and prostitutes. My mum worked every hour god sends as a cleaner just to make ends meet, while I looked after the younger kids. We didn't know if the bills would be paid and were stuck in a cycle of weekly payday loans for years.

On paper, that doesn't sound like a happy existence, right?

But we were happy. As we settled in, we became part of the community, and watching all the street drama - like the regular fights and arrests that are common in rough areas - just became part of the entertainment, like watching a live episode of Jerry Springer.

It wasn't all sunshine and roses, though. I remember one time when the addict that lived opposite us came busting into our flat screaming that her baby had died and she needed to call an ambulance. Back then there were no mobile phones, and our landline was in mum's bedroom. So mum obviously let her go call an ambulance.

Turns out her baby was fine, but she knew our phone was in mum's bedroom and she took the opportunity to steal all mum's jewellery for drug money.

Still, most of my memories from back then are good ones. I fondly remember sitting with my mum on a Friday night watching a stream of comedy shows like Cheers and Frasier. Once in a blue moon she'd say, "do you fancy a pizza?" Obviously I did! I'd jump on my bike, cycle to the local takeaway, and get us a 10" pizza to share because that's all we could afford. My god, were we happy. We were together, money be damned.

Fast forward 35 years

Today, my life is the polar opposite of how I grew up. We live in a lovely quaint village in the Welsh countryside and I earn a very good living. Having money solves certain problems - like not having to worry about paying the bills or putting food on the table - which certainly makes life easier, even if it doesn't automatically make you happy.

It still comes down to the choices you make along the way. Four years ago, we bought our dream home in the country. It's an old place that needs a ton of renovation work, which comes with big bills of its own. Had we stayed in our old house, we could have been mortgage-free by now.

Would having no mortgage have made us happier? Probably not. That house was too small for us, right in the middle of a large town, and it felt claustrophobic. Taking on the bigger financial commitment gave us the lifestyle we actually wanted.

It's a balancing act

I am happy today, but not because of what I earn. I'm happy because I'm surrounded by the people I love, living the life we want to live.

On the other end of the scale from my childhood, you could have a millionaire who's completely alone and tries to fill that void with things - nice watches, nice cars, a nice home. With no-one to share it with, it's all just meaningless stuff.

I think of it like a see-saw. The sweet spot is somewhere in the middle: having enough money that you don't have to worry about the basics, without spending your whole life climbing the ladder and missing out on time with the people who matter. That's a big part of why I stepped down last year.

Money doesn't necessarily mean happiness. It can certainly help, though.

Thanks for reading this post via RSS. RSS is ace, and so are you. ❤️

You can reply to this post by email, or leave a comment.

espresso - James' Coffee Blog

2026-11-08T00:00:00.000Z

Cosy glass, white wisps —
Bubbling dual espressos.
Morning steams and flows.

the meadows, edinburgh - James' Coffee Blog

2026-11-08T00:00:00.000Z

Amber triangle —
Stillness in the graceful air.
Foliage falling.

Book Review: When the Dust Settles - Stories of Love, Loss and Hope from an Expert in Disaster by Lucy Easthope ★★★★★ - Terence Eden’s Blog

2026-11-07T12:34:34.000Z

This is a difficult but essential book. I was initially put off by how graphically autobiographical it is. The disaster planning I came for was frequently interrupted with the author's loves, disasters, health issues, pains, and domestic issues. As the book wore on, I realised how vital that is. Disasters - whether natural or caused by human actions - cannot be tackled in a dispassionate way. It's all very well having a plan to repatriate bodies, strict timetables for witness statements, and a clinical approach to disposing of victims' personal effects - but there needs to be space for a humane response; not just a humanitarian response. People need space to grieve, they need a shower and cup of tea, they need to be allowed to fucking scream.

My chauvinistic biases were stopped in their tracks by the unrelenting assault of pure and righteous indignation.

Women in disaster planning and response are constantly accused of overreaction, of too much thinking and emotion. We ignore our instincts in an effort to fit in.

It is also a rallying cry against the national crime that was austerity. The hollowing out of the state's capacity to respond to trauma was a vicious and unnecessary attack on our future. Hoping that the worst never comes is in itself a recipe for disaster.

The book is necessarily grim - with occasional gallows humour - but never fails to be fascinating:

It seemed that pigeons and other birds were scooping up the smallest human bones, the finger bones or phalanges, that were still being uncovered

Every chapter contains at least one "big ooof" where you can see exactly how reality refuses to comply to with the best laid plans of disaster planners. Here's one about the difficulty in identifying people after a disaster:

[The victims] had the same kit on and, in an extra twist of fate, they had all dyed their hair canary yellow for the game.

As I said, it is a difficult and bloody book. Vital reading for anyone who wants to understand the why and the how of complex recovery efforts.

Feature: open your Bear notes by ID, not exact title - Johnny.Decimal

2026-11-07T09:10:56.000Z

If you own the LAS or SBS, this site has a link to open the current entry in your local JDex.

Figure 0264A. Life Admin System / 15.21.

Previously, this opened the exact title of the ID. So if you change that title in any way, the link will fail.

On the forum, Robert asked if this can be changed to a search instead, matching the ID only. This will help those of you who have changed your titles, e.g. by localising them.

This feature is now live. Find it at your Life Admin and Small Business settings.

Figure 0264B. Life Admin System / Settings.

Stress-free travel with an 'active trip' note - Johnny.Decimal

2026-11-07T04:04:17.000Z

This post has an accompanying video. Sign in with your Personal account to view it.

I recently found myself in an airport immigration queue, passport in hand, metres from the counter. At this moment my brain reminded me of something very important:

Yesterday, I filled in an immigration form and saved a QR code.
I need this QR code now, right now, this instant.
I've no idea where it is.¹

In these moments, it's like you're a newborn. You don't know the place, the people, or the language. Your phone probably isn't on the local network. You're helpless, and you know it.

There is also a small window of opportunity to be at the front of the line. I pay an extra $20 to sit up front so that I'm one of the first off the plane. And now I'm about to ruin it by not being organised. Me!

The shame. It hit me like a brick. Wait until they hear about this…

How to not be 'that guy' who holds up the line

So I solved it with a really simple process. I've been using it for a few months now and it works. Make this a habit and never stress again.

This tip isn't limited to travel. Think about any situation where you find yourself needing a piece of information. Current you – un-stressed you, sitting-on-the-couch you – has easy access to it. So let's help future you – first-in-line you, holding-people-up you – by making it as easy to find as possible.

1. Create a new entry in your JDex

If you use Life Admin, there's already a place. Attach this note to the ID 15.21 Important documents & lists.²

Do that by creating a new note called 15.21+ Active trip.

2. Load it up

At the start of the trip, clear the note. Start fresh. It's not a diary.

Add your boarding passes, QR codes, train tickets, and Airbnb checkin instructions. Put them in the note in the order that you'll need them.

Add nothing else to the note. It must be a place of calm.

Good notes apps will let you add a 'widget' to your home screen that opens a specific note. Bear and Apple Notes do this.

Add a widget that opens this note.

That's it. Now all you need to remember is to open that note.

Video

In the video for this post, I show you exactly how to set this all up. And at the end I give you some tips for getting QR codes and boarding passes out of websites and your email, and into this note.

Become a Personal member to view it, and get the Life Admin System and all future Personal videos.

Of course, it was already in my JDex. I had saved it, in a trip-specific entry. Lucy was next to me in the queue and she said, surely it's in your JDex?

But in that moment what I needed was a habit. This is that habit. ↩
Small Business has this at 15.11. ↩

New standard zero for AI and small system edits - Johnny.Decimal

2026-11-07T04:03:43.000Z

There is a new standard zero at 0.05 in the Life Admin and Small Business Systems. This is a place that your AI agent controls, where it can keep its notes about the systems.

00.05 AI for the Life Admin System
00.05 AI for the Small Business System

2 IDs in Life Admin have had examples or links added.

11.22 Health insurance & claims
12.31 Motor vehicle purchase, leasing, & rental

4 IDs in Small Business have had links added.

12.41 Official vehicle documents
13.44 Fixed assets
13.45 Current assets
13.46 Intangible assets

CLI v5, .config v2, supports Bear – please update - Johnny.Decimal

2026-11-07T01:37:38.000Z

The JD CLI has been updated to v5. It now supports Bear as a JDex.

This required a breaking change to the configuration file which is now versioned 2. The jdex property is now an object.

{
  "version": 2,
  "systems": [
    {
      "sys": "P76",
      "title": "My personal system",
      "root": "/Users/you/Documents/P76 My personal system",
      "jdex": { "app": "bear" }
    }
  ]
}

Updating

git -C ~/.local/share/johnnydecimal/cli pull to get v5.
Run jd which reads your config file, causing the CLI to automatically update it to v2.
If you use my agent skills, npx skills update jdex johnnydecimal.

Now checks for updates

From v5, the CLI reads GitHub tags once/day and will notify you when there's an update. jd update will perform the update.

No telemetry is sent. Run jd update --help for opt-out instructions.

blooms into time - James' Coffee Blog

2026-11-07T00:00:00.000Z

Before morning glows
Breathing space. Blooms into time —
The burgeoning light.

frosted ground - James' Coffee Blog

2026-11-07T00:00:00.000Z

Near-frosted ground holds —
The earnestly sleepy sky.
Birdsong awakens.

the coffeeshop - James' Coffee Blog

2026-11-07T00:00:00.000Z

Fresh golden pastries —
Early treats of the new day.
Flowing espresso.

Weeknote #2025 - Robb Knight • Posts • Atom Feed

2026-11-06T20:23:14.000Z

A plague has descended upon the Knight household. 0/10, would not recommend.

I remembered a post I now can't find where a developer listed everything they had searched for in a week^[1] and thought it would be fun to include some searches I've done this week with zero context.

marry me pasta
words than end in go
hanging chads
triscuit biscuit

I bought a Legami Super Kawaii pen case designed to hold 100 Legami pens but I needed it for my mildliners. Here it is with just over 60 in it. Also, it's a panda.

I sold my Kodak Charmera for two reasons: one, I knew I'd never really use it again and two, I could sell it on Vinted for what I paid for it but then I bought The Jaffa cake camera — more on that in another post.

As soon as I sent the Jaffa cam to Ben, a fellow novelty camera enjoyer, he replied with another camera I now want — the Godex C100 which has a transparent viewfinder and looks cool af.

This Ghostbusters × Wild Wild West mashup is glorious.

It's been three years since Duel of the Defaults and the post collection is up to 539 posts. Wild.

Pablo wrote a lovely post about the good internet.

I lost more time than I care to admit playing Katamari Met — Katamari Damacy but for objects from The Metropolitan Museum of Art's open object collection. I scored 15k on my first run.

This GitHub issue complaining because their little robot didn't do as it was told and deleted loads of stuff is absolute cinema. Poor baby.

Ben posted about Thai colours of the day. I should try this as a way to get through more of my ink.

While viewing a school for Baby Knight, the teacher (who was teaching six year olds) asked them to say what a "digraph" was and I went into full panic because I had never heard that word in my life. Why did I think she was going to ask me? No idea. Anyway, it's two consonants that join to make a unique sound like "sh".

I want the Pepsi Canamera (not a typo) more than anything right now. Can't stop thinking about it.

If anyone knows what post I'm on about, please send it my way ⤾

Knowvember 2026 - Joel's Log Files

2026-11-06T16:50:00.000Z

I saw some bloggers and friends participating on this prompt/challege, which—of course—originates from Robert Birming’s mind. Even though I’m one of the ones who feels like the about page I have covers pretty much everything, I decided to contribute with my own entry anyway.

A photo

You can find two pretty faithful pixel art recreations of me on both my home page and my about page. These will do for most situations. Here I decided to share a picture of one of my dogs, her name is Lana and she’s a very good girl!

She can't help but wag her tail all the time

Name or nickname

As some of you know, my name is Joel, and joelchrono is my username in most places. I have told this story many times, an older username I had was hard to pronounce in English on Twitch streams, and I went for “Chrono” from Chrono Trigger and appended it to my regular name, not much else to say at this point! Best videogame of all time, not the best username for sure.

Part of me wishes I had gone for a nickname that doesn’t use my real name in any way, but it’s kinda late for that at this point, I don’t mind it much.

Where in the world I blog from

I blog from México! I live in the state of Jalisco and that’s where I post from most of the time, usually via my laptop or my phone.

All I do is upload markdown files to my repo and go from there. I have a whole set-up for this on my laptop, but on my phone I just upload files to GitHub’s website directly. This has made my commit history a little bit ugly, I must admit.

I definitely prefer when I get to sit on my desk at home and write away, but the time for that has lessened since I started to work! Definitely try to do that during weekends though, if I don’t get hooked by some videogame.

What my blog is mostly about

My website is about pretty much everything that lives inside of my head at any given time. I talk about many things. The videogames I play, the books I read, my personal thoughts here and there, regarding whatever situations in my life I’m going through. Every once in a while I mention the state of technology, or what’s on my phone or talk about childhood memories. Maybe I’ll mention a pet of mine, or how my website works, or my thoughts after binge-watching a whole movie franchise.

Do not stick with me if you want me to have serious topics or essays on whatever is trending, although I may dwell on those things from time to time. I do enjoy to know I am being read, and sometimes that affects what I write, but I try to remind myself that most of what I share is because I want to talk about more people about it, so I’m always happy to get comments from people who share my interests and such.

Basically, it’s just me and my hobbies and random thoughts, and if you are lucky, some useful tutorial about some niche thing like FreshRSS.

This is day 66 of #100DaysToOffload

Reply to this post via email | Reply on Fediverse

Fairphone 1: Still going strong after 13 years - Kev Quirk

2026-11-06T14:45:00.000Z

Fairphone 1: Still going strong after 13 years

by Fairphone

The Fairphone team talk through two examples of where the original Fairphone 1 from back in 2013 are "still very much in use", but I think this post is a little disingenuous.

Read post ➡

I saw this post on Mastodon, and clicked on it as the title and intro both read like there's people still using their original Fairphone 1 as a daily driver, after more than a decade. This surprised me as Fairphone clearly states that their phones are supported for 7 years, and according to this site the Fairphone 1 went end of life in July 2017 (that's 4 years of support for those who are counting).

Reading the post it's clear that neither example is using their phone as a daily driver. One is sat on shelf, providing spare CPU capacity for scientific research, and the other is being used as a glorified MP3 player.

The post irks me a little as it feels disingenuous. A phone having hardware that's able to turn on and function after 13 years is nothing special. I've just pulled a Blackberry Priv and Wileyfox Swift, both from 2015 out of the drawer and both still work after a few years of daily use.

So having a decade old phone that's running, but not being used as a daily driver, is really nothing special.

For the record, I like what Fairphone are doing - I've seriously considered getting one myself a few times, but this post missed the mark for me. Maybe I'm being unfair here?

Thanks for reading this post via RSS. RSS is ace, and so are you. ❤️

You can reply to this post by email, or leave a comment.

Knowember 2026 - Kev Quirk

2026-11-06T13:54:00.000Z

Knowember in the brainchild of Robert Birming. At first I thought it was a bit of a pointless exercise as it only asks fore 3 things from bloggers:

A photo
Name or nickname
What your blog is mostly about

I figured any regular readers will know all those things about me, so it's pointless, but then I read the list of people who have already taken part, some I know of already, others I don't, and in all cases I learned something new.

So here's my entry to Knowember 2026 (I do think it's a silly name though 🙃).

A photo

You can see a photo of me on my about page, so I'm not gonna to share a photo of me here. Instead, I'm going to share a photo of the thing(s) that bring me the most joy in my life...my dogs (don't tell my wife and kids).

LTR - Sidney, Tia, and Nelly

Name or nickname

My real, legal name is Kevin Quirk, but I go by Kev everywhere - I much prefer it. I've never really liked the name Kevin, especially since I learned about Kevinism. My middle name is Thomas, and I'd have preferred to have been named that, but it's too late now. I suppose I could tell people to start calling me "Tom" but I think they'd look at me as if I had 2 heads, given I'm a 40 something man who's always gone by "Kev".

Everyone calls me Kev, except for my wife and my mum. They both call me Kevin, except when they're being serious, then it's Kev. Which is weird as most people have it the other way round - as the saying goes "I'm only called by my full name when I'm in trouble". I suppose it's because Kev is what I've always gone by, so my wife and mum use my "common" name when I'm in trouble. 🤷🏻‍♂️

I've never really had a nickname. Some people used to call me "scouse" when I was in the military, which is the name of a person who comes from Liverpool. But I'm not from Liverpool, I'm from a town on the other side of the River Mersey, called The Wirral. But to people not from the area, I do sound "scouse". I always disliked it when people called me that though, and asked them not to. Being the Army, some of my closer friends would use ironically as they knew I didn't like it.

What my blog is mostly about

Pfft. It's about all kinds of things. Tech, my career, online stuff, my opinions, my home life, and more. In the early days of this blog it was pretty much exclusively tech, but over the years it's grown into a true personal blog where I write about whatever is on my mind.

There's a tag cloud on the discover page if you want to see the tags I've used for all my 1,000+ posts.

That's it

That's it. That's my entry into this little challenge. If you decide to write your own entry, don't forget to let Robert know so he can include you in the list he's keeping.

Thanks for reading this post via RSS. RSS is ace, and so are you. ❤️

You can reply to this post by email, or leave a comment.

A video game which caused real world violence - Terence Eden’s Blog

2026-11-06T12:34:34.000Z

There has been a dramatic fall in the amount of interpersonal violence in most countries.

I don't want to go too Freakanomics and, obviously, correlation is not causation but perhaps video games have a role to play in this? A teenager being cooped up in their room means less exposure to situations where hormonal impertinence is likely to cause a violent reaction. Shouting and screaming at people via a headset rarely leads to real-life consequences. Beating up street-fighters is less risky than being in a street fight yourself.

But there are times when games do cause problems away from the screen. Players of Pokémon Go ramble about outside trying to collect digital pets - this also causes them to trespass into military bases.

I was recently reminded of one of the first Augmented Reality Games - Mozzies. Back in 2004 having a phone with a camera was almost unheard of. The Mozzies game let you see virtual mosquitoes overlayed on the real world - and then shoot them.

Waving your cameraphone around while playing caused at least one case of physical violence.

Here's a report from Singapore's The New Paper on 6 October 2004.

I'm grateful to Esme Potatoes for helping me find a transcript.

Playing game or snapping girl? Then… SMASH!

The incident happened while he and his friends were at Orchard Cineleisure for a movie recently.
Before the movie started at 7pm, his friends went to E-Zone, an arcade in the same building. The Indonesian student, who has lived in Singapore for more than 10 years, preferred to wait outside and play his favourite game, Mozzies, on his Siemens phone.
The game, which involves killing mosquitoes that appear on screen, requires the use of the phone's camera.
The camera captures a live video image as the game's playing background, with the mosquitoes appearing in the foreground.
The player has to move the phone around to target the mosquitoes.
Heriyono said: "I was so engrossed with the mosquitoes, I became oblivious to my surroundings."
"Then, I saw through the phone, a figure behind the swarm of mosquitoes heading in my direction but I thought he was just passing by."
Heriyono claims the man then shouted: “Trying to take a photo of my girlfriend, is it?”
And he smashed the phone on the floor.
Heriyono said he told the man, whom he estimates to be in his mid- or late 20s, that it was a misunderstanding and that he could check the phone for himself to see if he had indeed taken pictures of the man’s girlfriend.
But the phone was so badly damaged it could not be turned on.
“I was really shocked. He was behaving very aggressively, I thought he was going to hit me,” Heriyono said.
MAN WALKED OFF

But the man then walked off with his girlfriend, he said.
Heriyono and his friends decided not to chase after the man because he was older and they were worried he could get violent.
Heriyono did not make a police report either.
He was worried the man may get to him again, and refused to be photographed for this report.
When contacted, Siemens Mobile said it has never received any complaints about the games on its handphones. (See other report.)
The Mozzies game is available only on the Siemens SX1 model.
Heriyono had bought the handphone about four months earlier for over $700, after convincing his parents that it would be worth it because he uses all its functions, including the radio and MP3 player.
And he particularly liked the Mozzies game.
“In the end, the game caused me so much trouble,” he said with a sigh.
He sent the phone to the Siemens service centre but was told it was beyond repair.
His friends told him later that his actions could have looked suspicious.
“I realised that I could have looked like a pervert if seen by a passer-by,” he admitted.
“The thrill took over basic common sense and I began pointing my camera around.”
The girl was playing “air hockey” with her boyfriend at the time.
Miss Nalia Suli, 18, the receptionist at E-Zone, said she saw the commotion.
She said: “The girl was dressed very sexily. Her skirt was very short and when she bent down to pick up the ball, you could see her underwear.”
She, too, thought Heriyono was taking pictures of the girl.
“If he wasn’t taking pictures, why was the camera facing up?”
But Heriyono said: “Yes I could have pointed to the floor. But the mosquitoes are everywhere on the screen, you have to move around to kill them.”
He is now using a handphone he has borrowed from a friend, until he saves up enough to buy another. “I think after this incident, I will buy a much cheaper phone,” he said.

Perhaps staying inside to play games is safer all round!

After Binance, check what your signing systems can approve - Trail of Bits Blog

2026-11-06T12:00:00.000Z

Binance’s October 2026 security incident raises an operational question for every organization holding user funds: Can your security controls recognize when a valid signature grants an attacker wallet authority? If an organization only monitors transfers and ownership changes, it may miss the shift in wallet authority until assets move.

Binance’s initial update about the incident suggested that a compromised DevOps laptop allowed an attacker to access a service container and submit unauthorized withdrawals. Its second update reported additional breaches but no evidence that wallet private keys had leaked. In its November 3 report, Binance described a broader attack involving social engineering, misuse of an internal AI tool, stolen credentials, and unauthorized access to its wallet-signing service. The attacker nevertheless obtained valid signatures, illustrating a major risk: a compromised server with permission to request signatures can misuse a protected key without extracting it.

The attacker used an EIP-7702 delegation that allows a wallet to sign a standing instruction: “Use this code when my account is called.” Ethereum keeps that instruction in place until it is changed or cleared using the wallet’s key. That enabled repeated transfers, including funds deposited after the first theft, without further signatures from Binance. Other Binance wallets were drained through ordinary signed transfers.

Transaction execution and monitoring systems must keep pace with Ethereum. EIP-7702 places delegation authorizations outside ordinary calldata. Session keys, recovery paths, authorization modules, Safe modules, and ERC-4337 UserOperations all add execution paths that signing policies and monitors must understand. Systems that have not been updated can miss malicious authority changes and asset movements, leaving wallets exposed. Teams must update their detection rules and test that these attack paths are covered.

If you’re responsible for securing wallet infrastructure, start with our checklist.

Four steps to strengthen wallet security

These four recommendations address the risks exposed by the attack. We also provide tests to help you verify that these security controls work.

1. Reduce access to signing infrastructure

Document every service and API that can request wallet signatures, who can call it, and what it can authorize, including transfers, delegation, and arbitrary data. Review this inventory whenever wallet functionality changes on supported chains. Separate signing infrastructure from everyday business systems and verify transaction details through an independent system. Use our TRAIL method to trace how a compromised laptop or server could reach signing.

Verify the result:

For each identified compromise path, use the access and credentials available to the compromised system to attempt an unapproved action. Identify the control expected to block it and retain evidence that no usable signature was produced.

2. Treat delegation as an administrative privilege

Configure signing services to recognize requests that change account authority. Reject EIP-7702 authorizations for custody externally owned accounts (EOAs) that do not need delegation, and ensure generic digest-signing APIs cannot bypass that restriction. Where delegation is required, separately approve the authorizing account, delegate address and code, chain, and nonce. Before evaluating execution, simulations must apply the proposed delegation and inspect changes to permissions and future execution authority alongside immediate balance changes.

Verify the result:

Delegation requests for accounts with delegation disabled are rejected through both dedicated and generic signing interfaces.
Changing an approved account, delegate, chain, or nonce requires renewed approval. Simulations expose added authority even when the transaction moves no assets immediately.

3. Limit damage even if signing is compromised

Even after delegation, the original EOA key can still transfer funds or change the delegate. This means that if the key is compromised, an attacker can bypass limits enforced by the delegate. Protect those assets with separate custody controls that the operational key cannot change. Our cold-storage guidance describes independently enforced limits, monitored delays on sensitive actions, and a separate configuration authority.

Verify the result:

Treat the operational key as compromised and attempt direct transfers, delegate replacement, and policy changes. Confirm these paths cannot bypass the claimed protections, including shortening or removing delays.
Exercise incident response against a malicious withdrawal. Record alert and containment times, and demonstrate that responders can cancel or contain the withdrawal before execution. Confirm that the blocked withdrawal cannot subsequently execute.

4. Detect changes in wallet authority

Map each wallet to the assets and contracts it controls, including wallets that hold no funds. Alerts should identify the affected systems and privileges (e.g., an unapproved delegation on an account that can upgrade funded vaults). Attribute direct calls, module execution, and ERC-4337 operations to their authorization paths.

Verify the result:

Test various delegation scenarios, mixed authorization tuples, multisig-module execution, and failed UserOperations inside successful bundles.
Monitoring should reconstruct authority changes and asset movements in order, identify affected systems, and distinguish detection from controls that block execution before funds move.

Make signing infrastructure an ongoing responsibility

If your organization runs wallets or signing services, take another look at how they’re secured. Test whether your signing policies account for EIP-7702 and ERC-4337, whether independent safeguards still work if an attacker gains access to signing, and whether your monitoring catches changes to accounts and permissions.

Give someone ownership of this review and put it on a regular schedule. Run it again whenever you change the protocols you support, the wallets you use, or your signing services.

Notable links: November 6, 2026 - Werd I/O

2026-11-06T10:00:00.000Z

Most Fridays, I share a handful of pieces that caught my eye at the intersection of technology, media, and society.

Did someone forward this to you? Subscribe for free.

How an obscure website became a force in America’s election information machine

There hasn’t been enough discussion about the proliferation of reference sites that are built not for humans but to influence chatbot answers. Take the Ballot Brief, which was designed to influence questions about the election:

“In tests by The Washington Post, ChatGPT cited the Ballot Brief in 22 percent of its answers to questions about the election. Microsoft’s Copilot cited it in 75 percent of answers. […] Anthropic’s Claude initially turned to established voter guides run by nonprofits — but started frequently linking to the Ballot Brief in The Post’s second round of tests.”

The Ballot Brief is, in itself, built using AI, with one guy — Ben Torres Ezrick — in control. Here in the US, 42% of adults use AI to ask questions, including about the election. That gives Torres Ezrick outsize influence on information people receive that may influence how they use their vote. Given that Torres Ezrick’s most recent position was Chief Marketing Officer at the far-right video streaming service Rumble, that should probably give us some pause.

And even without that potential rightward skew, the Ballot Brief consists of a bunch of content created at scale using AI with little oversight. So inevitably, there are mistakes:

“The Post identified numerous mistakes on the Ballot Brief. Sen. Jon Husted (R-Ohio) was credited with supporting a bill that passed before he took office — an error that Copilot repeated in a response to The Post. Two Robert Garcias running in California were collapsed into one profile. And several House members were listed with incorrect committee jobs.”

The web has already been insufferable for years because of SEO; this has only gotten worse with the rise of AI-generated marketing content. Now it stands to become a battleground as various entrenched interests fight to have their perspectives represented in chatbot results.

Should newsrooms counteract this with their own set of open, validated information? Or is it an unwinnable arms race that is bound to be dominated by moneyed interests? I’m not sure. But the web is certainly no longer just a place for humans to publish and be heard.

Creating a New Internet Bargain to Preserve Fair Use and Protect the Commons

This should be required reading for everyone in news, but also anyone who cares about a healthy knowledge commons:

Two of the most important organizations advocating for a healthy information economy, Public Knowledge and Creative Commons, have produced an important document that describes the threats and some potential solutions.

I particularly appreciated their definition of what they call defensive enclosure. In a world where their content is being scraped for someone else’s profit — and robots.txt files are being ignored at least 30% of the time, while almost nobody is using AI-specific exclusion standards — publishers are more likely to hide their content away. In turn, this has created its own ecosystem of tools, many of which have the potential to also be centralized and monopolistic.

As their article summarizes the problem:

“The blunt tools in use on either side of the AI developer/rights holder divide are serving to shrink the knowledge commons and erode its quality. This isn’t theoretical, AI-doomer prognosticating about some imagined AI future. The digital knowledge commons is contracting at an alarming rate, driven by the rise of AI model developers that have transformed openly shared content into a high-value industrial input and the defensive response of rights holders who are rapidly restricting access through legal, technical, and contractual means.”

This is not just a problem for us humans who would like to learn and build on each other’s work; AI model developers themselves rely on this information to train their future products. They, too, should be invested in solving the problem.

The challenge is that for newsrooms and other publishers, this enclosure is completely rational. The desire to not be intermediated from their communities is based on a need to serve them well and to achieve financial sustainability. To them, these blunt instruments are tools to ward off an existential threat. But, of course, that then has an adverse effect on the knowledge ecosystem as a whole: there’s an enclosure movement in progress, and the battle is really over who is building the fences.

So it’s interesting to read the angle these two organizations take here. They take the stance that training on content is fair use (which has been found in, for example, Bartz v. Anthropic). They also want to protect public-interest scraping, which would allow researchers and journalists (among others) to continue gathering information, and reject legislation that restricts bot activity without the public in mind. Instead, they favor a bigger swing: renegotiating the broad economic framework of the web itself to move the incentives away from enclosure.

They think solutions may involve some combination of public policy and innovation around data governance. The question is really: what does that mean in practice? How might we shift the web’s value exchange in order to promote open publishing? And — beyond the public good — whose interests are aligned with that?

Without a concrete answer, publishers will keep blocking, and AI vendors will keep strip-mining. That’s a path that will lead to a much more restricted information commons, to the detriment of all of us.

How Can Wikipedians Overcome Leadership Succession Crises? Lessons from the Invasion of Ukraine

An interesting dive into what happened to the Ukrainian Wikipedia in the aftermath of the 2022 Russian invasion, told with characteristic care by CAT Lab’s J. Nathan Matias.

“Inside Ukraine, people desperately needed to understand the changing circumstances of the war. Outside of Ukraine, the world flocked to information sources like Wikipedia to learn about the people and places facing the violence we saw on our screens. In the weeks following the invasion, viewership of the Ukrainian language Wikipedia increased by millions.”

At the same time, as you might expect under the circumstances, the number of active contributors plummeted. Wikipedia lives or dies based on its contributions and its editorial process — and Ukrainian attention was diverted elsewhere. Still, a dedicated core remained, and stories like the librarian who contributed edits from a bomb shelter are remarkable.

But the point here isn’t just to highlight the dedication of the volunteers keeping trustworthy information online even as the immediate world around them succumbed to war. It’s a lesson about succession. Our information ecosystem is vulnerable to a diminishing pipeline of administrators, editors, and dedicated contributors; the number of admins in particular is shrinking across Wikipedia. How can we fix that?

In Ukraine, they added a new probationary admin role:

“To fill the urgent need for admins, the Ukrainian Wikipedia created a “temporary administrator role” the day after the invasion. Rather than use their normal extended discussion and voting process, leaders quickly appointed new admins after a 3 day discussion period and [gave] a probationary period of 1-2 months, with the option to extend.”

They basically created an apprenticeship, designed to try someone out, help teach them the skills, and most importantly, demonstrate and build trust. (It also had a quick escape hatch if they turned out to be untrustworthy.) The result: 20% more admins within months.

The full post dives into the lessons to be learned for organizations like Wikipedia in useful detail. There are deeper lessons to be learned for other community spaces too, including in news and journalism. The stat about non-profits without leadership succession being around three times more likely to close is striking; how many non-profit newsrooms have a plan in place?

We often talk about building the organizations and the platform stacks that they depend on. We talk less about ensuring there’s a pipeline for succession to safeguard their sustainability — or the layers of carefully designed community-building and socialization that this requires.

Every leader should be engaged in the work of planning for succession and, ideally, designing their own obsolescence — even when times are hard. That’s as true for volunteer organizations like Wikipedia and organic online communities as anywhere else.

Rest of World faces prospect of shutting down

I was distraught to hear that Rest of World may have to shut down in January. Since its launch, I’ve relied on its coverage about the impact of technology and the tech industry on communities and geographies that often fall outside of a Western lens. And I’ve become a huge fan of its Chief Product Officer Michael Donohoe, who I think is one of the best product and engineering people working in journalism (or in any industry). Working with a small team, he’s built a site and underlying tech that punches way above its weight.

On one level, the forces that have created issues for Rest of World aren’t unique to it: declining search and social referrals, intermediation by AI chatbots, and a fixation with the Trump administration at the expense of other topics.

But then, as Semafor reports, Rest of World had a unique problem in that its audience was partially the tech industry itself, which has shifted to become more insular and conservative:

“The organization’s leaders also attributed the decline to a deeper cultural shift to the right within the tech community. One senior leader at the organization said they believe tech news readers who previously expressed liberal values and an appetite for consuming global journalism have grown disillusioned with the news media, and now prefer an information diet of inward-looking podcasts, YouTube shows, and chatbot outputs.”

This coincided with a tonal shift in coverage of the tech industry from typically fairly optimistic, glowing pieces about connection and innovation to criticism about oligarchy and the role of tech power in the global rise of authoritarianism. Looking at Rest of World’s homepage today, many headlines are now about how communities around the world are being either taken advantage of by American AI firms or left out of AI developments.

That’s vital coverage, in my opinion, and makes Rest of World required reading for me — but for an industry that likes to be praised for changing the world and is bad at engaging with criticism, it might be a tough read. Semafor notes that the likes of Wired and The Verge, which also produce excellent coverage, are suffering from the same problem (although I’ve also heard that Wired’s subscriptions are growing).

What’s surprising to me is that Rest of World should also be required reading for a whole slew of foundations and NGOs that want to make a positive impact globally, as well as investors looking to support ventures in underserved markets. Clearly this either isn’t happening or it’s not happening in a way that converts into the kind of financial support the newsroom needs.

It’s also, in a way, a warning about newsrooms started by founders with deep pockets. Sophie Schmidt (Eric Schmidt’s daughter) committed $60M to Rest of World a months into its launch. That gave it both a solid mission and an enormous runway that may have made it harder to test and pivot. It did pivot, to focus more on countries that Western readers might be more interested in, as well as to require user registration as a way to know its audience better, but it was relatively late in its life. I’m very grateful for the resulting coverage but I think it would be worth having an open conversation about whether those funds helped or hindered its ability to become sustainable in the long run.

Anyway, I hope it finds a home. I badly want it to continue to exist. For me, it’s the best tech journalism there is.

And more:

Here are some of the articles I didn't get a chance to go into in depth this week.

Bluesky hit peak usage for the year on election night

I adore Bluesky and I'm always surprised when people I know aren't on it. It's a community of people that genuinely care about news and information. Newsrooms should know that they disproportionately engage with and support trustworthy journalism. And it's where many of us looked for a backchannel during the night of the midterms.

Building Opportunities: One Year Since The First App

The Newsmast Foundation now powers 16 community apps for journalists and activists around the world, all powered by the open social web. Pretty impressive; pretty cool.

The Tech Bros Who Bet On Fascism Lost. Don’t Let The Internet Pay For It.

A warning against letting the justified backlash to tech oligarchy curdle into regulation that punishes the open internet itself. The distinction between Big Tech and the web matters enormously – but do legislators understand the difference?

Almost no one uses AI agents to book their Uber, company says

Also see a similar note from DoorDash. That doesn't necessarily mean it won't happen – but it's not happening right now, despite the hype. Have the people building and funding AI agents done the research due diligence to know if this actually solves a problem for anyone?

Y Combinator’s Garry Tan uses AI agents so much, he spends up to $200K a year on tokens

The absolutely unhinged counterpoint to the above. But there's a real point here: it costs too much, the technical overhead is enormous, and this is a pastime for the privileged.

Want to Rent an Internet Address at the White House?

"Several staffers at the White House are using computers or mobile devices equipped with residential proxy services that render their internet address available for others to rent, security experts warned today. One of the proxy services is a Russian company whose founder’s web hosting business was ground zero for cyberattacks against election systems in Arizona and Illinois in 2016." Seems bad. But, by the way, do you know for a fact this isn't happening at your office too?

Voters Rejected A.I. in the Midterms. Now Comes an Era of Scrutiny.

"Despite record donations by tech executives to tech-friendly candidates, voters chose a new Democratic leadership raring to investigate the cozy ties between A.I. companies and the administration." This isn't about tech so much as it is abuses of wealth and power.

A lesson on resilient knowledge organizations from Ukrainian Wikipedia - Werd I/O

2026-11-06T06:12:32.000Z

Link: How Can Wikipedians Overcome Leadership Succession Crises? Lessons from the Invasion of Ukraine, by J. Nathan Matias at CAT Lab

An interesting dive into what happened to the Ukrainian Wikipedia in the aftermath of the 2022 Russian invasion, told with characteristic care by CAT Lab’s J. Nathan Matias.

“Inside Ukraine, people desperately needed to understand the changing circumstances of the war. Outside of Ukraine, the world flocked to information sources like Wikipedia to learn about the people and places facing the violence we saw on our screens. In the weeks following the invasion, viewership of the Ukrainian language Wikipedia increased by millions.”

In Ukraine, they added a new probationary admin role:

“To fill the urgent need for admins, the Ukrainian Wikipedia created a “temporary administrator role” the day after the invasion. Rather than use their normal extended discussion and voting process, leaders quickly appointed new admins after a 3 day discussion period and [gave] a probationary period of 1-2 months, with the option to extend.”

Shellsharks Blogroll - BlogFlock

Some thoughts on restaurant menu QR codes - Terence Eden’s Blog

Does Money Buy Happiness? - Kev Quirk

Does Money Buy Happiness?

Fast forward 35 years

It's a balancing act

espresso - James' Coffee Blog

the meadows, edinburgh - James' Coffee Blog

Book Review: When the Dust Settles - Stories of Love, Loss and Hope from an Expert in Disaster by Lucy Easthope ★★★★★ - Terence Eden’s Blog

Feature: open your Bear notes by ID, not exact title - Johnny.Decimal

Stress-free travel with an 'active trip' note - Johnny.Decimal

How to not be 'that guy' who holds up the line

1. Create a new entry in your JDex

2. Load it up

3. Add a widget to your home screen

Video

Footnotes

New standard zero for AI and small system edits - Johnny.Decimal

CLI v5, .config v2, supports Bear – please update - Johnny.Decimal

Updating

Now checks for updates

blooms into time - James' Coffee Blog

frosted ground - James' Coffee Blog

the coffeeshop - James' Coffee Blog

Weeknote #2025 - Robb Knight • Posts • Atom Feed

Knowvember 2026 - Joel's Log Files

A photo

Name or nickname

Where in the world I blog from

What my blog is mostly about

Fairphone 1: Still going strong after 13 years - Kev Quirk

Fairphone 1: Still going strong after 13 years

Knowember 2026 - Kev Quirk

A photo

Name or nickname

What my blog is mostly about

That's it

A video game which caused real world violence - Terence Eden’s Blog

After Binance, check what your signing systems can approve - Trail of Bits Blog

Four steps to strengthen wallet security

1. Reduce access to signing infrastructure

2. Treat delegation as an administrative privilege

3. Limit damage even if signing is compromised

4. Detect changes in wallet authority

Make signing infrastructure an ongoing responsibility

Notable links: November 6, 2026 - Werd I/O

And more:

A lesson on resilient knowledge organizations from Ukrainian Wikipedia - Werd I/O