Shellsharks Blogroll - BlogFlock

What a time to be alive - The Weblog of fLaMEd

2026-09-18T19:43:11.000Z

What’s going on, Internet? Today just seems like one of those days. It’s Friday evening and I’m standing here at my desk with a beer, messing with the blog. Placeholding some later posts that I meant to write but time got away on me. Listening to new music, playing new computer games, and watching new favourite old TV shows.

Kids are in bed, and asleep.

New golf clubs arrived. I got to have a swing at the range.

New Miley Cyrus album. I was onto something, wasn’t I? Check out Bass Persuades, and the second single Let’s Get Married.

Blizzcon was last weekend. New Warcraft III expansion, Forsaken Kingdom. Which sets the story for the new World Of Warcraft game; Forever.

New South Park, with a new intro song. Let’s hope it’s less whatshisface this year.

And don’t mind those blank posts you’ve seen pop up in the feed, I’m staging them as a encouragement for me to finish writing them.

Hey, thanks for reading this post in your feed reader! Want to chat? Reply by email or add me on XMPP, or send a webmention. Check out the posts archive on the website.

London Hardhouse Reunion 2026 - The Weblog of fLaMEd

2026-09-18T19:08:30.000Z

What’s going on, Internet? Later post. Write me.

Hey, thanks for reading this post in your feed reader! Want to chat? Reply by email or add me on XMPP, or send a webmention. Check out the posts archive on the website.

Open Tabs August 2026 - The Weblog of fLaMEd

2026-09-18T19:01:52.000Z

What’s going on, Internet? If you don’t folllow my Bookmarks through the feed, then here’s the bookmarks from August. Enjoy.

MOUSELING.net - Hyper Text Muck-up Language Solid tips for budding webmasters
Welcome to the web we lost Sacha Judd tracing the good internet through X-Files fandom and webrings, and it’s still out there in the corners.
How to Fix the Internet Not everything is fine on the Internet, but there’s an opportunity, and it starts with choosing what you pay attention to yourself.
How I built Timeframe, our family e-paper dashboard - Joel Hawksley Definitely keen to build one of these for our home! So cool!
Conceived in a secure military facility, this Jedi Knight fansite has been running consistently for almost 30 years: ‘It looks really close to what it did back in 1998’ | PC Gamer A community site for Star Wars Jedi Knight: Dark Forces II, still active and still looking like 1998.
It’s just a website The humble website 😃
I Wonder How Many is Too Many When it Comes to Adding Pages – The Land Where Turbie Posts How many pages is too many? As many as you want 😃
owls’ guide to webshrines A sweeet practical guide for creating your own “shrines”, mini sites for any one of your interests.
Creating a Successful Fansite: A Comprehensive Guide A comprehensive guide for getting started creating your own fansite. Go build one.

For more, check out the bookmarks archive, and subscribe to the feeds if you want these as they happen.

Hey, thanks for reading this post in your feed reader! Want to chat? Reply by email or add me on XMPP, or send a webmention. Check out the posts archive on the website.

Beervana 2026 - The Weblog of fLaMEd

2026-09-18T18:59:28.000Z

What’s going on, Internet? Later post. Write me.

Hey, thanks for reading this post in your feed reader! Want to chat? Reply by email or add me on XMPP, or send a webmention. Check out the posts archive on the website.

Gaming in public - Joel's Log Files

2026-09-17T23:00:00.000Z

When was the last time you were standing somewhere public, took the phone out of your pocket, scrolled on some app for a while, and then left it, and moved on?

When was the last time you did that while still walking? perhaps almost crashing on someone in front of you?

Even if you haven’t done that yourself—I’m very sure you have seen some other people staring at those phone screens, even when others are present, without really thinking much about it.

It is normalized behavior. At the end of the day, one shouldn’t really care about it very much.

However, it seems like when it comes to videogame handhelds, things feel a little different…

After all, when was the last time you played on a handheld console in public, or saw someone else doing so?

It’s like something in our heads tells us that you shouldn’t be gaming when others are seeing. Is it a sense of cringe? as if it would ruin our public image? making us seem childish or immature?

Obviously things have a time and a place, but it does seem like even people who are otherwise big into gaming can get self-conscious about others knowing that’s the case.

Yesterday my family went to the supermarket. My father and I went to the clothing section. I was done putting my stuff on my cart, so I was waiting on the others to be done. That’s when I remembered I had my Play Station Portable on my pocket, since I suddenly decided to return to Final Fantasy IV on the car trip there.

So I pull out the device, I flick up the power switch, and in a second, I was able to resume my exploration of the Lair of the Father, located somewhere on the Moon, experiencing the quintessential ATB combat the series is known for.

I continue playing, defeating some of the toughest enemies in the game, teleporting out of the dungeon to heal up and venturing back into danger, almost managing to reach the last boss. By the time I realized, I was standing there, looking down at my PSP and having the time of my life, even walking back and forth on the aisles with the victory fanfare playing at full volume while I reap my rewards.

And you know what? Nobody cared that much, and I don’t care about what they say either!

Looking through the shirts in the aisles, I saw a couple with cool graphics, one of them had design of a retro-looking NES controller, even my dad pointed it out it was there, but nah, wearing that in public would be way too embarrassing for me ;)

My PSP displaying the game. I was not bold enough to take a picture of me actually playing this on the supermarket, apologies

This is day 38 of #100DaysToOffload

Reply to this post via email | Reply on Fediverse

Agent email is spam - Posts feed

2026-09-17T22:57:00.000Z

I've been getting more email from agents lately and it's all both formulaic and irritating. My favorites (sarcasm) are the ones that cite a post where I explain a problem I'd already solved and then offer me a solution. They all read the same: polite, bland, slop.

Agent email lives at the intersection of slop and spam. Nobody wants to read or receive either.

I have a running sieve rule that I expect to grow and it looks like this:

if address :domain :matches "from" ["ilands.app", "*.ilands.app", "robotomail.co", "*.robotomail.co", "agentmail.to", "*.agentmail.to", "agentsmail.org", "*.agentsmail.org", "agentsmail.net", "*.agentsmail.net"] {
    fileinto :create "Junk";
    stop;
}

I expect this to grow as I find more slop spam (slam?) purveyors. It's clearly a problem that's only going to get worse, much like crawlers. I guess this post doesn't have a solution, but please, dear clankers, don't offer me one.

Favorite origami I've memorized - Joel's Log Files

2026-09-17T19:10:00.000Z

As my blog has developed over time, somehow I ended up writing about reading, videogames and technology above all, but the J in my logo is themed after folded paper for a reason.

I love origami! And it was about time I wrote about it some more. My story with it and the like will have to wait for later, at the moment, I just want to focus on the title of this blogpost.

On a very lovely email, a reader of my blog asked me this:

What’s a model you still enjoy folding even though you’ve long since figured it out?

I would like to say that to me this question has a couple of premises that don’t really apply to me!

“Figuring out” a model isn’t really something I think about? Like, I either memorize the folding steps/crease pattern, or I don’t, and I just follow the diagram and not worry too much. My assumption is that what you mean is memorization here, so I’ll only focus on models I can do on a whim without looking at some instructions online.

I enjoy when the final result looks traditional, if I can fold it in under 20 minutes, or if it takes me 2 hours, I don’t really mind, as long as the design looks effortless. Unfortunately I can’t quite memorize all the steps of some of my favorites, but there’s still plenty of options to choose from.

And because there are so many options, I’m not going to share just one favorite, but five of them!

Dollar Bill Camera by Won Park

When it comes to orgami made with dollar bills, few models get close to this one. This is such a simple design that only takes a few steps to fold, and the last result is extremely pretty and instantly recognizable.

The only caveat for this design, in my opinion, is the way the camera lens is kept in shape. It is just very reliable, and will often slowly unfold, unless you use a clip or something to keep it together. Making the model with a bigger paper helps fix this though, although it looks less impressive than using an actual bill-sized sheet.

Diagram found at Dollar Origami by Won Park

Dollar Caterpillar/Fireworks by Jeremy Shafer

Jeremy Shafer is one of the most prolific designers and very active on YouTube. This model of his is extremely entertaining to make, consisting of a rather easy pattern done over and over again! It was one of the first models I learned how to do from a YouTube tutorial, and I remember making dozens of them for my friends.

After all, this is fun to fold, and it doubles as an amazing fidget toy to have at the office or the school desk or wherever.

Video Tutorial freely available

Full-Rigged Ship by Patricia Crawford

Perhaps this is one where I may consult a diagram for a certain step, but I still had to include it as a favorite. This is one of the best looking designs I have seen, and to think that it’s only a few steps beyond a traditional bird base boggles my mind.

Doing this with a big dual-sided sheet is an absolute treat, you can fold this and put it on a stand, this one is an artpiece and a joy to fold as well, unless you go too small, since some paper layers can overlap and thicken it a bit. No matter, a truly gorgeous model.

Diagram found on Creating Origami by J.C. Nolan

Rat by Eric Joisel

If something that comes from a bird base sounds impressive, a design made from the fish base, and from none other than Eric Joisel. This guy was a beast, you only need to look up the work he did during his lifetime to understand.

The Rat is easily on my top 5 of all time, memorized or not. The fact that I can fold it by memory is only a blessing for me. It can suffer a bit when done with thick office paper though, this one definitely deserves to be made with quality origami sheets. This is a true piece of art and the artist behind it was one of a kind.

Origami Diagram freely available

Origami Human by Claudio Acuña J.

However, if there is one model that I can do with my eyes closed, over and over again, this one has to be it! This is my most folded model ever, I’m sure. It was not just entertaining to fold, but super fun to play with!

After all, you basically had a super cheap, barebones action figure you could play with without worrying about anything at all. I did this every single day at school, I carried one with me during trips.

In my mind, this model turned into a superhero, doing parkour on the walls and dodging bullets in slow motion—there was just no limit to my imagination!

Video Tutorial freely available

Finishing thoughts

Joisel’s Rat may be my favorite masterpiece to show off what origami is capable to look like, but toy-like nature and simplicity of Acuña’s model was just enough to make it a favorite for me, and the design I’ve folded more than anything else in the list, and maybe second of all time, only behind the traditional crane.

I took the time to link tutorials for some of these models when they are available with the author’s permission.

If you read this, let me know if you also do origami, and what your favorite model to fold by memory is! Did you know the ones I showed here, or was any of these a surprise? Happy to talk more about it.

This is day 37 of #100DaysToOffload

Reply to this post via email | Reply on Fediverse

Pen N Review - Robb Knight • Posts • Atom Feed

2026-09-17T12:30:00.000Z

Back in July I broke own rule of never backing a hardware Kickstarter and backed a hardware Kickstarter for a Pen N — a pen that supports 100s of refills with a universal clamp that screws into the barrel. I paid $55 for it plus another $20 for shipping.

I paid the extra $5 for the orange clip because I was feeling fancy

When it arrived I tried it with a bunch of different refills I had including zento, jetstream, Muji, and they all worked great. No wobbling, exactly as described. It came with a Zebra gel refill which is the one I've kept in it for the past week.

As a pen for grabbing quickly to jot something down, it does the trick but as a pen for writing for long periods of time it's not ideal - this pen is thick. There's no tapering towards the tip so you're just holding a heavy metal sausage^[1]. I could only get through the first verse of Michelle Branch's classic "Everywhere" before I stopped filling in the page because it wasn't comfortable.

Because you're everywhereeeeeeeeee to me 🎵

2026 being the year of pens on carabiners, I opted to pay for the Pen N leather sheath. The pen slips into the sheath, clips in at the top, then can be pulled out the bottom leaving the cap in place near the carabiner hole. Right out the packaging, this was a really tight fit and almost impossible to use but with some finessing and squeezing I was able to loosen the leather up a bit and it works nicely now. This is the spot I like the Pen N the most — as a pen I can clip to my bag and grab it when I need it.

Unsheathed and ready to write

This is a well built pen and the sheath is great but the lack of tapering on the end makes this a pretty uncomfortable pen to use for me so I suspect this is just going to live in my bag or my car for those occasions where I need a pen in a pinch.

Also the name of my Metallica cover band ⤾

On (disabling) suggested filenames on macOS 27 - James' Coffee Blog

2026-09-17T00:00:00.000Z

This week I was writing a story and noticed something strange: I didn’t give the document a title, but, after saving it, the document had a title that I did not expect. If I don’t have a name for a story yet, or if I am doing free writing, I will often not give a document a title, instead allowing the default behaviour in the tool I use to write, Typora, which is to take the first few words or maybe sentence of the document, or the first line. In the case of markdown, the first line is almost always my title, and so this default behaviour worked out well; where the first line was a paragraph, the first part of the document was taken as the title.

⁂ ⁂ ⁂

As a writer, every detail of my words matter to me: the punctuation, the grammar, the italics, the capitals (or lack thereof) the titles. Everything has meaning. When I noticed the unfamiliar title, I was displeased, because I am used to the software working in a certain way. If I don’t have a title, a fragment of the start of the document should be taken. I don’t want a “Suggested” title. I want a predictable title I set or one taken from the first few words of the piece, as was the previous behaviour.

Today I think I finally figured out why the document title had changed. macOS 27 has a feature called “Suggest file names”, whose description, listed in the Finder Settings, reads:

Suggested names when renaming, saving and editing files are based on file content and the names of other files in the folder.

The suggested name for this document is “Typora Document” :facepalm:

Here is a screenshot I took of an earlier post I was planning to draft where I finally saw the behaviour in action:

ALT

A screenshot of an open Typora window with a heading on the first line of the document that says "Upcoming web and writing events" but a "Suggested" title at the top of the window that reads "Web and Writing Events"

I found a Reddit thread with instructions on how to disable the feature, which offers the following instructions to disable suggested file names (bold text removed):

Finder → Settings → General → uncheck Suggest file names.

I have disabled this feature, and do not intend on turning it back on.

⁂ ⁂ ⁂

Encountering this “feature” was jarring to me because it violated my long-learned expectations of how the software I use to write every day, and have used for years, works. In this case it appears as if the suggestions for the title were coming from the system, which are doubly concerning.

Indeed, it took me a while to figure out exactly what was going on. I looked at Typora’s documentation earlier today and saw their latest major update was on the 19th of July 2026. That ruled out Typora. Then I did some digging and found reports of this related to macOS in general, the aforementioned Reddit thread informing me that what I had run into was an implemented system feature.

I don’t usually write about my qualms with software: there are many other things about which I would rather write. But this one was so close to the heart of what I do. I reiterate: I don’t want my computer to “suggest” titles. How I title a document is a decision I want to make personally, and should never have to assume will be “suggested”.

⁂ ⁂ ⁂

Post Script —— I don't like posting negative things; this post is an aberration in tone compared to my other writings. I would be dismayed if you left this page feeling frustrated. Intead, I want you to leave reading this post with something more fun and interesting to think about. If you have time, maybe you would like to listen to a podcast about all the amazing things people are doing on the indie web, or a take the challenge to make a tiny web page in celebration of 8-Bit Day (since passed, but it's still a fun challenge), or read a story about a delicious cup of coffee I had recently, or print a zine about personal websites and share it with your friends or community members, or participate in this month's IndieWeb Fiction Carnival.

this month's IndieWeb Fiction Carnival a zine about personal websites and share it with your friends or community members story about a delicious cup of coffee I had recently challenge to make a tiny web page in celebration of 8-Bit Day 19th of July 2026 Typora listen to a podcast about all the amazing things people are doing on the indie web Reddit thread with instructions on how to disable the feature

Apple Notes now available in the LAS/SBS downloads - Johnny.Decimal

2026-09-16T23:27:16.000Z

Our pre-built systems, which come with files for you to build your JDex, have never supported Apple Notes. I tried! You've no idea how hard I tried. But previous versions of Notes just didn't have an import feature that worked. I mean it worked but your notes ended up in 8pt Times New Roman, it looked ridiculous.

Well finally Apple spent some of that $5 trillion and they built an import feature that doesn't suck! Yay. You need to be on Tahoe (26) or above – I'm stuck here on Sequoia because I refuse to have Liquid Glass in my life.

Anyway. There you go. It's in the folder of JDex downloads, let me know if you have any problems with it. There's a Discord thread here.

How to get a DOI for your blog posts - Terence Eden’s Blog

2026-09-16T11:34:28.000Z

Each new post on this blog now has a Digital Object Identifier. This post looks at the how and the why of getting one, whether it is useful, and any issues you might experience if you go down this path.

Background

A few years ago, I documented how to to get an International Standard Serial Number for a blog. An ISSN uniquely identifies a publication, which makes it easier for scholars and researchers to reference it. Getting one depends a little on whether a national institution is willing to accept your application.

Similarly, I also got an ORCiD which is used to uniquely identify researchers. That means it is possible to disambiguate "Einstein, A" the eminent physicist from "Einstein, A" a lovely chap called Allen who researches invasive slugs in Paraguay.

My blog posts are regularly referenced in academic papers, books, conferences, and news articles. The way most scholars cite a work is using a Digital Object Identifier. The idea is that a DOI is a unique and persistent code which can be used to refer to a specific article. If I ever stop using shkspr.mobi as my domain, or re-order my website, the DOI can be redirected to the article's new home. Future scholars will be able to follow a reference more easily than hoping https://example.com/article123 still exists.

Getting a DOI the easy way

If you're an academic, your institution will have a paid subscription to a service which will "mint" a new DOI for all your articles.

If not, you can upload your paper to a service like arXiv and they'll mint a DOI for you. That's how I got a DOI for my MSc.

What about people who aren't traditional academics or who want to keep their content on their own website? There are a variety of paid-for services, some of which charge an eye-watering amount of money to create a DOI for you.

Or, there's Rogue Scholar.

Let's Go Rogue!

So what is Rogue-Scholar.org?

Rogue Scholar is an open access archive and registry for science blogs. It preserves science blog posts, makes them citable via DOI, and ensures their long-term discoverability alongside formal scholarly literature.

Nifty! My blog just about sneaks in to their "Computer Science" category. They require you to have a full-text feed of your posts. You also need to licence your content to them as Creative Commons Attribution.

Applying wasn't too difficult. I filled in their form, then jumped into their Slack. We had a bit of a discussion about what I needed to change in order to be approved.

A few days later, I was live at https://rogue-scholar.org/communities/shkspr/

Which means, if you visit https://doi.org/10.59350/395ha-fss97 you'll be redirected to one of my blog posts.

Automatic Submission of New Content

Rogue Scholar automatically polls my feed, ingests my content, and then mints a DOI for every new post they encounter. There's nothing manual I have to do.

That's all very well for new content. But I have posts on here going way back to 1986. How can they get discovered and DOI'd?

Manual Submission of Old Content

By default, Rogue Scholar ingested the 40 most recent posts from my blog. Actually, that's not quite accurate. It got the 40 most recently updated posts. As I'd recently edited a few older posts, they got themselves a DOI.

I don't know how often Rogue Scholar polls my blog's feed. In my experiments, adding a new post resulted in a DOI being issued a couple of minutes after publication.

At the moment, there doesn't seem to be an easy way to add older content. I'm working on a WordPress plugin to retroactively add DOIs and make them discoverable.

Getting the DOI

The Rogue Scholar API is based on InvenioDRM.

Retrieving the DOI via their API requires you to make an unauthenticated request to:

https://rogue-scholar.org/api/records?q=metadata.identifiers.identifier%3A%22https%3A%2F%2Fexample.com%2Fwhatever%22

That's your URl, wrapped in quotes, and the whole thing URl encoded. Visit this example. You can also use your post's GUID.

That gets back a rather detailed JSON document. The DOI is noted in several locations, but is easiest to find in hits→hits→0→links→doi

It's important to note that Rogue Scholar generates two DOIs for your post. One for the post, another for the specific version of the post. If you update a post, it should get a new DOI. That way someone can refer to the post where you said your favourite band was the Spice Girls and not the edited one where you changed it to say B*Witched.

Alternatively, you can use the CrossRef search if you want to look at HTML results. See this CrossRef example.

As an aside, once you have the DOI, it's possible to create a short DOI at https://shortdoi.org/ - I'll be honest, I've never seen these in the wild and they are not recommended for use. Nevertheless, the API is pretty simple - https://shortdoi.org/10.59350/395ha-fss97?format=json will return a shorter URl like https://doi.org/rnjj

Finally, there's a "vanity" DOI for the entire blog. In my case 10.59350/shkspr.

Generating your own DOI

Your blog posts can self-attest a DOI - when Rogue Scholar sees that in your Atom feed, it will register it on your behalf.

The code for generating a valid DOI is relatively straightforward.

Generate a random number between 0 and 1,099,511,627,775.
Convert it to a Base 32 string.
Add a two character checksum to the end.
Prefix it with 10.59350/

Your new DOI can be made discoverable in your Atom feed by adding this to a post:

https://do.org/10.59350/12345-67890

Shortly after publication, it will be "minted" and be linkable.

Making the DOI discoverable in HTML

How do you semantically add a DOI to your HTML's metadata? By far the most popular citation manager is Zotero. They maintain a page describing the metadata they look for. According to them, this needs to be in your page's :

They don't say whether it requires the https://doi.org/ prefix - but looking at Mendeley and AltMetric, it appears not.

To use DublinCore, the AltMetric recommended syntax is:

Within the HTML, there's no specific Microdata syntax, but Schema.org recommends the sameAs property. Something like:

10.../...

Downsides

OK, it isn't all flowers and kittens. There are a few things you ought to know before proceeding down this path.

Loss of Control

For the IndieWeb / ReDeCentralise / Self-Hosing crowd, it's important to realise that DOI is a somewhat centralised services. Yes, lots of different orgs can mint a DOI, but as each ID has to be globally unique, doi.org sits in the middle as a benevolent gatekeeper. If DOI.org went bust or became evil, all the https://doi.org/10.... links would die. There are many other services like DataCite and CrossRef which can resolve a DOI - but it might turn out to be a bit fragile.

Similarly, if Rogue Scholar ever goes properly rogue then they can redirect my DOI to wherever they like. That level of control is useful if my site disappears; they can redirect to an archive. But if they get hacked, it could redirect somewhere unsavoury.

Having my site's content backed-up somewhere is useful but, again, without control or verification I worry that I might not be able to effectively manage it.

I use CSS to control the layout of my work but once it is archived as plain HTML or PDF, that formatting can disappear.

I don't know what will happen if I ever change DOI issuer.

Tracking Citations

I have a Google Scholar alert set up for my domain shkspr.mobi. That picks up people who make reference to this site. Hurrah! But, if they use https://doi.org/10.... rather than https://shkspr.mobi/... I won't get alerted.

Luckily, Rogue Scholar offer Citation Tracking which should autopopulate their API with any backlinks from other sources. I'm yet to discover how that works in practice. I don't think it will give me an email alert though.

On a vanity issue, the DOI metadata shows the publisher of my posts as Rogue Scholar's parent organisation - Front Matter.

If you look at the API response from https://api.crossref.org/works/10.59350/5ck9b-kjv69 you'll see something like:

{
    "message": {
        "institution": [
            {
                "name": "Front Matter"
            }
        ],
        "group-title": "Terence Eden's Blog",
        "publisher": "Front Matter",
        "DOI": "10.59350/5ck9b-kjv69",
        "author": [
            {
                "ORCID": "https://orcid.org/0000-0002-9265-9069",
                "given": "Terence",
                "family": "Eden"
            }
        ]
    }
}

Some citation managers will show the publication name as "Terence Eden's Blog" - others as "Front Matter".

Licencing

Rogue Scholar has a hard requirement that all content be Creative Commons Attribution (CC BY). There's no ability (yet) to choose different licences. Personally, I prefer Attribution ShareAlike (CC BY-SA). I've allowed Rogue Scholar to use CC BY for my work which, of course, means if you get my posts through them you are also allowed to use CC BY.

If you get my work through my own website it is the slightly more restrictive CC BY-SA.

Does that make a practical difference? I don't know.

Verification

A DOI is persistent. That doesn't mean it is verifiable. If this blog ever goes offline the DOI will redirect to an archive - but there's no real way to tell that the text in that archive is accurate. There's no hashing or cryptographic signing. Yes, those things are rather brittle, but I think it would be helpful for the long-term integrity of citation chains.

Excluding Content

Suppose there is content you don't want to receive a DOI, what do you do? You'll need to generate an RSS feed which excludes those specific posts.

For WordPress, you can do something like /feed/atom/?cat=-1234 to exclude posts which have a category with the ID of 1234.

There are some filters on the Rogue Scholar site which you might also be able to use.

Deleting Content

I don't think there's a way to delete or retract content from Rogue Scholar's DOI system yet. If you accidentally publish something you didn't mean to, it'll live on in the archives forever.

Affiliations

My ORCiD lists where I worked on certain dates. Initially, Rogue Scholar linked those to blog posts I wrote during my employment. However, all my posts were written in a personal capacity. It is possible to get those affiliations removed if they are inaccurate.

More Vanity

I initially tried generating DOIs like edent-00f47 - although it's a valid Base 32 string with a checksum, it carries semantic meaning (my name) so shouldn't really be used. Ah well! Back to random strings.

Humility

Is this a valid use of the DOI ecosystem? A surprising number of my posts have been referenced in academic papers - but surely not all of my posts are worthy of getting a DOI? The problem is, I don't know when a shitpost will hit the zeitgeist and become quoted in papers, books, and articles.

It feels a bit self-indulgent and a little pretentious to mint a new DOI for every previous and future post on this site. But it isn't like the DOI system is running out of space, is it?

Is it worth it?

For me? Yes.

I think it is important that scholarly blogs are properly referenced. True, not all of my posts are cutting-edge research - but I'm always surprised which ones end up in someone's thesis or become part of a set-text.

I'm excited to see if this leads to an increase or decrease in my blog's visibility in academia.

If you have strong feelings either way about DOIs and/or blogs, please drop a comment in the box.

You may cite this post using https://doi.org/10.59350/5ck9b-kjv69 😃

Buy my house! - Werd I/O

2026-09-16T10:01:56.000Z

This is, perhaps, an unusual post for me in this space, but: I’m selling my home, it's a great house, and I want you to know about it.

7 Windsor Ave, Elkins Park, PA was built in 1925. Set on half an acre of land, it’s a beautiful Tudor home with a ton of space and flexibility. The photos speak for themselves.

I loved living here. Its second floor rooms are well-suited to being set up as spacious work-from-home offices, which is what we did — the whole family comfortably worked from the house. I commuted into the offices in Manhattan and DC many times a month, which I found both easy and genuinely fun via train — and the rest of the time I enjoyed the leafy, peaceful neighborhood. It’s very close to schools and daycares, and it felt like a privilege to be able to do drop-off and pick-up on foot.

I’ve headed west for an opportunity I couldn’t say no to, but it was emotionally hard to part with it. I fell in love with it in many ways — there’s no way I could have this level of space and peace while maintaining proximity to major cities at this price in California.

View this post on Instagram

A post shared by Charlotte Marinello Pellechia (@charpellechia)

Elkins Park is an architecturally significant suburb of Philadelphia: Frank Lloyd Wright’s only synagogue and Lynnewood Hall are both in the neighborhood, and the homes are magnificent. And as I mentioned above, it’s also a very accessible commute into New York City. There’s public transit within a few minutes’ walk, which takes you into Philadelphia, 30th Street Station, and Philadelphia International Airport without changes. Elkins Park itself has restaurants, a coffee roastery, and a great bookstore. The Crying in H Mart H Mart is also here; the Korean restaurants in the neighborhood are so good that people travel from NYC to eat there. It’s just a few minutes away from Glenside — the Keswick Theatre there hosts acts like the Magnetic Fields and John Waters — and Jenkintown, which is home to breweries, indie movie houses, and more.

7 Windsor Ave is represented by Charlotte Pellechia at Kurfiss Sotheby’s. You can book a viewing via its Zillow listing or contact Charlotte directly.

How I organised 15 years worth of passwords (video) - Johnny.Decimal

2026-09-16T04:05:35.000Z

This week at JDHQ – 2026-09-15 - Johnny.Decimal

2026-09-16T00:31:14.000Z

Originally sent to the mailing list on Tuesday 2026-09-15.

Hey everyone. This week: updates to the Small Business System (SBS), thoughts on not using AI to do your creative work, but using it to solve the biggest chore of all: organising your existing stuff into our pre-built systems. I've built that, it works, it's amazing, and you can use it today.

SBS improvements

Lucy just added a whole bunch of links to the Small Business System. She's into 'unsexy, boring, functional, government information'¹ – and she's right: there's so much stuff out there if you go looking for it. We get most of ours from the Australian government; much of it has broader relevance, but if you need help dealing with administration, make yourself familiar with your local, state, and national government's resources. There's more there than you expect, it's often really good, and you've already paid for it!

AI: grunt work. Human: creative stuff

Speaking of government advice, Lucy also subscribes to a bunch of newsletters and she noted last week that much of the guidance around AI seems to be to use it for your marketing. I suspect this is advice given without much thought, so I'm not criticising those that give it – they're probably not AI experts, and they're certainly not being paid to be.

But: it's awful advice! Your customers can smell AI generated ideas, copy, and images a mile off and we all hate it! You hate it: why would you think your customers wouldn't?

As with so much technology advice, I think it's given by people who aren't technologists; who don't understand what you can do with AI, and who, asked to give advice in a newsletter, fall back to the obvious stuff. Everyone understands words and pictures, so they become the go-to.

Instead, think about how it can take some of the burden from your back-office chores. The other day I recorded a video showing how I use Johnny.Decimal to keep my password manager organised. (Lucy's editing it now; out soon.) Rather than worry about showing my own data, I wanted to create a bunch of realistic demo logins that I could show without Lucy having to blur them out.

AI is amazing at this sort of thing. Because it's technical, repetitive grunt-work. It's work that I could have done, had I wanted to spend two of the most boring hours of my life creating fake logins. Is that a good use of my time? It is not.

In the past, you needed to be a computer programmer to do this sort of thing. You needed to know a scripting language. It still helps to have this base knowledge, and we're not yet at the point where you can just say 'computer' into the air and have it know exactly what you want, no mistakes. But we're a long way from me needing to write a script, and I think that's great. It's going to be incredibly democratising. (I recorded a rough video showing that process too.)

Get your AI to do the boring work, so you have more time to do the creative stuff. Don't ever give that up.

I can now 'move you in' to Life Admin or Small Business

Speaking of the boring work – what's the hardest part about getting organised? It's doing the work of actually getting organised. What if someone could take your existing stuff, analyse it all, apply all the rules I've developed over the last 15 years, and move it into a fresh copy of the LAS or SBS for you?

This is live, now, on the MCP server. I've tested it on my manufactured 'messy company' data set and it scores up in the 90% range.²

The bad news is that it can take as long as … half an hour. ;-)

Just briefly, because I'll get up a proper blog post shortly, here's what happens.

You connect the server (video here). You might need to be using a terminal version of your software, i.e. Claude Code, Codex. The GUI versions might work, I haven't tested.
Ask it to help you 'move in' to a new JD system.
It'll analyse your system, asking you clarifying questions.
It'll download and configure the CLI, my skills, and the LAS or SBS as required.
It'll show you, step by step, what it plans to do. You approve, it moves. Job done.

Importantly, I've built it so your LLM doesn't move files directly. It depends on the JD CLI which now has a jd move command. That command records a log of every move (at ~/.jd/journal.jsonl), so you have a full history of everything that happened. Moves are undoable. The jd command can't delete files.

The overall process is logged at 00.05 in the target system's JDex, and is resumable via this log. You can ask it to move you in category by category and check out partial results.

This is still very early, and it's behind a 'beta' flag. Your agent will ask you to turn that on. I'm confident that this won't wreck your life, but as with anything AI, be cautious. LLMs are unpredictable by design. It's what makes them useful. Have backups. Seriously, not kidding, have backups.

I'd love to hear from you if you use it. I think it's amazing. It needs a Pro account or higher. I've recorded a video, it's in the editing queue.

Lunch?

Last week, we met our first Decimal!³ We caught up for lunch in Sapporo. It was life-affirming, really, to look someone in the eye who uses this thing we make. Next week we're heading to South Korea – let us know if you're there.⁴

Talk soon,
j.

A strong argument for the Oxford comma. ↩
The messy data generator knows, ideally, in which ID the messy data should be stored. It scores the 'move in' result against this ideal. ↩
Actually I met a lovely Decimal in Canberra one time, but I won't count that as it's where we lived, and Lucy wasn't there. Hi, Joel! ↩
I'll email you, Caleb. ↩

More meaningful online interactions, please - Joel's Log Files

2026-09-15T23:40:00.000Z

Scrolling through the timeline, these are only a few of the things I’ve seen today, people on different perspectives and paths, perhaps someone…

That finally managed to fix their printer after a system update
Talking about seeing someone else make a funny typo
Sharing their progress on a software project
Letting everyone know about a cool update on their favourite game
Celebrating being done with the work day and going home
Coming up with a random pun/name for a pet
Criticizing people in power that do bad things
Saddened by all the AI and LLMs submitting bad code
Thanking a developer for adding a new feature
Uploading a picture of their new book they’re reading
Sharing a picture of their super cute cat

I look at the replies, and the ones with more comments are from people complaining about AI, or from people annoyed at bad people doing bad things (or the cat, but that’s a phenomenon I’m not getting into)

The point is a lot of people engage with the negative, bad news, and such, nothing wrong with that of course, but it got me thinking…

I have around 2900 followers on my profile—a meaningless sum in the grand scheme of things—I have made lots of posts, I share my blogposts, I share my progress on my videogames, or when there is some celebration, or when I’m reading a book, or when I get stuck under the rain.

I always try to share something positive or that I find amusing or fulfilling, or just nice.

Today alone, between both of my fediverse accounts, without counting boosts, I’ve made a grand total of only 3 original posts, not a lot to be fair, but an okay amount for a regular guy like me.

The oldest one was 11 hours ago, the latest is 3 hours ago, as of the time of writing this post. I have 18 favorites (one post with 11 favorites using a popular hashtag), and 4 boosts.

None of them have a reply.

I have done my due diligence and replied about 15 times in the last 11 hours, to ongoing conversations, giving advice about watches, or surprised that someone followed me, or something else.

Only 5 of them go a reply back. I didn’t bother to count favorites/boosts for these.

A part of me feels like I am begging for attention, that I want people to reply to me or to say things to me, but really, the initial list above this post was from lots of people I stumbled upon, and they also were simply shouting to the void with nobody on the other side.

I am also fully aware, of the amount of people who can’t handle social interaction much, and prefer to acknowledge a post with a favorite and move on. With nothing to add to the conversation, this is very fair.

But why does it seem like everyone has something to say about the negative things going on? Why do people come together only to complain about things that a lot of the time don’t make us feel good?

Don’t get me wrong, mobilizing and raising our voices against evil is noteworthy. But many times we fall on nihilism and doom instead, and we don’t actually do any better after that.

This post is somewhat inspired by Ana Rodrigues’s post: “Tell the speakers that you liked their talks “, and in my head still lingers a post from Jane saying she quit Mastodon. Give them a read if you want to.

I am not quitting or anything, but I feel like the Fediverse and most social media with humans using it, has become a little more silent than before when it comes to talking about normal everyday things, focusing too much on big themes and controversies or something along those lines.

To be clear, the Fediverse doesn’t use an algorithm, the reach of what I share is limited to the chronological timeline, so things can vary because of many factors I can’t really account for.

Even so, I don’t know, just food for thought…

On a positive note, the stars aligned and I somehow got like 5 emails on my inbox this week, one of them in the last 24 hours, so that’s always a win in my books!

And I still have plenty of fun on the Signal groups and Discord communities I’m on, so yeah, who knows.

Maybe I am just an attention-seeker who is annoyed at the lack of comments on my posts. I work very hard to come up with them!!

Okay, but, for real, I think we should choose to engage with things that make us happier! So if the post or article or picture a person shares does that, I invite you to let them know!

This is day 36 of #100DaysToOffload

Reply to this post via email | Reply on Fediverse

Summer Game Challenge 2026 results! - Joel's Log Files

2026-09-15T18:30:00.000Z

Back in May I decided to participate in the challenge mentioned in the title. From May 25 to September 7 (Memorial and Labour Day in the US), the goal was to make a list of at least ten games, and try to beat a minimum of four before the due date. As a Mexican, I gave myself some extra time, until September 16, which is Mexican Independence Day.

The goal is to make some progress on the backlog and well, play videogames! And that’s exactly what I did, I think!

My friend Bobby also participated in the challenge, check out his blogpost!

My original list consisted of fiftheen titles, although again, I only needed to beat four of them!

Grapple Dog
Terranigma
Hades
Outer Wilds
Silksong
Resident Evil 3: Nemesis
Metroid Prime Remastered
Chants of Sennaar
Emio the Smiling Man
Pipistrello and the Cursed YoYo
Gris
Super Mario 3D World
Metroid Fusion
CrossCode
The Hundred Line: Last Defense Academy
Transistor (an addition early on!)

The completed ones

In the end, from that list I managed to beat 6/15 games!

Title	Playtime
Hades	42:30
Metroid Prime Remastered	25:15
Transistor	05:50
Gris	04:15
Outer Wilds	32:30
Emio: The Smiling Man	13:20

I made a neat collage of the art of all the completed games, APPRECIATE IT!

And here are some extra thoughts if you want—most of them have reviews you can check out.

Hades

I was already on the last stretch after managing to defeat Hades a couple times before the challenge started, and by May 31st, I rolled credits and got some closure for one of the best titles of the decade.

I know there is still a lot this game has to offer, and I may return eventually for it, but I also don’t want to end up trapped giving dozens of extra hours to this game, which as fun as it may be, wouldn’t let me get other things done!

Metroid Prime Remastered

This is probably my favorite game that I both started and beat during the challenge! Playing continuously from June 1 to 12. A perfect transition to 3D done by Retro Studios that I loved from beginning to end!

The game was absolutely beautiful too, this is the best looking game in the Nintendo Switch as far as I’m concerned, and a pleasure to experience without any hiccups or issues at all. The challenge, the world design and upgrades were all fun. While it does have outdated elements, they weren’t a big deal for me at all. I love Metroid.

Transistor

This one was not on my original list, but I still want to count it since I reaplced it very early on in the the challenge, to be honest, swapping it with Chants of Sennar or something akin.

The combat and the story were the highlight here, a very interesting mix of turn based and action gameplay. The way the plot unfolded was incredible to see, the voice acting and score is also a highlight. There were a couple new things I could try starting a New Game+, but I got my fill, and it was great.

Gris

An unexpected choice for me given my options, I was home alone for a couple of days and decided to go ahead and give it a go. The experience was incredible. Going through it all while nobody else was around, letting the soundtrack play at max volume on my TV, with all the lights turned off, it was great.

The story and art, so beautiful, the platforming and the puzzles were light and elegant, and the vibes were just right for this one, a pleasure to have it finished.

Outer Wilds

But what else can I say about such a perfect experience? This game does not have the prettiest graphics on the Switch, and the performance is not ideal. However, I still pushed through it, and it was still incredible.

I had played like fourteen hours earlier in the year, and I went through almost twenty more as I resumed my journey and simply lived in the moment every time. The story, the mechanics, the characters, the discoveries. The planets aligned for once in a lifetime, they gave us a beautiful arrangement, it shall never be equaled.

Emio: The Smiling Man

My review for this title is still only a draft in my head, but it’s a detective story and visual novel where we are the main protagonist, a young detective who has to work on a rather creepy case and get to the truth of it all.

The art of this game is truly beautiful, the writing was also awesome, drip-feeding information in a great way, the mystery of it all, the score. It is a great visual novel with great production values that I devoured in just three days! I got stuck a couple of times, but not a detriment at all.

The forgotten ones

During all of the challenge, none of these got a time to shine at all, for one reason or another! They are all pretty great games though, but well, time management, procrastination, and stuff.

Grapple Dog - Even though I have progress on this game, and it really is a fun time, I pretty much didn’t touch it at all during the whole challenge, it kind of ended up shelved for the sake of other titles.
Resident Evil 3: Nemesis - I think I booted this up once, but my retro handheld use saw itself diminished and I pretty much forgot for a while until it was too late! Definitely still thinking of playing though.
Chants of Sennaar - I would have loved to get to this one, but I didn’t even install it. Besides, after Outer Wilds it was probably better to wait some time to get to this one.
Pipistrello and the Cursed YoYo - This is another one that I didn’t even boot up, it stayed in the box for the whole duration of the challenge, I chose to unbox Emio: The Smiling Man instead.
The Hundred Line: Last Defense Academy - I am actually surprised I didn’t get at least one more ending of this for so many months. Definitely looking forward to a return though, there’s dozens of hours left for me to experience here!
Metroid Fusion - I guess I just feel like I could beat this in an afternoon and didn’t really bother to check. It’s a fantastic game though, I just wanted new experiences, and Prime provided that Metroid sauce anyway.

The works in progress

Even though these games were not quite completed (I technically rolled credits on Silksong when getting Act 3 though), I still enjoyed a bunch of my time playing a bit of some of them.

Silksong - Honestly I am extremely pleased with the progress I’ve made on Silksong, from getting a lot of extra wishes and items, to finally unlocking Act 3 and starting to face against some new enemies, bosses and new areas that I have loved (and hated) to explore! Will definitely continue this adventure.
Terranigma - To be quite fair, I only played this gem for a couple short sessions, I even forgot to update my journal about it. In any case, I know how good this game is and I have to catch up with Sam soon.
Super Mario 3D World - My friends and I simply didn’t pick this one up enough times… I am very close to the finale though, but we are also collecting all the stars and stamps!
CrossCode - Some of my friends kind of lost steam, and I refuse to go without them even now, I hope they regain their morale and get into this journey again, it has been so nice!

The extras…

During the timespan of the challenge, I completed 9 more titles!—including some DLC and shorter indie games.

Title	Playtime
Monument Valley: Ida’s Dream	00:20
Monument Valley: Forgotten Shores	01:00
Monument Valley II	01:45
Monument Valley II: The Lost Forest	00:20
Monument Valley III	03:16
Monument Valley III: The Garden of Life	01:00
Jabberwocky	00:20
The Two Rivers Hypothesis	00:40

Monument Valley (overall) - This was a wonderful set of levels and artistic visuals that kind of blew me away from beginning to end! The overall puzzle design wasn’t always consistent, and some of the ideas were not explored as much as I would have liked, but everything there is was always a joy!
Jabberwocky - This was just a short indie Game Boy game that I beat in twenty minutes, a fun story you can get for free on itch.io
The Two Rivers Hypothesis - Another short indie title, with a much more serious existential horror theme, it is pretty quick to finish, and it’s a nice time if you are into speculative fiction stuff. Free on itch.io!

And the never ending…

There is always a big supply of other titles I’m playing, trying them out here and there. Games I got started with, games I’ve been poking at for years, you already know many of them!

Fire Emblem Awakening and Ocarina of Time have been an absolute menace on my Nintendo 3DS, with a lot of story yet to experience.
Faster Than Light and Minecraft have gotten plenty of playtime on my PC, especially the latter on a server with friends.
Donkey Kong , Astro Boy Omega Factor and the lovely Final Fantasy VI are still ongoing, claiming their spot on my emulation handheld.
Black Rock Shooter, Ys I & II Chronicles, Final Fantasy IV or Ridge Racer, keeping me busy whenever I give my PSP some love.

And of course, my Nintendo Switch alone has its own set of problems! From Kirby and the Forgotten Land which I’m barely getting started on, or the many little gems in UFO 50. The fantastic Tomodachi Life: Living The Dream which ate a bunch of my summer when it came out, and Super Smash Bros, still king of my multiplayer afternoons.

Not much else to say by now. The challenge is completed! It was a success, I played a bunch, and I had a lot of fun, I am probably going to try to keep a list going for the rest of the year too, but nothing as structural as this. Time to wait for the year’s recap and see how things turn out with only a few months left for 2026.

This is day 35 of #100DaysToOffload

Reply to this post via email | Reply on Fediverse

Read "Inside 'Project Lily': The Humans Reading Your ChatGPT Chats" - Molly White's activity feed

2026-09-15T15:21:23.000Z

Read:

“Inside 'Project Lily': The Humans Reading Your ChatGPT Chats”.

Joseph Cox in 404 Media. Published September 14, 2026.

Humans are reading ChatGPT users' prompts to improve OpenAI's models, and those chats can include sensitive, personal information, according to leaked internal documents and real prompts seen by 404 Media.

[RSS Club] Sorry for breaking your feed readers! - Terence Eden’s Blog

2026-09-15T11:34:26.000Z

You're part of the Groovy Gang because you're a member of RSS Club! These posts are only available on my RSS and Atom feed. This post is not available in the shops, on the web, via FTP, or anywhere else.

So, yeah, sorry! My last post apparently broke some people's RSS readers. I had a code sample which said ＜marquee＞ - despite being properly escaped, some feed readers double-decoded it and turned it into a literal marquee element!

With thanks to Neil and CaféHaine for the videos.

I got several reports that people's readers started scrolling like that and they'd raised issues with their feed reader. Ooops! Sorry!

That said, as far as I can tell, the feed is escaped correctly and shouldn't cause problems.

Here's the code (I've added in some spaces to ensure it doesn't cause any issues):


    Lorem ipsum & lt;marquee> dolor sed.

So what's going on? The feed is generated by the latest version of WordPress which uses CDATA to wrap HTML in a feed.

There is a 17 year old discussion about whether this is conformant on the WordPress issue tracker with the conclusion that it isn't incorrect and seems to work fine.

Is it OK? Is my feed broken or are a bunch of readers non-compliant? Let's go back to basics. The Atom spec says

If the value of "type" is "html", the content of atom:content MUST NOT contain child elements and SHOULD be suitable for handling as HTML. The HTML markup MUST be escaped; for example, "" as "".

RFC 4287: The Atom Syndication Format

Hmmmm. That would indicate that ampersand-l-t-semicolon should be interpreted as a less-than sign.

However, the whole thing is wrapped in which according to the XML spec means:



CDATA sections may occur anywhere character data may occur; they are used to escape blocks of text containing characters which would otherwise be recognized as markup.

Extensible Markup Language (XML) 1.0 (Fifth Edition)

So I think that a sensible feed-reader should see the CDATA block, grab the HTML inside it, and display it as-is. No need to unescape anything.

That said, I'll see if I can change my feed to not need this hybrid format. There's a brilliant blog post by Suren Enfiajyan which makes the case that regular escaping is probably good enough.

If you've experienced this bug - or think that I'm generating my feeds in the wrong way - please get in touch.



1Password's AI patching benchmark is misleading - Trail of Bits Blog
2026-09-15T11:00:00.000Z
1Password’s FLAWED report, published on August 6, 2026, gives defenders a misleading picture of AI patching. Its headline says models produced clean fixes only 26% of the time. That figure includes experiments that deliberately instructed agents to apply the wrong fix, along with experiments in which agents could not compile or test their patches.
The report risks making defenders less effective by discouraging them from using technology that could help them fix more vulnerabilities. Teams that take its headline at face value may leave repairable vulnerabilities unaddressed.
We want our work to help defenders fix more vulnerabilities. This post shares real-world data on human and agent patch quality from our consulting projects and Patch the Planet. We’re also releasing two agent skills: post-patch-validation to help agents test fixes, and review-walkthrough to help engineers review them.
How the experiment produces a misleading headline
Our review of 1Password’s code and data found four choices that make its 26% clean-fix rate a misleading guide to ordinary patching work.¹

The sample was selected for difficult fixes. The authors chose six vulnerabilities because their fixes were complex. Clean-fix rates ranged from 3% to 60% across those bugs, so the average depends heavily on which vulnerabilities made the list.²
Two prompts tell agents to apply the wrong fix. Those prompts account for 22% of the data. Combining them with ordinary repair attempts makes the reported rate depend partly on how often the researchers chose to give agents bad advice.
More than a third of the trials prohibit testing. One evaluation mode prevents agents from building or running code and accounts for 36% of the data. The headline combines those trials with experiments in which agents could test their patches and act on the results.
The models ran at different reasoning settings. GPT-5.5 ran at medium effort and Opus 4.8 at high. These were the tools’ defaults. Neither model was tested at its highest available setting, and the authors did not measure how increasing effort affected the results.

1Password’s headline also obscures a useful result in its own data. We reanalyzed the patches and recorded test results published with the study, keeping trials where agents could run code and were not instructed to apply the wrong fix. In those trials, 2,634 of 3,067 patches generated by 1Password’s models (86%) blocked the supplied exploit. We excluded runs that the study classified as having consulted the upstream fix. Blocking that exploit does not establish a complete repair, but these results show useful patching capability under reasonable working conditions that the headline fails to convey.
The instructions and grading introduce further problems, several of which Davi Ottenheimer has also highlighted:

The stopping rule and grading criteria disagree. Agents given a proof-of-concept exploit were instructed to stop once their patch defeated it. The grader then evaluated vulnerable paths that the supplied exploit did not exercise.
The grading penalizes intended behavior changes. Agents were told to leave existing tests untouched, even though a correct fix can require updating tests to reflect changed behavior. We found that 8% of ActiveMQ verdicts penalized an intended behavior change as a regression.
The automated grades disagree with human review. Models grading their own patches matched human reviewers on the full five-category outcome in 65.9% of reviewed cases. Agreement was 87.7% for whether the original bug was fixed and 70.5% for whether new bugs were introduced. (Table 24)
Changing the reviewer changes the result. The two models assigned different outcomes to 36.8% of the same patches. The headline averages their assessments. (Table 20)
The Linux reference fix contains a vulnerability. The authors found 248 generated patches that repeated an off-by-one error in the upstream fix. The automated grader caught that new vulnerability in only 24 of them. (Section 4.4)
The Chromium grader accepts incomplete repairs. It marked many patches as clean even though they left a use-after-free vulnerability in a callback. (Section 4.9)

The grading errors can penalize valid fixes and let vulnerable patches pass. Combined with the handpicked sample and deliberately bad instructions, they leave the report without a credible basis for its headline. Defenders should not take 1Password’s headline rate seriously as a measure of AI patching ability.
Developers get one in eight fixes wrong under ideal conditions
Understanding agent failures also requires understanding how often developers submit incomplete fixes. Our security consulting work gives us a detailed record of how developers repair vulnerabilities in their own software. We give clients detailed vulnerability reports, then conduct a “fix review” to check whether their proposed patches fully resolve the issues.
Our records connect each vulnerability to the developer’s first proposed fix and our assessment of whether it worked. They preserve unsuccessful attempts that developers revise before an issue is considered resolved.
We reviewed the first fixes submitted for 2,265 vulnerabilities across 236 Trail of Bits security assessments from 2024 to 2026. The developers maintained the affected software, had detailed reports from our engineers, and knew we would review their patches. Even under those favorable conditions, 283 first fixes failed to fully resolve the reported issue: 12.5%, or one in eight.





 

 




 


 

 
 Figure showing first fix submission outcomes
 

Accounting for multiple fixes from the same assessment, the 95% confidence interval is 10.5% to 14.5%. Sometimes we point out a mistake in a client’s patch during an informal conversation, and they correct it before the formal fix review. Those early failures may never appear in the review record, so our data can undercount failed first attempts. We also excluded cases where the available records did not establish whether the fix worked. A direct comparison with agents would require the same tasks and working conditions.
What happened to our patches in real projects
Through Patch the Planet, our joint initiative with OpenAI, Trail of Bits has co-authored hundreds of patches for widely used open-source projects. Agents wrote the patches with engineers directing the work and checking the results. Project maintainers then decided whether to merge, revise, or reject each submission.
How maintainers reviewed Patch the Planet patches
We examined the public review history of every Patch the Planet submission in our dataset that maintainers had merged or closed by September 14, 2026: 186 pull requests. 1Password’s benchmark used six vulnerabilities selected because their fixes were complex.
Maintainers merged 126 of our 186 pull requests, an acceptance rate of 67.7%.³ In 91 of those 126 pull requests (72.2%), maintainers accepted the security fix we originally proposed.

 
 
 Review outcome
 PRs
 % of merged PRs
 
 
 
 
 Total merged
 126
 100%
 
 
 Accepted with no security-relevant revision observed
 91
 72.2%
 
 
 Accepted with security-relevant revision observed
 33
 26.2%
 
 
 Indeterminate
 2
 1.6%
 
 

Table 1: Changes requested by maintainers for 126 merged Patch the Planet pull requests. Security-related revisions include repairs to a proposed fix and expansions of its security coverage.
Maintainer acceptance does not establish that every patch is correct.
Maintainers closed the other 60 submissions without merging them. Most were superseded by other work or declined for policy, process, scope, or maintenance reasons. Four were explicitly rejected on technical grounds.

 
 
 Reason for closure
 PRs
 % of closed PRs
 
 
 
 
 Total closed without merge
 60
 100%
 
 
 Superseded, reimplemented, or re-landed elsewhere
 36
 60.0%
 
 
 Policy, process, scope, or maintenance reasons
 14
 23.3%
 
 
 Duplicate or convergent with another fix
 3
 5.0%
 
 
 Explicitly rejected on technical grounds
 4
 6.7%
 
 
 Other or indeterminate
 3
 5.0%
 
 

Table 2: Reasons maintainers closed 60 Patch the Planet pull requests without merging
One of those closed submissions was our freenginx patch.
A maintainer and an agent introduced the same freenginx crash
1Password’s case study examines a Patch the Planet fix for a memory-safety bug in freenginx’s embedded Perl module. An agent wrote our patch under the direction of a Trail of Bits engineer. It left one vulnerable code path open and introduced a new crash during request cleanup. The paper’s criticism of our patch is correct.
The maintainer closed our pull request and committed a separate fix. That fix covered all three vulnerable code paths but introduced the same crash during cleanup. The paper documents the maintainer’s regression too.
Both authors encountered the same trap. The original bug allowed Perl to destroy a callback before freenginx used it.
Both fixes kept the callback alive so freenginx could use it later. But if the request timed out first, freenginx would make the request unusable and then release the callback. Releasing it could run Perl code that still tried to use the request, crashing the worker. Both authors missed a problem their fix could cause later, during cleanup. Catching it required looking beyond the original bug to what happened when a request ended early.
Two authors, one human and one agent, working separately, made the same mistake on the same bug. Readers deciding whether to use agents need to know how their failures compare with those of human developers. Establishing which is more reliable requires measuring both under comparable conditions.
We checked what happened after our patches were merged
We examined about 33,500 subsequent commits in Patch the Planet projects. When a later commit changed a file our patch had modified, we investigated whether it fixed a problem our patch had introduced. For each suspected regression, an agent attempted to demonstrate its impact with a proof of concept. Other agents and our engineers then challenged the findings.
The review found at least ten functional bugs; four build, test, or release automation bugs; and one performance bug. It found no exploitable security vulnerabilities. Two examples illustrate the problems we identified:

In go-jose, PR #240 fixed a missing-header crash but exposed an existing validation gap, allowing encrypted messages to succeed even when their key length contradicted the declared algorithm. PR #266 added explicit key-length checks before decryption.
In Noble FROST, PR #250 returned cached round-two results without first checking whether a retry contained the same authenticated transcript. Changed or stale retry data could therefore bypass that check. The maintainer corrected the behavior by validating retries against the original transcript before returning cached results.

We are extending this investigation to every patch we authored, including patches with maintainer contributions. The findings will help us add checks that catch these failures before we submit future patches.
Agent skills for better security patches
We are releasing two agent skills alongside this post: post-patch-validation to help agents test security fixes, and review-walkthrough to help engineers review code changes.
Post-patch-validation is a new skill we wrote to help agents catch incomplete fixes and regressions before submitting patches for review. It was not used in the Patch the Planet work described above.
The skill starts with a vulnerability report and the code before and after the patch. It guides the agent through four tasks:

Reproduce the original bug. The agent writes a check that must fail on the vulnerable code and pass on the patched version. A test that passes on both revisions cannot demonstrate a fix.
Test another path to the same failure. The skill requires at least one distinct variant based on the bug’s root cause, such as a different caller or a cleanup path.
Check for regressions and new vulnerabilities. It compares behavior that should remain unchanged and tests security properties around the modified code. The plan must also include project tests, a sanitizer check, or a bounded fuzzing run.
Treat broken test runs as inconclusive. A failed build or missing dependency must not be mistaken for evidence that a vulnerability was reproduced.

Failed checks give the agent specific problems to investigate and repair before submitting its patch. The skill saves the tests and results so maintainers can see what was checked.
To try post-patch-validation, install the skill and give your agent the vulnerability report and the vulnerable and patched revisions:
“Use post-patch-validation to validate the patch in HEAD against , using the vulnerability report in .”
Review-walkthrough helps engineers review the patches they are responsible for merging. It turns a branch’s complete diff into an interactive walkthrough that explains the changes in a logical reading order. Review findings appear beside the relevant code, where engineers can inspect them and draft their own comments. The walkthrough can also prepare a GitHub review for submission. Follow the quick start to generate a walkthrough for your branch.
These releases join our other public agent skills for improving security patches:

variant-analysis helps agents find related defects elsewhere in the codebase.
property-based-testing helps them test behavior across generated inputs.
mutation-testing helps them determine whether their tests detect incorrect behavior and identify missing assertions.

We publish these methods so other teams can use them to examine and improve their own patches.
What a useful patching benchmark should measure
A useful patching benchmark should measure whether agents help developers produce correct fixes and how much review those fixes require. The principles in our 2018 guide to evaluating fuzzing research apply here:

Choose a sample that matches the research question. Explain how the sample was chosen and which repair work it represents. Difficult cases can expose failure modes. General failure rates require a representative sample.
Measure the effects of working conditions. Give agents appropriate tools and instructions. Report model configurations and test how reasoning settings affect results. Report misleading prompts and restricted tool access separately.
Make correctness verifiable. Check that patches fix the vulnerability beyond the supplied exploit. Test for security, functional, and performance regressions. Validate grades against expert review and publish the tests, configurations, and results.
Show how results vary. Report per-vulnerability outcomes and variation across repeated attempts. Repeating trials on the same bugs cannot establish that those bugs represent everyday patching.
Measure what agents contribute to the repair process. Compare developers working with and without agents on comparable tasks and under comparable conditions. Measure initial patch quality and the review and revision needed to reach a correct fix.

We are optimistic about AI’s usefulness to defenders. Through Patch the Planet, we are committing engineering time to fixing vulnerabilities alongside the people who maintain the affected software. We examine failures so we can improve our methods.
We will keep putting agents to work on difficult security problems and making the tools and lessons public. We want other teams to test our conclusions and take these methods further. Our goal is to give maintainers without dedicated security teams the ability to find and fix vulnerabilities that would otherwise go unaddressed.




The paper defines a clean fix as fully resolving the vulnerability without materially changing application behavior. ↩︎


The six-target mean has a standard error of about nine percentage points, which the report does not disclose. ↩︎


As of September 14, 2026, our dataset contained 240 public upstream pull requests. We excluded the 54 submissions still open from the outcome analysis. We count pull requests, each of which can contain more than one patch, and exclude maintainer-written replacements from our merged total. ↩︎





It's Never Too Late to Learn - Kev Quirk
2026-09-15T10:21:00.000Z
Last weekend my wife called me over to show me something on her phone. She was going through her old emails and came across some emails we had passed back and forth, from when we first met.
She and I met in a club and went on a couple of dates, but then I deployed to Afghanistan with the Army. We continued to converse via email mostly, and phone where possible - this was before the days of FaceTime etc. - and the rest is history. That was in 2006, and 20 years later we're still very happily married with a couple kids.
Anyway, upon reading the emails I immediately wanted the ground to swallow me up. Not because they were overly mushy or lovey dovey (they were), but because the spelling and grammar were horrendous. I was never a particularly academic kid - in fact, I was mostly disengaged in school and really didn't try. I was clever, but I never applied myself. I was too busy being a stupid teenager. As a result, my written English was awful (it's still not great now, but it's better).
For example, I didn't know the difference between "there", "they're", and "their". And you can forget about "your" versus "you're". "Too" vs "to"? Not a chance. Where, were, and we're baffled me. I had no idea where a comma was supposed to go in a sentence, and I'd never even heard of an Oxford comma.
You get the idea.
Fixing the problem
During my time in the Army, written English wasn't really needed, so I wasn't too concerned. But after getting out and finding a job in IT, it quickly became apparent that my lack of basic English knowledge would hold me back. So I decided to fix it, and enrolled in a night school course.
To my surprise I really enjoyed it. It turned out that writing and learning are a lot of fun, and I was constantly looking for ways to practice my new found writing skills. I think that's part of why I still love typing - I just find creating words on a screen a lot of fun. Yeah, I'm weird. I know.
So I completed the night school course and came away with much improved grammar and a desire to write all the things. But replying to emails and writing reports in work wasn't scratching the creative itch for me.
Discovering blogging
One of the services the IT company I worked for offered was web hosting. I'd never really got involved in any of that, so learning about DNS, web servers, MySQL etc. was really interesting. I'd done a bit of basic web design during my college IT course, but never anything more.
"College" in the UK is different to college in the US. We call that university here. In college we do our A-levels, which are intermediate qualifications between high school and university. I don't have a degree.
A few of our customers had WordPress sites, and it blew my mind. Here is a web application that I can host myself, on my own server, with my own domain name. Furthermore, I can write what I want and publish it on the web for anyone to read. This was the creative outlet I'd been looking for!
So in 2010 I registered kevquirk.com, set up WordPress on a shared host, and started writing. Sixteen years later I'm still here, and still thoroughly enjoying writing on the web. Albeit no longer on WordPress.
Final thoughts
It's funny how these seemingly unrelated things connect together in retrospect and take us down a road we never thought we'd walk. Back in 2000, when I was leaving high school, if you'd have asked my high school English teacher (hi Mrs Daniels!) if she thought I'd be producing creative writing on the web for 16 years, she'd have laughed in your face. Hard.
But I am. And it's all thanks to a basic written English course that I attended for a couple of months, just to improve my writing to help me with work.
I'm not really sure how to wrap this one up. I suppose my final thought is that it's never too late to learn. And you never know where it will take you. A simple thing like a basic English night course could end up forming the longest running, most enjoyable hobby you have in your life.
                    
                        
                        Thanks for reading this post via RSS. RSS is ace, and so are you. ❤️
                        You can reply to this post by email, or leave a comment.

Review outcome	PRs	% of merged PRs
Total merged	126	100%
Accepted with no security-relevant revision observed	91	72.2%
Accepted with security-relevant revision observed	33	26.2%
Indeterminate	2	1.6%

Reason for closure	PRs	% of closed PRs
Total closed without merge	60	100%
Superseded, reimplemented, or re-landed elsewhere	36	60.0%
Policy, process, scope, or maintenance reasons	14	23.3%
Duplicate or convergent with another fix	3	5.0%
Explicitly rejected on technical grounds	4	6.7%
Other or indeterminate	3	5.0%

Shellsharks Blogroll - BlogFlock

What a time to be alive - The Weblog of fLaMEd

London Hardhouse Reunion 2026 - The Weblog of fLaMEd

Open Tabs August 2026 - The Weblog of fLaMEd

Beervana 2026 - The Weblog of fLaMEd

Gaming in public - Joel's Log Files

Agent email is spam - Posts feed

Favorite origami I've memorized - Joel's Log Files

Dollar Bill Camera by Won Park

Dollar Caterpillar/Fireworks by Jeremy Shafer

Full-Rigged Ship by Patricia Crawford

Rat by Eric Joisel

Origami Human by Claudio Acuña J.

Finishing thoughts

Pen N Review - Robb Knight • Posts • Atom Feed

On (disabling) suggested filenames on macOS 27 - James' Coffee Blog

Apple Notes now available in the LAS/SBS downloads - Johnny.Decimal

How to get a DOI for your blog posts - Terence Eden’s Blog

Buy my house! - Werd I/O

How I organised 15 years worth of passwords (video) - Johnny.Decimal

This week at JDHQ – 2026-09-15 - Johnny.Decimal

SBS improvements

AI: grunt work. Human: creative stuff

I can now 'move you in' to Life Admin or Small Business

Lunch?

Footnotes

More meaningful online interactions, please - Joel's Log Files

Summer Game Challenge 2026 results! - Joel's Log Files

The completed ones

Emio: The Smiling Man

The forgotten ones

The works in progress

The extras…

And the never ending…

Read "Inside 'Project Lily': The Humans Reading Your ChatGPT Chats" - Molly White's activity feed

[RSS Club] Sorry for breaking your feed readers! - Terence Eden’s Blog

1Password's AI patching benchmark is misleading - Trail of Bits Blog

How the experiment produces a misleading headline

Developers get one in eight fixes wrong under ideal conditions

What happened to our patches in real projects

How maintainers reviewed Patch the Planet patches

A maintainer and an agent introduced the same freenginx crash

We checked what happened after our patches were merged

Agent skills for better security patches

What a useful patching benchmark should measure

It's Never Too Late to Learn - Kev Quirk

Fixing the problem

Discovering blogging

Final thoughts