Shellsharks Blogroll - BlogFlock

Live concert, vacation, Ghibli films - W44 - Joel's Log Files

2026-11-03T20:45:00.000Z

I basically took a whole week off, thus my weeknotes are late as well. I was behind on my Monthly Summary and this had to wait for a little longer. Nothing too bad though.

This week was jam-packed with stuff, lots of updates on things that happened, stuff I bought, places I went to, and food I ate, from October 27 to November 2, 2026!

🛬 I flew on an airplane! It was my first trip in about five (maybe eight) years, and well, even though the trip was only about an hour long, it was still a pretty cool experience to have after such a long time. It is also the first trip I took by myself, given previous trips were with family or friends.
🚘 My trip was to Monterrey! One of the biggest cities in Mexico with over five million people. I think the one thing I realized as an adult compared to my childhood there is the amount of time you spend just stuck in traffic in big cities. Taking like an hour just to go to some place nearby is kind of a pain. Thankfully it’s not the only thing we did there.
🌮 Tried all sorts of food that’s common there and that I had missed lately. One of my favorites is the tostada siberiana, as well as gorditas, tacos de barbacoa, tortas and machaca con huevo. I also tried a coffee shop called Tim Horton which seems to be more popular than Starbucks here, interesting stuff!—there’s none where I live.
📚 There were a couple of book purchases this time around. On the digital realM—via Kobo store—I acquired the Star Wars Trilogy novelizations, Recursion by Blake Crouch, The Great Divorce by C.S. Lewis, and Making it So by Patrick Stewart. In the physical realm, I picked The Three Body Problem by Cixin Liu from my sibling, as well as acquiring The Pilgrim’s Progress by John Bunyan and The Screwtape Letters by C.S. Lewis from a local library in Monterrey.
🎲 Also bought a cool Rubik’s cube—if a little expensive—that is actually squishy! That’s the only reason I got it. It actually turns! although it’s an absolute pain to do so, just a nice trinket to have as a cubing enthusiast.
📻 The whole trip I stayed with family friends who I’ve known for decades (they are pretty much aunt and uncle to me). It was pretty cozy. My uncle showed me a whole collection of old coins from all over the country, all over the US, and all over the world. As well as some old tech gadgets and things around his home. I had seen a lot of this during my younger years, but I never really saw the appeal of it at the time. It was nice to find new appreciation for it all.
🎙️ One of the most interesting gadgets was a portable voice recorder, which used micro-cassettes and AA batteries! It still worked just fine and I managed to store my voice on it. My voice stored in physical format! Pretty cool stuff I have to say.
🎶 Went to my first concert! It was a live peformance of the album Eterno (Eternal), featuring Marco Barrientos, Marcos Witt and Marcos Vidal—three of the most influential singers of christian worship music in Spanish. It was all about the evolution of worship from old hymns, choruses, and contemporary songs. The music was amazing, hymns that are centuries old, songs that I’ve heard for decades, some I’ve never listened to before. All along classical instruments beautifully performed, and modern ones later too. It was a wonderful experience for me, I ran out of breath singing along!
👨‍✈️ On my flight back home, it looks like they had oversold tickets, and I was going to have to book another flight. I was already calling people to pick me up when support let me know that someone had canceled their seats, which means I was able to get back home as planned!
🛞 Some friends picked me up from the airport, and on our way back home one of the tires flattened. Unfortunately, the car jack also gave out and we had to wait for some help to come. Thankfully a taxi showed up which let us borrow their car jack and we managed to continue the ride without issue. Quite the way to get home!

A collage of pretty much all I mentioned, the concert, the flight, an old Motorola phone, snacks, food, screen caps, and more!

Watching

🐛🛩️ Nausicaa of the Valley of the Wind - WOW WOW WOW. I watched this film on a whim, after hearing so much about it. All I knew is that it was often compared to Dune and NOTHING MORE. I am extremely happy that I went fully blind and ready to be amazed for this one because AMAZE ME IT DID. This movie has it all. Some extremely awesome sci-fi concepts, some fantastic artwork, an incredible soundtrack, a really captivating story, and a beautiful message as well. Give it a go please.

☁️🏰 Castle in the Sky - WOW WOW WOW. I had to keep going on my Ghibli journey and decided to check this. The only thing I knew about it was the name of the floating city is “Laputa”, which is a pretty bad word in Spanish. Other than that I was AMAZED BY THE WHOLE THING AGAIN. I was NOT expecting the direction this wonderful thing took. It really reminded me of Breath of The Wild (and definitely Tears of the Kingdom although I haven’t played it myself yet) and it was so wonderful. Watch Ghibli movies.

💀📓 Death Note - Episodes 7-31. I continued my journey through anime-land by returning and binge-watching some more Death Note. I got through pretty much the whole thing now. Only the last few chapters remain. I definitely feel how the later episodes got a little convoluted and messy compared to the first 25 or so. Nonetheless, I am here for the ride wherever it leads (I already know the manga but I still enjoy the drama that the voice acting and the soundtrack brings).

Reading

🌌🪱 Dune Messiah - Well this book was pretty much already complete last week, I simply went through the last few chapters in half an hour or so, and yeah, that was some crazy stuff that unfolded all of a sudden, ending in the only way it could end. I really enjoyed the build-up and the writing and dialogue, as weird and challenging as it was, it kind of just felt right, I don’t know, but good book!

Gaming

🏰🦇 Castlevania: Symphony of the Night - I gave this a pretty good run while waiting at the airport and played it on and off during my vacation. This game is fantastic so far! Although it definitely has some aspects that you simply have to accept as what they are for the time. I have gotten plenty of unlockables and power-ups and discovered plenty of cool places. I’ve met some interesting characters with kinda whacky dialogue (and voice acting) and managed to get the Bat power-up at last. There are many secrets in this castle!

🗡🎲️ Slice & Dice - There was this very unexpected and huge update to this game that added HUNDREDS of new characters, power-ups, enemies and mechanics. Basically mods made by the community that were added to the base game by the developer. This has been absolutely incredible to see and it makes an already huge roguelike even more chaotic and fun. I am looking forward to doing some more runs of this gem.

Around the Web

I pretty much went offline on my blog reading during all of the week. I could be looking for something to share today but I’d rather not pretend like I read any blogposts. I did watch some YouTube videos though so you can check these:

Gunnm - Battle Angel Alita - Motorball CGI 3D VFX Short 銃夢 - A CGI short film from the year 2000 featuring Alita doing some sick moves. Only three minutes of PS1-style FMV graphics!
Running Minecraft Until It Beats Itself - This was a wild video to watch and I really had fun seeing how everything happened on it. Billions of years of simulation, this is what the internet is all about!
They sold us a lie (and it’s still working) - Putting the blame on climate change on the people rather than corporations and lack of policies, evil stuff!
How are people reading so many books? - I was feeling self-conscious about how I feel happy to have read three books in a month when some people seem to read dozens, but I feel ok now.

This is day 62 of #100DaysToOffload

Reply to this post via email | Reply on Fediverse

Just a little AI resistance, as a treat - Terence Eden’s Blog

2026-11-03T12:34:31.000Z

At the recent EMFCamp, I bumped in to Professor Kate Devlin who was talking a little about the AI Resist List. I think one of the useful things we can do is loudly complain about shitty uses of AI. Here's an example.

As mentioned in a previous post, I'm contacting companies which send malformed calendar invites. One of the organisation I contacted was the British online supermarket Ocado. They don't have an easy way to contact their technical team, and no obvious paths to raise a bug report, so I filled in their usual customer service feedback form. I included a clear statement of the problem and a detailed technical analysis of why I thought it was a problem with their service.

After sending in my message, I received this back from "Lulu" at Ocado:

Thanks for getting in touch and sharing this feedback about our calendar files.

You're entirely right—having a technical glitch pop up when you're trying to organise your delivery is a real pain, so I've made sure to pass your feedback on to our technical and webshop team.

We really appreciate you taking the time to help us improve our service. I hope you have a wonderful rest of your day

I mean, that's AI right? It starts with the classic tell of a sycophantic agreement.

Next up is the em-dash. Beloved by chatbots but almost unheard of in British English style guides.

Finally (and this is hard to quantify) it just doesn't feel like a customer service response. They're usually poorly spelled, have dodgy grammar, and ask a bunch of irrelevant questions. The message gave me no confidence that anyone had looked at the problem and I doubted it had been passed on to a technically competent human.

I immediately got a customer satisfaction survey. Usually I give top marks to humans because, even though Net Promoter Score is bullshit, I don't want customer service agents to suffer the indignity of a bad review. But in this survey I vented my spleen - giving crappy 1 ⭐ scores on every metric and complaining vociferously about how rude it is to use an AI to deal with a genuine complaint.

I was both surprised and delighted to receive this back a few days after my invective was sent:

I saw your survey comment about getting a robotic, AI-generated response previously, and I wanted to reach out personally to apologise. There is nothing more frustrating than pointing out a legitimate bug only to feel like you're talking to a brick wall. I promise you there is a real person typing this out!

Second, I wanted to send a massive thank you for the incredibly detailed diagnostic. It is rare to get feedback that tells us exactly what is broken and how to fix it.

I can assure you that this has been passed to our team to look into. Your feedback is going to make things much smoother for a lot of people, and we really appreciate you taking the extra time to help us get it right.

Thank you again, I do hope that this issue is resolved quickly. If there is anything else I can help with in the meantime, please don't hesitate to get in touch.

Perhaps I'm being touchingly naïve, but that feels a lot more human, right? The grammar isn't perfect, the sentences are a bit more rambly, and it appears to have actually engaged with the contents of my message.

I get that having a million irate customer service messages is a hassle. Using AI to triage them probably makes business sense, summarising the verbose ones could be useful for customer service agents, and totting up general themes is almost certainly a sensible way to gather metrics without overloading the workforce.

But using an AI to reply to a human is just disrespectful. It says the organisation values their customer's time at less than their own.

It's OK to call out shitty AI responses and insist that a human engages with you.

The cryptography behind electronic voting (and why paper ballots are still essential) - Trail of Bits Blog

2026-11-03T12:00:00.000Z

As millions of Americans vote in today’s U.S. midterms, most will use paper ballots, which are protected by strict chain-of-custody protocols and, in some cases, statistical audits. You may wonder why we still use paper for our elections and voting systems when tasks like banking, tax filing, and document signing have moved away from paper-based legacy systems and become fully electronic. The short answer: security.

That may come as a surprise to some. After all, cryptography and other security advancements have enabled secure electronic systems for many applications. In fact, cryptography can be used to provide two essential safeguards in elections: keeping (1) individual votes secret while (2) making the final tally independently verifiable. This is exactly the approach of cryptographic protocols like Helios and ElectionGuard. However, Helios intentionally targets lower-risk and lower-coercion settings rather than high-stakes public elections. ElectionGuard, by contrast, is intended for public elections, but not as a replacement for a paper-based system; it is used as a cryptographic layer integrated with traditional voting infrastructure.

In this blog post, we’ll explain how cryptographic techniques can help protect ballot secrecy and prevent manipulation in electronic voting systems, and explore the limitations of these systems. Although cryptography can strengthen election verifiability and have other strong security properties, it cannot fully replace the security and trust of existing paper ballot systems in general elections.

The challenges of electronic voting

The National Academy of Sciences’ excellent 2018 report on election security concludes that electronic ballot return (also known as online voting or internet voting) should not be used in general elections, since “no known technology guarantees the secrecy, security, and verifiability of a marked ballot transmitted over the Internet.”

The difficulty of this problem makes sense when you consider the strong security guarantees any election system requires:

Voter privacy must be maintained, even if a voter has a financial incentive to disclose their vote to a third party.
Ballot integrity must be maintained. This becomes especially challenging in the electronic setting because, in general, the voter does not hold a cryptographic identity and cannot sign their ballot cryptographically. Oh, and the electronic voting client and server may be compromised anyway.
Voters shouldn’t be able to vote more than once, but this is hard to verify without associating votes with their voters. This becomes even more challenging electronically when, again, voters often lack a digital cryptographic identity.
Everyone should be able to trust (and ideally verify) that the election result correctly reflects the voters’ intent.

Paper-based voting systems must solve these problems, too. The first three requirements are typically met through standard physical security measures you see in paper ballot election locations: voters identify themselves to polling workers (preventing multiple votes from one person), are given a ballot without their name on it and a secure location to fill it in (protecting voter privacy), and personally hand their ballot to a polling worker and watch as their ballot is submitted for counting (ballot integrity). As with any security controls, there are threats that can compromise these protections; however, compromising them at a nationwide scale is extremely expensive, difficult, and noisy (i.e., detectable) to election observers, making these controls especially effective for large national elections. The final requirement is the most difficult to achieve for paper-based systems, and voters typically have to trust that election workers compute the final tallies honestly, and that chain-of-custody controls coupled with post-election audits would detect any attempt to compromise the election outcome. Cryptography can be used in conjunction with paper-based systems to help strengthen the trust in this final requirement, using what’s known as end-to-end verifiability, as we will explore later in the post.

Electronic systems introduce an existentially dangerous failure mode not present in modern, sensible paper-based systems: a supply-chain or 0-day vulnerability that can scale across many voting machines and jurisdictions could allow one person to single-handedly control and influence the outcome of an election (and, depending on the system and exact vulnerability, possibly while evading detection). In traditional paper-based systems, this risk is sharply constrained by independent physical records and physical security controls. It’s much more difficult for a single person to meaningfully change an election’s outcome while evading detection in this system.

Software security alone is not enough to secure electronic voting systems, though; the key design principle is not only to implement robust security controls but also to design your system so that all failures of those controls are detectable. This can’t be solved only using software whose correctness must be trusted. This property is known as software independence: changes in the election outcome caused by changes or errors (or vulnerabilities) in voting software must be detectable. In practice, this is typically achieved using evidence that can be verified independently of the voting software, such as a paper ballot audit trail.

Inside the design and cryptographic safeguards of electronic voting systems

Now that we’ve introduced the challenges of electronic voting, let’s explore how modern system designs aim to address them. We will focus our discussion on two electronic voting systems in particular: Helios and ElectionGuard. Helios is a complete voting protocol that targets low-stakes elections where coercion is not a concern. Famously, it is used by the International Association for Cryptologic Research to elect its board of directors. ElectionGuard aims to provide end-to-end verifiability on top of existing election infrastructure, and has been tested alongside systems based on paper ballots in College Park Maryland, Preston Idaho, and Fulton Wisconsin. Let’s look at how these systems use cryptography to provide voter privacy, ballot integrity, and end-to-end verifiability.

Protecting voter privacy

Encryption is a natural choice to preserve voter privacy and ensure that cast votes cannot be read by anyone else: by having the voting client encrypt ballots before they are returned, we protect them from being read in transit. But who controls the key we encrypt to? If we encrypt ballots to a public key controlled by the backend server, it could just decrypt each ballot when it is received, which would immediately reveal how users voted. (Even if the ballot is sent anonymously, the backend would still know how users at a particular voting station voted; it would just not be able to associate individual ballots with the corresponding voters.)

One way of solving this problem is to threshold-share the keypair used for encryption, and split the private key between $N$ trusted election officials. This means that a predetermined quorum $t+1\ \leq N$ of the trustees have to be involved in order to decrypt ciphertexts. Using a homomorphic encryption scheme offers further protection for individual encrypted ballots: it allows the backend to compute an encrypted tally from the encrypted votes and only decrypt the final result. As long as $N-t$ election officials are honest, this protects the confidentiality of cast votes from the voting client to the inclusion in the final tally¹.

${{E}_{K}({x}_{1}+\ \ldots \ +{x}_{N})\ ={E}_{K}({x}_{1})\ \oplus \ \ldots \ \oplus {E}_{K}({x}_{N})}_{}$

With homomorphic encryption, the server can compute the encryption of the sum of the individual votes ${x}_{i}$ as the sum of the encrypted votes ${E}_{K}({x}_{i})$.

Schemes like Helios and ElectionGuard use a version of exponential ElGamal to encrypt individual choices on the ballot². If the threshold-shared election key is $K\ =\ {g}^{k}$, the choice $x$ is encrypted as ${E}_{K}(x)\ =\ ({g}^{r},\ {K}^{r}{g}^{x})$, where $r$ is a random scalar. This scheme is additively homomorphic using pointwise multiplication of ciphertexts, as shown below.

${E}_{K}(x)\ \oplus {E}_{K}(y)\ {=}_{}({g}^{r}{\cdot g}^{s},{K}^{r}{g}^{x}\cdot {K}^{s}{g}^{y})\ =\ ({g}^{r+s},\ {K}^{r+s}{g}^{x+y})={E}_{K}(x+y)$

Exponential ElGamal is additively homomorphic if we define $\oplus$ as pointwise multiplication of ciphertexts.

Note that decryption yields ${g}^{x}$ rather than $x$, which is typically hard to invert. However, since $x$ is comparatively small in this case, we can use brute force (or tables) to recover the exponent.

As an example, if we use 0 to indicate No and 1 to indicate Yes, we can compute the number of Yes-votes by summing the individual encrypted votes as described above, and then decrypting the encrypted tally to reveal the result. However, if we don’t ensure that individual ciphertexts are well-formed, a compromised client could simply encrypt the value 1,000,000 to vote Yes a million times. To prevent this, clients must include a zero-knowledge proof ensuring that the encrypted ballot contains a permitted value (or a permitted combination of values).

Protecting against a compromised voting client

What if the voting client is hacked and alters the voters’ choices before they are encrypted, or drops the ballot completely? To protect against client compromise, the voter needs a way to ensure that the backend received their ballot, and that the choices recorded and encrypted by the software client correspond to how they actually voted.

This can be achieved in different ways. Helios and ElectionGuard use a mechanism known as Benaloh’s challenge method. The underlying idea is that when the ballot is encrypted, the voter obtains a commitment to the encrypted ballot and is then allowed to challenge and spoil their ballot. If they do, the ballot is opened and the voter can verify that their choices were recorded correctly and that the commitment corresponds to the encrypted ballot. The device has to reveal the commitment to the voter before learning whether or not the voter wants to challenge the encrypted ballot. Otherwise, it could present a correct commitment only when it is challenged. Moreover, it must be possible to obtain some external validation that the committed ciphertext actually encrypts the voter’s intended choices. Otherwise, the voting client can simply lie and present a plaintext that doesn’t match the commitment.

When the voter is satisfied that the voting client records their choices honestly, they record their choices one last time and cast their ballot, which is then published to a public bulletin board. The voter can use their commitment to check that their encrypted ballot is included in the published election record.

While this protocol provides a method to detect a compromised voting client that tampers with the voter’s choices or drops ballots, it still requires that a significant portion of voters exercise the mechanism in order to ensure that compromised clients are detected with high-enough probability³. Moreover, it does not protect against other types of compromise, like a voting client surreptitiously sending the voter’s plaintext ballot to a third-party server.

Additional issues must be solved in order for this method to be secure. One is the problem of voter authentication: how does the voting client ensure that the voter is eligible to vote, and how do we ensure that only one vote is cast? Additionally, there is the previously mentioned problem of coercion: how do we protect voters from being strong-armed into voting for a specific candidate or issue when voting stations may be spread out all over the world?

Authenticating voters is generally a difficult problem in countries (like the U.S.) that do not have a widely used national ID. However, there are options available for specific groups of voters. For example, some voting systems designed for overseas military voters use the Common Access Card to allow service members to identify themselves. Protecting voters against coercion typically requires that voters are able to vote without being supervised, which seems like a difficult problem to solve using cryptography.

Protecting against a compromised backend

What if the backend server is faulty or compromised by an attacker? With encryption, the backend aggregates the encrypted votes into an election record, computes the encrypted final tally over the encrypted votes, and then lets election officials decrypt the result. Encryption protects voter privacy, but it doesn’t stop the server from dropping, altering, or injecting votes into the election record. How could we allow voters to verify that this did not happen?

If the election record is public (and we can ensure that everyone shares a consistent view of it), voters can verify that their encrypted vote is included in the record using their commitment to their encrypted ballot, as described above. This provides a mechanism to detect a compromised server which attempts to drop or alter votes. Again, we need to rely on active participation from many voters to ensure that a compromise is detected, since a voter can only detect if their individual ballot has been dropped or tampered with.

ElectionGuard extends this idea to allow voters to detect a change in any of the ballots cast before theirs by chaining ballot commitments generated on the same device. Without chaining, the commitment is essentially computed as a hash of the voter’s encrypted ballot. With chaining, ballot commitments are chained as follows:

${c}_{1}=H({c}_{0}\ ,\ {B}_{1})$ ${c}_{2}=H({c}_{1}\ ,\ {B}_{2})$ ${c}_{3}=H({c}_{2\ },\ {B}_{3})$ $\vdots$

When ballot commitments are computed as a chain, the hash chain is published together with the election record. Here, ${B}_{i}$ is voter $i$’s encrypted ballot.

This means that any changes are propagated forward, allowing voters to detect tampering with earlier votes cast using the same voting client.

Detecting a compromised server that injects additional votes is more difficult and usually requires external data, like voter participation records, to solve. It is not enough to associate encrypted ballots with voter identities, since a malicious server could pad the election record with ballots corresponding to abstaining voters.

Once the election record is trusted, it is possible to use zero-knowledge proofs to verify that the final result is computed correctly from the published election record. Since anyone can compute the encrypted tally from the election record, we only need to prove that the final aggregate ciphertext was decrypted correctly.

What cryptography solves that paper ballots can’t do alone: end-to-end verifiability

Recall our fourth requirement for election systems, which we admitted was most difficult to achieve for paper-based systems: Everyone should be able to trust (and ideally verify) that the election result correctly reflects the voters’ intent.

This requirement is usually formalized in terms of end-to-end verifiability, which means that the following should be possible:

Each voter should be able to verify that their choices have been correctly recorded.
Anyone should be able to verify that the final tally is computed correctly from the election record.

Taken together, these two mechanisms allow voters to independently verify that their vote contributed to the election outcome, without relying on a particular piece of software or hardware (which may be hacked), or external observers (who may not be trustworthy). This property isn’t achievable in exclusively paper-based election systems without introducing some level of trust in humans/institutions overseeing the election. For example, without trusting anyone, how do you know what happens to your paper ballot after you and your vote both leave the voting location? The reason you won’t know this in an exclusively paper-based system is simple: in order to protect vote secrecy, when you submit your ballot to be counted with the other ballots, you intentionally break the link between your identity and your ballot.

Well, using cryptography, you can introduce a mechanism to verify that a cryptographic representation of your vote was included in the election record while still preserving voter privacy! This mechanism is exactly what was described above: encrypt the ballots and publish them to a public bulletin so that voters can privately check that their vote was both included and not tampered with. This allows you to enhance trust in existing paper-based election systems without compromising their security properties. This is the exact design choice behind ElectionGuard.

We won’t be replacing paper ballots any time soon

Helios and ElectionGuard both build on the ideas outlined above, but their use cases differ. Helios explicitly targets settings with low coercion risk and advises against use in high-stakes public elections. ElectionGuard, on the other hand, is built to provide end-to-end verifiability on top of an existing paper-based voting system. Neither protocol makes a general claim to solve the problem of electronic voting because neither achieves the security of status quo paper-based systems purely electronically.

There is widespread agreement among experts on election security that paper ballots are essential for protecting the security and integrity of general elections, and that likely will not change anytime soon. However, cryptographic techniques like the ones described in this post can still be used alongside paper ballots to improve trust in the election outcome by improving the result’s public verifiability and auditability.

If you’re using cryptography to build a new voting system, please reach out. We want to hear about it!

A higher threshold is not always better. Helios requiring all trustees to participate to decrypt the election result caused the IACR to have to rerun their 2025 election after it found that one of the trustees had inadvertently lost their share of the key. ↩︎
Helios and ElectionGuard differ slightly in how they implement encryption. Here, we describe the method used in Helios since it’s closer to standard ElGamal. ↩︎
As an example, if a compromised voting client tampers with 1000 votes, and voters challenge one encrypted vote in one hundred on average, the probability of the attack remaining undetected would be 0.991000 ≈ 4.3 ∙10-5. However, it is also important to consider what recourse a voter has if tampering is detected. This determines whether they are apt to raise concerns, or simply shrug their shoulders and try again. ↩︎

What there is to see - James' Coffee Blog

2026-11-03T00:00:00.000Z

A browning leaf fell from the tree with grace
“I had no idea leaves could be so tiny.”
A large yellow leaf fell into my embrace
“This is my dream – ever colourful and shiny.”

Stacks of leaves lie at the feet of their past
Layers of reds and yellows – veins of time
Ever maturing with life ever vast
From sunrise to evenfall – may Day shine.

Chatbot election answers are dominated by one right-wing dude and an army of AI slop. - Werd I/O

2026-11-02T21:01:38.000Z

Link: How an obscure website became a force in America’s election information machine, by Ian Duncan and Kevin Schaul in the Washington Post

There hasn’t been enough discussion about the proliferation of reference sites that are built not for humans but to influence chatbot answers. Take the Ballot Brief, which was designed to influence questions about the election:

“In tests by The Washington Post, ChatGPT cited the Ballot Brief in 22 percent of its answers to questions about the election. Microsoft’s Copilot cited it in 75 percent of answers. […] Anthropic’s Claude initially turned to established voter guides run by nonprofits — but started frequently linking to the Ballot Brief in The Post’s second round of tests.”

The Ballot Brief is, in itself, built using AI, with one guy — Ben Torres Ezrick — in control. Here in the US, 42% of adults use AI to ask questions, including about the election. That gives Torres Ezrick outsize influence on information people receive that may influence how they use their vote. Given that Torres Ezrick’s most recent position was Chief Marketing Officer at the far-right video streaming service Rumble, that should probably give us some pause.

And even without that potential rightward skew, the Ballot Brief consists of a bunch of content created at scale using AI with little oversight. So inevitably, there are mistakes:

“The Post identified numerous mistakes on the Ballot Brief. Sen. Jon Husted (R-Ohio) was credited with supporting a bill that passed before he took office — an error that Copilot repeated in a response to The Post. Two Robert Garcias running in California were collapsed into one profile. And several House members were listed with incorrect committee jobs.”

The web has already been insufferable for years because of SEO; this has only gotten worse with the rise of AI-generated marketing content. Now it stands to become a battleground as various entrenched interests fight to have their perspectives represented in chatbot results.

Should newsrooms counteract this with their own set of open, validated information? Or is it an unwinnable arms race that is bound to be dominated by moneyed interests? I’m not sure. But the web is certainly no longer just a place for humans to publish and be heard.

Lorem Ipsum Dot Gov Dot UK - Terence Eden’s Blog

2026-11-02T12:34:00.000Z

I love testing in production. The thrill of accidentally publishing some dummy data - or taking down an entire website - is similar to skydiving without a parachute. Exquisite excitement followed by heart-stopping terror.

Before going live with a new website or service, it's sensible to test how text looks on it. Most people don't test with readable text - it's too easy for management to start reading the content rather than looking at the layout. So the default is the Latin text "Lorem ipsum". Latin looks enough like English to get a feel for how text will render - but most people can't read it so they gloss over the words and look at the layout.

Say, it sure would be annoying if those dummy pages ever made their way to production, right?!?

One of the things that's fascinating about seeing testing data in a live environment is that you get a small peek behind the curtain of how a site was made. A tiny glimpse into the minds of the people who made it.

Who was Alice? Did she enjoy her time working on the London Councils' website?

Was she friends with Henry at Lambeth council? We may never know.

Some of the placeholders eventually become load-bearing. For reasons which remain inscrutable to those who follow, the Elders declared some pages must remain sacrosanct forever!

What would happen if that page were deleted? Would you dare risk it?

Sometimes finding a test page leads to a dead end. A stub of a page which should have been purged before go-live.

But other times it can lead us to a page hinting at something more. Deeper tests of long-forgotten functionality.

What did those plugins do? Aaaaaaaa indeed!

The purpose of this post isn't to point and laugh, it's to show that searching for dummy data is a good way to find interesting things. It might show you a style-guide, or lead to you to a forgotten and outdated plugin, or it might lead you to an entire pre-production environment.

Finally, this image was on one of the FCDO blog posts. I assume that means it is available under the Open Government Licence and, therefore, I can start T-Shirt production immediately!

St Jude Drawings Gallery - Robb Knight • Posts • Atom Feed

2026-11-02T12:28:00.000Z

Now it's been a month of so since the end of St Jude September I think enough time has passed that I think everyone's drawings should have arrived now so I can share them. It's hard to pick a favourite but here's a selection of them I wanted to highlight here because I enjoy them. I won't be including Jimothy because I included him in the last post, not because I don't love him.

I can't wait to do this again next year. I scanned all the drawings this year so I've put them all up on the 2026 gallery for your perusal.

Backporting security fixes at scale with Codex - Trail of Bits Blog

2026-11-02T12:00:00.000Z

Stable Linux releases lack existing security fixes because backporting them is time-consuming and often thankless work. We’re using Codex to reduce the backporting process time from days to hours per fix, empowering human patch reviewers to rapidly submit fixes for critical software like Ubuntu Long Term Support, Fedora, and the Linux kernel. By October 29, our project helped deliver fixes for 149 distinct CVEs into stable Linux kernel releases, and several fixes to Fedora and Ubuntu packages.

Deploying fixes to older software requires multiple steps, including adapting fixes to older code, checking dependencies, and ensuring the fix did not introduce new bugs. A single task (like tracking down a bug in a bad commit) can take a week or more of effort that no one sees or appreciates.

Our Codex workflow has reduced the human effort required to prepare and review fixes. Excluding project-specific initial setup, preparing and reviewing a straightforward backport takes about 30 minutes of human attention; a more involved case can take around three hours. The workflow’s approach is twofold: agents perform activities like identifying missing fixes, adapting patches, assembling validation evidence, running tests, and preparing submission packets, while engineers review the patches and submit them to maintainers.

Those estimates only cover patch preparation and review; regression testing and maintainer acceptance remain essential. But the reduced human commitment makes a substantial class of neglected security work practical to undertake. The patch backlog is large, but we now have a practical way to work through it.

Do we have to decide between stability and security?

Software has bugs, and we try to fix them when we can. The first place the fix happens is in the latest version of the software. Unfortunately, that’s often the only place where the fix happens.

Backporting is the process of getting a fix from the latest source code to older versions. Fixes for big-name, critical bugs are indeed often backported quickly. But for many other bugs, the backporting process never happens. It is easy to understand why: software packaging is often done by volunteers who are already overworked, and backporting is frustrating, thankless work that gets little credit or publicity. For open source projects staffed by teams of volunteers, backports are (understandably) a low priority. As XFS developer Dave Chinner once described, this work is “effectively a full time job” that simply goes undone without sufficient resources.

The lack of backports is a problem because almost no one runs the latest and greatest version of software that’s been freshly built with today’s code changes. People overwhelmingly prefer slightly older, more tested software packaged in “long term stable” releases. For example, about 95% of Ubuntu Linux installations are of the Long Term Support (LTS) variety. When looking at installed Linux kernel packages from Debian’s popcon, the overwhelming majority are based on older stable trees:

Figure 1: A Codex-generated graph of recently installed kernel packages from Debian’s popcon. The overwhelming majority (about 96%) are older, stable releases, and not the latest kernel series.

Users are faced with a decision: they can either stick with a stable, familiar version of software that has security flaws, or upgrade to a newer version that fixes those flaws but introduces other changes and new features they may not want.

Many people purposely do not update to new releases; I think this is entirely justified and normal end-user behavior. Just recently, I updated my Mac to macOS 27 and couldn’t use a printer that had worked flawlessly for years (until Codex wrote a new, compatible printer driver). Similar situations effectively require older software.

We should not have to make a choice between stability and security.

Thousands of known CVEs lack stable-branch fixes

A swarm of cyber-capable AI agents can cut through a network of stable, known-vulnerable software like a hot knife through butter. The scale of the problem is such that the software you are currently running likely contains unfixed security bugs that can be exploited by modern AI agents. As AI-assisted bug hunting makes it easier to identify vulnerabilities in older code, reducing this backlog becomes increasingly important. This is not merely theoretical. A fix for the latest high-profile bug, CVE-2026-98432 (a critical remotely exploitable flaw in the Linux TCP stack), still had not landed in distribution kernels weeks after being patched upstream. That bug is high-profile enough that it will soon be fixed everywhere. But fixes for more obscure bugs never get backported. I saw this during my sandbox escape research, and an old vulnerability in stable software was used as a part of the recently disclosed OpenAI hack.

Let’s quantify the scale of the missing backport problem. To make counting simple, we can limit ourselves to known bugs (with assigned CVEs) that are patched in the latest release but missing from stable packages. For this example, we’ll look at the Linux kernel, Ubuntu 26.04 LTS and Debian 13 Stable. I’m not singling out those projects—they are all run very well! I’m using them because they have documentation and accounting for unfixed CVEs. Other projects lack this transparency.

Let’s look at the number of outstanding CVEs in the Linux kernel, by stable branch. The table below shows CVEs per supported stable branch that do not have a fix in that branch, but do have it in a newer branch. (Hence, older branches by definition have more unfixed CVEs.) The source is the kernel CVE team’s vulns.git as of September 18, 2026. This is not an exact bug count, as it both over- and under-counts due to several technicalities. It is also not a measure of exploitability. Rather, it’s a measuring stick showing that a substantial amount of known CVEs have not been fixed in stable kernel branches:

Branch	Unfixed CVEs	% CVEs with an NVD Score	High or Critical Severity
5.10.y	2,006	55.8%	213 (19.0%)
5.15.y	1,889	51.5%	195 (20.0%)
6.1.y	1,329	43.9%	99 (17.0%)
6.6.y	1,012	35.6%	65 (18.1%)
6.12.y	686	22.3%	21 (13.7%)
6.18.y	337	15.1%	3 (5.9%)

The package landscape is not any better. These are non-kernel CVEs reported as open or affected in Debian 13 and Ubuntu 26.04 (raw data via their respective bulk CVE data feeds, compiled by Codex). These are distro-metadata findings, not individually source-confirmed vulnerabilities. Again, this is not meant to be an exact bug count, but more of a measuring stick indicating how many unfixed vulnerabilities remain in stable software packages:

Distribution	Source Packages with Unfixed CVEs	Unique CVEs	High or Critical Severity
Debian 13	1,128	4,562	1,822 (39.9%)
Ubuntu 26.04	1,028	770	335 (43.5%)

Engineers and AI can accelerate backporting

We realized this was an issue and have been fixing it proactively. First, we started with the equivalent of finding money on the sidewalk: there are bug fixes to known CVEs that apply cleanly to the stable kernel trees, but the fix was just never pulled into the kernel. We used Codex with GPT-5.6 to find these fixes, and asked the maintainers to apply the existing patches. They did, graciously. We then moved on to backporting patches that don’t apply as-is, starting with the most trivial to validate and review, and are slowly moving towards more complex changes. So far 149 CVE fixes in stable trees are currently applied; the list on our backport tracker just keeps growing.

We’ve done the same for Linux distributions: we used Codex and GPT-5.6 to identify known vulnerabilities in shipping stable packages, and then backport and validate a fix. We have begun reaching out to Linux distributions with an initial batch of patches.

If you run an open-source project or a Linux distribution and would like help backporting security fixes, please apply at trailofbits.com/patch-the-planet and we’ll be glad to assist.

The big upside of stable software that does not add features is that we can, in theory, fix bugs before attackers exploit them. So, let’s continue to patch the planet!

Rest of World tells vital stories about the impact of tech on the world. We may lose it anyway. - Werd I/O

2026-11-02T01:32:00.000Z

Link: Rest of World faces prospect of shutting down, by Max Tani in Semafor

I was distraught to hear that Rest of World may have to shut down in January. Since its launch, I’ve relied on its coverage about the impact of technology and the tech industry on communities and geographies that often fall outside of a Western lens. And I’ve become a huge fan of its Chief Product Officer Michael Donohoe, who I think is one of the best product and engineering people working in journalism (or in any industry). Working with a small team, he’s built a site and underlying tech that punches way above its weight.

On one level, the forces that have created issues for Rest of World aren’t unique to it: declining search and social referrals, intermediation by AI chatbots, and a fixation with the Trump administration at the expense of other topics.

But then, as Semafor reports, Rest of World had a unique problem in that its audience was partially the tech industry itself, which has shifted to become more insular and conservative:

“The organization’s leaders also attributed the decline to a deeper cultural shift to the right within the tech community. One senior leader at the organization said they believe tech news readers who previously expressed liberal values and an appetite for consuming global journalism have grown disillusioned with the news media, and now prefer an information diet of inward-looking podcasts, YouTube shows, and chatbot outputs.”

This coincided with a tonal shift in coverage of the tech industry from typically fairly optimistic, glowing pieces about connection and innovation to criticism about oligarchy and the role of tech power in the global rise of authoritarianism. Looking at Rest of World’s homepage today, many headlines are now about how communities around the world are being either taken advantage of by American AI firms or left out of AI developments.

That’s vital coverage, in my opinion, and makes Rest of World required reading for me — but for an industry that likes to be praised for changing the world and is bad at engaging with criticism, it might be a tough read. Semafor notes that the likes of Wired and The Verge, which also produce excellent coverage, are suffering from the same problem (although I’ve also heard that Wired’s subscriptions are growing).

What’s surprising to me is that Rest of World should also be required reading for a whole slew of foundations and NGOs that want to make a positive impact globally, as well as investors looking to support ventures in underserved markets. Clearly this either isn’t happening or it’s not happening in a way that converts into the kind of financial support the newsroom needs.

It’s also, in a way, a warning about newsrooms started by founders with deep pockets. Sophie Schmidt (Eric Schmidt’s daughter) committed $60M to Rest of World a months into its launch. That gave it both a solid mission and an enormous runway that may have made it harder to test and pivot. It did pivot, to focus more on countries that Western readers might be more interested in, as well as to require user registration as a way to know its audience better, but it was relatively late in its life. I’m very grateful for the resulting coverage but I think it would be worth having an open conversation about whether those funds helped or hindered its ability to become sustainable in the long run.

Anyway, I hope it finds a home. I badly want it to continue to exist. For me, it’s the best tech journalism there is.

Anticipation - James' Coffee Blog

2026-11-02T00:00:00.000Z

Does the tree anticipate the sunrise, or nonchalantly receive its growing light?

Is the sun why leaves turn yellow in autumn, the colour coming from months of light, and, anticipating darker nights, the tree becomes the sun for as long as it can, before shedding into the new silver season?

The hope-filled tree grows into where it is.

How I Customised Pure Blog for This Site - Kev Quirk

2026-11-01T17:10:00.000Z

A few people have reached out to me to ask how I did X, or Y with my site, so I thought I'd talk about the customisations I've made to this site, and how they work.

Firstly, this site runs on Pure Blog, a CMS that I've been building over the last year or so. As it's matured, I've added features that allow more advanced users to do clever things without having to fiddle with the core platform. This means that people generally shouldn't have to fork the project and should continue to get all the new goodness as I release it.

This site is no different. I haven't done anything clever that Pure Blog can't do out of the box - everything is documented so by reading the docs and using a bit of creativity, you can do quite a lot with this plucky little CMS. I'll link out to the appropriate docs as we go through this post.

Ok, so what customisations have I made? This is going to be a fairly long post, so I'll list them here with links to each header so you can jump around and read the parts that interest you.

If you want to see specific code examples for any of these customisations, feel free to contact me.

Post layouts

I have three custom post types on this site - notes, links, and books. Notes are used as short-form social media type posts, links are links to other blog posts that I've enjoyed, and books are short reviews of the books I read.

Each has their own layout and in the case of notes, they have a different view on the homepage too. To do this I've created a custom post-list.php partial, but we will come to that later.

I could just use the default post type for all these posts, but I prefer to have a customised UI at the back-end for each. Here's what books and links look like in my editor:

Book editor layout

Link editor layout

Notes are a little different as I use a custom page for them that only I can access. This looks more like a social media post window than a blog post window:

Read the custom post layout docs ➡

Hooks and automations

I like to think of hooks as little tripwires that are set to go off when certain conditions are met. For example, something happens when an image is uploaded, or a new post is published. They're extremely useful and I have a number of them on this site:

Email Obfuscation (on_filter_content): Scans rendered content and encodes the site email address into hexadecimal HTML entities to protect against scrapers. This has been pretty effective at reducing spam - I wrote more about this feature in this post.
Post Sanitisation & Metadata Preservation (on_filter_post):
- Automatically generates date/time titles for new notes.
- Normalises layout values by stripping quotes (turning layout: "notes" into layout: notes), ensuring posts written in external editors like Obsidian don't break layout checks.
- Preserves mastodon_url in post frontmatter when saving via the admin interface so the Mastodon card at the bottom of every post continues to work.
Image Optimisation (on_image_uploaded): Automatically resizes images exceeding 2560px width whilst maintaining aspect ratio, also converts them to lossless WebP, and cleans up original unoptimised files.
Mastodon Cross-Posting & Syndication (on_post_published): Automatically crossposts all published post types to Fosstodon via the Mastodon API.
- Notes posts are cross-posted with full body text and media attachments (uploaded to Mastodon's media endpoint).
- Articles, links, and books are crossposted with their description and permalink URL.
- Captures the returned Mastodon status URL and automatically persists mastodon_url into the post's frontmatter which is then used for the Mastodon card at the bottom of every post.
Custom Font for Open Graph Images (on_og_image_font): Makes dynamic Open Graph image generation to use my custom font.

Read the hooks docs ➡

Templates and partials

Beyond custom post types, Pure Blog lets you drop PHP files into content/includes/. These can either override default pieces of the site (like navigation or post footers), or serve as entirely bespoke standalone pages, like my quick-publish notes screen, or the terminal 404 page.

Here's a full list of the templates and partials used on this site:

post-list.php (partial): This replaces the default post-list.php and adds post-type filter buttons, preserving query parameters across pagination. It also displays notes in full, while other post types show only the title and excerpt.
post-meta.php (partial): A customised version of the default post-meta.php file from Pure Blog. On top of the default tag list and post pagination, this version adds the obfuscated "Reply by email" button, a client-side Mastodon conversation card displaying live stats (favourites, boosts, replies) as well as a link to the post on Fosstodon, Pure Comments integration, and a subscription call-to-action.
discover.php (template): Dedicated discovery hub combining Pure Blog's full-text search with an alphabetical, weighted tag cloud showing post frequencies.
sitemap.php (template): An interactive metro map that lists all of the pages on this site. There's also an option to see the pages as a list.
social.php (template): My quick-publish admin screen for composing and publishing short-form note posts.
100.php (template): Dashboard for tracking the 100 Days to Offload challenge streaks in batches of 100 posts.
masthead.php (partial): This replaces the default masthead template in Pure Blog. It adds a custom layout, as well as 404 handoff ($is404) to render the custom 404.php template without modifying core Pure Blog files.
404.php (template): A fun interactive terminal-styled 404 page with custom commands that include goats!
random-post.php (template): Endpoint that resolves and redirects visitors to a randomly chosen published post.

Read the layout partials docs ➡

RSS feed enhancements

I've replaced the default feed with one that allows for filtering on post type. So one feed file, 5 feeds - one for each post type, and a fifth for everything.

My custom feed template allows you to visit /feed/ for everything, or /feed/[post-type] (e.g. /feed/books) for the posts of that particular type. This custom feed file lives in /content and I then used .htaccess redirects to redirect the default /feed URL to /content/feed.php.

All the feed URLs are available here.

Newsletter subscriptions

I use a self-hosted instance of Sendy to send out email "newsletters" whenever I publish a new post. These emails always contain the entire post, so people can read my content from their inbox if they wish.

Because I write notes much more frequently than long-form posts, I let readers choose what they receive: everything, long-form content only, or notes only.

To make that work without sending people through clunky third-party forms, I wrote a custom server-side handler (content/subscribe-handler.php). When someone submits the form on the subscribe page, the handler:

Checks a simple verification question ("What is Kev's surname?") to keep bots at bay.
Silently discards submissions that trigger a honeypot field, or exceed IP rate limits.
Subscribes the user to the correct Sendy list(s) via Sendy's API in a single click.

This not only helps segregate the emails people receive, but it has also had a dramatic effect on spammy sign ups. Which, if you've ever run a newsletter, you will know is a common problem.

Functions and helpers

Pure Blog allows you to add your own PHP helper functions for all kinds of things. On my site, I only have 1 function defined:

render_star_rating(string $rating) which transforms fractional score strings in my book posts (e.g. "4/5") into accessible star glyph strings (e.g. "★★★★☆"). I just think that "★★★★☆" looks far nicer in a post than "4/5".

But how is this star rating accessible? Well, it's rendered on the front-end like this so screen readers can parse it:


    ★★★☆☆

Read the custom functions docs ➡

Design and typography

I don't do anything magical with the design on this site. I use the Victor Mono font, and around 850 lines of CSS, which I've added to the custom CSS field within settings. Combined with the custom masthead, post-list and post-meta files above, it gives me everything I need to customise the site from the default look to what you see now.

I have a custom theme palette that I've defined too, also in settings. The colours used can be found at the bottom of my colophon.

Read the design customisation docs ➡

Data driven pages

One of the most powerful things about using a static site generator is the ability to use data files. With data files you can have a structure data file, like YAML, that contains repeated data, which can then be looped through on the front-end to render content.

I really wanted Pure Blog to be able to support data files, so I added support very early on. Personally, I use two data files on this site:

data/blogroll.yml which is then used to render my blogroll page.
data/projects.yml which is used for my projects.

Data files are fantastic as they reduce the amount of repetitive code you have to write. Instead of typing div, after div, after div manually, you write your div once, then loop through it with a data file and Pure Blog does the rest.

Read the data files docs ➡

`.htaccess` rules

The final thing I customise is my .htaccess file. There's a number of things I do to the standard Pure Blog .htaccess file to either redirect URLs, or protect various locations:

Admin Access Restriction: I restricts /admin/ access to specific allowed IP addresses.
Legacy URL & Feed Redirects:
- 301 redirects mapping historical /blog/* and /categories/* URLs to clean root and /tag/* routes that Pure Blog uses.
- Redirects for legacy feed and social endpoints (/feed.xml, /social-feed, /social-feed.xml, /rss, /blog.rss, etc.) to /feed or /feed/notes to make sure the feed URLs from various versions of this site don't break.
Route Rewrites: clean URL routing for all my RSS feeds so they have simple to share URLs.

Final thoughts

This ended up being an even longer post than I anticipated, but hopefully it shows just how much you can bend Pure Blog to your will, by design.

None of this requires hacks to the core code, or maintaining your own fork. Everything you see here is achieved using Pure Blog as designed: settings, custom CSS, hooks, custom layouts, and partials. Because all these files live inside /content, /config, and /data, I can upgrade Pure Blog the moment a new release drops without worrying about overwriting my site's bespoke features.

That was always my goal with Pure Blog - a super simple, distraction-free blogging platform out of the box, with enough flexibility under the hood for tinkerers (like me!) to build whatever they want.

If you're running Pure Blog and have built your own customisations, or if this post inspired you to try something new with your setup, hit the reply button below, or find me on Mastodon. I'd love to see what you've done with it.

Thanks for reading this post via RSS. RSS is ace, and so are you. ❤️

You can reply to this post by email, or leave a comment.

October 2026 Summary - Joel's Log Files

2026-11-01T16:45:33.000Z

Another month goes by! For October I decided to mostly focus on a plan for my gaming and my reading! That’s the reason I managed to get a lot of books done! I am quite happy with that progress, although I still have one week to finish all the games I planned. Still, this was all pretty cool!

Some artwork of my favorite media that showed up during the month!

Podcasts

Into The Aether - I listened to this the most, but not as much as usual because the last episode came out in October 31st and I didn’t listen to it in time!
The Ten Minute Bible Hour - A bunch of listened episodes this time around! Finally getting started on Matthew 17, and past the 400th episode!
Darknet Diaries - I enjoyed a couple episodes this time: Bayrob and Melody Fraud. Although the casual chitchat on crypto annoys me sometimes.
Welcome to Night Vale - I can’t remember what I listened this time, I must have fell asleep quickly.

Manga

✨ Battle Angel Alita: Last Order - Chapters 1-18. I started this one right after being done with the original run. Taking into account that a lot of the manga I read is in the hundreds of chapters, it’s kinda funny how this became a new series instead of just continuing. I think there was a span of time between this continuation though so, I get it. I am really enjoying the continuation to Alita’s story nonetheless. Perhaps the most confusing thing is the name changes though.
✅ Battle Angel Alita - Chapters 45-51. I started this manga ages ago, and to see it finally over was pretty cool! The finale, which felt a bit rushed originally, was replaced by Last Order, so I decided I’d give it a go too. I still really liked the finale of this run though, which goes for a more philosophical take on things and has some timeskips that worked well for me.
Blue Lock - Chapters 360-364. Just the weekly chapters! It has been fun so far.

Books

✅ Dune Messiah - This is the first physical book I’ve read in a while, and it was amazing from start to finish. I didn’t expect to be so utterly hooked! Done with it in a week, reading it everyday during my trips to work. The plot is much more political and full of twists and difficult to understand dialogue, but I just couldn’t stop myself. It felt ominous and grandiose and like something that I had to see through until the end. Good stuff.
✅ The House on the Borderland - A very interesting predecessor to what would eventually become space/existential horror and the like. This was a very interesting read, but with some dated elements in its writing. I have a feeling it won’t impress you by itself without taking into account its context. It features a few different experiences from som old man living in this old house, and some are more interesting than others too. Overall pretty satisfied by it, since I haven’t read anything like it.
✅ The Left Hand of Darkness - One of the more famous works of fiction, written by Ursula K. Le Guin. This was a very interesting story about some envoy tasked with establishing an alliance with a planet of androgynous people whose sex is only defined for a few days every month or so. And it’s also a very cold planet. There is a bunch of interesting things going on because of this society’s behaviour. But also political intrigue, survival, and understanding of each other.
✨ Clarkesworld #212 - Only one of the short stories is done. I need to continue this one soon.

Movies

Klaus - Starting October with a chrismas film was not on my plans, but I am glad that it was this one nonetheless. I had a wonderful time watching this story. Beautiful animation, great characters, wonderful message. Just everything a christmas movie needs!
Bumblebee - I have a feeling I watched this one at some point before, but not from start to finish, and not since I started to keep track of the movies I watch. In any case, Bumblebee is my favorite transformer and this origin story is quite a good coming-of-age story.
Nausicaä of the Valley of the Wind - It has been ages since I had seen a Ghibli film. I had heard lots of things about this one. Seeing how it is considered as the “Dune of anime” and the like. This film is gorgeous. The animation, the story, the message, the world. It was mesmerizing to watch. I really really enjoyed everything about it, so much it’s probably my favorite movie I’ve watched this year…

Anime & TV Shows

Death Note - Espisodes 7-8. I decided to return at last, and watched some more of this in the background. Since I read (and really enjoyed the Manga), revisiting this story has been quite nice. I am going for the Latin Spanish dub on this, which is quite good too.
Lanterns - Episodes 4-5. For some reason I haven’t watched more than a couple episodes. I should get going with this one some more, but well, I have put my focus elsewhere.

Videogames

✅ Final Fantasy IV - The quintessential JRPG! Completed over a span of multiple years, I am glad that I gave it a go and managed to complete the whole thing and some extra dungeons!
✅ Outer Wilds: Echoes of the Eye - A paralogue to the story of the base game. Answering questions I didn’t know I had, introducing new elements to the story, featuring new uses for tools that have always been available to me, and so much more. This was incredible, and the soundtrack was also pretty much perfect.
✅ Strange Jigsaws - This was an incredible puzzle game that really brings a lot of excellent ideas in a pretty tight package.
✨ Castlevania: Symphony of the Night - This is the second Castlevania I have played, and it has been a blast so far! I’ve played about 7 hours of it, the gameplay has been great, the artwork is insanely good for the PS1, and the score too! I enjoy it so far and I’m taking my time with it.
✨ Meccha Chameleon - This was a complete surprise! Everyone in my play group felt like giving it a go, so we started doing matches together and it became an instant favorite of ours. Hide and seek, brought to the next level!
✨ Astral Ascent - Only played this for like ten minutes so, yeah we’ll see if I return to it.
Donkey Kong - More pretty good platforming puzzles in the iceberg section of the game.
Kirby and the Forgotten Land - Barely touched it this month. Focused on other games and books.
Ultimate Chicken Horse - I even unlocked two new maps, there’s not much left but this is still super fun.
Nintendo Switch Sports - Still fun as ever! Golf and volleyball.
Guncho - A great tactics roguelike I’ve mentioned before.

Finishing thoughts

October is gone now. Even though I’ve managed to do a lot, completing three books and finishing some great games, it still feels like everything went by so fast. To be quite honest, I wrote most of this summary while watching more episodes of Death Note. Excuse the lack of detail or the quality of this summary overall.

This is day 61 of #100DaysToOffload

Reply to this post via email | Reply on Fediverse

Note published on November 1, 2026 at 3:17 PM UTC - Molly White's activity feed

2026-11-01T15:17:40.000Z

If you are reading this, you are someone who reads the news, and if you are someone reading the news, that hand is throttling your heart right now. On some level, you know this, but you are likely so used to it that you do not really know how hard it’s squeezing, and how much it saps your strength.

There is a difference between burying your head in the sand and periodically reminding ourselves that the world can be beautiful and good. We have somehow become convinced that turning away even for a second is a betrayal of the most vulnerable amongst us, but constant activation paralyzes us with dread and leaves us too exhausted to take action. Hyperawareness is not a virtue, it’s a symptom of mental illness—ask your complex post-traumatic stress disorder friends about it sometime. We are not betraying the cause by turning off our phones for a few hours; we are not lazy pieces of shit who deserve to be poor when we opt for sleep over pseudoproductivity.

Note published on November 1, 2026 at 2:48 PM UTC - Molly White's activity feed

2026-11-01T14:48:44.000Z

The healthcare marketplace would like me, a self-employed person with no recorded disabilities who has never served in the military, to prove that I DON’T have insurance through an employer, the VA, or Medicare.

Apparently I am meant to do this with things like a letter from my employer saying they don’t over me coverage?? “Dear me, I regret to inform us...”

10 Years on Mastodon - Terence Eden’s Blog

2026-11-01T12:34:18.000Z

As of today, I've been on the Mastodon social network for 10 years. I think that deserves a little reflection and celebration.

Post by @Edent@mastodon.social

View on Mastodon

Social networks often launch in a blaze of glory but limp out of existence within a year or so⁰. How many services have you signed up to, only to gradually drift away from? If you're anything like me¹, your password manager is a graveyard of unloved services and your MFA app is filled with icons of websites you barely remember.

It could easily have been that way with Mastodon. I gradually drifted away from Slashdot. Despite a promising start, AppDotNet died an untimely death. Slack works as a meta-social-network - but there are half-a-dozen communities which I know I'll never check in on. Once in a blue moon I'll think about uploading a photo to Flickr. I tried quitting Twitter several times - only to walk away cold turkey to prevent my soul being polluted by its filth.

I lurk on LinkedIn mainly to gawp at the brainworms. Threads just pushed too much crap into my feed. I think I have a tumblr and a dozen other social media accounts which fell into disrepair.

So what made Mastodon so sticky for me?

Silence Brand

Brands on social networks is an anti-pattern. You cannot be friends with a company.

In the early days of Twitter, brands were desperate to join the global conversation. They saw people complaining about them and wanted to intercede. Sadly that just promoted maladaptive behaviour as people (especially those with large followings) found they could bully brands into submission.

So brands retreated into the only thing they know how to do; advertise.

Mastodon has been remarkably resistant to corporations coming along to plant their flags. The few that are on there are either genuinely interested in the technology or are broadcast only.

Algorithms and Filters

It's wrong to say that Mastodon doesn't have an algorithm. It displays posts in chronological order - that's an algorithm. It has decent enough spam filtering - again, an algorithm. But it never tries to promote far-right hate posts to me.

Even better, it has proper support for a user's personalised filters. I can easily block discussion of politics² and sport. I can turn off reposts from individual accounts that I follow - you know the guy who reposts every puppy video he finds.

That makes for a relaxing and stress-free experience.

Fun Technology

I wasted years on the Twitter API. While I got some lovely swag from Twitter for faffing about with their tech, it was always clear that certain sections of Twitter's leadership hated that 3rd parties could use their APIs. Similarly, Facebook's API started as fun but quickly descended into a locked-down corporate hellscape.

Mastodon's API is mostly a delight to use. There aren't weird and arbitrary restrictions. Even better, because of the inherent open nature of the Fediverse, I can write my own ActivityPub software to interact with it.

I'm even getting paid to develop ActivityBot!

Nice People

Most of the people who join Mastodon³ feel rejected from more corporate social media. They've either made an active choice to try something different or they've been thrown off the mainstream apps. That's (mostly) good - and means that they're invested in making work something that's different.

I'd be lying if I said I didn't miss some of the people from Twitter. I think most of them are on BlueSky now - so I'm on there as well. Think of it like quitting smoking by taking up vaping. Sure, not ideal, but better than the alternative.

What it is missing

I can't pretend everything is brilliant. In no particular order, here are some of the papercuts which annoy me daily.

Reply Controls

BlueSky allows me to set a limit on who can reply to my posts. It is bliss. Sometimes I don't want the world chatting back to me. Yes, there's the ability to restrict who can see my posts in the first place, or who can quote my posts, but it isn't the same.

Super Block

Similarly, I want to be able to remove replies to me. If someone is being abusive or annoying, I don't want my friends to see that. If I block them, I want their replies to vanish from view in my threads.

I can moderate replies to my blog posts - why can't I moderate replies to my microblog posts?

Reply Guys

The two issues above are caused by the same strain of reply-guy. There's something about Mastodon which attracts a certain class of person. I get so many replies from people who either have never heard of this Earth concept called humour, or think that their inexpert Googling is helpful, or want to argue about something I haven't said.

It can be infuriating and I understand why it drives people away.

Geolocation

I just think social geolocation would be nifty!

More People

I'm in two minds about this. Services like Brid.gy allow me to follow my BSky friends on Masto, and vice-versa. Having more people on the Fediverse and away from corporate-owned social media would (hopefully) make it more viable in the long-term.

But more people means more spammers, grifters, and agents provocateur. There's a delicate balance to be found - not enough people and the network fails, too many people and it collapses.

I don't know what the right number is.

The nice thing about the Fediverse is that it literally cannot fail completely. Much like IRC survives despite "everyone" moving to Discord and WhatsApp, it chugs along in the background. ActivityPub servers will be around for the foreseeable future. So I'll be available on Mastodon (or its successor) until the bitter end.

Here's to the next ten years!

I'm looking forward to seeing what happens to Mastodon (and the Fediverse as a whole) by 2036. I am sure it'll have some wobbles, I hope it will see a renaissance, I look forward to shitposting far into the future.

You can follow me on Mastodon - @edent@mastodon.social.

I'm pulling these numbers out of my arse. But, come on, that feels about right, doesn't it? ↩︎
Poor you! ↩︎
I am grateful that so many politicians have reasonably unique names! ↩︎
Yes, I know it is the Fediverse and they're not all on one platform. Cut me some slack. ↩︎

Weeknotes W3 - James' Coffee Blog

2026-11-01T00:00:00.000Z

Today I got to see one of my favourite places in the world – a park I really like – in its full autumn colours. The paths were lined with autumn trees and scattered with yellows and oranges and reds. I heard crisp sounds with almost every step on certain straights of the walk. I forgot how beautiful the trees get here. The colours get more beautiful by the day, even though the trees are more sparse.

For the first time this autumn, I thought to myself that it will only be a few weeks before the oranges and reds will be mostly gone. I will have to make the most of the next few weeks and soak myself in the colours of the season for as long as I can.

The highlights

After last weekend’s storm had me inside for the weekend, I was especially excited to get out this weekend. I went for a long walk – one of my longest this year – and enjoyed the weather. I was surprised by how warm it was, though; I was expecting a chillier air. I went to places I haven’t visited in weeks, visited a new bookshop (where I bought a poetry zine with a layout that caught my eye), and generally appreciated all the time outside, breathing in the fresh air of day.

Today – Sunday – I spent the whole day away from the computer. When I sat down this evening to check in with notifications and prepare to write this weeknote, I realised that the day passed by quickly and I seldom thought of my computer. So too was true of yesterday: I spent many hours walking, checking my phone occasionally. I love being outside.

I spent some time in a coffee shop and started journaling. I am still not in the mood for reading on the weekends, but I was in the mood for writing. I let my stream of consciousness flood onto the pages, writing about all that came to mind while I looked around and watched the world go by. I haven’t written as much prose by hand in quite some time, even though the sum of my writing was less than a page in my writing journal. I wonder if I will write more on paper in the coming weeks. I did enjoy the experience.

In terms of studying, I got back my final grades for last year. I am pleased with how I did. Admittedly I am a bit nervous for my first art history assignment this year, but I am sure I will get through it. This is the first time I have felt nervous about an assignment weeks before it is due, and before we have even been fully introduced to it. I have a lecture about the topic of the assignment tomorrow, on Monday, in which I expect to take many notes. I am already feeling more confident by the day.

In the creative writing section of my studies. I submitted my assignment for the first block last week, marking the end of our block on defining ideas. I am already in love with the next module, fiction writing. Next week I will be starting to study character building, for which I am excited. I have found my confidence in fiction writing has come on leaps and bounds this year, owing, I think, in large part to my studies. We also had a lecture on poetry that I really enjoyed, studying Hayden’s Full Moon.

On that note, this is Writing Month. I am not sure whether I will participate, but this morning I had a burst of creative inspiration and ended up writing a few paragraphs toward a story. I am unsure whether what I wrote has a strong enough foundation to be a longer work – and whether the plot went in the way I want – but it did give me more confidence. I will make a decision about Writing Month by the end of the day. I like that you can set your own goal rather than committing to a longer project such as the 50,000 word total that NaNoWriMo formerly set.

Music corner

On Saturday I picked out a few songs from Bandcamp at random to listen to. I can’t remember any in particular, but I did enjoy many of the songs I heard. With that said, there are a few other songs I remember listening to this week.

This acoustic recording of Soon You’ll Get Better by Taylor Swift.
Little Feat’s Long Distance Love.
A cover of Bon Iver’s Perth, performed by the Coastal Sound Youth Choir: Indiekör 2016.
This cover of Bon Iver’s 715 Creeks.
Maisie Peters’ “It's Your Bed Babe, It's Your Funeral” EP from 2019.
The album “we’re all feeling the same” by lovelytheband.
I am enjoying music by Alice Kristiansen.

Thoughts, wandering

After a Homebrew Website Club meetup this week, I worked on a feature in Artemis that lets users opt in to see boosts from an ActivityPub account. Previously Artemis only showed posts originally authored by the ActivityPub user, but now there is a checkbox to opt in to see boosts in the settings for a subscription. My implementation shows the title of a post to be “Shared a post by @accountname”, rather than showing the actual post. This was inspired by Colin who has a similar implementation in their web reader. I much prefer this minimal approach to showing materials from an account I do not directly follow in my reader.
A little snippet from this morning: “The joy of the first sip of coffee — of how that may beget words, words that beget more words for there is rhythm to be found after starting. I am listening to electronic music. Despite having few words I am starting to appreciate the music for its own qualities — for the repetition, for the moments of change, for the pitches that I seldom hear. There is joy to be found in so much music. I started my morning thinking about ambitions and potential adventures — where I want to go, what I want to try.”
I opened a box of chocolates that I received as a gift a while ago. I love chocolate. Especially the ones in the box that is open now.
I am hoping to “lock in” to my fiction writing next week. I am really excited to see what I learn. I have a feeling that I am going to go through the phase of writing stories that aren’t great while I find my feet, fiction being so new. With that said, yesterday I did a writing exercise and I ended up writing way more than I expected. I found something of a flow state that I feel with other kinds of writing that I enjoy. That was a real delight to feel.
I am starting to get used to the darker nights again. It was nice to see the stars so early last night. There was a forecast that indicated the Northern Lights might be visible later in the night, but I didn’t see them. One of my dreams is to see the Northern Lights. I really hope to see them one day.
I have had this idea of “building bridges” in my mind related to the indie web for several weeks now. I don’t really know what I want to say, but I think the message is how I wish the indie web was more interconnected with other interest groups. My zine “A Creative’s Guide to Personal Websites” is an experiment in communicating the value of websites to creative people (artists, photographers, painters – anyone who thinks of themselves as creative) and how to get one set up while trying to avoid as much technical language as possible. If the words “building bridges” mean anything to you as it relates to the indie web, do let me know. I am still trying to piece this idea together.
I want to make another zine in the next few weeks!
I had a note that is almost a year old nearby with three questions I thought I’d put here: “How did Michelangelo feel when he painted the Sistine Chapel?”, “Has anyone painted HTML code?”, and “Is reading a creative art?”. I don’t plan to actively search for answers to these questions, but I thought I’d give them space here both for future reference and in case they are interesting to you, dear reader.

Miscellanea

I read Ralph Waldo Emerson’s Nature for the first time. I think I will have to re-read the work before I would feel comfortable sharing any thoughts, but I certainly thought this was worth reading. I have known Emerson’s name for a long while as he was friends with Thoreau, so it was good to finally read something written by him.
I love Frances’ link-roundups, and was overjoyed when I saw a few of my recent posts linked in the last edition.
I love the idea of showing a count of how many images have alt text as detailed in the article “Number go up”. This is one case where I am in firm support of “number go up.”
I was listening to the episode of the In Our Time podcast on Logic earlier this week. I think it was in that podcast I heard the term “syncategorematic term”. The term was so full of character I knew I had to bookmark it.
I love the Why Cheap Art manifesto by Bread and Puppet.
The 3D virtual museum linked in “Virtual museum for my wife's artworks” is unbelievable. I have never experienced a museum on the web like I have that one.
The “Historical www-talk archives made complete” publication by the W3C is worth perusing. The “Guido van Rossum writes a web robot that "tries to map out the entire web", distributed along with python 0.9.8” link caught my attention in particular.
I haven’t read this piece in full, but I bookmarked “'It's offensively cheap': How solar power is quietly becoming bigger than nuclear” so I could link to it. Quoting from the piece: “By 2030, the IEA thinks solar power generation will have reached double that of 2025's levels, with solar overtaking hydro to become the world's third-largest electricity source.”

Thank you for reading! My inbox is open if you have any recommendations or ideas that follow from this weeknote.

Artemis Why Cheap Art manifesto Virtual museum for my wife's artworks syncategorematic term last edition A Creative’s Guide to Personal Websites My inbox is open Guido van Rossum writes a web robot that "tries to map out the entire web", distributed along with python 0.9.8 Number go up Colin Writing Month Full Moon 'It's offensively cheap': How solar power is quietly becoming bigger than nuclear Ralph Waldo Emerson’s Nature Historical www-talk archives made complete Soon You’ll Get Better This cover of Bon Iver’s 715 Creeks. Long Distance Love Bon Iver’s Perth, performed by the Coastal Sound Youth Choir: Indiekör 2016

in their season - James' Coffee Blog

2026-11-01T00:00:00.000Z

The leaves are in their “flying season".
Coating the skies in colour, brilliantly.

The trees are in their “wintering season".
Branches bearing and silvering, beautifully.

The sunrises are in their “November season".
Pink comes later in the day, unpredictably.

Leaves, trees, sunrises and all, perpetually
Delighting day, cyclically.

Discoverability Is Only Solved If You Can Be Discovered - Kev Quirk

2026-10-31T13:58:00.000Z

Discoverability Is Only Solved If You Can Be Discovered

by Widdershins

This is a follow up to my post where Widdershins talks about how they agree with certain parts of my argument, but that the discoverability piece is flawed.

Read post ➡

Saw this in my RSS feed and thought it was an interesting take that's worth sharing - also Widdershins' blog is excellent. I'd recommend adding it to your feed reader.

I think the argument around other people controlling the gate to discoverability is a sound one, generally, but sites like Bubbles tend to add most sites, unless they're somehow obnoxious. So inclusion (and therefore discoverability) is only an email away. Having said that, one person's obnoxious is another person's heaven, so it's all subjective.

Either way, it's an interesting debate and I'm glad we're having it. Go check out Widdershins' blog too!

Thanks for reading this post via RSS. RSS is ace, and so are you. ❤️

You can reply to this post by email, or leave a comment.

Open Tabs October 2026 - The Weblog of fLaMEd

2026-10-31T13:00:07.000Z

What’s going on, Internet? If you don’t follow my Bookmarks through the feed, then here’s the bookmarks from October. Enjoy.

Bit of a theme this month, the old web was messier and more fun, and running a site now keeps getting harder.

Jenny O’Connor on why the embarrassing internet was the good internet. My old fan pages agree.
Winnie Lim on why running a personal website is not fun anymore. Rough read. Between AI bots scraping the fuck out of the open web and hackers using AI agents to find holes, no wonder.
Aaron’s Early Web Links is a one-person directory of personal homepages, covering all types of personal websites.
wulfpaper on why making websites shouldn’t seem so hard. Start with the writing, worry about code and design later.
A big alphabetised list of old linkware webset graphics sites. Handy if you’re after that old-school look.

For more, check out the bookmarks archive, and subscribe to the feeds if you want these as they happen.

Hey, thanks for reading this post in your feed reader! Want to chat? Reply by email or add me on XMPP, or send a webmention. Check out the posts archive on the website.

Gig Review: The Witcher in Concert ★★★★☆ - Terence Eden’s Blog

2026-10-31T12:34:18.000Z

The most common way people experience classical style music these days is via movies and video-games. After seeing The Force Awakens - live in concert, I've become rather a fan of watching movies performed with a live soundtrack.

But what about watching a video game with orchestral accompaniment? We travelled up to Wolverhampton to see "The Witcher":

A one-of-a-kind live event that transforms the lasting legacy and emotional storytelling of The Witcher 3: Wild Hunt into an immersive concert

Obviously you can't have someone sat there with a PS5 controller while a band plays (although that'd be a hell of a Twitch stream!) instead a large screen projects various cut-scenes and in-game footage. It works pretty well - most of the popular scenes are in there (Geralt in the bathtub got a big cheer) although there was no hyper-extended Gwent session. The videos were a little repetitive. Some of the music is obviously composed to be swelling in the background and so repeated shots of swords looking cool or Geralt looking grumpy were sprinkled throughout.

The highlight was seeing Percival Schuttenbach play a variety of instruments with absolute joy and gusto. The entire band look like they're having a whale of a time, and the conductor encouraged us to whoop and cheer for our favourite scenes (with perhaps a few boos for some of the more notorious enemies).

As soundtracks go, it isn't particularly varied. There's a decent mix of tunes, some with singing, but they do tend to blur into one after a while. Nevertheless, a brilliant time for fans of the game who want to soak up the music.

The Witcher in Concert is on tour around the world now.

Pre- and Post-Show

There was a merchandise stall hidden in one corner of the venue. Between doors opening and the start of the show (about an hour) a video looped through three screens - one of which encouraged up to share our photos with a hashtag. That's fine, but a few more videos wouldn't have gone amiss.

After the show, the conductor said the band would stick around for selfies - which was nice of them.

A touring show like this probably can't spare too much space for large scale models for people to pose with, or a couple of cosplayers to photograph, but it might have been nice if there were something to interact with before and after the show.

Shellsharks Blogroll - BlogFlock

Live concert, vacation, Ghibli films - W44 - Joel's Log Files

Watching

Reading

Gaming

Around the Web

Just a little AI resistance, as a treat - Terence Eden’s Blog

The cryptography behind electronic voting (and why paper ballots are still essential) - Trail of Bits Blog

The challenges of electronic voting

Inside the design and cryptographic safeguards of electronic voting systems

Protecting voter privacy

Protecting against a compromised voting client

Protecting against a compromised backend

What cryptography solves that paper ballots can’t do alone: end-to-end verifiability

We won’t be replacing paper ballots any time soon

What there is to see - James' Coffee Blog

Chatbot election answers are dominated by one right-wing dude and an army of AI slop. - Werd I/O

Lorem Ipsum Dot Gov Dot UK - Terence Eden’s Blog

St Jude Drawings Gallery - Robb Knight • Posts • Atom Feed

Backporting security fixes at scale with Codex - Trail of Bits Blog

Do we have to decide between stability and security?

Thousands of known CVEs lack stable-branch fixes

Engineers and AI can accelerate backporting

Rest of World tells vital stories about the impact of tech on the world. We may lose it anyway. - Werd I/O

Anticipation - James' Coffee Blog

How I Customised Pure Blog for This Site - Kev Quirk

Post layouts

Hooks and automations

Templates and partials

RSS feed enhancements

Newsletter subscriptions

Functions and helpers

Design and typography

Data driven pages

.htaccess rules

Final thoughts

October 2026 Summary - Joel's Log Files

Podcasts

Manga

Books

Movies

Anime & TV Shows

Videogames

Finishing thoughts

Note published on November 1, 2026 at 3:17 PM UTC - Molly White's activity feed

Note published on November 1, 2026 at 2:48 PM UTC - Molly White's activity feed

10 Years on Mastodon - Terence Eden’s Blog

Weeknotes W3 - James' Coffee Blog

The highlights

Music corner

Thoughts, wandering

Miscellanea

in their season - James' Coffee Blog

Discoverability Is Only Solved If You Can Be Discovered - Kev Quirk

Discoverability Is Only Solved If You Can Be Discovered

Open Tabs October 2026 - The Weblog of fLaMEd

Gig Review: The Witcher in Concert ★★★★☆ - Terence Eden’s Blog

`.htaccess` rules