Shellsharks Blogroll - BlogFlock

Apple Notes now available in the LAS/SBS downloads - Johnny.Decimal

2026-09-16T23:27:16.000Z

Our pre-built systems, which come with files for you to build your JDex, have never supported Apple Notes. I tried! You've no idea how hard I tried. But previous versions of Notes just didn't have an import feature that worked. I mean it worked but your notes ended up in 8pt Times New Roman, it looked ridiculous.

Well finally Apple spent some of that $5 trillion and they built an import feature that doesn't suck! Yay. You need to be on Tahoe (26) or above – I'm stuck here on Sequoia because I refuse to have Liquid Glass in my life.

Anyway. There you go. It's in the folder of JDex downloads, let me know if you have any problems with it. There's a Discord thread here.

How to get a DOI for your blog posts - Terence Eden’s Blog

2026-09-16T11:34:28.000Z

Each new post on this blog now has a Digital Object Identifier. This post looks at the how and the why of getting one, whether it is useful, and any issues you might experience if you go down this path.

Background

A few years ago, I documented how to to get an International Standard Serial Number for a blog. An ISSN uniquely identifies a publication, which makes it easier for scholars and researchers to reference it. Getting one depends a little on whether a national institution is willing to accept your application.

Similarly, I also got an ORCiD which is used to uniquely identify researchers. That means it is possible to disambiguate "Einstein, A" the eminent physicist from "Einstein, A" a lovely chap called Allen who researches invasive slugs in Paraguay.

My blog posts are regularly referenced in academic papers, books, conferences, and news articles. The way most scholars cite a work is using a Digital Object Identifier. The idea is that a DOI is a unique and persistent code which can be used to refer to a specific article. If I ever stop using shkspr.mobi as my domain, or re-order my website, the DOI can be redirected to the article's new home. Future scholars will be able to follow a reference more easily than hoping https://example.com/article123 still exists.

Getting a DOI the easy way

If you're an academic, your institution will have a paid subscription to a service which will "mint" a new DOI for all your articles.

If not, you can upload your paper to a service like arXiv and they'll mint a DOI for you. That's how I got a DOI for my MSc.

What about people who aren't traditional academics or who want to keep their content on their own website? There are a variety of paid-for services, some of which charge an eye-watering amount of money to create a DOI for you.

Or, there's Rogue Scholar.

Let's Go Rogue!

So what is Rogue-Scholar.org?

Rogue Scholar is an open access archive and registry for science blogs. It preserves science blog posts, makes them citable via DOI, and ensures their long-term discoverability alongside formal scholarly literature.

Nifty! My blog just about sneaks in to their "Computer Science" category. They require you to have a full-text feed of your posts. You also need to licence your content to them as Creative Commons Attribution.

Applying wasn't too difficult. I filled in their form, then jumped into their Slack. We had a bit of a discussion about what I needed to change in order to be approved.

A few days later, I was live at https://rogue-scholar.org/communities/shkspr/

Which means, if you visit https://doi.org/10.59350/395ha-fss97 you'll be redirected to one of my blog posts.

Automatic Submission of New Content

Rogue Scholar automatically polls my feed, ingests my content, and then mints a DOI for every new post they encounter. There's nothing manual I have to do.

That's all very well for new content. But I have posts on here going way back to 1986. How can they get discovered and DOI'd?

Manual Submission of Old Content

By default, Rogue Scholar ingested the 40 most recent posts from my blog. Actually, that's not quite accurate. It got the 40 most recently updated posts. As I'd recently edited a few older posts, they got themselves a DOI.

I don't know how often Rogue Scholar polls my blog's feed. In my experiments, adding a new post resulted in a DOI being issued a couple of minutes after publication.

At the moment, there doesn't seem to be an easy way to add older content. I'm working on a WordPress plugin to retroactively add DOIs and make them discoverable.

Getting the DOI

The Rogue Scholar API is based on InvenioDRM.

Retrieving the DOI via their API requires you to make an unauthenticated request to:

https://rogue-scholar.org/api/records?q=metadata.identifiers.identifier%3A%22https%3A%2F%2Fexample.com%2Fwhatever%22

That's your URl, wrapped in quotes, and the whole thing URl encoded. Visit this example. You can also use your post's GUID.

That gets back a rather detailed JSON document. The DOI is noted in several locations, but is easiest to find in hits→hits→0→links→doi

It's important to note that Rogue Scholar generates two DOIs for your post. One for the post, another for the specific version of the post. If you update a post, it should get a new DOI. That way someone can refer to the post where you said your favourite band was the Spice Girls and not the edited one where you changed it to say B*Witched.

Alternatively, you can use the CrossRef search if you want to look at HTML results. See this CrossRef example.

As an aside, once you have the DOI, it's possible to create a short DOI at https://shortdoi.org/ - I'll be honest, I've never seen these in the wild and they are not recommended for use. Nevertheless, the API is pretty simple - https://shortdoi.org/10.59350/395ha-fss97?format=json will return a shorter URl like https://doi.org/rnjj

Finally, there's a "vanity" DOI for the entire blog. In my case 10.59350/shkspr.

Generating your own DOI

Your blog posts can self-attest a DOI - when Rogue Scholar sees that in your Atom feed, it will register it on your behalf.

The code for generating a valid DOI is relatively straightforward.

Generate a random number between 0 and 1,099,511,627,775.
Convert it to a Base 32 string.
Add a two character checksum to the end.
Prefix it with 10.59350/

Your new DOI can be made discoverable in your Atom feed by adding this to a post:

https://do.org/10.59350/12345-67890

Shortly after publication, it will be "minted" and be linkable.

Making the DOI discoverable in HTML

How do you semantically add a DOI to your HTML's metadata? By far the most popular citation manager is Zotero. They maintain a page describing the metadata they look for. According to them, this needs to be in your page's :

They don't say whether it requires the https://doi.org/ prefix - but looking at Mendeley and AltMetric, it appears not.

To use DublinCore, the AltMetric recommended syntax is:

Within the HTML, there's no specific Microdata syntax, but Schema.org recommends the sameAs property. Something like:

10.../...

Downsides

OK, it isn't all flowers and kittens. There are a few things you ought to know before proceeding down this path.

Loss of Control

For the IndieWeb / ReDeCentralise / Self-Hosing crowd, it's important to realise that DOI is a somewhat centralised services. Yes, lots of different orgs can mint a DOI, but as each ID has to be globally unique, doi.org sits in the middle as a benevolent gatekeeper. If DOI.org went bust or became evil, all the https://doi.org/10.... links would die. There are many other services like DataCite and CrossRef which can resolve a DOI - but it might turn out to be a bit fragile.

Similarly, if Rogue Scholar ever goes properly rogue then they can redirect my DOI to wherever they like. That level of control is useful if my site disappears; they can redirect to an archive. But if they get hacked, it could redirect somewhere unsavoury.

Having my site's content backed-up somewhere is useful but, again, without control or verification I worry that I might not be able to effectively manage it.

I use CSS to control the layout of my work but once it is archived as plain HTML or PDF, that formatting can disappear.

I don't know what will happen if I ever change DOI issuer.

Tracking Citations

I have a Google Scholar alert set up for my domain shkspr.mobi. That picks up people who make reference to this site. Hurrah! But, if they use https://doi.org/10.... rather than https://shkspr.mobi/... I won't get alerted.

Luckily, Rogue Scholar offer Citation Tracking which should autopopulate their API with any backlinks from other sources. I'm yet to discover how that works in practice. I don't think it will give me an email alert though.

On a vanity issue, the DOI metadata shows the publisher of my posts as Rogue Scholar's parent organisation - Front Matter.

If you look at the API response from https://api.crossref.org/works/10.59350/5ck9b-kjv69 you'll see something like:

{
    "message": {
        "institution": [
            {
                "name": "Front Matter"
            }
        ],
        "group-title": "Terence Eden's Blog",
        "publisher": "Front Matter",
        "DOI": "10.59350/5ck9b-kjv69",
        "author": [
            {
                "ORCID": "https://orcid.org/0000-0002-9265-9069",
                "given": "Terence",
                "family": "Eden"
            }
        ]
    }
}

Some citation managers will show the publication name as "Terence Eden's Blog" - others as "Front Matter".

Licencing

Rogue Scholar has a hard requirement that all content be Creative Commons Attribution (CC BY). There's no ability (yet) to choose different licences. Personally, I prefer Attribution ShareAlike (CC BY-SA). I've allowed Rogue Scholar to use CC BY for my work which, of course, means if you get my posts through them you are also allowed to use CC BY.

If you get my work through my own website it is the slightly more restrictive CC BY-SA.

Does that make a practical difference? I don't know.

Verification

A DOI is persistent. That doesn't mean it is verifiable. If this blog ever goes offline the DOI will redirect to an archive - but there's no real way to tell that the text in that archive is accurate. There's no hashing or cryptographic signing. Yes, those things are rather brittle, but I think it would be helpful for the long-term integrity of citation chains.

Excluding Content

Suppose there is content you don't want to receive a DOI, what do you do? You'll need to generate an RSS feed which excludes those specific posts.

For WordPress, you can do something like /feed/atom/?cat=-1234 to exclude posts which have a category with the ID of 1234.

There are some filters on the Rogue Scholar site which you might also be able to use.

Deleting Content

I don't think there's a way to delete or retract content from Rogue Scholar's DOI system yet. If you accidentally publish something you didn't mean to, it'll live on in the archives forever.

Affiliations

My ORCiD lists where I worked on certain dates. Initially, Rogue Scholar linked those to blog posts I wrote during my employment. However, all my posts were written in a personal capacity. It is possible to get those affiliations removed if they are inaccurate.

More Vanity

I initially tried generating DOIs like edent-00f47 - although it's a valid Base 32 string with a checksum, it carries semantic meaning (my name) so shouldn't really be used. Ah well! Back to random strings.

Humility

Is this a valid use of the DOI ecosystem? A surprising number of my posts have been referenced in academic papers - but surely not all of my posts are worthy of getting a DOI? The problem is, I don't know when a shitpost will hit the zeitgeist and become quoted in papers, books, and articles.

It feels a bit self-indulgent and a little pretentious to mint a new DOI for every previous and future post on this site. But it isn't like the DOI system is running out of space, is it?

Is it worth it?

For me? Yes.

I think it is important that scholarly blogs are properly referenced. True, not all of my posts are cutting-edge research - but I'm always surprised which ones end up in someone's thesis or become part of a set-text.

I'm excited to see if this leads to an increase or decrease in my blog's visibility in academia.

If you have strong feelings either way about DOIs and/or blogs, please drop a comment in the box.

You may cite this post using https://doi.org/10.59350/5ck9b-kjv69 😃

Buy my house! - Werd I/O

2026-09-16T10:01:56.000Z

This is, perhaps, an unusual post for me in this space, but: I’m selling my home, it's a great house, and I want you to know about it.

7 Windsor Ave, Elkins Park, PA was built in 1925. Set on half an acre of land, it’s a beautiful Tudor home with a ton of space and flexibility. The photos speak for themselves.

I loved living here. Its second floor rooms are well-suited to being set up as spacious work-from-home offices, which is what we did — the whole family comfortably worked from the house. I commuted into the offices in Manhattan and DC many times a month, which I found both easy and genuinely fun via train — and the rest of the time I enjoyed the leafy, peaceful neighborhood. It’s very close to schools and daycares, and it felt like a privilege to be able to do drop-off and pick-up on foot.

I’ve headed west for an opportunity I couldn’t say no to, but it was emotionally hard to part with it. I fell in love with it in many ways — there’s no way I could have this level of space and peace while maintaining proximity to major cities at this price in California.

View this post on Instagram

A post shared by Charlotte Marinello Pellechia (@charpellechia)

Elkins Park is an architecturally significant suburb of Philadelphia: Frank Lloyd Wright’s only synagogue and Lynnewood Hall are both in the neighborhood, and the homes are magnificent. And as I mentioned above, it’s also a very accessible commute into New York City. There’s public transit within a few minutes’ walk, which takes you into Philadelphia, 30th Street Station, and Philadelphia International Airport without changes. Elkins Park itself has restaurants, a coffee roastery, and a great bookstore. The Crying in H Mart H Mart is also here; the Korean restaurants in the neighborhood are so good that people travel from NYC to eat there. It’s just a few minutes away from Glenside — the Keswick Theatre there hosts acts like the Magnetic Fields and John Waters — and Jenkintown, which is home to breweries, indie movie houses, and more.

7 Windsor Ave is represented by Charlotte Pellechia at Kurfiss Sotheby’s. You can book a viewing via its Zillow listing or contact Charlotte directly.

How I organised 15 years worth of passwords (video) - Johnny.Decimal

2026-09-16T04:05:35.000Z

This week at JDHQ – 2026-09-15 - Johnny.Decimal

2026-09-16T00:31:14.000Z

Originally sent to the mailing list on Tuesday 2026-09-15.

Hey everyone. This week: updates to the Small Business System (SBS), thoughts on not using AI to do your creative work, but using it to solve the biggest chore of all: organising your existing stuff into our pre-built systems. I've built that, it works, it's amazing, and you can use it today.

SBS improvements

Lucy just added a whole bunch of links to the Small Business System. She's into 'unsexy, boring, functional, government information'¹ – and she's right: there's so much stuff out there if you go looking for it. We get most of ours from the Australian government; much of it has broader relevance, but if you need help dealing with administration, make yourself familiar with your local, state, and national government's resources. There's more there than you expect, it's often really good, and you've already paid for it!

AI: grunt work. Human: creative stuff

Speaking of government advice, Lucy also subscribes to a bunch of newsletters and she noted last week that much of the guidance around AI seems to be to use it for your marketing. I suspect this is advice given without much thought, so I'm not criticising those that give it – they're probably not AI experts, and they're certainly not being paid to be.

But: it's awful advice! Your customers can smell AI generated ideas, copy, and images a mile off and we all hate it! You hate it: why would you think your customers wouldn't?

As with so much technology advice, I think it's given by people who aren't technologists; who don't understand what you can do with AI, and who, asked to give advice in a newsletter, fall back to the obvious stuff. Everyone understands words and pictures, so they become the go-to.

Instead, think about how it can take some of the burden from your back-office chores. The other day I recorded a video showing how I use Johnny.Decimal to keep my password manager organised. (Lucy's editing it now; out soon.) Rather than worry about showing my own data, I wanted to create a bunch of realistic demo logins that I could show without Lucy having to blur them out.

AI is amazing at this sort of thing. Because it's technical, repetitive grunt-work. It's work that I could have done, had I wanted to spend two of the most boring hours of my life creating fake logins. Is that a good use of my time? It is not.

In the past, you needed to be a computer programmer to do this sort of thing. You needed to know a scripting language. It still helps to have this base knowledge, and we're not yet at the point where you can just say 'computer' into the air and have it know exactly what you want, no mistakes. But we're a long way from me needing to write a script, and I think that's great. It's going to be incredibly democratising. (I recorded a rough video showing that process too.)

Get your AI to do the boring work, so you have more time to do the creative stuff. Don't ever give that up.

I can now 'move you in' to Life Admin or Small Business

Speaking of the boring work – what's the hardest part about getting organised? It's doing the work of actually getting organised. What if someone could take your existing stuff, analyse it all, apply all the rules I've developed over the last 15 years, and move it into a fresh copy of the LAS or SBS for you?

This is live, now, on the MCP server. I've tested it on my manufactured 'messy company' data set and it scores up in the 90% range.²

The bad news is that it can take as long as … half an hour. ;-)

Just briefly, because I'll get up a proper blog post shortly, here's what happens.

You connect the server (video here). You might need to be using a terminal version of your software, i.e. Claude Code, Codex. The GUI versions might work, I haven't tested.
Ask it to help you 'move in' to a new JD system.
It'll analyse your system, asking you clarifying questions.
It'll download and configure the CLI, my skills, and the LAS or SBS as required.
It'll show you, step by step, what it plans to do. You approve, it moves. Job done.

Importantly, I've built it so your LLM doesn't move files directly. It depends on the JD CLI which now has a jd move command. That command records a log of every move (at ~/.jd/journal.jsonl), so you have a full history of everything that happened. Moves are undoable. The jd command can't delete files.

The overall process is logged at 00.05 in the target system's JDex, and is resumable via this log. You can ask it to move you in category by category and check out partial results.

This is still very early, and it's behind a 'beta' flag. Your agent will ask you to turn that on. I'm confident that this won't wreck your life, but as with anything AI, be cautious. LLMs are unpredictable by design. It's what makes them useful. Have backups. Seriously, not kidding, have backups.

I'd love to hear from you if you use it. I think it's amazing. It needs a Pro account or higher. I've recorded a video, it's in the editing queue.

Lunch?

Last week, we met our first Decimal!³ We caught up for lunch in Sapporo. It was life-affirming, really, to look someone in the eye who uses this thing we make. Next week we're heading to South Korea – let us know if you're there.⁴

Talk soon,
j.

A strong argument for the Oxford comma. ↩
The messy data generator knows, ideally, in which ID the messy data should be stored. It scores the 'move in' result against this ideal. ↩
Actually I met a lovely Decimal in Canberra one time, but I won't count that as it's where we lived, and Lucy wasn't there. Hi, Joel! ↩
I'll email you, Caleb. ↩

More meaningful online interactions, please - Joel's Log Files

2026-09-15T23:40:00.000Z

Scrolling through the timeline, these are only a few of the things I’ve seen today, people on different perspectives and paths, perhaps someone…

That finally managed to fix their printer after a system update
Talking about seeing someone else make a funny typo
Sharing their progress on a software project
Letting everyone know about a cool update on their favourite game
Celebrating being done with the work day and going home
Coming up with a random pun/name for a pet
Criticizing people in power that do bad things
Saddened by all the AI and LLMs submitting bad code
Thanking a developer for adding a new feature
Uploading a picture of their new book they’re reading
Sharing a picture of their super cute cat

I look at the replies, and the ones with more comments are from people complaining about AI, or from people annoyed at bad people doing bad things (or the cat, but that’s a phenomenon I’m not getting into)

The point is a lot of people engage with the negative, bad news, and such, nothing wrong with that of course, but it got me thinking…

I have around 2900 followers on my profile—a meaningless sum in the grand scheme of things—I have made lots of posts, I share my blogposts, I share my progress on my videogames, or when there is some celebration, or when I’m reading a book, or when I get stuck under the rain.

I always try to share something positive or that I find amusing or fulfilling, or just nice.

Today alone, between both of my fediverse accounts, without counting boosts, I’ve made a grand total of only 3 original posts, not a lot to be fair, but an okay amount for a regular guy like me.

The oldest one was 11 hours ago, the latest is 3 hours ago, as of the time of writing this post. I have 18 favorites (one post with 11 favorites using a popular hashtag), and 4 boosts.

None of them have a reply.

I have done my due diligence and replied about 15 times in the last 11 hours, to ongoing conversations, giving advice about watches, or surprised that someone followed me, or something else.

Only 5 of them go a reply back. I didn’t bother to count favorites/boosts for these.

A part of me feels like I am begging for attention, that I want people to reply to me or to say things to me, but really, the initial list above this post was from lots of people I stumbled upon, and they also were simply shouting to the void with nobody on the other side.

I am also fully aware, of the amount of people who can’t handle social interaction much, and prefer to acknowledge a post with a favorite and move on. With nothing to add to the conversation, this is very fair.

But why does it seem like everyone has something to say about the negative things going on? Why do people come together only to complain about things that a lot of the time don’t make us feel good?

Don’t get me wrong, mobilizing and raising our voices against evil is noteworthy. But many times we fall on nihilism and doom instead, and we don’t actually do any better after that.

This post is somewhat inspired by Ana Rodrigues’s post: “Tell the speakers that you liked their talks “, and in my head still lingers a post from Jane saying she quit Mastodon. Give them a read if you want to.

I am not quitting or anything, but I feel like the Fediverse and most social media with humans using it, has become a little more silent than before when it comes to talking about normal everyday things, focusing too much on big themes and controversies or something along those lines.

To be clear, the Fediverse doesn’t use an algorithm, the reach of what I share is limited to the chronological timeline, so things can vary because of many factors I can’t really account for.

Even so, I don’t know, just food for thought…

On a positive note, the stars aligned and I somehow got like 5 emails on my inbox this week, one of them in the last 24 hours, so that’s always a win in my books!

And I still have plenty of fun on the Signal groups and Discord communities I’m on, so yeah, who knows.

Maybe I am just an attention-seeker who is annoyed at the lack of comments on my posts. I work very hard to come up with them!!

Okay, but, for real, I think we should choose to engage with things that make us happier! So if the post or article or picture a person shares does that, I invite you to let them know!

This is day 36 of #100DaysToOffload

Reply to this post via email | Reply on Fediverse

Summer Game Challenge 2026 results! - Joel's Log Files

2026-09-15T18:30:00.000Z

Back in May I decided to participate in the challenge mentioned in the title. From May 25 to September 7 (Memorial and Labour Day in the US), the goal was to make a list of at least ten games, and try to beat a minimum of four before the due date. As a Mexican, I gave myself some extra time, until September 16, which is Mexican Independence Day.

The goal is to make some progress on the backlog and well, play videogames! And that’s exactly what I did, I think!

My friend Bobby also participated in the challenge, check out his blogpost!

My original list consisted of fiftheen titles, although again, I only needed to beat four of them!

Grapple Dog
Terranigma
Hades
Outer Wilds
Silksong
Resident Evil 3: Nemesis
Metroid Prime Remastered
Chants of Sennaar
Emio the Smiling Man
Pipistrello and the Cursed YoYo
Gris
Super Mario 3D World
Metroid Fusion
CrossCode
The Hundred Line: Last Defense Academy
Transistor (an addition early on!)

The completed ones

In the end, from that list I managed to beat 6/15 games!

Title	Playtime
Hades	42:30
Metroid Prime Remastered	25:15
Transistor	05:50
Gris	04:15
Outer Wilds	32:30
Emio: The Smiling Man	13:20

I made a neat collage of the art of all the completed games, APPRECIATE IT!

And here are some extra thoughts if you want—most of them have reviews you can check out.

Hades

I was already on the last stretch after managing to defeat Hades a couple times before the challenge started, and by May 31st, I rolled credits and got some closure for one of the best titles of the decade.

I know there is still a lot this game has to offer, and I may return eventually for it, but I also don’t want to end up trapped giving dozens of extra hours to this game, which as fun as it may be, wouldn’t let me get other things done!

Metroid Prime Remastered

This is probably my favorite game that I both started and beat during the challenge! Playing continuously from June 1 to 12. A perfect transition to 3D done by Retro Studios that I loved from beginning to end!

The game was absolutely beautiful too, this is the best looking game in the Nintendo Switch as far as I’m concerned, and a pleasure to experience without any hiccups or issues at all. The challenge, the world design and upgrades were all fun. While it does have outdated elements, they weren’t a big deal for me at all. I love Metroid.

Transistor

This one was not on my original list, but I still want to count it since I reaplced it very early on in the the challenge, to be honest, swapping it with Chants of Sennar or something akin.

The combat and the story were the highlight here, a very interesting mix of turn based and action gameplay. The way the plot unfolded was incredible to see, the voice acting and score is also a highlight. There were a couple new things I could try starting a New Game+, but I got my fill, and it was great.

Gris

An unexpected choice for me given my options, I was home alone for a couple of days and decided to go ahead and give it a go. The experience was incredible. Going through it all while nobody else was around, letting the soundtrack play at max volume on my TV, with all the lights turned off, it was great.

The story and art, so beautiful, the platforming and the puzzles were light and elegant, and the vibes were just right for this one, a pleasure to have it finished.

Outer Wilds

But what else can I say about such a perfect experience? This game does not have the prettiest graphics on the Switch, and the performance is not ideal. However, I still pushed through it, and it was still incredible.

I had played like fourteen hours earlier in the year, and I went through almost twenty more as I resumed my journey and simply lived in the moment every time. The story, the mechanics, the characters, the discoveries. The planets aligned for once in a lifetime, they gave us a beautiful arrangement, it shall never be equaled.

Emio: The Smiling Man

My review for this title is still only a draft in my head, but it’s a detective story and visual novel where we are the main protagonist, a young detective who has to work on a rather creepy case and get to the truth of it all.

The art of this game is truly beautiful, the writing was also awesome, drip-feeding information in a great way, the mystery of it all, the score. It is a great visual novel with great production values that I devoured in just three days! I got stuck a couple of times, but not a detriment at all.

The forgotten ones

During all of the challenge, none of these got a time to shine at all, for one reason or another! They are all pretty great games though, but well, time management, procrastination, and stuff.

Grapple Dog - Even though I have progress on this game, and it really is a fun time, I pretty much didn’t touch it at all during the whole challenge, it kind of ended up shelved for the sake of other titles.
Resident Evil 3: Nemesis - I think I booted this up once, but my retro handheld use saw itself diminished and I pretty much forgot for a while until it was too late! Definitely still thinking of playing though.
Chants of Sennaar - I would have loved to get to this one, but I didn’t even install it. Besides, after Outer Wilds it was probably better to wait some time to get to this one.
Pipistrello and the Cursed YoYo - This is another one that I didn’t even boot up, it stayed in the box for the whole duration of the challenge, I chose to unbox Emio: The Smiling Man instead.
The Hundred Line: Last Defense Academy - I am actually surprised I didn’t get at least one more ending of this for so many months. Definitely looking forward to a return though, there’s dozens of hours left for me to experience here!
Metroid Fusion - I guess I just feel like I could beat this in an afternoon and didn’t really bother to check. It’s a fantastic game though, I just wanted new experiences, and Prime provided that Metroid sauce anyway.

The works in progress

Even though these games were not quite completed (I technically rolled credits on Silksong when getting Act 3 though), I still enjoyed a bunch of my time playing a bit of some of them.

Silksong - Honestly I am extremely pleased with the progress I’ve made on Silksong, from getting a lot of extra wishes and items, to finally unlocking Act 3 and starting to face against some new enemies, bosses and new areas that I have loved (and hated) to explore! Will definitely continue this adventure.
Terranigma - To be quite fair, I only played this gem for a couple short sessions, I even forgot to update my journal about it. In any case, I know how good this game is and I have to catch up with Sam soon.
Super Mario 3D World - My friends and I simply didn’t pick this one up enough times… I am very close to the finale though, but we are also collecting all the stars and stamps!
CrossCode - Some of my friends kind of lost steam, and I refuse to go without them even now, I hope they regain their morale and get into this journey again, it has been so nice!

The extras…

During the timespan of the challenge, I completed 9 more titles!—including some DLC and shorter indie games.

Title	Playtime
Monument Valley: Ida’s Dream	00:20
Monument Valley: Forgotten Shores	01:00
Monument Valley II	01:45
Monument Valley II: The Lost Forest	00:20
Monument Valley III	03:16
Monument Valley III: The Garden of Life	01:00
Jabberwocky	00:20
The Two Rivers Hypothesis	00:40

Monument Valley (overall) - This was a wonderful set of levels and artistic visuals that kind of blew me away from beginning to end! The overall puzzle design wasn’t always consistent, and some of the ideas were not explored as much as I would have liked, but everything there is was always a joy!
Jabberwocky - This was just a short indie Game Boy game that I beat in twenty minutes, a fun story you can get for free on itch.io
The Two Rivers Hypothesis - Another short indie title, with a much more serious existential horror theme, it is pretty quick to finish, and it’s a nice time if you are into speculative fiction stuff. Free on itch.io!

And the never ending…

There is always a big supply of other titles I’m playing, trying them out here and there. Games I got started with, games I’ve been poking at for years, you already know many of them!

Fire Emblem Awakening and Ocarina of Time have been an absolute menace on my Nintendo 3DS, with a lot of story yet to experience.
Faster Than Light and Minecraft have gotten plenty of playtime on my PC, especially the latter on a server with friends.
Donkey Kong , Astro Boy Omega Factor and the lovely Final Fantasy VI are still ongoing, claiming their spot on my emulation handheld.
Black Rock Shooter, Ys I & II Chronicles, Final Fantasy IV or Ridge Racer, keeping me busy whenever I give my PSP some love.

And of course, my Nintendo Switch alone has its own set of problems! From Kirby and the Forgotten Land which I’m barely getting started on, or the many little gems in UFO 50. The fantastic Tomodachi Life: Living The Dream which ate a bunch of my summer when it came out, and Super Smash Bros, still king of my multiplayer afternoons.

Not much else to say by now. The challenge is completed! It was a success, I played a bunch, and I had a lot of fun, I am probably going to try to keep a list going for the rest of the year too, but nothing as structural as this. Time to wait for the year’s recap and see how things turn out with only a few months left for 2026.

This is day 35 of #100DaysToOffload

Reply to this post via email | Reply on Fediverse

Read "Inside 'Project Lily': The Humans Reading Your ChatGPT Chats" - Molly White's activity feed

2026-09-15T15:21:23.000Z

Read:

“Inside 'Project Lily': The Humans Reading Your ChatGPT Chats”.

Joseph Cox in 404 Media. Published September 14, 2026.

Humans are reading ChatGPT users' prompts to improve OpenAI's models, and those chats can include sensitive, personal information, according to leaked internal documents and real prompts seen by 404 Media.

[RSS Club] Sorry for breaking your feed readers! - Terence Eden’s Blog

2026-09-15T11:34:26.000Z

You're part of the Groovy Gang because you're a member of RSS Club! These posts are only available on my RSS and Atom feed. This post is not available in the shops, on the web, via FTP, or anywhere else.

So, yeah, sorry! My last post apparently broke some people's RSS readers. I had a code sample which said ＜marquee＞ - despite being properly escaped, some feed readers double-decoded it and turned it into a literal marquee element!

With thanks to Neil and CaféHaine for the videos.

I got several reports that people's readers started scrolling like that and they'd raised issues with their feed reader. Ooops! Sorry!

That said, as far as I can tell, the feed is escaped correctly and shouldn't cause problems.

Here's the code (I've added in some spaces to ensure it doesn't cause any issues):


    Lorem ipsum & lt;marquee> dolor sed.

So what's going on? The feed is generated by the latest version of WordPress which uses CDATA to wrap HTML in a feed.

There is a 17 year old discussion about whether this is conformant on the WordPress issue tracker with the conclusion that it isn't incorrect and seems to work fine.

Is it OK? Is my feed broken or are a bunch of readers non-compliant? Let's go back to basics. The Atom spec says

If the value of "type" is "html", the content of atom:content MUST NOT contain child elements and SHOULD be suitable for handling as HTML. The HTML markup MUST be escaped; for example, "" as "".

RFC 4287: The Atom Syndication Format

Hmmmm. That would indicate that ampersand-l-t-semicolon should be interpreted as a less-than sign.

However, the whole thing is wrapped in which according to the XML spec means:



CDATA sections may occur anywhere character data may occur; they are used to escape blocks of text containing characters which would otherwise be recognized as markup.

Extensible Markup Language (XML) 1.0 (Fifth Edition)

So I think that a sensible feed-reader should see the CDATA block, grab the HTML inside it, and display it as-is. No need to unescape anything.

That said, I'll see if I can change my feed to not need this hybrid format. There's a brilliant blog post by Suren Enfiajyan which makes the case that regular escaping is probably good enough.

If you've experienced this bug - or think that I'm generating my feeds in the wrong way - please get in touch.



1Password's AI patching benchmark is misleading - Trail of Bits Blog
2026-09-15T11:00:00.000Z
1Password’s FLAWED report, published on August 6, 2026, gives defenders a misleading picture of AI patching. Its headline says models produced clean fixes only 26% of the time. That figure includes experiments that deliberately instructed agents to apply the wrong fix, along with experiments in which agents could not compile or test their patches.
The report risks making defenders less effective by discouraging them from using technology that could help them fix more vulnerabilities. Teams that take its headline at face value may leave repairable vulnerabilities unaddressed.
We want our work to help defenders fix more vulnerabilities. This post shares real-world data on human and agent patch quality from our consulting projects and Patch the Planet. We’re also releasing two agent skills: post-patch-validation to help agents test fixes, and review-walkthrough to help engineers review them.
How the experiment produces a misleading headline
Our review of 1Password’s code and data found four choices that make its 26% clean-fix rate a misleading guide to ordinary patching work.¹

The sample was selected for difficult fixes. The authors chose six vulnerabilities because their fixes were complex. Clean-fix rates ranged from 3% to 60% across those bugs, so the average depends heavily on which vulnerabilities made the list.²
Two prompts tell agents to apply the wrong fix. Those prompts account for 22% of the data. Combining them with ordinary repair attempts makes the reported rate depend partly on how often the researchers chose to give agents bad advice.
More than a third of the trials prohibit testing. One evaluation mode prevents agents from building or running code and accounts for 36% of the data. The headline combines those trials with experiments in which agents could test their patches and act on the results.
The models ran at different reasoning settings. GPT-5.5 ran at medium effort and Opus 4.8 at high. These were the tools’ defaults. Neither model was tested at its highest available setting, and the authors did not measure how increasing effort affected the results.

1Password’s headline also obscures a useful result in its own data. We reanalyzed the patches and recorded test results published with the study, keeping trials where agents could run code and were not instructed to apply the wrong fix. In those trials, 2,634 of 3,067 patches generated by 1Password’s models (86%) blocked the supplied exploit. We excluded runs that the study classified as having consulted the upstream fix. Blocking that exploit does not establish a complete repair, but these results show useful patching capability under reasonable working conditions that the headline fails to convey.
The instructions and grading introduce further problems, several of which Davi Ottenheimer has also highlighted:

The stopping rule and grading criteria disagree. Agents given a proof-of-concept exploit were instructed to stop once their patch defeated it. The grader then evaluated vulnerable paths that the supplied exploit did not exercise.
The grading penalizes intended behavior changes. Agents were told to leave existing tests untouched, even though a correct fix can require updating tests to reflect changed behavior. We found that 8% of ActiveMQ verdicts penalized an intended behavior change as a regression.
The automated grades disagree with human review. Models grading their own patches matched human reviewers on the full five-category outcome in 65.9% of reviewed cases. Agreement was 87.7% for whether the original bug was fixed and 70.5% for whether new bugs were introduced. (Table 24)
Changing the reviewer changes the result. The two models assigned different outcomes to 36.8% of the same patches. The headline averages their assessments. (Table 20)
The Linux reference fix contains a vulnerability. The authors found 248 generated patches that repeated an off-by-one error in the upstream fix. The automated grader caught that new vulnerability in only 24 of them. (Section 4.4)
The Chromium grader accepts incomplete repairs. It marked many patches as clean even though they left a use-after-free vulnerability in a callback. (Section 4.9)

The grading errors can penalize valid fixes and let vulnerable patches pass. Combined with the handpicked sample and deliberately bad instructions, they leave the report without a credible basis for its headline. Defenders should not take 1Password’s headline rate seriously as a measure of AI patching ability.
Developers get one in eight fixes wrong under ideal conditions
Understanding agent failures also requires understanding how often developers submit incomplete fixes. Our security consulting work gives us a detailed record of how developers repair vulnerabilities in their own software. We give clients detailed vulnerability reports, then conduct a “fix review” to check whether their proposed patches fully resolve the issues.
Our records connect each vulnerability to the developer’s first proposed fix and our assessment of whether it worked. They preserve unsuccessful attempts that developers revise before an issue is considered resolved.
We reviewed the first fixes submitted for 2,265 vulnerabilities across 236 Trail of Bits security assessments from 2024 to 2026. The developers maintained the affected software, had detailed reports from our engineers, and knew we would review their patches. Even under those favorable conditions, 283 first fixes failed to fully resolve the reported issue: 12.5%, or one in eight.





 

 




 


 

 
 Figure showing first fix submission outcomes
 

Accounting for multiple fixes from the same assessment, the 95% confidence interval is 10.5% to 14.5%. Sometimes we point out a mistake in a client’s patch during an informal conversation, and they correct it before the formal fix review. Those early failures may never appear in the review record, so our data can undercount failed first attempts. We also excluded cases where the available records did not establish whether the fix worked. A direct comparison with agents would require the same tasks and working conditions.
What happened to our patches in real projects
Through Patch the Planet, our joint initiative with OpenAI, Trail of Bits has co-authored hundreds of patches for widely used open-source projects. Agents wrote the patches with engineers directing the work and checking the results. Project maintainers then decided whether to merge, revise, or reject each submission.
How maintainers reviewed Patch the Planet patches
We examined the public review history of every Patch the Planet submission in our dataset that maintainers had merged or closed by September 14, 2026: 186 pull requests. 1Password’s benchmark used six vulnerabilities selected because their fixes were complex.
Maintainers merged 126 of our 186 pull requests, an acceptance rate of 67.7%.³ In 91 of those 126 pull requests (72.2%), maintainers accepted the security fix we originally proposed.

 
 
 Review outcome
 PRs
 % of merged PRs
 
 
 
 
 Total merged
 126
 100%
 
 
 Accepted with no security-relevant revision observed
 91
 72.2%
 
 
 Accepted with security-relevant revision observed
 33
 26.2%
 
 
 Indeterminate
 2
 1.6%
 
 

Table 1: Changes requested by maintainers for 126 merged Patch the Planet pull requests. Security-related revisions include repairs to a proposed fix and expansions of its security coverage.
Maintainer acceptance does not establish that every patch is correct.
Maintainers closed the other 60 submissions without merging them. Most were superseded by other work or declined for policy, process, scope, or maintenance reasons. Four were explicitly rejected on technical grounds.

 
 
 Reason for closure
 PRs
 % of closed PRs
 
 
 
 
 Total closed without merge
 60
 100%
 
 
 Superseded, reimplemented, or re-landed elsewhere
 36
 60.0%
 
 
 Policy, process, scope, or maintenance reasons
 14
 23.3%
 
 
 Duplicate or convergent with another fix
 3
 5.0%
 
 
 Explicitly rejected on technical grounds
 4
 6.7%
 
 
 Other or indeterminate
 3
 5.0%
 
 

Table 2: Reasons maintainers closed 60 Patch the Planet pull requests without merging
One of those closed submissions was our freenginx patch.
A maintainer and an agent introduced the same freenginx crash
1Password’s case study examines a Patch the Planet fix for a memory-safety bug in freenginx’s embedded Perl module. An agent wrote our patch under the direction of a Trail of Bits engineer. It left one vulnerable code path open and introduced a new crash during request cleanup. The paper’s criticism of our patch is correct.
The maintainer closed our pull request and committed a separate fix. That fix covered all three vulnerable code paths but introduced the same crash during cleanup. The paper documents the maintainer’s regression too.
Both authors encountered the same trap. The original bug allowed Perl to destroy a callback before freenginx used it.
Both fixes kept the callback alive so freenginx could use it later. But if the request timed out first, freenginx would make the request unusable and then release the callback. Releasing it could run Perl code that still tried to use the request, crashing the worker. Both authors missed a problem their fix could cause later, during cleanup. Catching it required looking beyond the original bug to what happened when a request ended early.
Two authors, one human and one agent, working separately, made the same mistake on the same bug. Readers deciding whether to use agents need to know how their failures compare with those of human developers. Establishing which is more reliable requires measuring both under comparable conditions.
We checked what happened after our patches were merged
We examined about 33,500 subsequent commits in Patch the Planet projects. When a later commit changed a file our patch had modified, we investigated whether it fixed a problem our patch had introduced. For each suspected regression, an agent attempted to demonstrate its impact with a proof of concept. Other agents and our engineers then challenged the findings.
The review found at least ten functional bugs; four build, test, or release automation bugs; and one performance bug. It found no exploitable security vulnerabilities. Two examples illustrate the problems we identified:

In go-jose, PR #240 fixed a missing-header crash but exposed an existing validation gap, allowing encrypted messages to succeed even when their key length contradicted the declared algorithm. PR #266 added explicit key-length checks before decryption.
In Noble FROST, PR #250 returned cached round-two results without first checking whether a retry contained the same authenticated transcript. Changed or stale retry data could therefore bypass that check. The maintainer corrected the behavior by validating retries against the original transcript before returning cached results.

We are extending this investigation to every patch we authored, including patches with maintainer contributions. The findings will help us add checks that catch these failures before we submit future patches.
Agent skills for better security patches
We are releasing two agent skills alongside this post: post-patch-validation to help agents test security fixes, and review-walkthrough to help engineers review code changes.
Post-patch-validation is a new skill we wrote to help agents catch incomplete fixes and regressions before submitting patches for review. It was not used in the Patch the Planet work described above.
The skill starts with a vulnerability report and the code before and after the patch. It guides the agent through four tasks:

Reproduce the original bug. The agent writes a check that must fail on the vulnerable code and pass on the patched version. A test that passes on both revisions cannot demonstrate a fix.
Test another path to the same failure. The skill requires at least one distinct variant based on the bug’s root cause, such as a different caller or a cleanup path.
Check for regressions and new vulnerabilities. It compares behavior that should remain unchanged and tests security properties around the modified code. The plan must also include project tests, a sanitizer check, or a bounded fuzzing run.
Treat broken test runs as inconclusive. A failed build or missing dependency must not be mistaken for evidence that a vulnerability was reproduced.

Failed checks give the agent specific problems to investigate and repair before submitting its patch. The skill saves the tests and results so maintainers can see what was checked.
To try post-patch-validation, install the skill and give your agent the vulnerability report and the vulnerable and patched revisions:
“Use post-patch-validation to validate the patch in HEAD against , using the vulnerability report in .”
Review-walkthrough helps engineers review the patches they are responsible for merging. It turns a branch’s complete diff into an interactive walkthrough that explains the changes in a logical reading order. Review findings appear beside the relevant code, where engineers can inspect them and draft their own comments. The walkthrough can also prepare a GitHub review for submission. Follow the quick start to generate a walkthrough for your branch.
These releases join our other public agent skills for improving security patches:

variant-analysis helps agents find related defects elsewhere in the codebase.
property-based-testing helps them test behavior across generated inputs.
mutation-testing helps them determine whether their tests detect incorrect behavior and identify missing assertions.

We publish these methods so other teams can use them to examine and improve their own patches.
What a useful patching benchmark should measure
A useful patching benchmark should measure whether agents help developers produce correct fixes and how much review those fixes require. The principles in our 2018 guide to evaluating fuzzing research apply here:

Choose a sample that matches the research question. Explain how the sample was chosen and which repair work it represents. Difficult cases can expose failure modes. General failure rates require a representative sample.
Measure the effects of working conditions. Give agents appropriate tools and instructions. Report model configurations and test how reasoning settings affect results. Report misleading prompts and restricted tool access separately.
Make correctness verifiable. Check that patches fix the vulnerability beyond the supplied exploit. Test for security, functional, and performance regressions. Validate grades against expert review and publish the tests, configurations, and results.
Show how results vary. Report per-vulnerability outcomes and variation across repeated attempts. Repeating trials on the same bugs cannot establish that those bugs represent everyday patching.
Measure what agents contribute to the repair process. Compare developers working with and without agents on comparable tasks and under comparable conditions. Measure initial patch quality and the review and revision needed to reach a correct fix.

We are optimistic about AI’s usefulness to defenders. Through Patch the Planet, we are committing engineering time to fixing vulnerabilities alongside the people who maintain the affected software. We examine failures so we can improve our methods.
We will keep putting agents to work on difficult security problems and making the tools and lessons public. We want other teams to test our conclusions and take these methods further. Our goal is to give maintainers without dedicated security teams the ability to find and fix vulnerabilities that would otherwise go unaddressed.




The paper defines a clean fix as fully resolving the vulnerability without materially changing application behavior. ↩︎


The six-target mean has a standard error of about nine percentage points, which the report does not disclose. ↩︎


As of September 14, 2026, our dataset contained 240 public upstream pull requests. We excluded the 54 submissions still open from the outcome analysis. We count pull requests, each of which can contain more than one patch, and exclude maintainer-written replacements from our merged total. ↩︎





It's Never Too Late to Learn - Kev Quirk
2026-09-15T10:21:00.000Z
Last weekend my wife called me over to show me something on her phone. She was going through her old emails and came across some emails we had passed back and forth, from when we first met.
She and I met in a club and went on a couple of dates, but then I deployed to Afghanistan with the Army. We continued to converse via email mostly, and phone where possible - this was before the days of FaceTime etc. - and the rest is history. That was in 2006, and 20 years later we're still very happily married with a couple kids.
Anyway, upon reading the emails I immediately wanted the ground to swallow me up. Not because they were overly mushy or lovey dovey (they were), but because the spelling and grammar were horrendous. I was never a particularly academic kid - in fact, I was mostly disengaged in school and really didn't try. I was clever, but I never applied myself. I was too busy being a stupid teenager. As a result, my written English was awful (it's still not great now, but it's better).
For example, I didn't know the difference between "there", "they're", and "their". And you can forget about "your" versus "you're". "Too" vs "to"? Not a chance. Where, were, and we're baffled me. I had no idea where a comma was supposed to go in a sentence, and I'd never even heard of an Oxford comma.
You get the idea.
Fixing the problem
During my time in the Army, written English wasn't really needed, so I wasn't too concerned. But after getting out and finding a job in IT, it quickly became apparent that my lack of basic English knowledge would hold me back. So I decided to fix it, and enrolled in a night school course.
To my surprise I really enjoyed it. It turned out that writing and learning are a lot of fun, and I was constantly looking for ways to practice my new found writing skills. I think that's part of why I still love typing - I just find creating words on a screen a lot of fun. Yeah, I'm weird. I know.
So I completed the night school course and came away with much improved grammar and a desire to write all the things. But replying to emails and writing reports in work wasn't scratching the creative itch for me.
Discovering blogging
One of the services the IT company I worked for offered was web hosting. I'd never really got involved in any of that, so learning about DNS, web servers, MySQL etc. was really interesting. I'd done a bit of basic web design during my college IT course, but never anything more.
"College" in the UK is different to college in the US. We call that university here. In college we do our A-levels, which are intermediate qualifications between high school and university. I don't have a degree.
A few of our customers had WordPress sites, and it blew my mind. Here is a web application that I can host myself, on my own server, with my own domain name. Furthermore, I can write what I want and publish it on the web for anyone to read. This was the creative outlet I'd been looking for!
So in 2010 I registered kevquirk.com, set up WordPress on a shared host, and started writing. Sixteen years later I'm still here, and still thoroughly enjoying writing on the web. Albeit no longer on WordPress.
Final thoughts
It's funny how these seemingly unrelated things connect together in retrospect and take us down a road we never thought we'd walk. Back in 2000, when I was leaving high school, if you'd have asked my high school English teacher (hi Mrs Daniels!) if she thought I'd be producing creative writing on the web for 16 years, she'd have laughed in your face. Hard.
But I am. And it's all thanks to a basic written English course that I attended for a couple of months, just to improve my writing to help me with work.
I'm not really sure how to wrap this one up. I suppose my final thought is that it's never too late to learn. And you never know where it will take you. A simple thing like a basic English night course could end up forming the longest running, most enjoyable hobby you have in your life.
                    
                        
                        Thanks for reading this post via RSS. RSS is ace, and so are you. ❤️
                        You can reply to this post by email, or leave a comment.
                    


New documentation page: Work packages - Johnny.Decimal
2026-09-15T00:06:26.000Z
There is a new documentation page in the 'further reading' section that summarises the concept of work packages.
The Small Business System now comes with an area for work packages.
And there are two lessons in the Task and Project management course that discuss how work packages fit in our project management strategy.
We're enjoying working this way, let us know if you need help implementing them.


Wonders of Web Weaving, Episode 19 - James' Coffee Blog
2026-09-15T00:00:00.000Z
The nineteenth episode of Wonders of Web Weaving is out:

In Episode 19, I chat with Daniel, the author of melonking.net and maintainer of the Melonland community forum about, among other things, longevity on the web, the 'web revival', the creative potential of the web, and more.

I hope you enjoy the episode!
Wonders of Web Weaving also has an RSS feed you can use to follow along from wherever you get your podcasts.

Melonland community forum
Daniel
melonking.net
The nineteenth episode of Wonders of Web Weaving is out
Wonders of Web Weaving also has an RSS feed


Published on Citation Needed: "The Senate must reject the Clarity Act’s ethics charade" - Molly White's activity feed
2026-09-14T23:11:20.000Z
Published an issue of Citation Needed: 
The Senate must reject the Clarity Act’s ethics charade 
The supposedly “unprecedented” ethics restrictions exempt Trump’s crypto businesses and leave enforcement to his loyalists
Posted: September 14, 2026 at 11:11 PM UTC. 
 Also posted to:MastodonBluesky
Tagged: corruption, crypto, crypto lobby, Trump administration, US politics.


Esoteric HTML - ismap vs CSS - Terence Eden’s Blog
2026-09-14T11:34:53.000Z
The HTML specification is old and, while there is beauty in longevity, there's an inevitable build-up of boondoggles and baggage. Some elements like  have sadly been consigned to the dustbin of history - but there are still vestigial attributes just waiting to trip up the unwary.

If you're young, you may never have heard of Image Maps. Back in the bad-old-days, there weren't many good options for laying out a pixel-perfect HTML page. One option was to draw your website in an image editor, load it into a website as an image, and then make certain areas of the image clickable.

One way to do this was to add the attribute ismap. It is only valid on  elements which are inside an  element. Like so:



    



When you click on that image, you don't go to click.php - instead you go to click.php?12,34 where the two numbers represent the X and Y coordinates of where on the image you clicked. That's brilliant! Your server knows the size of the image - so if you click on the top half it can take you to one place, and if you click in the lower left corner you can go to another.

Brilliant!

Except, of course, there's a catch!

The specification of the  element is a little obtuse. Merely saying:

The ismap attribute […] indicates by its presence that the element provides access to a server-side image map. This affects how events are handled on the corresponding a element.

Instead, the details are in 4.6.2 Links created by a and area elements:

set x to the distance in CSS pixels from the left edge of the image to the location of the click, and set y to the distance in CSS pixels from the top edge of the image to the location of the click.

Did you notice the gotcha?

the distance in CSS pixels

This is not based on the actual size of the image! It is based on the layout

Let's suppose you have an image which is 100 x 100 pixels. It is added to the website like this:



Click on this image and you'll see that your X and Y positions are based on the natural size of the image.



But suppose you change the HTML to this:



When you click on the image, the X & Y positions are not based on the actual size of the image; they're based on its layout size.



Suppose you use CSS to resize the image:





The X and Y aren't based on the image's natural size, nor their declared height and width. Instead they're based on the size on screen determined by CSS.

And, of course, that's not necessarily your CSS! If the user has turned off style sheets, supplied their own, or uses an accessibility tool - the CSS size of the image might be vastly different from what you intended.

If you have an image 100 pixels wide and you want people clicking on the left half to go to a different location to the people clicking on the right half, you might have server-side code which says:

if X < 50 :
    return page1.html
else
    return page2.html


But if the CSS has stretched, shrunk, skewed, or distorted the image then you have no way of knowing where the user clicked.

As far as I can tell, this behaviour is the same in all major browsers.

Basically, what I'm saying is, don't use ismap unless you're absolutely sure that there will be no CSS shenanigans. Even then, it probably isn't worth the risk.



8-Bit Day 2026 - James' Coffee Blog
2026-09-14T00:00:00.000Z


Yesterday – September 13th – was the 256th day of the year. Tantek blogged about this in 2024 and in 2025 introduced a challenge to make a web page in under 256 bytes. After reading his announcement from yesterday his morning, I decided I would participate again.
Last year I made a minimal HTML home page using 253 bytes of HTML and 220 bytes of CSS. This year I made two pages, each of which only use a single HTML file with styles in a style tag. The single files are each under 256 bytes.
The first page I made this year was a poem about websites. I used CSS, in particular the color-scheme: light dark; rule, to make the colour of one of the words in the poem change depending on whether the page is viewed in light or dark mode. The page is 215 characters long.
The second page I made this year was an interactive web page to count the number of characters and words in a textarea. This took a fair bit of time to make because I had to use JavaScript to make the textarea work. The page is 254 characters long, and uses four HTML elements: two paragraphs, a textarea, and a script tag.
To save characters in the character and word count web page, I assigned the document value to a variable called d and the document.getElementById function to d.g. This syntax when I needed to retrieve elements or their values, or set new values for an element, I could do so in many fewer characters (although at the notable cost of readability). Of note, the word count splits at space characters, which means that of – day would be three words (of, –, day), even though it is two words. If anyone can suggest a way to make a more accurate word counter while staying under the character limit, I’d love to see your versions!
The constraints of 8-Bit Day have, in both years, encouraged me to make something I otherwise would not have. I didn’t start today thinking I was going to make a character and word counter in under 256 characters of code, but I am glad the day went this way.

minimal HTML home page
interactive web page to count the number of characters and words in a textarea
blogged about this in 2024
make a web page in under 256 bytes
reading his announcement from yesterday his morning


Note published on September 13, 2026 at 10:03 PM UTC - Molly White's activity feed
2026-09-13T22:03:51.000Z
me and my runaway zucchini patch beg to differ
i had a zucchini so big that i could only use half of it in a meal i was making, and the remaining half alone is 550 grams
Posted: September 13, 2026 at 10:03 PM UTC. 
Updated September 13, 2026 at 10:23 PM UTC.
  Also posted to: Mastodon, Bluesky
Tagged: gardening. 


The expectations of privacy in driverless cars - Terence Eden’s Blog
2026-09-13T11:34:13.000Z
Do riders in autonomous vehicles think that they are in a private space? Here's a fascinating story from California where an robotaxi was redirected from its intended destination and, instead, delivered its misbehaving passengers to the police.

The 15-year-old passengers were riding in a driverless autonomous car around San Mateo Monday afternoon. The teens drank alcohol inside the Waymo taxi and shot Orbeez beads with a toy gun toward other vehicles.

A Waymo employee, who was remotely monitoring the car, tricked the unruly teenagers, authorities said. The employee told the young passengers that the Waymo was having mechanical issues and needed to stop.

Unknown to the teens, the employee had also called the San Mateo Police Department to report that a gun was firing from the car.

Here’s how Waymo tricked unruly teen passengers in San Mateo

Is that OK?

Kids shooting (albeit fake) guns out of cars is bad. I've no problem with the long arm of the law feeling their collars.

But what sort of reasonable expectation of privacy do you have when you jump into a driverless car?

If you have a blazing row with your partner while sat in the back of a black cab, the driver's going to hear, right? There's no privacy expectation although you might rely on their discretion.

Take a phone call and arrange a drug deal, the driver might turn you in to the police. They're not a confidant, are they?

Kiss someone you shouldn't and you accept the risk that the driver might both notice and care.

But when there's no driver, there's no risk of your privacy being invaded is there?

Nine former Tesla employees told Reuters that Tesla workers shared customer videos and images recorded by in-car cameras between 2019 and 2022.

Tesla Workers Shared ‘Intimate’ Videos Recorded By In-Car Cameras

Ah.

I don't know how Waymo was alerted to the problems in the car. Perhaps someone called them and reported the numberplate. Perhaps the car heard raised voices and sent an alert. Perhaps Waymo just regularly drops in on all its customers.

Rummaging through Waymo's various privacy policies eventually leads to this rather ambiguous page which describes how they monitor the inside of their vehicles.

Our autonomous vehicles are equipped with an advanced suite of sensors – including cameras and microphones – that act as the 'eyes and ears' of our Waymo Driver.

Cameras inside the car

Cameras are a way for us to make sure that your trip goes smoothly. Among other things, we may use cameras to:


  Make sure that cars are clean
  Find lost items
  Provide help in case of emergency
  Check that in-car rules are being followed [Emphasis added]
  Improve products and services
  Promote safety and security [Emphasis added]


Our Support team may review video under certain circumstances, including after an issue is brought to our attention. Occasionally, in more urgent circumstances, Support may access live video during a trip.

Microphones inside the car

The microphones inside the car are only on during voice calls with Rider Support or when you actively choose to enable microphones inside the car.

To me, that sounds like riders' voices aren't automatically sent back to the mothership. Indeed, they're at pains to say:

Waymo vehicles also have a number of sensors, including our audio-detection system used to detect police and emergency vehicle sirens. Waymo has implemented technical and procedural safeguards designed to limit the collection of any human voice data from these microphones.

So there is some acknowledgement of privacy - for our voices at least. Meanwhile, passengers are all watched over by machines of loving grace or, at the very least, fallible humans with prurient interests.

About a decade ago, people were theorising that a driverless cars would one day deliver to you a rider who died on the journey. I don't think that's happened yet - instead, we have cars watching what what we do. Silently judging us picking our noses. Examining our body language for signs of stress. Tracking our breathing patterns and heart-rates to ensure we aren't going to cause damage to the vehicle.

Not listening though. That would be a step too far.

Besides, who needs to use a microphone when you've got a high-resolution camera backed by AI?

https://shkspr.mobi/blog/wp-content/uploads/2026/09/2001-lip-reading-web.mp4


Just as I finished writing this post, a story broke about how a Waymo pulled over and called the police on riders who had "ghost gun". The company said it alerted the authorities after detecting a terms of service violation.

Of course, it didn't say how it detected that!

I also find it curious that in both cases, the alleged perpetrators were juveniles. Maybe children have less of a right to privacy than adults?

I guess when you ride alone, you ride with a snitch.



2026-09-13 10:35: Nelly the pup absolutely loving life in the field! 🤣 - Kev Quirk
2026-09-13T09:35:00.000Z
Nelly the pup absolutely loving life in the field! 🤣
                    
                        
                        Thanks for reading this post via RSS. RSS is ace, and so are you. ❤️
                        You can reply to this post by email, or leave a comment.
                    


Lucy loves unsexy, boring, functional, government information - Johnny.Decimal
2026-09-13T06:21:04.000Z
I've spent two days going through a long list of small-business-related online resources that I've collected over the last few months.
I'm always amazed at how much handy stuff is out there. Stuff that never gets airplay because it's not doom-laden news, scandalous gossip, or memes. It's mostly tax-payer funded, created by government departments, reasonably well maintained, and helpful.
It's easy to complain about 'the government' ... "What does it actually do again?".¹ Ha ha. But in my experience of living in a national capital, the government isn't the politicians on the telly. Or some secretive, Borg-like structure full of lizard aliens.
It's everyday people whose job is to create unsexy, boring, functional information and services. The kind that helps make the wheels of a country go round.
I've just added all these links to the Small Business System. While they are Australian, I think there's a decent amount of pages with generic information that could be applied to any business.
But wherever you are, I'm guessing there's also good unsexy, boring, functional information made by your government. So hopefully these links give you ideas on the type of things to search for locally, or ask your AI robot to find.²
Footnotes


To be clear, I don't think ours is perfect. My current complaint is that my birth certificate and drivers licence were deemed invalid when we moved interstate last year. This is not yet fixed. 🥲 ↩


But be careful asking your robot friend to summarise business advice. Especially important legal stuff about things like regulations and compliance. This article – Using AI for help with workplace questions – recommends checking original source pages versus just reading summaries. The information might be inaccurate (e.g. out of date or from another jurisdiction). ↩

Review outcome	PRs	% of merged PRs
Total merged	126	100%
Accepted with no security-relevant revision observed	91	72.2%
Accepted with security-relevant revision observed	33	26.2%
Indeterminate	2	1.6%

Reason for closure	PRs	% of closed PRs
Total closed without merge	60	100%
Superseded, reimplemented, or re-landed elsewhere	36	60.0%
Policy, process, scope, or maintenance reasons	14	23.3%
Duplicate or convergent with another fix	3	5.0%
Explicitly rejected on technical grounds	4	6.7%
Other or indeterminate	3	5.0%