Shellsharks Blogroll - BlogFlock

News will be intermediated by AI. What's next? - Werd I/O

2026-10-22T18:30:42.000Z

Link: The Three-Layer Cake: Public-Interest Information in an AI-Intermediated Age, by Gina Chua and Adiel Kaplan at the Tow-Knight Center for Journalism Futures

Gina Chua and Adiel Kaplan at the Tow-Knight Center for Journalism Futures have put together a report summarizing a year of convenings and conversations about how journalism might react to its intermediation by AI. I was privileged to take part and to read a draft version of this report.

I love the framing here: the three-layer cake is digestible (so to speak), and I think the conclusions are sound. The worrisome thing for journalism is that most newsrooms live in the creation layer — the creators who supply the information which informs answers and summaries — which is also the part of the stack where participants have the least leverage.

So we need open, shared, common infrastructure. I think we also need strong portability standards. I’d argue that another word for the consumption layer as described here is profiling; tools at the consumption layer need to know a lot about their users so they can provide the most relevant information.

As the report says:

“This is the layer that holds the relationship with the end user, where their data resides and the understanding of their information needs and desires accumulates and deepens over time. Owning that relationship will be one of the prizes of the AI age; not only will it unlock deep knowledge of individuals, it could lock them into particular providers.”

And any solution needs to keep this in mind:

“At the consumption layer, [points of leverage] involve working to ensure that the knowledge of people’s wants and needs is not the monopoly of organizations that may not have the public’s interest at heart.”

Profile data is accumulated, private, and usually non-portable. The consumption layer also represents the greatest risk to creators from platform business decisions, both in terms of the business models of those platforms and which creators they choose to feature. Open portability standards and protocols — combined with full user control of their data — can scale, create useful competition, and empower users in the process.

Read "AI Is Changing Everything About Hacking. No One Knows What Happens Next" - Molly White's activity feed

2026-10-22T15:40:58.000Z

Read:

“AI Is Changing Everything About Hacking. No One Knows What Happens Next”.

Jason Koebler in 404 Media. Published October 22, 2026.

So much is happening, and so quickly, that it has been difficult for me — someone who has been reporting and editing stories on security and hacking for a decade — to fully understand what’s going on, to have a sense of what could happen next, or predict where this is going. And I think that that is largely where we are at the moment, as I am writing this. But it has become clear that AI, broadly defined, has fundamentally changed both offensive hacking and defensive cybersecurity. This is not because AI has become sentient or because human beings have lost control of it or because of “swarms” of “rogue agents,” but because AI is proving something that we have always known: much of the software that runs the internet, our devices, our accounts, and our lives is vulnerable, or out of date, or has security flaws that human beings never noticed, or was installed by someone at a company who left the company six years ago and has been replaced four times and no one knows how to find them now or how to update it.

Note published on October 22, 2026 at 2:38 PM UTC - Molly White's activity feed

2026-10-22T14:38:38.000Z

a sight for sore eyes

2026-10-22 14:13: So. Hooman. Are you ready for our meeting? - Kev Quirk

2026-10-22T13:13:00.000Z

So. Hooman. Are you ready for our meeting?

Thanks for reading this post via RSS. RSS is ace, and so are you. ❤️

You can reply to this post by email, or leave a comment.

Gadget Review: Mokin 17 Port USB-C Tower ★★☆☆☆ - Terence Eden’s Blog

2026-10-22T11:34:36.000Z

The good folks at Mokin have sent me their new USB-C hub and it is a beast.

This is the MODK2403 - the latest in their line of high-tech USB-C docks. It does close to everything you could want and has an LCD monitor for showing the weather.

Errr… What?

OK, a quick product shots, then on to the specs.

On to the ports:

Triple display
- Either 3x HDMI or 1x HDMI and 2x DisplayPort
4x USB-A
- 2x 2.0 480Mbps, 1x 3.0 5Gbps, 1x 3.1 10Gbps
2x USB-C
- 1x 3.0 5Gbps, 1x 3.1 10Gbps
USB-C PD input
- 100W
USB-C to host computer
- USB-C to C cable included
Ethernet port
- 1Gbps
SD and microSD
3.5m Audio Jack
Suction cup

Yup! At the bottom of the tower is a silicone surround which allows it to firmly plant on any flat surface. It's strong enough to take any gentle nudges without toppling over, but easy enough to lift off if you need to move the unit.

It is slightly cheeky to describe this as 17 ports. The two DisplayPorts are tied to the HDMI ports - so you can only have 3 screens active at a time, not five. But as each screen can do 4K @ 60Hz, I'll let it slide.

Screen

There's a black and white screen included which can show you a bunch of information. Tap the power-button on top to cycle between them.

Which ports are connected:

Screen resolution of attached devices:

Total power draw:

WiFi set up:

Wait? What! If you connect to the hub's WiFi, you get this set-up screen.

Once it is connected, it'll show you the weather in your area:

I'm not entirely convinced about whether that's useful. Although you can change the units from ℉ to ℃, and show or hide your area, there's no other customisation available. No 24 hour clock, no date formatting, nothing. There's also no privacy policy or indication of which weather provider it is connecting to.

The screen switches off after a few minutes - so it isn't a constant distraction. Tapping the top button turns it on again.

Double-pressing the power-button switches the external monitors off. Which is useful for privacy I guess?

Linux Info

Worked perfectly with my Linux laptop. I drove two external screens via DisplayPort, a bunch of USB peripherals, Ethernet, etc.

A full read-out gives:

0bda:8153 Realtek Semiconductor Corp. RTL8153 Gigabit Ethernet Adapter
0bda:0411 Realtek Semiconductor Corp. Hub
2109:0822 VIA Labs, Inc. USB3.1 Hub
2109:8822 VIA Labs, Inc. USB Billboard Device
0020:0b21 Generic AB13X USB Audio
0bda:1100 Realtek Semiconductor Corp. HID Device
0bda:5411 Realtek Semiconductor Corp. RTS5411 Hub
1a86:8095 QinHeng Electronics USB Hub
303a:1001 Espressif USB JTAG/serial debug unit
2109:2822 VIA Labs, Inc. USB2.0 Hub

Speed

I have 1Gbps broadband, and I was able to get 850Mbps through the Mokin's Ethernet port. That's pretty much what I'd expect.

Copying files via USB-C to a Pixel phone topped out at about 200MBps, which was a little underwhelming, but fast enough for my needs. I tried a variety of cables, including the bundled one.

Sound

The AB13X USB Audio presents as both analogue and S/PDIF. There was no meaningful difference between the two in terms of sound quality. There was minimal hum on output when nothing was being played.

WiFi and Security

I'm slightly uneasy about the built-in WiFi connection this hub offers. It is primarily used for showing the weather on screen, but it can also be used to upload new firmware.

Worryingly, it has a weak default password set - mokin123. I think that might be against the law. The password can be changed by the user - but I wonder how many people will bother?

When I mentioned this to Mokin, they replied:

After the initial password is set, the user can change the password themselves rather than continuing to use a fixed default password.

I don't think that's good enough to protect users.

Similarly, the SSID can be hidden and is randomised, but I wonder if that's suitable defence against a determined hacker?

I'm glad that the unit doesn't hijack the Ethernet connection - but who knows what a future firmware update might do.

There's also a 303a:1001 Espressif USB JTAG/serial debug unit exposed on the hub. I tried connecting to it with esptool and the hub crashed! I had to pull out the power to get it to restart. I'm not smart enough to probe it further, but I can't help wondering why it is there.

Finally, there's a mysterious 0bda:1100 Realtek Semiconductor Corp. HID Device. I thought that was used for blanking the external screens when the power-button is double-pressed, but that didn't register on evtest. So what is it for? I don't like the idea of a random Human Interface Device (usually a keyboard or mouse) being attached to my computer.

I spoke to Mokin about it and they said:

our technical manager confirmed that these two entries are reserved for future firmware updates.

Personally, I would expect these to be disabled if they aren't going to be used.

Privacy

With any device which connects to the Internet, you have to be concerned about what data it is collecting, storing, and transmitting. I asked Mokin if they had a privacy policy related to their weather service. They said:

There is no need to worry about your personal or location information being uploaded or stored remotely. The relevant user information is stored locally on the device.

The weather/location information is provided through Google services, and no personal information is uploaded or stored by us. Therefore, there should be no privacy or data security concern from our side.

I don't find that terribly convincing. At the very least they should tell users who their weather provider is and what their privacy says. I assume that the device is doing a GeoIP lookup before sending the request to Google - again, that should be explained to users.

I've no evidence that the hub is collecting data about what is attached and then sending it off somewhere - but without a privacy policy from Mokin, who can say?

Cracking It Open

The suction cup at the bottom is only lightly glued on and peeled off easily. Underneath are four screws.

The base removes easily, exposing the three circuit boards.

Here's a close up:

I couldn't easily get them out, and the front plastic was held on securely. I'm sure it would be possible to snap off, but I didn't want to damage it.

Price and Final Thoughts

It's usually about £90 from the manufacturer or around £70 from Amazon.

You can get a basic hub for less than half that price - but what you're paying for here having all the ports. It's an attractive package, well designed, quiet, and unobtrusive.

The screen is moderately useful - being able to see which ports are in use was handy, as was seeing the total power draw. The screen debugging was also handy. I'm not that interested in the weather, but I can see how it would be helpful as a single-use screen.

I have significant concerns about the always-on WiFi, especially given its easy to guess password. I've contacted the manufacturer to see if anything can be done about that but they don't seem interested in fixing it. The lack of privacy policy is also worrying.

Similarly, the HID and JTAG are also something I wouldn't expect to see on a hub like this. Ideally they should be disabled if not in use.

In terms of ports and performance, this can't be beat. But I would be reluctant to connect it to my home WiFi network.

Converting YAML to Jekyll collection - Joel's Log Files

2026-10-22T03:36:01.000Z

I was reading a blogpost by AetherAnne where she spent some time manually turning a YAML file into a Jekyll collection. Doing things by hand is a wonderful thing, but well, sometimes a bash script works too!

I don’t know why I hadn’t done this myself already for my books. Especially because I already had used Jekyll collections for my origami before. Check that out in case anything here is unfamiliar to you. I am assuming a bunch of terms that only make sense if you use Jekyll or YAML or parsing and such.

In any case, my YAML file looked like this:

- title: "Dune Messiah"
  author: "Frank Herbert"
  cover: "/assets/img/books/dune-messiah.jpg"
  start: "2026-10-20"
  end: "2026-10-20"
  progress: 15
  summary: "a summary"

Like AetherAnne, I also considered using some LLM tool to do this, it would have taken a single prompt and would probably work just fine, and few people would have judged me too harshly for it. But again, why not actually try and do it myself, and maybe learn something?

First I had to figure out how to read a yaml file with bash. I could have done some stuff with the usual echo and cut or awk, but I looked it up and discovered that yq would do the trick rather cleanly. This only took some basic online research!

I probably could have done an equivalent function but again, not the point

Afterwards I needed to remember how to do a for loop in bash. Thankfully I found this tutorial from W3Schools

So I tried this little script to see if I got the logic right:

title=$(yq '.[].title' books.yml)
for i in $title; do
    echo $i
done

…It didn’t work.

The output ended up looking like this:

"Dune
Messiah"
"The
Left
Hand
of
Darkness"

I guess it was taking the whole string of characters and… not doing what I wanted!

But hey, that’s how coding works, the computer is doing as it is told, I am the one who misunderstands here.

I figured I would do a bit of a cheat code after seeing the examples in the article I linked, and use a range for the loop to go through. I knew I had a total of 57 books logged, so I did the obvious from there.

for i in {0..56}; do
	title=$(yq '.['$i'].title' books.yml)
	echo $title
done

This worked as expected! Now the output was:

"Dune Messiah"
"The Left Hand of Darkness"

It was a bit slow but I didn’t mind one bit. Some smarter people would do a line count to see how many files there are and such, but hey, this works.

Since I got the main thing going, I revisited some of my older scripts where I do some similar stuff and applied it.

I needed to figure out how to make a filename. This wasn’t different from what I already do to generate my permalinks from the title of my posts. Excuse the ugly variable:

filen=$(echo $title | tr " ,.!" "-"| awk '{print tolower($0)}')

Check my article about my rofi script to generate my posts in case you are curious about that.

In any case, now everything is done. Here is the whole script:

for i in {0..56}; do
	title=$(yq '.['$i'].title' books.yml)
	filen=$(echo $title | tr " ,.!" "-"| awk '{print tolower($0)}')
	author=$(yq '.['$i'].author' books.yml)
	cover=$(yq '.['$i'].cover' books.yml)
	start=$(yq '.['$i'].start' books.yml)
	ending=$(yq '.['$i'].end' books.yml)
	desc=$(yq '.['$i'].summary' books.yml)
	echo $filen.md
	echo -e "---\nlayout: book\ntitle: $title\nauthor: $author\ncover: $cover\nstart: $start\nend: $ending\ndescription: $desc\n---" >> ./test/$filen.md
done

This is not a script that will work with any format or for any edgecases, in fact, it doesn’t even do things as I expected: all the filenames ended up as "name-of-book".md

So those extra quote marks were rather ugly, but by this point I just used the built-in Bulk Rename tool in Thunar file manager and called it a day.

It is my script, it got me where I needed, and I worked from there. I created the _books folder in my website root directory, I did a super quick modification to the liquid syntax to generate my booklog, enabled the "books" collection on _config.yml, and called it a day.

Now I kind of have to do this with my videogames…

This is day 56 of #100DaysToOffload

Reply to this post via email | Reply on Fediverse

Walking - James' Coffee Blog

2026-10-22T00:00:00.000Z

I stopped in awe.

Looking up, I saw a tall tree whose base was yellow and top was red, with all of its leaves glistening in the golden sun that made its way through the clouds we have seen in recent days. An adjacent tree had a combination of green leaves and barren branches, prompting me to wonder why. These are two different types of trees. I know not their names, but all trees are beautiful.

The path was full of colour. I took a deep breath of the cold air. Was I also trying to breathe in the colour of the day, and the energy that brought the trees to life today? Filling my lungs and propelling my walk, the air blew away difficult thoughts and opened my mind to new ones: falling leaves danced through the sky, contributing to the bed of colour that I like to imagine keeps the grasses warm as they adjust to the cooler weather.

An idle thought occupies my mind for a moment. The present is a theme and a focus of my work. I like looking to the world each day and writing what I see; what I feel with the passing moments.

What if leaves were stars, flickering in the light of day? From where I stand – from where I walk – the trees are high in the sky, their leaves twinkling as they move with the wind and catch the light of the day. I think about how the way I look at trees is similar to how I look at architecture. I look up, in awe. With time I have come to realise that everything I see in the world has many dimensions to appreciate.

If the leaves were stars, we would be walking perpetually among stars. Who would we be? The sun, radiating warm energy? The moon, casting a cool calm glow? Jupiter? I like to think I’d be myself.

Every season has its own sounds, and its own textures. I trawl through crispy leaves to hear the crunch, a sound that is made possible by Autumn. My attention turned to the ground, to all the colours. Then I looked up again and saw a hill that, yesterday I saw – and today, and every day, I see – in a new way.

Your AI agent fixed the bug, but what else did it change? - Trail of Bits Blog

2026-10-21T15:00:00.000Z

Today we’re publishing patching-bugs and regression-hunt, two plugins that let engineers delegate patch development and regression checks to agents. Our patching-bugs plugin reproduces reported bugs, develops fixes, and tests them. The regression-hunt plugin checks whether any changes break previously working and supported behavior. Engineers can direct the work and review their results; maintainers can supply their own security assumptions and patching requirements, so the agents work within the project’s rules.

We built patching-bugs and regression-hunt through Patch the Planet, our joint initiative with OpenAI, where we’ve co-authored hundreds of security patches for widely used open-source projects. Motivated by our major successes on projects like Scapy, our plugins draw on our analysis of merged patches and thousands of our engineers’ Codex sessions.

The plugins provide maintainers with a structured workflow, evidence, independent checks, and best practices to improve their patching hygiene. In our preliminary evaluations, regression-hunt produces 25% fewer false-positive findings than a baseline Codex agent prompted to “review the PR for regressions.”

Standardizing the patching process

Our September post reported regressions introduced by some of our Patch the Planet patches. Since then, we’ve reviewed every patch that a Trail of Bits engineer authored and maintainers merged upstream. The review confirmed 21 regressions from over 130 PRs merged: 16 functional, one performance, and four build/test. None broke a security protection.

(“Regression” refers to a new defect introduced by a change that breaks previously correct and supported behavior along a path a real user or attacker can reach.)

For each patch, an agent looked for potential regressions, confirmed each one with a proof-of-concept (PoC) run before and after the change, and then passed the results to an engineer for review.

The review was noisy: today’s bug disclosures arrive at an unprecedented speed and scale, and for patching to keep pace, the industry needs to increase its signal-to-noise ratio. The 21 confirmed regressions were identified among 58 candidates in a single run (~36% precision). But because agents take many different approaches and reach different results, each run generates more candidates to manually sort through.

That led us to two conclusions:

To introduce fewer regressions, we needed a standard way to write patches, with the same checks applied every time.
To catch the regressions we still introduce, we needed a standard way to check for them, with written rules for what counts as a regression.

Standardizing both steps also makes every run repeatable and comparable. No fixed checklist will catch every regression, so we collect agent trajectories from our engineers’ patching sessions, and use the tasks that an earlier version failed to benchmark for the next one (figure 1).

Figure 1: Feedback loop for generating and evaluating patches.

How we designed the plugins

We used two primary sources to guide the design of our plugins: a review of every patch we merged upstream and the thousands of Codex sessions our engineers used to write those patches.

This led to four principles that shaped our patching-bugs and regression-hunt plugins:

Opinionated guidance in as few words as possible. We give the agent wide latitude and record only Trail of Bits’ judgment of what constitutes a good patch and a real regression. The goal is to direct the agent towards the desired result with the least possible guidance.
Modular steps. You don’t have to run either plugin end-to-end, as both provide multiple skills that can be used in tandem or in isolation.
Strict input and output schemas. Every step takes and returns a defined schema that includes the claim, the code revision, the required check, the raw evidence, and open questions. Fixed schemas reduce variability across runs and allow each step to verify the previous step’s work rather than trusting its summary.
A live proof of concept for every claim. Every conclusion depends on a PoC run against a live deployment: a built, running instance of the project, reached through the interfaces a real user would use. When reproducing a bug, proving a fix, and confirming a regression, if a step can’t produce a live PoC, its result is inconclusive.

regression-hunt reduces false positive rates

The regression-hunt plugin (Figure 2):

Enumerates candidate regressions by tracing the changed code (the diff) through its callers to its real interfaces.
Reproduces each candidate regression on a live deployment of the system.
Replays the PoC on the live deployment on a fresh-context agent.
Judges the results of all the previous steps to validate that the proof meets the requirements of a regression.

Figure 2: The regression-hunt workflow.

In addition to the four principles above, there are two core aspects that are critical to the plugin:

Defining a regression: The plugin has strong opinions about what a regression is and, more importantly, what a regression is NOT. The burden of proof is placed on the agent (specifically during the “adjudication agent” step) to prove that there is sufficient evidence to show that the suspected regression is not a false positive, an incomplete fix, a latent bug, a pre-existing bug, and so on. The plugin only reports a regression if all of these gates are passed.
Incorporating a threat model: If a threat model is available, the orchestrator will intentionally pass this document as part of the global context for each individual agentic step. This is an attempt to require each step/agent to refer back to the threat model before reaching its conclusion.

Our review of merged PRs yielded a set of 21 confirmed regressions that we could use to evaluate regression-hunt. We used the whole set to compare the plugin with a baseline Codex agent prompted to “review the PR for regressions.”

Across those runs, regression-hunt produced 25% fewer false-positive findings than the baseline, with a 95% confidence interval of 14% to 38%. Its strict evidence requirements also left some known regressions classified as borderline: the plugin identified a possible regression but did not gather enough evidence to confirm it. Fewer false positives therefore came with a tradeoff in how many known regressions it could confidently report.

Next, we’ll investigate why these cases remained borderline and improve the plugin’s strategies for gathering evidence. Our goal is to confirm more real regressions while giving maintainers clearer information when the evidence remains inconclusive.

patching-bugs streamlines best practices from thousands of agent sessions

The patching-bugs plugin is a distillation of all the best practices we’ve identified by analyzing thousands of Codex sessions by Trail of Bits engineers (Figure 3). In addition to the more traditional capabilities (such as reproduction on live deployments and independent adversarial review), the plugin emphasizes:

The three-arm proof: The proof runs the same reproduction against three specifications: the original code must fail, the patched code must pass, and a complete revert must fail again. Bringing the bug back by removing the patch provides stronger evidence that the patch—rather than an unrelated environment or test change—actually fixed the bug.
Invariant-guided repair: The patch attempts to fix the underlying, violated security invariant rather than fix the specific bug. This helps generalize the patch for possible variants of the same bug class.
Incorporates regression analysis: The plugin mandates that regression-hunt is run to ensure that any patch goes through the same standard pipeline to check for mistakes.

Figure 3: The patching-bugs workflow.

What’s next for the plugins

Both patching-bugs and regression-hunt will continue to evolve. Our engineers are using them in their Patch the Planet work now, and we’re collecting data on how they’re being used, what works, and what doesn’t. That data, along with better evaluations, will shape the next version’s capabilities:

Evaluate patching-bugs. We’re building an evaluation that measures whether the plugin’s patches fix the reported bug and its variants without introducing regressions.
Learn from agent traces. We’re analyzing the first batch of trace-level data from our engineers’ sessions. It will show whether Codex follows the rules and definitions required at each step, which steps it skips, and where its evidence is weakest.
Make the plugins more configurable. patching-bugs already reads a project’s own patching guidelines (more on that in a bit). Next, we want maintainers to be able to choose whether to minimize patch sets—or, when broader coverage is worth more false positives, to loosen regression-hunt’s rules to surface more candidates.

These plugins encode best practices we’ve found for an agent to patch a bug properly, and they improve when you tell them how your project works.

The plugins work best when you input two kinds of project knowledge:

A THREAT_MODEL.md, which tells agents what counts as a vulnerability or a regression. The regression-hunt plugin passes it to every step, so each agent has to check its conclusions against the file. It should define the following: assets whose compromise matters, trust boundaries, access controls, supported configurations, specifications on what is or isn’t a vulnerability, and evidence required for a valid bug report (example).
A PATCHING_GUIDELINES.md (or AGENTS.md), which tells agents and patching-bugs how your project wants fixes written. It should outline how to build and test the project, how big a fix should be, where a fix should go, how to present proposed changes, and what a regression test must show (example).

For our Patch the Planet work with GPAC, our engineers wrote a threat model and a project-specific patching skill that captures how GPAC’s maintainers want bugs reproduced, what evidence a fix needs, and what a patch must preserve. Liboqs and validator.js have also published threat models in accordance with our guidance.

The more comprehensive and specific these files are to your project, code conventions, and operating style, the better the output you’ll receive.

The industry needs to focus on patching

As AI accelerates bug discovery, we need to turn those findings into reliable fixes just as quickly. Solutions need to balance speed and quality: an agent needs to understand a report, decide what needs to change, and check that a patch fixes the issue without introducing regressions. Our patching-bugs and regression-hunt plugins bring what we’ve learned from Patch the Planet into that workflow, helping maintainers move from a bug report to a patch they can confidently review and ship.

Install patching-bugs and regression-hunt, add a THREAT_MODEL.md and a PATCHING_GUIDELINES.md to your repository, and put them to work on your next bug report. Give the tools your project’s context so they can help you focus on the right fix and validate it faster. Then share your feedback, including comments about where our defaults don’t fit your project. Those real-world cases will help us build the next version.

Get 18% more keys for free with this one crazy trick - Johnny.Decimal

2026-10-21T03:43:24.000Z

You probably only have 78 keys on your keyboard.¹ So why do you never use 12 of them?

These keys, of course, are the F-keys F1 through F12. By default, macOS uses them for the glyphs printed thereon. But tell me the last time you pressed any of these:

F3 for Mission Control.
F4 for Spotlight.
F5 for whatever that microphone does.
F6 for Sleep.²
F7–F9 for Music control.

I'll grant that you might use F1/F2 for brightness and F10–F12 for volume control. But still, how often?

Let your apps use them

I'm writing an app. Apps work really well with shortcut keys. We all have 12 perfectly great keys right there, begging to be used – and we never do.

'Of course', you'll say. 'The user can press the Fn key to access the F-keys'. And, right, they can do that. But a fraction of people know that this is possible. So they never, ever will.

I implore you, then, to change this setting. Go to Settings > Keyboard > Keyboard Shortcuts… > Function Keys. Turn on Use F1, F2, etc. keys as standard function keys.

And there you go. Previously you had 66 usable keys. Now you have 78.

US keyboard on a modern Mac laptop. ↩
TIL that there's a built-in Sleep shortcut! I've created my own via a Raycast shortcut for years now.³ 😭 ↩
For 'sleep' I use Control-Option-L. I use Control-Option for my own global shortcuts because not much else does. L because the shortcut, which triggers Raycast's system action Sleep Displays, has the effect of Locking my laptop. I may have inherited this from Windows, where Win-L does the same. ↩

Brainstorming multi-lingual use of Artemis - James' Coffee Blog

2026-10-21T00:00:00.000Z

I now follow three websites or feeds whose authors write in French; in at least two cases, the authors write in both French and English. When I see posts in different languages, I use Firefox’s Translate feature to read them. Firefox Translate is not perfect, but as long as I can get the gist of something I am happy (although suggestions for better translation practices, ideally locally, and without complex, internet-connected, or paid technology, would be sincerely appreciated!).

Now that I am seeing more French in my Artemis feed, I have been thinking about what features may be useful to help me make the most of what I see. Here is a snippet of some posts in my web reader right now:

ALT

Five posts in Artemis by four authors. The first three posts are in French. The last two are in English.

One of the features I am experimenting ¹ with (seen in the screenshot above) is adding the language code associated with an article before the title of the article, like so:

[FR] [post title]

I only add this if the title isn't in a language I know (English).

To determine the language that corresponds with a post, I am using the “langdetect” Python package ². There are likely ways to infer language deterministically (ActivityStreams has a “contentMap” value that contains as keys language codes that map to post content, e.g. “fr” would map to a post written in French).

This feature is most useful when a title is also written in a language I don’t know. The tag gives me a clear visual indication that a post is in a different language before I start reading the title. This helps me while scanning my feed.

One edge case where this tag adds confusion, however, is when all the words in the title happen to be in English. This was the case with one title in my feed, “Writober 2026 – Lounge ”, whose contents are in French but the title is readable in English. In this case, an “[FR]” preface to the title is technically correct, but is jarring given the title co-incidentally is in words that I can read as English.

⁂ ⁂ ⁂

Earlier today at HWC Asia/Pacific, I raised the idea of multi-lingual feeds and we had a good discussion. Part of me wants to offer a translated version of a post title, but I am not sure whether I want to be running a full translation model on the server. Argos Translate looks like a promising model should I want to go down this path, though I would sincerely appreciate recommendations on this front. The red line is that I want all translation to either happen within Artemis or, if absolutely necessary, the user’s browser. I don’t want to use an external API.

There is an experimental Translator API in the browser which could, in theory, allow the use of JavaScript to translate specific parts of the page on load. With that said, this API does not have Firefox or Safari support, and it would mean titles would be translated on every page load.

I am also unsure whether using a translation will deprive me of some part of the experience of seeing multilingual text. I read one Mastodon post in Artemis today that was written in French. I was able to translate the post myself approximately enough to get the joke, even though I know very few words of French. I felt really good after this!

⁂ ⁂ ⁂

Reflecting on what multi-lingual features a readers should have has taken me down a long rabbit hole of considerations. If an article has a translated version, could a web reader show an icon to indicate that there is a translated version? Could said reader automatically retrieve the translated version? What could/should Artemis do when the titles of feeds are in a different language? Yesterday I was subscribing to a French blog that uses WordPress. The titles of the feeds were in French and at first I accidentally selected the comments feed as the one to which I wanted to subscribe.

Language use on the web is complicated, and I am only scratching the surface. Stephanie Booth’s talk “While We Wait for BabelFish: Languages on theInternet [sic]”, although given in 2007, has given me a lot to think about. As I only speak one language (although I do understand the specific Scots dialect/words from where I grew up), I have a limited view of what is best to do. Someone who only speaks one language may prefer a different UI to someone who speaks multiple. That is to say: there is a lot to explore, and I would love help! If you have thoughts, I would be delighted to hear from you.

This experiment is currently enabled only on my account. I do this sometimes so I can get a feel for a feature before releasing it either in the Artemis Labs section of the software as an experiment or as a fully-fledged feature.

[↩]

Technical note: I check if the post content is more than two words to prevent false positives, something I ran into with short Mastodon posts. This logic will likely need to be made more robust, though.

[↩]

Writober 2026 – Lounge Translator API Argos Translate I would be delighted to hear from you 1 2 [↩] [↩] langdetect While We Wait for BabelFish: Languages on theInternet

Note published on October 20, 2026 at 11:02 PM UTC - Molly White's activity feed

2026-10-20T23:02:20.000Z

truly a wild time to be alive when the cryptography world is split between those worried about quantum computers and those whose private key is “4”

Hilary Duff at the Spark Arena - The Weblog of fLaMEd

2026-10-20T22:47:52.000Z

What’s going on, Internet? Just got back from seeing Hilary Duff at the Spark Arena (on a Tuesday night, whooo).

Great show. I wish I knew her music more as I would have loved to be belting out the lyrics with the rest of the crowd.

Definite millenial energy in the crowd. Loved it.

Hey, thanks for reading this post in your feed reader! Want to chat? Reply by email or add me on XMPP, or send a webmention. Check out the posts archive on the website.

Read "The Internet goes on high alert after discovery of 8 compromised TLS certs" - Molly White's activity feed

2026-10-20T22:34:34.000Z

Read:

“The Internet goes on high alert after discovery of 8 compromised TLS certs”.

Dan Goodin in Ars Technica. Published October 20, 2026.

“That is extremely in the ‘this should not be possible’ category,” Valdorda said. “Maybe some horribly dangerous key generation interface has a ‘size’ parameter and they set it to 1 by mistake???”

AI can weaken relationships between people - and teams suffer as a result. - Werd I/O

2026-10-20T17:49:51.000Z

Link: Team Dynamics Weaken When Employees Turn to AI Instead of Colleagues, by Kate Niederhoffer, Kristina Rapuano, Alex Liebscher, Alexi Robichaux and Jeffrey T. Hancock in Harvard Business Review

Relationships take time, effort, and practice to keep alive. So in a sense, it shouldn’t be a surprise to see this finding from a survey of more than a thousand desk workers across 20 industries:

“The more they turned to AI instead of a teammate, the more their trust in each other and their ability to coordinate seemed to erode.”

It turns out that if you start asking an AI system instead of your colleague, coordination and trust drop by at least 20%. These technologies are still relatively new; I imagine that over time this will continue to drop. People who feel isolated in their work today will feel more so as this trend solidifies. Similarly, people who feel untrusted today will only feel more so as their teams continue to ask AI systems instead of them.

That doesn’t mean AI is always inherently bad. Like all work processes, it demands that we think hard about culture: what kinds of behaviors and feelings do we want to promote? What’s important to the organization? And do we care more about an individual’s productivity than creating a high-performing team? (We shouldn’t.)

This also rings true:

“People consistently underestimate how enjoyable a human conversation turns out to be. Whether the motivation is fear of judgment or a desire not to impose, avoiding a colleague is hardly a new workplace behavior. AI now provides an alluring alternative that forgoes the social and emotional costs of getting support.”

One way we can counteract this is by making asking for help (and giving it) an explicit norm in our team cultures, and leading by example by doing it ourselves. In remote or hybrid teams that rely on tools like Slack, that also means doing it in a non-private channel, so that other team members can see it and it can become normalized.

Although a bit of a cliché and genuinely heinous if they’re done poorly, I think standups can also be really helpful here, if you can do them live. Here, everyone goes round a circle and talks briefly about what they’re working on, with explicit needs for help made as part of the update. Implicit requests for help can be answered once everyone has gone around the circle.

Can AI help? Totally. As the authors discuss in this piece, you can use technology to help conversations to happen asynchronously, particularly on teams that spread across multiple timezones, and it can actively facilitate connections between people.

Let’s do that, instead of displacing our people and our relationships. AI can be a facilitator between people, but it should never be an intermediator: our relationships, our communities, and our companies will suffer.

Foursquare died at the hands of private equity. What happens next? - Werd I/O

2026-10-20T16:45:59.000Z

Link: Some final words on Foursquare, by Dennis Crowley

I freaking loved Foursquare. It was a wonderful way to explore cities with the help of my friends: in the same way that Upcoming was my best way of figuring out which events I should be going to, Foursquare let me know which restaurants, bars, parks, etc, were worth checking out. If Chris ranked a cocktail bar, you know it was amazing. Aaron always found the best coffee spots. And so on: my friends were better recommenders than any other source I had.

My own map lists every state and country I’ve been to over the last few decades. If I’m back in Amsterdam, I can figure out which Indonesian food place I really loved, because there it is on my map. (It’s Paon Bali, by the way. You’re welcome.)

So this was sad to see as an outcome. I think there are a bunch of important lessons here – not least the dangers of raising too much too soon without tethering the business to revenue. But at the same time, Foursquare launched during a startup explosion, and this kind of fundraising was the norm; I don’t fault Dennis for his decisions. The bigger problem seems to have been the private equity leadership more recently. I can’t think of a time when private equity hasn’t led to toxic leadership and a strip-mined company with an inequitable deal for employees.

Which leads me to an obvious problem. That check-in data is intimate stuff. It probably shouldn’t be something private equity can just inherit and do whatever with. Journalists and activists should hopefully not have been using Foursquare to check in; if they did, that data can almost certainly have been bought for analysis. And then a future-facing question: how might we have these kinds of social effects without sacrificing privacy?

Regardless, I’m pouring one out for Foursquare. I loved it. Thanks to everyone involved for building something that I found genuinely meaningful.

2026-10-20 16:31: Hooman, we are ready to receive your apple core. 🍎 - Kev Quirk

2026-10-20T15:31:00.000Z

Hooman, we are ready to receive your apple core. 🍎

Thanks for reading this post via RSS. RSS is ace, and so are you. ❤️

You can reply to this post by email, or leave a comment.

Book Review: Quackery - A Brief History of the Worst Ways to Cure Everything by Lydia Kang ★★★⯪☆ - Terence Eden’s Blog

2026-10-20T11:34:35.000Z

This is a charming and funny book all about the various ways humans have promoted fake medical cures in exchange for money.

Despite the grim (and occasionally distressing) subject matter, the tone remains light and poppy throughout. There are lots of snarky asides (especially about the fake medical practitioners) and a real appreciation for the bizarre. It's fun the whole way through, although sometimes at the expense of people who perhaps didn't know better than to trust charlatans.

One thing that is constantly brought back is how it can be hard to determine what is patent nonsense and what is a bone fide cure:

Prevent blood clotting: Extract mucus from the intestinal membranes of slaughtered pigs or from the lungs of slaughtered cows. Inject. (heparin)

Is that any more believable than injecting goat testicles to cure impotence?

It also brings to light how squeamish we can be, especially when faced with unusual medical procedures:

We borrow other people’s wombs for surrogacy. And yet, plenty of people squirm at the idea of breastmilk banks. We are a society of contradictions.

The eBook is beautifully formatted. For once, images are in-line with the text! Usually in books of this sort, publishers treat the eBook like a mass-market paperback and stick the illustrations at the end.

It ends rather abruptly, after taking us through light, electricity, colour therapy, animal magnetism, and a couple of dozen other "cure-alls"

Sadly, there are no references or footnotes. While I have no reason to doubt the veracity of the claims, for a book about scientific misinformation and malpractice, I'd've expected a way to find out more information.

Wonders of Web Weaving, Episode 24 - James' Coffee Blog

2026-10-20T00:00:00.000Z

The twenty-fourth episode of Wonders of Web Weaving is out:

In Episode 24, I chat with Alex, the author of alexsirac.com about, among other things, collective intelligence in public commons, what the IndieWeb can learn from Wikipedia, community in comments, and more.

I hope you enjoy the episode!

Wonders of Web Weaving also has an RSS feed you can use to follow along from wherever you get your podcasts.

Alex alexsirac.com The twenty-fourth episode of Wonders of Web Weaving is out Wonders of Web Weaving also has an RSS feed

contours - James' Coffee Blog

2026-10-19T00:00:00.000Z

Spectra of coherence — ground, sky; all presents. // Deconstruct.
Where do I find the word that embodies a step?
— elevation, propulsion, placing; in cycles, forward, forward.
A mirror of irreducibility.
How can a word reflect my cold nose, dripping with winter air,
Breathing in fast, deeply.
Stories, of moments —
Collapsed colour, stark senses, every expression:
Poem, no contours; possible?
(But in contours definition exists.)

seen - James' Coffee Blog