Shellsharks Blogroll - BlogFlock

Your AI agent fixed the bug, but what else did it change? - Trail of Bits Blog

2026-10-21T15:00:00.000Z

Today we’re publishing patching-bugs and regression-hunt, two plugins that let engineers delegate patch development and regression checks to agents. Our patching-bugs plugin reproduces reported bugs, develops fixes, and tests them. The regression-hunt plugin checks whether any changes break previously working and supported behavior. Engineers can direct the work and review their results; maintainers can supply their own security assumptions and patching requirements, so the agents work within the project’s rules.

We built patching-bugs and regression-hunt through Patch the Planet, our joint initiative with OpenAI, where we’ve co-authored hundreds of security patches for widely used open-source projects. Motivated by our major successes on projects like Scapy, our plugins draw on our analysis of merged patches and thousands of our engineers’ Codex sessions.

The plugins provide maintainers with a structured workflow, evidence, independent checks, and best practices to improve their patching hygiene. In our preliminary evaluations, regression-hunt produces 25% fewer false-positive findings than a baseline Codex agent prompted to “review the PR for regressions.”

Standardizing the patching process

Our September post reported regressions introduced by some of our Patch the Planet patches. Since then, we’ve reviewed every patch that a Trail of Bits engineer authored and maintainers merged upstream. The review confirmed 21 regressions from over 130 PRs merged: 16 functional, one performance, and four build/test. None broke a security protection.

(“Regression” refers to a new defect introduced by a change that breaks previously correct and supported behavior along a path a real user or attacker can reach.)

For each patch, an agent looked for potential regressions, confirmed each one with a proof-of-concept (PoC) run before and after the change, and then passed the results to an engineer for review.

The review was noisy: today’s bug disclosures arrive at an unprecedented speed and scale, and for patching to keep pace, the industry needs to increase its signal-to-noise ratio. The 21 confirmed regressions were identified among 58 candidates in a single run (~36% precision). But because agents take many different approaches and reach different results, each run generates more candidates to manually sort through.

That led us to two conclusions:

To introduce fewer regressions, we needed a standard way to write patches, with the same checks applied every time.
To catch the regressions we still introduce, we needed a standard way to check for them, with written rules for what counts as a regression.

Standardizing both steps also makes every run repeatable and comparable. No fixed checklist will catch every regression, so we collect agent trajectories from our engineers’ patching sessions, and use the tasks that an earlier version failed to benchmark for the next one (figure 1).

Figure 1: Feedback loop for generating and evaluating patches.

How we designed the plugins

We used two primary sources to guide the design of our plugins: a review of every patch we merged upstream and the thousands of Codex sessions our engineers used to write those patches.

This led to four principles that shaped our patching-bugs and regression-hunt plugins:

Opinionated guidance in as few words as possible. We give the agent wide latitude and record only Trail of Bits’ judgment of what constitutes a good patch and a real regression. The goal is to direct the agent towards the desired result with the least possible guidance.
Modular steps. You don’t have to run either plugin end-to-end, as both provide multiple skills that can be used in tandem or in isolation.
Strict input and output schemas. Every step takes and returns a defined schema that includes the claim, the code revision, the required check, the raw evidence, and open questions. Fixed schemas reduce variability across runs and allow each step to verify the previous step’s work rather than trusting its summary.
A live proof of concept for every claim. Every conclusion depends on a PoC run against a live deployment: a built, running instance of the project, reached through the interfaces a real user would use. When reproducing a bug, proving a fix, and confirming a regression, if a step can’t produce a live PoC, its result is inconclusive.

regression-hunt reduces false positive rates

The regression-hunt plugin (Figure 2):

Enumerates candidate regressions by tracing the changed code (the diff) through its callers to its real interfaces.
Reproduces each candidate regression on a live deployment of the system.
Replays the PoC on the live deployment on a fresh-context agent.
Judges the results of all the previous steps to validate that the proof meets the requirements of a regression.

Figure 2: The regression-hunt workflow.

In addition to the four principles above, there are two core aspects that are critical to the plugin:

Defining a regression: The plugin has strong opinions about what a regression is and, more importantly, what a regression is NOT. The burden of proof is placed on the agent (specifically during the “adjudication agent” step) to prove that there is sufficient evidence to show that the suspected regression is not a false positive, an incomplete fix, a latent bug, a pre-existing bug, and so on. The plugin only reports a regression if all of these gates are passed.
Incorporating a threat model: If a threat model is available, the orchestrator will intentionally pass this document as part of the global context for each individual agentic step. This is an attempt to require each step/agent to refer back to the threat model before reaching its conclusion.

Our review of merged PRs yielded a set of 21 confirmed regressions that we could use to evaluate regression-hunt. We used the whole set to compare the plugin with a baseline Codex agent prompted to “review the PR for regressions.”

Across those runs, regression-hunt produced 25% fewer false-positive findings than the baseline, with a 95% confidence interval of 14% to 38%. Its strict evidence requirements also left some known regressions classified as borderline: the plugin identified a possible regression but did not gather enough evidence to confirm it. Fewer false positives therefore came with a tradeoff in how many known regressions it could confidently report.

Next, we’ll investigate why these cases remained borderline and improve the plugin’s strategies for gathering evidence. Our goal is to confirm more real regressions while giving maintainers clearer information when the evidence remains inconclusive.

patching-bugs streamlines best practices from thousands of agent sessions

The patching-bugs plugin is a distillation of all the best practices we’ve identified by analyzing thousands of Codex sessions by Trail of Bits engineers (Figure 3). In addition to the more traditional capabilities (such as reproduction on live deployments and independent adversarial review), the plugin emphasizes:

The three-arm proof: The proof runs the same reproduction against three specifications: the original code must fail, the patched code must pass, and a complete revert must fail again. Bringing the bug back by removing the patch provides stronger evidence that the patch—rather than an unrelated environment or test change—actually fixed the bug.
Invariant-guided repair: The patch attempts to fix the underlying, violated security invariant rather than fix the specific bug. This helps generalize the patch for possible variants of the same bug class.
Incorporates regression analysis: The plugin mandates that regression-hunt is run to ensure that any patch goes through the same standard pipeline to check for mistakes.

Figure 3: The patching-bugs workflow.

What’s next for the plugins

Both patching-bugs and regression-hunt will continue to evolve. Our engineers are using them in their Patch the Planet work now, and we’re collecting data on how they’re being used, what works, and what doesn’t. That data, along with better evaluations, will shape the next version’s capabilities:

Evaluate patching-bugs. We’re building an evaluation that measures whether the plugin’s patches fix the reported bug and its variants without introducing regressions.
Learn from agent traces. We’re analyzing the first batch of trace-level data from our engineers’ sessions. It will show whether Codex follows the rules and definitions required at each step, which steps it skips, and where its evidence is weakest.
Make the plugins more configurable. patching-bugs already reads a project’s own patching guidelines (more on that in a bit). Next, we want maintainers to be able to choose whether to minimize patch sets—or, when broader coverage is worth more false positives, to loosen regression-hunt’s rules to surface more candidates.

These plugins encode best practices we’ve found for an agent to patch a bug properly, and they improve when you tell them how your project works.

The plugins work best when you input two kinds of project knowledge:

A THREAT_MODEL.md, which tells agents what counts as a vulnerability or a regression. The regression-hunt plugin passes it to every step, so each agent has to check its conclusions against the file. It should define the following: assets whose compromise matters, trust boundaries, access controls, supported configurations, specifications on what is or isn’t a vulnerability, and evidence required for a valid bug report (example).
A PATCHING_GUIDELINES.md (or AGENTS.md), which tells agents and patching-bugs how your project wants fixes written. It should outline how to build and test the project, how big a fix should be, where a fix should go, how to present proposed changes, and what a regression test must show (example).

For our Patch the Planet work with GPAC, our engineers wrote a threat model and a project-specific patching skill that captures how GPAC’s maintainers want bugs reproduced, what evidence a fix needs, and what a patch must preserve. Liboqs and validator.js have also published threat models in accordance with our guidance.

The more comprehensive and specific these files are to your project, code conventions, and operating style, the better the output you’ll receive.

The industry needs to focus on patching

As AI accelerates bug discovery, we need to turn those findings into reliable fixes just as quickly. Solutions need to balance speed and quality: an agent needs to understand a report, decide what needs to change, and check that a patch fixes the issue without introducing regressions. Our patching-bugs and regression-hunt plugins bring what we’ve learned from Patch the Planet into that workflow, helping maintainers move from a bug report to a patch they can confidently review and ship.

Install patching-bugs and regression-hunt, add a THREAT_MODEL.md and a PATCHING_GUIDELINES.md to your repository, and put them to work on your next bug report. Give the tools your project’s context so they can help you focus on the right fix and validate it faster. Then share your feedback, including comments about where our defaults don’t fit your project. Those real-world cases will help us build the next version.

Get 18% more keys for free with this one crazy trick - Johnny.Decimal

2026-10-21T03:43:24.000Z

You probably only have 78 keys on your keyboard.¹ So why do you never use 12 of them?

These keys, of course, are the F-keys F1 through F12. By default, macOS uses them for the glyphs printed thereon. But tell me the last time you pressed any of these:

F3 for Mission Control.
F4 for Spotlight.
F5 for whatever that microphone does.
F6 for Sleep.²
F7–F9 for Music control.

I'll grant that you might use F1/F2 for brightness and F10–F12 for volume control. But still, how often?

Let your apps use them

I'm writing an app. Apps work really well with shortcut keys. We all have 12 perfectly great keys right there, begging to be used – and we never do.

'Of course', you'll say. 'The user can press the Fn key to access the F-keys'. And, right, they can do that. But a fraction of people know that this is possible. So they never, ever will.

I implore you, then, to change this setting. Go to Settings > Keyboard > Keyboard Shortcuts… > Function Keys. Turn on Use F1, F2, etc. keys as standard function keys.

And there you go. Previously you had 66 usable keys. Now you have 78.

US keyboard on a modern Mac laptop. ↩
TIL that there's a built-in Sleep shortcut! I've created my own via a Raycast shortcut for years now.³ 😭 ↩
For 'sleep' I use Control-Option-L. I use Control-Option for my own global shortcuts because not much else does. L because the shortcut, which triggers Raycast's system action Sleep Displays, has the effect of Locking my laptop. I may have inherited this from Windows, where Win-L does the same. ↩

Brainstorming multi-lingual use of Artemis - James' Coffee Blog

2026-10-21T00:00:00.000Z

I now follow three websites or feeds whose authors write in French; in at least two cases, the authors write in both French and English. When I see posts in different languages, I use Firefox’s Translate feature to read them. Firefox Translate is not perfect, but as long as I can get the gist of something I am happy (although suggestions for better translation practices, ideally locally, and without complex, internet-connected, or paid technology, would be sincerely appreciated!).

Now that I am seeing more French in my Artemis feed, I have been thinking about what features may be useful to help me make the most of what I see. Here is a snippet of some posts in my web reader right now:

ALT

Five posts in Artemis by four authors. The first three posts are in French. The last two are in English.

One of the features I am experimenting ¹ with (seen in the screenshot above) is adding the language code associated with an article before the title of the article, like so:

[FR] [post title]

I only add this if the title isn't in a language I know (English).

To determine the language that corresponds with a post, I am using the “langdetect” Python package ². There are likely ways to infer language deterministically (ActivityStreams has a “contentMap” value that contains as keys language codes that map to post content, e.g. “fr” would map to a post written in French).

This feature is most useful when a title is also written in a language I don’t know. The tag gives me a clear visual indication that a post is in a different language before I start reading the title. This helps me while scanning my feed.

One edge case where this tag adds confusion, however, is when all the words in the title happen to be in English. This was the case with one title in my feed, “Writober 2026 – Lounge ”, whose contents are in French but the title is readable in English. In this case, an “[FR]” preface to the title is technically correct, but is jarring given the title co-incidentally is in words that I can read as English.

⁂ ⁂ ⁂

Earlier today at HWC Asia/Pacific, I raised the idea of multi-lingual feeds and we had a good discussion. Part of me wants to offer a translated version of a post title, but I am not sure whether I want to be running a full translation model on the server. Argos Translate looks like a promising model should I want to go down this path, though I would sincerely appreciate recommendations on this front. The red line is that I want all translation to either happen within Artemis or, if absolutely necessary, the user’s browser. I don’t want to use an external API.

There is an experimental Translator API in the browser which could, in theory, allow the use of JavaScript to translate specific parts of the page on load. With that said, this API does not have Firefox or Safari support, and it would mean titles would be translated on every page load.

I am also unsure whether using a translation will deprive me of some part of the experience of seeing multilingual text. I read one Mastodon post in Artemis today that was written in French. I was able to translate the post myself approximately enough to get the joke, even though I know very few words of French. I felt really good after this!

⁂ ⁂ ⁂

Reflecting on what multi-lingual features a readers should have has taken me down a long rabbit hole of considerations. If an article has a translated version, could a web reader show an icon to indicate that there is a translated version? Could said reader automatically retrieve the translated version? What could/should Artemis do when the titles of feeds are in a different language? Yesterday I was subscribing to a French blog that uses WordPress. The titles of the feeds were in French and at first I accidentally selected the comments feed as the one to which I wanted to subscribe.

Language use on the web is complicated, and I am only scratching the surface. Stephanie Booth’s talk “While We Wait for BabelFish: Languages on theInternet [sic]”, although given in 2007, has given me a lot to think about. As I only speak one language (although I do understand the specific Scots dialect/words from where I grew up), I have a limited view of what is best to do. Someone who only speaks one language may prefer a different UI to someone who speaks multiple. That is to say: there is a lot to explore, and I would love help! If you have thoughts, I would be delighted to hear from you.

This experiment is currently enabled only on my account. I do this sometimes so I can get a feel for a feature before releasing it either in the Artemis Labs section of the software as an experiment or as a fully-fledged feature.

[↩]

Technical note: I check if the post content is more than two words to prevent false positives, something I ran into with short Mastodon posts. This logic will likely need to be made more robust, though.

[↩]

Writober 2026 – Lounge Translator API Argos Translate I would be delighted to hear from you 1 2 [↩] [↩] langdetect While We Wait for BabelFish: Languages on theInternet

Hilary Duff at the Spark Arena - The Weblog of fLaMEd

2026-10-20T22:47:52.000Z

What’s going on, Internet? Just got back from seeing Hilary Duff at the Spark Arena (on a Tuesday night, whooo).

Great show. I wish I knew her music more as I would have loved to be belting out the lyrics with the rest of the crowd.

Definite millenial energy in the crowd. Loved it.

Hey, thanks for reading this post in your feed reader! Want to chat? Reply by email or add me on XMPP, or send a webmention. Check out the posts archive on the website.

Read "The Internet goes on high alert after discovery of 8 compromised TLS certs" - Molly White's activity feed

2026-10-20T22:34:34.000Z

Read:

“The Internet goes on high alert after discovery of 8 compromised TLS certs”.

Dan Goodin in Ars Technica. Published October 20, 2026.

“That is extremely in the ‘this should not be possible’ category,” Valdorda said. “Maybe some horribly dangerous key generation interface has a ‘size’ parameter and they set it to 1 by mistake???”

AI can weaken relationships between people - and teams suffer as a result. - Werd I/O

2026-10-20T17:49:51.000Z

Link: Team Dynamics Weaken When Employees Turn to AI Instead of Colleagues, by Kate Niederhoffer, Kristina Rapuano, Alex Liebscher, Alexi Robichaux and Jeffrey T. Hancock in Harvard Business Review

Relationships take time, effort, and practice to keep alive. So in a sense, it shouldn’t be a surprise to see this finding from a survey of more than a thousand desk workers across 20 industries:

“The more they turned to AI instead of a teammate, the more their trust in each other and their ability to coordinate seemed to erode.”

It turns out that if you start asking an AI system instead of your colleague, coordination and trust drop by at least 20%. These technologies are still relatively new; I imagine that over time this will continue to drop. People who feel isolated in their work today will feel more so as this trend solidifies. Similarly, people who feel untrusted today will only feel more so as their teams continue to ask AI systems instead of them.

That doesn’t mean AI is always inherently bad. Like all work processes, it demands that we think hard about culture: what kinds of behaviors and feelings do we want to promote? What’s important to the organization? And do we care more about an individual’s productivity than creating a high-performing team? (We shouldn’t.)

This also rings true:

“People consistently underestimate how enjoyable a human conversation turns out to be. Whether the motivation is fear of judgment or a desire not to impose, avoiding a colleague is hardly a new workplace behavior. AI now provides an alluring alternative that forgoes the social and emotional costs of getting support.”

One way we can counteract this is by making asking for help (and giving it) an explicit norm in our team cultures, and leading by example by doing it ourselves. In remote or hybrid teams that rely on tools like Slack, that also means doing it in a non-private channel, so that other team members can see it and it can become normalized.

Although a bit of a cliché and genuinely heinous if they’re done poorly, I think standups can also be really helpful here, if you can do them live. Here, everyone goes round a circle and talks briefly about what they’re working on, with explicit needs for help made as part of the update. Implicit requests for help can be answered once everyone has gone around the circle.

Can AI help? Totally. As the authors discuss in this piece, you can use technology to help conversations to happen asynchronously, particularly on teams that spread across multiple timezones, and it can actively facilitate connections between people.

Let’s do that, instead of displacing our people and our relationships. AI can be a facilitator between people, but it should never be an intermediator: our relationships, our communities, and our companies will suffer.

Foursquare died at the hands of private equity. What happens next? - Werd I/O

2026-10-20T16:45:59.000Z

Link: Some final words on Foursquare, by Dennis Crowley

I freaking loved Foursquare. It was a wonderful way to explore cities with the help of my friends: in the same way that Upcoming was my best way of figuring out which events I should be going to, Foursquare let me know which restaurants, bars, parks, etc, were worth checking out. If Chris ranked a cocktail bar, you know it was amazing. Aaron always found the best coffee spots. And so on: my friends were better recommenders than any other source I had.

My own map lists every state and country I’ve been to over the last few decades. If I’m back in Amsterdam, I can figure out which Indonesian food place I really loved, because there it is on my map. (It’s Paon Bali, by the way. You’re welcome.)

So this was sad to see as an outcome. I think there are a bunch of important lessons here – not least the dangers of raising too much too soon without tethering the business to revenue. But at the same time, Foursquare launched during a startup explosion, and this kind of fundraising was the norm; I don’t fault Dennis for his decisions. The bigger problem seems to have been the private equity leadership more recently. I can’t think of a time when private equity hasn’t led to toxic leadership and a strip-mined company with an inequitable deal for employees.

Which leads me to an obvious problem. That check-in data is intimate stuff. It probably shouldn’t be something private equity can just inherit and do whatever with. Journalists and activists should hopefully not have been using Foursquare to check in; if they did, that data can almost certainly have been bought for analysis. And then a future-facing question: how might we have these kinds of social effects without sacrificing privacy?

Regardless, I’m pouring one out for Foursquare. I loved it. Thanks to everyone involved for building something that I found genuinely meaningful.

2026-10-20 16:31: Hooman, we are ready to receive your apple core. 🍎 - Kev Quirk

2026-10-20T15:31:00.000Z

Hooman, we are ready to receive your apple core. 🍎

Thanks for reading this post via RSS. RSS is ace, and so are you. ❤️

You can reply to this post by email, or leave a comment.

Book Review: Quackery - A Brief History of the Worst Ways to Cure Everything by Lydia Kang ★★★⯪☆ - Terence Eden’s Blog

2026-10-20T11:34:35.000Z

This is a charming and funny book all about the various ways humans have promoted fake medical cures in exchange for money.

Despite the grim (and occasionally distressing) subject matter, the tone remains light and poppy throughout. There are lots of snarky asides (especially about the fake medical practitioners) and a real appreciation for the bizarre. It's fun the whole way through, although sometimes at the expense of people who perhaps didn't know better than to trust charlatans.

One thing that is constantly brought back is how it can be hard to determine what is patent nonsense and what is a bone fide cure:

Prevent blood clotting: Extract mucus from the intestinal membranes of slaughtered pigs or from the lungs of slaughtered cows. Inject. (heparin)

Is that any more believable than injecting goat testicles to cure impotence?

It also brings to light how squeamish we can be, especially when faced with unusual medical procedures:

We borrow other people’s wombs for surrogacy. And yet, plenty of people squirm at the idea of breastmilk banks. We are a society of contradictions.

The eBook is beautifully formatted. For once, images are in-line with the text! Usually in books of this sort, publishers treat the eBook like a mass-market paperback and stick the illustrations at the end.

It ends rather abruptly, after taking us through light, electricity, colour therapy, animal magnetism, and a couple of dozen other "cure-alls"

Sadly, there are no references or footnotes. While I have no reason to doubt the veracity of the claims, for a book about scientific misinformation and malpractice, I'd've expected a way to find out more information.

Wonders of Web Weaving, Episode 24 - James' Coffee Blog

2026-10-20T00:00:00.000Z

The twenty-fourth episode of Wonders of Web Weaving is out:

In Episode 24, I chat with Alex, the author of alexsirac.com about, among other things, collective intelligence in public commons, what the IndieWeb can learn from Wikipedia, community in comments, and more.

I hope you enjoy the episode!

Wonders of Web Weaving also has an RSS feed you can use to follow along from wherever you get your podcasts.

Alex alexsirac.com The twenty-fourth episode of Wonders of Web Weaving is out Wonders of Web Weaving also has an RSS feed

contours - James' Coffee Blog

2026-10-19T00:00:00.000Z

Spectra of coherence — ground, sky; all presents. // Deconstruct.
Where do I find the word that embodies a step?
— elevation, propulsion, placing; in cycles, forward, forward.
A mirror of irreducibility.
How can a word reflect my cold nose, dripping with winter air,
Breathing in fast, deeply.
Stories, of moments —
Collapsed colour, stark senses, every expression:
Poem, no contours; possible?
(But in contours definition exists.)

seen - James' Coffee Blog

2026-10-19T00:00:00.000Z

A flat sky
Field of fog
Hidden hills
Echoes of snowfall —
Not yet.

A landmark study of AI in newsrooms reveals they need to be coaxed to experiment with their business models - Werd I/O

2026-10-18T23:53:10.000Z

Link: The News + AI Field Report, by Djordje Padejski for the Walter Cronkite School of Journalism and Mass Communication

The News + AI Field Report for 2022-2025, produced by Djordje Padejski in conjunction with ASU’s Knight Center for the Future of News, is a landmark analysis of how newsrooms are experimenting with AI. The interactive app is also a really useful way to explore the 160 projects covered by this research.

I’ve been mulling over one of the findings described in the summary:

“Newsrooms are most worried about the business threat from AI and have built the least for it. Interviews reveal widespread anxiety about the effects of AI on site traffic, audience behavior and news business models. Yet relatively few projects focus on revenue, subscriptions or fundraising.”

20% of projects were business-related, but every fundraising project and over half of the business projects were grantees in the American Journalism Project’s AI programs. If those newsrooms are stripped out, the numbers drop significantly.

I think there’s a subtext worth talking about: I suspect the innovation projects listed here (that weren’t a part of a specific cohort) are a temperature check on how newsrooms are building technology / product experiments in general. If that’s the case, it implies that news is sticking to its comfort zone and spending much more time innovating on editorial concerns, and much less time experimenting with solutions for its existential business threats.

Reader-facing chatbots are a different angle on this: I’d call them a way for newsrooms to say they’re experimenting with AI without actually addressing a core user need. Newsroom websites are absolutely not where the chat layer should live (except, perhaps, for the use cases that provide deeper archive search for subscribers): AI users already have their own chatbots, which are the interfaces for all their AI-powered information. There are deeper ways AI could address user needs; the trick is that they would involve experimenting with the fundamental ways newsrooms do business. In turn, that requires both a willingness to do so, and much deeper collaboration between teams to make it happen.

So then the question becomes: how do we not just beef up journalism’s experiments in its business models, but the excitement and appetite to do so? Often the product teams that might be the owners of these kinds of experiments don’t (quite reasonably) own business models; how can those teams collaborate effectively? Funding from AJP clearly made a difference — is outside scaffolding required for this work to take place? How might product teams empower every team in the newsroom to run experiments?

These are much bigger questions than AI – and they’re questions newsrooms probably should be grappling with. In the meantime, I’m very grateful this analysis exists, and I hope it’s renewed to capture the year that follows.

2026-10-18 13:22: Terence Eden asking on Mastodon what people's setups look like. Here's mine - 38" ultrawide... - Kev Quirk

2026-10-18T12:22:00.000Z

Terence Eden asking on Mastodon what people's setups look like. Here's mine - 38" ultrawide LG monitor that docks to my Framework 13, Fully standing desk, fish tank and motorbike helmets on the wall. I love my home office, but I do like heading into the office too.

Thanks for reading this post via RSS. RSS is ace, and so are you. ❤️

You can reply to this post by email, or leave a comment.

Year 4 at the Smallholding - Kev Quirk

2026-10-18T12:10:00.000Z

So today marks the 4th anniversary of us moving to our 2.5 acre smallholding in north Wales. I can't believe it's been 4 years already - it feels like 5 minutes ago that I wad writing my 3 years at the smallholding post.

Last year's update wasn't as positive as previous years thanks to us having to get a new roof, which cost a shit tonne of money, and caused leaks all over the house. But I'm happy to say that the update for this year is mostly positive. I ended last year's post by saying:

If next year I can get the polytunnel and conservatory done, I'll class that as a win. I'd love to get a quad bike for towing the flail too, but again...money.

Unfortunately there's no poly tunnel, no insulation in the conservatory, and no quad bike in the barn. Let me explain...

Goats

In March of this year we decided it would be a good idea to get some goats. My wife had been talking to a goat farmer in mid-Wales for a few months, and we decided the time was right to get some. So we ordered 4 male pygmy goats and brought them home in the back of the car!

Our first 4 goats arriving home

While we were at the farm, the farmer showed us a beautiful half pygmy, half "normal" goat and her 2 kids, along with a little pygmy goat that followed her around like a lost puppy. We immediately warmed to all of them, but we couldn't fit them in the car, so we had to pass.

After a week or so of thinking about them, my wife decided to head back down there and pick them up too. So we ended up with 8 goats all together. I'm really glad that my wife decided to get the second batch, as the mum (now called Betsy) is so friendly and one of my favourite of the group.

Betsy being lovely (as usual)

Improving their home

We're very lucky to have a pair of stables at the back of our property, one was already used by the chickens, so we setup the other for the goats. However, the stables and surrounding needed some work. We had to:

Install a land drain and level the ground
Extend the hard standing around the stables
Get some fencing installed
Replace the doors and windows
Install ventilation and power
Create a "rock wall" for the goats to play on

Unfortunately this all took up what little budget we had left following the roof, so the poly tunnel and insulation in the conservatory had to wait.

We completed the renovations on the stables and both the chickens and the goats now have a lovely little home that has lots of space, but (more importantly) meets their needs.

Goats and chickens on the rock wall

Here's a little gallery of how the work progressed on the stables:

Land drain installed and ground leveled

Extended hard standing around the stables

Fencing being installed

New windows and doors being installed

All finished...ish

Bonus photo of a happy Lando sitting in his food bowl

Chickens

As well as goats, we decided to add to our flock of chickens, but instead of just buying more we wanted to do it a little differently. We have a rooster now, so all our eggs are fertilised and we decided to try and hatch some eggs instead. We also wanted to get something a little different, so my wife bought some guinea fowl eggs, which we put under a broody hen to see if they would hatch. They did, and we ended up with 5 beautiful (but noisy) guinea fowl.

Three of the fowl keets

The other 2 with their adopted mum, Nugget

4 of the 5 fowl today, still with Nugget

The guinea fowl were a great success - 5 of the 6 eggs hatched. So we decided to attempt the same thing with some of our chicken eggs, especially since a fox had gotten one of the hens and we wanted to hatch some of her eggs. Unfortunately we had no broody hens at the time, so we decided to buy an incubator and cheat.

We attempted to hatch 12 eggs, but only 3 were successful unfortunately. We think 2 of them are roosters too, so we will see how that goes as they grow up and undoubtedly challenge their dad. We're thinking about doing it again this spring, but we're worried about having a plethora of roosters and what we will ultimately have to do to them. 💀

Finally I installed some new perches for the chickens to roost on in the evening. Below is a removable shelf that makes things way easier to clean.

Another blow

So at this point we had used up everything we had saved. We had literally nothing in our savings account. Then we noticed that our older dog, Tia, who's 14, was getting very smelly breath and whenever she was chewing her favourite ball, her mouth was bleeding.

So we took her to the vets and they told us she had a fairly common type of benign tumour growing in her mouth. Although it was benign, it was very aggressive and if left untreated she would have 6-12 months if she was lucky. And it would be a very uncomfortable end for her.

We had to get it looked at, but this was going to cost thousands and in a 14 year old dog, I wasn't sure if it was worth it. The last thing we wanted was to put her through all this only to find out in a few months that she had another terminal condition that would end her life anyway.

I know that sounds heartless, but I think at times like this it's important to be practical and take into account how much the dog will suffer, and whether we're doing it for us, or them.

She needed a CT scan on her jaw to see if surgery was viable, so we decided to get a full body CT scan done instead. This would give us a good indication if anything else untoward was going on in her body. Lucky for us the CT came back all clear and the surgery on her jaw was viable, so we went ahead.

Three operations, 1 infection, and lots of discomfort later for poor Tia, and she's now fully recovered after having around 40% of her lower jaw removed. Unfortunately for her, this means her rather large tongue often dangles out of her mouth these days. But we think she's still gorgeous.

As if this wasn't punishment enough, we also got a new puppy, Nelly, at the same time that Tia was going through all this. So managing a sick dog, a new puppy, and keeping 2 kids entertained during their summer holidays really wasn't a fun time.

We had bought Nelly way before we knew Tia was sick. The kids knew she was coming, and we had all met Nell multiple times. So although we knew it would be a nightmare, we didn't want to renege on buying her. Let me tell you, dear reader, it was rough. Like, really rough, but we're glad we stuck it out because Nelly is beautiful and such a wonderful addition to our family.

What's next?

Tia's surgery ended up costing us around £6,000 (~$8,000). We already had no money, so it had to go on a credit card, which we will pay off over the next few months.

Our plans for year 5 are the same as year 4, I think - we'd love to get a poly tunnel in and the roof in the conservatory insulated so we can use it all year round. But we will need to see how the finances go - hopefully there will be no more unexpected expenses for a little while. We can only hope.

In the meantime we continue to enjoy our brood of various animals and the little plot we call home.

Thanks for reading this post via RSS. RSS is ace, and so are you. ❤️

You can reply to this post by email, or leave a comment.

Una Watch TOTP - MFA on your wrist! - Terence Eden’s Blog

2026-10-18T11:34:08.000Z

Let's get this out of the way first - this is a terrible idea! I want my two-factor authentication codes to be easily accessible to me, so I've built a watch app which will display them. That's really convenient for me - but makes for a terrible security posture. Anyone who steals my watch will be able to see my one-time code. If they're clever, they can decompile the app and find the secret which powers the code generation.

You should absolutely not do this and, if you ignore my warnings, you should only do this for codes which aren't critical to your security.

In my defence, an attacker would still need my username and password to make any use of these codes - but please don't trust your security to my deranged witterings.

What It Looks Like

Prior Art

I'm sure many other people have done this. Indeed, three years ago I built An eInk, Wrist-Mounted, TOTP Generator.

The Service

This is in my Service.cpp - as you can see, it's pretty simple. This won't let you add in hundreds of codes - you get one and that's it. There's no countdown when a code is about to expire, so I recommend waiting until a new one pops up before you start typing it in.

I'll be candid, I haven't used C++ properly since university - and that was in the last century. I've mostly just cut things out to see what breaks. Feel free to educate me on the correct idiomatic code.

You will need to set your own secret in here.

//  Standard includes.
#include "Service.hpp"
#include "SDK/Messages/CommandMessages.hpp"
#include "SDK/Messages/MessageGuard.hpp"

//  Needed for PureTOTP.
#include 
#include "TOTP.h"

#include 
#include 

//  What this Glance can do.
Service::Service(SDK::Kernel &kernel)
    : mKernel(kernel)
    , mGlanceUI()
    , mGlanceTitle()
    , mGlanceValue()
{}

void Service::createGuiControls()
{
    //  Set the main title in the Glance.
    mGlanceTitle = mGlanceUI.createText();
    mGlanceTitle.pos({ kTitleX, kTitleY }, { kTitleW, kTitleH })
        .font(GlanceFont_t::GLANCE_FONT_POPPINS_SEMIBOLD_20)
        .color(GlanceColor_t::GLANCE_COLOR_TEAL)
        .setText("HSBC MFA Code")
        .alignment(GlanceAlignH_t::GLANCE_ALIGN_H_CENTER);

    //  Set the default text for the value.
    mGlanceValue = mGlanceUI.createText();
    mGlanceValue.pos({ 20, kValueY }, { 200, kValueH })
        .font(GlanceFont_t::GLANCE_FONT_POPPINS_SEMIBOLD_20)
        .color(GlanceColor_t::GLANCE_COLOR_YELLOW_DARK)
        .setText( "Waiting for update" )
        .alignment(GlanceAlignH_t::GLANCE_ALIGN_H_CENTER);
}

void Service::glanceUpdate()
{
    //  Set the Base32 encoded secret (all uppercase).
    std::string secret = "QWERTYUIOP";
    //  Generate the code based on the Unix timestamp right now.
    const std::time_t t = std::time(0);
    std::string code = TOTP::GenerateTOTP( 6, 30, TOTP::HMAC_SHA1, secret, t );

    std::ostringstream ss;
    ss << t;

    //  Convert the string to char* and display it as the value.
    mGlanceValue.print( code.c_str() ); 

    //  Show the Unix time to check the timezone is correct.
    // mGlanceTitle.print( ss.str().c_str() );
}

//  No service.
Service::~Service(){}

//  When this glance is opened.
void Service::run()
{
    while (true) {
        SDK::MessageBase *msg;
        if(!mKernel.comm.getMessage(msg)) {
            continue;
        }

        switch (msg->getType()) {
            //  The Glance has started.
            case SDK::MessageType::EVENT_GLANCE_START:
                if (configGui()) {
                    createGuiControls();
                } else {
                    mKernel.comm.releaseMessage(msg);
                    mKernel.sys.exit(0);
                }
                break;
            //  The Glance has been stopped.
            case SDK::MessageType::COMMAND_APP_STOP:
            case SDK::MessageType::EVENT_GLANCE_STOP:
                mKernel.comm.releaseMessage(msg);
                return;
                break;

            //  Every second, perform an action.
            case SDK::MessageType::EVENT_GLANCE_TICK:
                onGlanceTick();
                break;

            default:
                break;
        }

        mKernel.comm.releaseMessage(msg);
    }
}

void Service::onGlanceTick()
{
    if (mGlanceUI.isInvalid()) {
        if (auto upd = SDK::make_msg(mKernel)) {
            upd->name           = APP_NAME;
            upd->controls       = mGlanceUI.data();
            upd->controlsNumber = static_cast(mGlanceUI.size());
            upd.send(100);
        }

        mGlanceUI.setValid();
    }
    glanceUpdate();
}

bool Service::configGui()
{
    bool status = false;
    if (auto gc = SDK::make_msg(mKernel)) {
        if (gc.send(100) && gc.ok()) {
            if (gc->maxControls >= 3) {
                mGlanceUI.setWidth(gc->width);
                mGlanceUI.setHeight(gc->height);
                status = true;
            }
        }
    }
    return status;
}

The Library

There are dozens of C++ libraries for RFC 6238 generation. I ended up using PureTOTP as it didn't require any external dependencies and was only two files. As I only needed SHA1 TOTP codes, I stripped out a bunch of functionality which was unnecessary for me. Similarly, I only wanted to generate 6 digit codes with a 30 second period - so took out anything which did more than that.

I've tidied up the code and comments where I can. The original was MIT Licenced - so this is as well.

There are two parts to this. First, the header

// TOTP.h
//
#pragma once
#include 
class TOTP
{
public:
    const static int HMAC_SHA1 = 20;    //  Length of HMAC.

    static std::string GenerateTOTP(const std::string& secret);
    static std::string GenerateTOTP(int digit, int refreshSeconds, int algorithm, const std::string& secret, int specTime);

    TOTP(int digit, int refreshSeconds, int algorithm, const std::string& secret): digit(digit), refreshSeconds(refreshSeconds), algorithm(algorithm), secret(secret) {}
    TOTP(const std::string& secret): digit(6), refreshSeconds(30), algorithm(HMAC_SHA1), secret(secret) {}

    std::string currentTOTP();

private:
    int digit, refreshSeconds, algorithm;

    std::string secret;
};

Next is the standalone library which does the TOTP generation, TOTP.cpp

// TOTP.cpp
//
#include "TOTP.h"
#include 
#include 
#include 
#include 
#include 
#include 
#include 
#include 
#include 
#include 
using namespace std;

struct JEVP_MD
{
    enum Kind {
        SHA1
    };

    Kind kind;
    int  md_size;
    int  block_size;
};

static inline uint32_t rotl32(uint32_t x, uint32_t n) { return (x << n) | (x >> (32 - n)); }
static inline uint32_t rotr32(uint32_t x, uint32_t n) { return (x >> n) | (x << (32 - n)); }
static inline uint64_t rotr64(uint64_t x, uint64_t n) { return (x >> n) | (x << (64 - n)); }

static uint32_t load_be32(const unsigned char* p)
{
    return (uint32_t(p[0]) << 24) |
           (uint32_t(p[1]) << 16) |
           (uint32_t(p[2]) <<  8) |
            uint32_t(p[3]);
}

static void store_be32(uint32_t v, unsigned char* p)
{
    p[0] = static_cast((v >> 24) & 0xFF);
    p[1] = static_cast((v >> 16) & 0xFF);
    p[2] = static_cast((v >>  8) & 0xFF);
    p[3] = static_cast( v        & 0xFF);
}

static void store_be64(uint64_t v, unsigned char* p)
{
    p[0] = static_cast((v >> 56) & 0xFF);
    p[1] = static_cast((v >> 48) & 0xFF);
    p[2] = static_cast((v >> 40) & 0xFF);
    p[3] = static_cast((v >> 32) & 0xFF);
    p[4] = static_cast((v >> 24) & 0xFF);
    p[5] = static_cast((v >> 16) & 0xFF);
    p[6] = static_cast((v >>  8) & 0xFF);
    p[7] = static_cast( v        & 0xFF);
}

static vector sha1_hash(const unsigned char* data, size_t len)
{
    vector msg(data, data + len);
    uint64_t              bit_len = static_cast(len) * 8;

    msg.push_back(0x80);
    while ((msg.size() % 64) != 56) msg.push_back(0x00);

    unsigned char lenbuf[8];
    store_be64(bit_len, lenbuf);
    msg.insert(msg.end(), lenbuf, lenbuf + 8);

    uint32_t h0 = 0x67452301;
    uint32_t h1 = 0xEFCDAB89;
    uint32_t h2 = 0x98BADCFE;
    uint32_t h3 = 0x10325476;
    uint32_t h4 = 0xC3D2E1F0;

    for (size_t chunk = 0; chunk < msg.size(); chunk += 64)
    {
        uint32_t w[80];
        for (int i = 0; i < 16; ++i)
            w[i] = load_be32(&msg[chunk + i * 4]);
        for (int i = 16; i < 80; ++i)
            w[i] = rotl32(w[i - 3] ^ w[i - 8] ^ w[i - 14] ^ w[i - 16], 1);

        uint32_t a = h0, b = h1, c = h2, d = h3, e = h4;

        for (int i = 0; i < 80; ++i)
        {
            uint32_t f, k;
            if (i < 20)
            {
                f = (b & c) | ((~b) & d);
                k = 0x5A827999;
            }
            else if (i < 40)
            {
                f = b ^ c ^ d;
                k = 0x6ED9EBA1;
            }
            else if (i < 60)
            {
                f = (b & c) | (b & d) | (c & d);
                k = 0x8F1BBCDC;
            }
            else
            {
                f = b ^ c ^ d;
                k = 0xCA62C1D6;
            }

            uint32_t temp = rotl32(a, 5) + f + e + k + w[i];

            e = d;
            d = c;
            c = rotl32(b, 30);
            b = a;
            a = temp;
        }

        h0 += a;
        h1 += b;
        h2 += c;
        h3 += d;
        h4 += e;
    }

    vector out(20);
    store_be32(h0, &out[ 0]);
    store_be32(h1, &out[ 4]);
    store_be32(h2, &out[ 8]);
    store_be32(h3, &out[12]);
    store_be32(h4, &out[16]);
    return out;
}

static const JEVP_MD g_sha1   = {JEVP_MD::SHA1, 20, 64};

const JEVP_MD* JEVP_sha1() { return &g_sha1; }

unsigned char* JHMAC(const JEVP_MD* JEVP_MD, const void* key, int key_len, const unsigned char* data, size_t data_len, unsigned char* md, unsigned int* md_len)
{
    if (!JEVP_MD || !key || key_len < 0 || !data)
        return nullptr;

    static thread_local unsigned char static_md[64];

    if (!md)
        md = static_md;

    vector key_block(JEVP_MD->block_size, 0);
    const unsigned char*  key_bytes = static_cast(key);

    vector real_key;
    if (key_len > JEVP_MD->block_size)
    {
        real_key = sha1_hash(key_bytes, static_cast(key_len));
        std::copy(real_key.begin(), real_key.end(), key_block.begin());
    }
    else
    {
        std::copy(key_bytes, key_bytes + key_len, key_block.begin());
    }

    vector ipad(JEVP_MD->block_size);
    vector opad(JEVP_MD->block_size);
    for (int i = 0; i < JEVP_MD->block_size; ++i)
    {
        ipad[i] = static_cast(key_block[i] ^ 0x36);
        opad[i] = static_cast(key_block[i] ^ 0x5C);
    }

    vector inner;
    inner.reserve(JEVP_MD->block_size + data_len);
    inner.insert(inner.end(), ipad.begin(), ipad.end());
    inner.insert(inner.end(), data, data + data_len);

    vector inner_hash = sha1_hash(inner.data(), inner.size());

    vector outer;
    outer.reserve(JEVP_MD->block_size + inner_hash.size());
    outer.insert(outer.end(), opad.begin(), opad.end());
    outer.insert(outer.end(), inner_hash.begin(), inner_hash.end());

    vector final_hash = sha1_hash(outer.data(), outer.size());

    std::memcpy(md, final_hash.data(), final_hash.size());
    if (md_len) *md_len = static_cast(final_hash.size());

    return md;
}

//  Base32 decoding table.
/* clang-format off */
const int base32_reverse_map[128] =
{
    255, 255, 255, 255, 255, 255, 255, 255, 255, 255, 255, 255, 255, 255, 255, 255, // 15
    255, 255, 255, 255, 255, 255, 255, 255, 255, 255, 255, 255, 255, 255, 255, 255, // 31
    255, 255, 255, 255, 255, 255, 255, 255, 255, 255, 255, 255, 255, 255, 255, 255, // 47
//      (49)   2    3    4    5    6    7  (56)
    255, 255,  26,  27,  28,  29,  30,  31, 255, 255, 255, 255, 255, 255, 255, 255, // 63
// (64)   A    B    C    D    E    F    G    H    I    J    K    L    M    N    O
    255,   0,   1,   2,   3,   4,   5,   6,   7,   8,   9,  10,  11,  12,  13,  14, // 79
//   P    Q    R    S    T    U    V    W    X    Y    Z  (91)
    15,  16,  17,  18,  19,  20,  21,  22,  23,  24,  25, 255, 255, 255, 255, 255, // 95
// (96)   A    B    C    D    E    F    G    H    I    J    K    L    M    N    O  // lower case instead
    255,   0,   1,   2,   3,   4,   5,   6,   7,   8,   9,  10,  11,  12,  13,  14, // 111
//   P    Q    R    S    T    U    V    W    X    Y    Z (123)                     // lower case instead
    15,  16,  17,  18,  19,  20,  21,  22,  23,  24,  25, 255, 255, 255, 255, 255  // 127
};
/* clang-format on */

//  Base32 decoding function.
vector base32_decode(const string& base32)
{
    queue q_rev;
    for (const char& c : base32)
    {
        if (c <= 49 || (c >= 56 && c <= 64) || (c >= 91 && c <= 96) || c >= 123)
        { //    Illegal lower case will be treat as upper case thanks to base32_reverse_map.
            if (c == '=') break;
        }
        else
        {
            q_rev.push(base32_reverse_map[(int)c]); //  Get integers of base32.
        }
    }
    queue q_bin;
    while (!q_rev.empty()) //   Transform the integers into bits and queue them up.
    {
        int now = q_rev.front(); // Get a integer from queue.
        q_rev.pop();
        stack sb;
        for (int i = 0; i < 5; i++) //  Push the bits of this integer into stack
        {                           //  5 bits into 1 group
            sb.push(now & 1);       //  Push the last bit of this integer into stack.
            now >>= 1;              //  Flush the last bit.
        }
        while (!sb.empty()) //  Flush the bits of this integer into binary queue.
        {
            q_bin.push(sb.top()); //    Pop bits from stack into binary queue.
            sb.pop();
        }
    }
    vector uc;
    while (!q_bin.empty()) //   Transform the bits into bytes.
    {
        int thehex = 0;
        for (int i = 0; i < 8; i++) //  Read a byte from the bits queue.
        {
            if (q_bin.empty())
            {                     //    If the bits queue is empty now,
                thehex <<= 8 - i; //    set 0 on the last bits of a byte.
                break;
            }
            thehex <<= 1;                 //    Make the space for the new bit.
            thehex |= (int)q_bin.front(); //    Push this bit into byte.
            q_bin.pop();
        }
        uc.push_back((unsigned char)thehex);
    }

    if (uc.back() == 0) uc.pop_back();     //   TOTP may abandon last zero.
    if (uc.size() % 2 != 0) uc.pop_back(); //   TOTP may abandon odd res.
    return uc;
}

//  Get Unix Time.
time_t getUnixTime()
{
    return time(0);
}

//  Calculate the TOTP time signature.
time_t getTimeSign(int refreshPeriod, time_t specUnixTime)
{
    time_t outTime = specUnixTime / refreshPeriod;
    return outTime;
}

//  Transform time_t aka  to bytes.
vector llong2bytes(time_t tt)
{
    uint64_t value = static_cast(tt);

    vector bytes(8);

    for (int i = 7; i >= 0; --i)
    {
        bytes[i] = static_cast(value & 0xFF);
        value >>= 8;
    }

    return bytes;
}

//  Fast Exponentiation algorithm.
unsigned fastpow(unsigned base, unsigned index)
{
    if (index == 0) return 1;
    unsigned t = 1;
    while (index != 0)
    {
        if (index & 1) t *= base;
        index >>= 1;
        base *= base;
    }
    return t;
}

//  Calculate TOTP according to RFC standard.
std::string hash_to_TOTP(const unsigned char* hmac, unsigned int length, int digit)
{
    int offset = hmac[length - 1] & 0x0F;

    uint32_t bin_code = ((hmac[offset]     & 0x7F) << 24) |
                        ((hmac[offset + 1] & 0xFF) << 16) |
                        ((hmac[offset + 2] & 0xFF) << 8)  |
                        ( hmac[offset + 3] & 0xFF);

    uint32_t mod = 1;
    for (int i = 0; i < digit; ++i) mod *= 10;

    uint32_t otp = bin_code % mod;

    std::ostringstream oss;
    oss << std::setw(digit) << std::setfill('0') << otp;
    return oss.str();
}

std::string TOTP::GenerateTOTP(const std::string& secret)
{
    return GenerateTOTP(6, 30, HMAC_SHA1, secret, getUnixTime());
}

std::string TOTP::GenerateTOTP(int digit, int refreshSeconds, int algorithm, const std::string& secret, int specTime)
{
    vector h_msg = llong2bytes(getTimeSign(refreshSeconds, specTime)); //    Get current time signature and transform time_t aka  to bytes.
    vector h_key = base32_decode(secret); // Transform base32 encoded secret key to decoded bytes.

    unsigned char* out_hmac = new unsigned char[algorithm]; //  Perform openssl function to calculate HMAC-SHA1 hash.
    unsigned int   out_hmac_length;
    const JEVP_MD* emd;
    emd = JEVP_sha1();
    JHMAC(emd, h_key.data(), (int)h_key.size(), h_msg.data(), (int)h_msg.size(), out_hmac, &out_hmac_length);

    string fine = hash_to_TOTP(out_hmac, out_hmac_length, digit);
    delete[] out_hmac;

    return fine; // Calculate TOTP according to RFC standard.
}

std::string TOTP::currentTOTP()
{
    return GenerateTOTP(digit, refreshSeconds, algorithm, secret, getUnixTime());
}

Olivia Dean at Western Springs - The Weblog of fLaMEd

2026-10-18T07:07:30.000Z

What’s going on, Internet? Saturday was a pretty good day. Sun was shining, but damn it was freezing cold (literal shivering) when out of the sun. So after we had dinner down at Ralph’s on our way to Western Springs to see Olivia Dean we decided to make a quick detour home to grab our jackets.

Lucky we did, because damn, it was cold. Western Springs is an outdoor stadium. We were amongst 45,000 people who turned up to see Olivia Dean. She kicked off on time at 9pm, but three songs in disaster struck. Equipment failure. She was visibly fustrated, but wanted to reassure the crowd… Forty minutes later she was back in action and completed her set.

It was cold, it was getting late and that forty minutes wrecked me so we dipped a bit early before she wrapped up.

Home and in bed before 11:30. Gotta pick up some of her vinyl now.

Hey, thanks for reading this post in your feed reader! Want to chat? Reply by email or add me on XMPP, or send a webmention. Check out the posts archive on the website.

Forum accounts are being connected to Johnny.Decimal accounts - Johnny.Decimal

2026-10-18T06:21:07.000Z

Until today, your forum account has been a completely separate account to your Johnny.Decimal account.

This was confusing. People wonder why they needed another account for the forum.

As of today, they're connected. When you log in at the forum, there's a button to do that With your Johnny.Decimal account.

Existing forum logins will stop working in a month.

There are more details in this pinned forum post. There's a bit of a migration process if your email addresses don't match, sorry. If you have any problems, post in that thread or email me.

Digital recipe management for fastidious cooks - localghost

2026-10-18T00:00:00.000Z

Much like your favourite recipe websites, I'm not going to get straight to the point, I'm going to start with a backstory and you're not getting a skip link.

Having grown up with a dad who read cookbooks for leisure, and who caused me to turn vegetarian for several weeks once at the age of 13 when he presented me with a lamb heart stew for dinner, it was inevitable that I would be a foodie. Dad’s squid and red wine stew was my favourite dish as a child. He can't cook any more, but I have fond memories of those meals (even if I did eat as fast as I could so I could leave the table and go back on MSN) and I owe my inquisitive palate to his globetrotting home cooking. As middle-class Brits go, I’m as Waitrose as they come: say “Ottolenghi” three times into a Guardian tote bag and I’ll appear in a puff of sumac.

These days, cooking for people is how I show love, which I definitely got from Dad. While the novelty's worn off for feeding myself and my husband (sorry James), I really enjoy having people over and putting on a spread (even if the kitchen then looks like a hurricane tore through it). Even at university, we used to hold parties in our student house where I'd cook for two solid days making sliders with homemade buns, big pots of chilli, clumsily-knotted pretzels, salads and cakes. Every Christmas I spend a weekend baking biscuits and sweets to post out to friends and family.

I used to have a shelf full of cookbooks. Only instead of being lovingly creased and food-stained through use like my parents’ books are, mine sat on a shelf gathering dust, largely untouched, pages spotless and not at all stuck together. My problem is that I have very poor object permanence: if something’s not in immediate sight, I will forget it’s there. I couldn’t remember the recipes that I had in the books, or even that I had the books in the first place, so I never used them. (The same logic applies to the very old packets of various seasonings in the kitchen cupboards.)

I’ve found the only way I reliably use recipes is if I have them available digitally. I’ve been collecting recipes from food blogs and recipe websites for a long time now - originally storing them in Evernote, which is what we did in the 2010s.

And somehow, over the last decade, I’ve amassed over 5,000 recipes. Have I made all of them? Of course I haven’t. And there's definitely a few I come back to again and again. But it’s nice to know I have them in case I find myself in desperate need of a carrot cake recipe (or five).

Paprika

For the last 7 years or so I’ve been using Paprika 3 to manage my digital recipe collection. It’s a solid cross-platform app with cloud sync and a one-off cost per-platform rather than a subscription. I can clip recipes on my laptop, plan the next week's meals on my phone on the train, and I've got an old iPad sitting on the kitchen counter to view the recipe on while I'm cooking.

All the recipe management apps I’ve tried have largely the same features:

clip recipes from the web
browse recipe websites from within the app, and download recipes
create recipes from scratch
scale and convert ingredient units
tag recipes
create meal plans
create shopping lists from recipes

I've categorised my recipes into what book they came from, different types of baked goods, different situations - for example, I've got a "quick weeknight dinners" category that's great if we just need something fast for dinner midweek.

Goldilocks and the three recipe managers

Paprika is a stalwart in the recipe app scene (and believe me, I’ve tried most of them), but it hadn’t been updated for years and I was getting a bit frustrated. It was so good, but lacked any kind of smart features - I was so bored of manually tagging recipes, and my extremely convoluted way of digitising recipe books and importing them into my collection was tedious as hell. My kingdom for literally any kind of OCR COME ON PEOPLE IT'S 2026. (Though while writing this I have just come across this Paprika Recipe Parser tool which I’ll definitely try out.)

Some newer competitors came on the scene post-2020, and offered some nice features Paprika didn’t have. Pestle is a lovely-looking app which has really leant into the capabilities of Apple Intelligence, making importing super easy, and also supports importing from Instagram and TikTok; Mela (by the same person who built Reeder) integrates with Apple Reminders and has a built-in RSS reader, which would be perfect for the food blogs I subscribe to. But I always found myself coming back to Paprika because other apps didn’t support nested recipe folders (which sounds incredibly nitpicky, but is a non-negotiable for me!)*.

I mentioned I had an extremely convoluted way of importing recipes from recipe books to my Paprika collection. Well.

If it’s a physical cookbook, I have to take photos of the pages, use Apple’s OCR in Preview to copy the text, then manually create the recipe in Paprika, which is so boring I rarely actually get round to it. If it’s an ebook, it’s a ridiculous workflow that I think I found on Reddit:

import epub into Calibre
convert the book to ZIP (an archive of HTML files)
extract into a folder
fix some of the garbled XHTML files that Calibre inevitably outputs
run a local HTTP server in the folder
open the IP address in Paprika’s in-app browser, and clip each recipe individually while half-watching ER (and I can't even use the "Download recipe" button because there are usually several recipes per outputted page)

Given how boring that was to read, I'm sure you can guess how often I can be bothered to do that.

* If you're wondering why I don't just build one myself that does everything I want it to, the answer is that I have enough software maintenance to do in my day job, and my free time is for petting dogs

Paprika 4 is here and it does the thing now

Great news for me: I happened to look at Paprika’s website yesterday and saw that they’d opened up the Paprika 4 beta, which supports - yesssss - recipe importing from photos and social media, recipe sharing, bulk categorisation, as well as being able to guess what categories you might want to add to a recipe! I’m extremely particular about the categories I want on my recipes, but also too lazy to scroll down a list and add them to recipes one by one, so this is a total game changer. (It is LLM-powered, so isn’t perfect - it keeps trying to categorise everything as being from “Dinner” by Meera Sodha - but I expect it’ll stop doing that eventually.)

I tested it out by importing recipes from the Farmer J cookbook I’d picked up from a charity shop. It worked a treat! It’s basically completely shortcutted the workflow I had going before, and I don’t need to fill out any of the metadata except the category (which, as I mentioned, is super quick to do now).

Having switched to buying only epubs, I miss having a shelf full of cookbooks, so maybe I’ll start buying physical ones again if they're this simple to import now - I love it when I go to someone’s house and they have a copy of a cookbook I really like - or I can just screenshot ebook pages to import them, which is slightly less convenient but still way easier than the stupid dance I had to do before.

Paprika 4 will be moving to a subscription model, which is unsurprising - the new features use LLMs, which aren't free. But it looks like existing users can keep using Paprika for free without the new features if they want.

And if you ever need a good recipe, let me know - I've got a few.

Weeknotes W1 - James' Coffee Blog

2026-10-18T00:00:00.000Z

Many of my pieces of writing, especially my creative non-fiction and Nature pieces, describe a single moment or the events that happened over the course of a day. With that in mind, one of the skills I want to develop in my writing is to consider longer periods of time in my writing – to tell stories that expand over greater lengths.

During the Homebrew Website Club Asia/Pacific meetup this week – open to all, hosted at a time that works well in the Asia/Pacific timezone by Naty – the topic of weeknotes came up. This got me thinking. Could weeknotes be a way for me to think about a longer time horizon in my writing? Shortly thereafter, I decided I wanted to try weeknotes again, this time committing to writing one week note each week for four weeks, ideally on a Sunday evening.

I suspect my weeknotes will be oriented more around bullet points than longer prose, but, in any case, I am coming at weeknotes afresh (I have tried to author weeknotes twice, but on my last try I ended up spending more time making a custom page layout than writing, which may have made the practice less sustainable). I am keen to see what I write and share!

The highlights

Herein, events of the week.

This was a busy week in terms of studying. I am continuing to work my way through the “art and the environment” block that I am studying. This week I spent a lot of time reading the textbook. I especially enjoyed learning about the Frost Fairs in London. Part of our work was focused on what we can learn about European attitudes to cold climates by analysing both art and prints from the London Frost Fairs as well as art and documents pertaining to the Arctic.

We did a “virtual gallery visit” where one of our lecturers presented photos of and historical background about artefacts from the Uffizi Gallery in Florence, discussing them in the context of our module. This was my second time attending such a visit, and I got a lot out of it. I didn't realise the extent of the excess wealth the Medici family had.

This was a busy week for events, too. I hosted a Homebrew Website Club (HWC) on Wednesday (notes), a HWC Writing discussion on Saturday (notes), and the 32-Bit Café Web Weaving Workshop today, as well as helping out with a non-technical event in a different community. Reflecting on these events in aggregate, they all have their own identity: I ask different opening questions in each, discussions flow in different ways. Indeed, when I am hosting an event I have to be “on” as much as possible; even if I take a few moments to find a link or write notes, I still need to be attentive to the wider room, thinking about how to make sure discussion continues between several participants. Perhaps I should write something about hosting online events. Reader, what would you like to know?

I had one day this week where I had four events I wanted to go to that were scheduled for the same three hour window: Front End Study Hall, the aforementioned virtual gallery visit, another university event, and a writing club event. It was hard to choose, but I decided to attend the first 30 mins of Front End Study Hall, which started before all the other events, then the full gallery visit. This worked out well: I had a great evening, and I didn't end up pushing myself to try and be in too many places at once.

This afternoon I watched the last game in the NFL London series on the television. Stroud’s passes were amazing. The Jaguars had me on the edge of my seat many times due to flags (a problem in their game in London last week too). I missed the final minute, at which point the game was equal. I just read the final score and the Texans won 34-31. I am not sure how many more games I will watch this season – the London games are on at such a convenient time – but I do want to learn more about how to “follow” a sport without watching the games. Any suggestions would be sincerely appreciated.

Music corner

Herein, music I have enjoyed listening to this week.

Courtney Barnett’s music is amazing. Thank you Thamara for the recommendation. I have listened to almost two whole album after learning about her music yesterday. Barnett is one of many Australian singers whose music I really appreciate, others being Hilltop Hoods, Montaigne, and Angus & Julia Stone.
Taylor Swift released two new versions of Patient Zero: the acoustic and piano versions. Of the two, the piano version is my favourite. I shall have to listen to it again after finishing this post.
I am on the lookout for hip-hop / rap bands, ideally that are more words-focused in their songs (and don’t sing too fast). If you have any recommendations, send me an email!
I listened to a few songs by Sigur Rós this week whose music I loved. Any more recommendations along these lines would be sincerely appreciated!

Thoughts, wandering

Herein, wondering thoughts as-yet not explicitly included in my writing.

How titles change a work.
“Reading the texts of time.”
I haven’t been doing many technical changes to my site lately. I haven’t had much inspiration for the coding side of my site of late. I feel both satisfied with the design of my website and also feeling like I want to make something new. Maybe a new page in my playground?
I am interested in why bookshops are so fascinating to me even when I know I don’t want to buy any books because I have some to read already. I’m thinking of bookshops as a place for visual inspiration.
I would like to make more zines, but I am also struggling to find the motivation. I saw a cool zine in a bookshop at the weekend that had a photo on the front cover and was tiny. I wonder if I could make a tiny photo zine?
Blogging encourages writing to become part of life.
I need new shoes for the winter. I always procrastinate on shoe shopping because I struggle to find shoes that are comfortable and that I like.

Miscellanea

Santiago Calatrava has worked on many impressive buildings. Two that stood out that he has worked on are the Milwaukee Art Museum and Liège-Guillemins railway station.
This series of Wonders of Web Weaving is coming to a close. I am not sure if there will be another series yet, but w will see! I will think more about that in the next year.
I thought I had more links to share in this post, but I looked at my bookmarks and I realised I haven’t saved many. I should keep this in mind for next week!
Naty’s recent feed changes caused some people to see all of her posts again in their web readers. This is common in tweaking web feeds. I have done the same in the past. I learned this week that Artemis was able to handle the changes with grace and didn’t show all of the posts in Naty’s feed as new. I can’t exactly remember all of the technical decisions I made to make this happen – it has been a while since I touched the polling part of the project – but I am glad to see things working.
The Book That Changed My Life was a wonderful documentary. After the documentary I found myself thinking more about my favourite book, Walden.
Seeing Joel and Naty publish weeknotes is what inspired me to give this a go. I have had fun! This is a different kind of writing from my other posts, but it’s nice to think through the week a little bit.

Naty Naty’s recent feed changes Liège-Guillemins railway station Milwaukee Art Museum Santiago Calatrava Front End Study Hall Homebrew Website Club Asia/Pacific meetup this week notes notes Walden I have tried to author weeknotes twice Joel new page in my playground Thamara The Book That Changed My Life Texans won 34-31

Shellsharks Blogroll - BlogFlock

Your AI agent fixed the bug, but what else did it change? - Trail of Bits Blog

Standardizing the patching process

How we designed the plugins

regression-hunt reduces false positive rates

patching-bugs streamlines best practices from thousands of agent sessions

What’s next for the plugins

The industry needs to focus on patching

Get 18% more keys for free with this one crazy trick - Johnny.Decimal

Let your apps use them

Footnotes

Brainstorming multi-lingual use of Artemis - James' Coffee Blog

Hilary Duff at the Spark Arena - The Weblog of fLaMEd

Read "The Internet goes on high alert after discovery of 8 compromised TLS certs" - Molly White's activity feed

AI can weaken relationships between people - and teams suffer as a result. - Werd I/O

Foursquare died at the hands of private equity. What happens next? - Werd I/O

2026-10-20 16:31: Hooman, we are ready to receive your apple core. 🍎 - Kev Quirk

Book Review: Quackery - A Brief History of the Worst Ways to Cure Everything by Lydia Kang ★★★⯪☆ - Terence Eden’s Blog

Wonders of Web Weaving, Episode 24 - James' Coffee Blog

contours - James' Coffee Blog

seen - James' Coffee Blog

A landmark study of AI in newsrooms reveals they need to be coaxed to experiment with their business models - Werd I/O

2026-10-18 13:22: Terence Eden asking on Mastodon what people's setups look like. Here's mine - 38" ultrawide... - Kev Quirk

Year 4 at the Smallholding - Kev Quirk

Goats

Improving their home

Chickens

Another blow

What's next?

Una Watch TOTP - MFA on your wrist! - Terence Eden’s Blog

What It Looks Like

Prior Art

The Service

The Library

Olivia Dean at Western Springs - The Weblog of fLaMEd

Forum accounts are being connected to Johnny.Decimal accounts - Johnny.Decimal

Digital recipe management for fastidious cooks - localghost

Paprika

Goldilocks and the three recipe managers

Paprika 4 is here and it does the thing now

Weeknotes W1 - James' Coffee Blog

The highlights

Music corner

Thoughts, wandering

Miscellanea