Shellsharks Blogroll - BlogFlock

Notable links: September 11, 2026 - Werd I/O

2026-09-11T16:48:53.000Z

Most Fridays, I share a handful of pieces that caught my eye at the intersection of technology, media, and society.

Did someone forward this to you? Subscribe for free.

Seattle Times and Newsday are the latest publications to sue OpenAI and Microsoft

I have some complicated feelings about these ongoing newsroom lawsuits against AI companies. The latest comes from The Seattle Times and Newsday. From the lawsuit itself:

“AI products like ChatGPT and CoPilot are touted as producers of content, but in fact they are rapacious consumers, devouring human-authored content and delivering back to the world copies and derivative imitations of that same original content they consumed to achieve their commercial objectives.”

The government has argued that training LLMs is fair use, and organizations like the EFF have agreed with it. The EFF’s argument in particular is important to take note of:

“The “market dilution” theory would eviscerate not only the fair use doctrine, but also other limits on copyright that work specifically to prevent rightsholders from unfairly suppressing competition by claiming broad ownership over tropes, genres, styles, and so on. In other words, publishers would wield unchecked veto power over any expression that might conceivably compete with a work they own.”

That’s a genuine problem! Expanding the scope of copyright law really does affect free expression. It’s an important concern to bring up — if the market dilution argument held, it could protect all sorts of businesses, both small and multinational.

No industry deserves to exist for its own sake, and we can’t ask the world to stay still to protect an industry. Systems and methods that work against journalism can’t be illegal in their own right. At the same time, we need journalism. An informed voting population is a prerequisite for a functioning democracy. The implication is that if the old methods no longer allow it to be sustainable, journalism must evolve and find new methods that are. We need information, context, and reporting; we don’t need the businesses that produce those things to operate in the exact same way they do now, or to look similar to how they do today.

There’s no doubt that AI in its current form takes work that is often independently produced by people with relatively few resources and uses it to enhance models that are controlled by large tech companies with billions of dollars at their disposal, which are often, in turn, controlled by billionaires. It’s a giant transfer of property from people with relatively low power to some of the most powerful people in the world. I think it’s fair to say they’re strip-mining culture to enrich themselves.

But those power dynamics are not entirely cut and dry. The EFF’s point is, in part, that expanding copyright scope will primarily benefit large corporations like Disney that have often, themselves, applied a chokehold to cultural expression. In preventing strip-mining by some billionaires, there’s a risk of giving new powers to other billionaires.

Although I want to focus on the power dynamics, there’s also a mechanical objection to consider. LLMs are performing statistical analysis on source material in order to train, and the outputs are created using probabilistic math, not intentional reproduction. We need to retain the ability to analyze creative work for all kinds of reasons, and even index it — consider search engine indices, which I think we generally want to exist so that people can find our work.

Of course, actual verbatim outputs — or approximate copies thereof — are plagiarism. And the materials LLMs are trained on are often obtained illegally or outside the terms of their licensing agreements: unambiguous theft that needs to be treated accordingly.

The Anthropic copyright settlement was about this: it wasn’t that training on books was found to be infringing in itself. In fact, Anthropic was found not liable for this. It was that it stole them. Anthropic settled for billions of dollars. That’s good in itself, but it turns out — surprise, surprise — that many publishers took the money for themselves and didn’t pass them down to authors, even when the rights had reverted to those authors.

The elephant in the room is that copyright was never designed to protect individual authors: it was designed to benefit the public, with author protections a necessary means to that end. In practice, most journalists, artists, etc, don’t own their work to begin with, and royalties are frequently corporation-to-corporation transfers even without AI.

The Newsday and Seattle Times lawsuits seek to protect corporate interests in a rapidly-changing market, with journalist reward effectively a trickle-down benefit. That's not to single them out in any way; it's just the industry dynamic. The licensing deals emerging as the market solution — among them OpenAI with News Corp, Axel Springer, the FT; Amazon with the New York Times — are corporate deals. Individual journalists and freelancers whose work constitutes the value see little of it, except in that it’s revenue that theoretically allows their employers to continue to exist and employ them. We probably need a new deal for creators that touches several levels.

The first is contracts and labor conditions. Unions have a huge part to play on this side of the equation. The Writers Guild of America won reasonable AI concessions from studios after their 2023 strike, ensuring that writer compensation couldn’t be diluted if a studio used AI. A revised contract this year also gave them written notice rights when studios intend to train models on their work, and a right to discuss compensation.

That’s great for members of the WGA, but most creative workers aren’t a part of an industry union. If that changed, both publishers and AI vendors would need to negotiate more creator-favorable terms. It seems like it should be a goal.

The second is infrastructure. We need independent creators to be able to set rights over their work and enforce them. Really Simple Licensing is one effort that’s working in this direction: a way to create an ASCAP-like standard for creative work. Notably, though, not a single major AI vendor has agreed to comply. There are criticisms of the collective licensing approach generally, and there’s still a platform compensation problem: if Reddit implements RSL, it will receive revenue, but its users who created the licensed content probably won’t.

The third is law. Our existing rules need to be updated to protect creators, regardless of AI; the advent of generative AI has made it even more important. Publishers must not be able to take all the money from licensing creative work (the EU’s Digital Single Market Directive is a good model to follow). AI vendors should be transparent about what they’re training on and how. Nobody should be able to steal training material. And rules should be revised to reflect that work can now be trained on and used to generate content at scale, automatically, which has knock-on effects on the public good.

These are all big topics. The shift we have to contend with is seismic in a way that hasn’t been rivaled since the advent of the web itself (and in some ways the impact on creators and publishers may be bigger than that). Each newsroom lawsuit is a kind of shot across the bow; the substantive conversations we need to be having are more expansive. But, in a political environment where AI vendors are aligned with the administration, and in a world where so many people want to be excited about AI in not very nuanced ways, I wonder if the conversations and actions that would lead to more equitable treatment and compensation for creators will be allowed to happen at all. Newsrooms should protect themselves, but news as an industry should make sure it's looking out for the people who create its value, too.

LG TVs caught spying even when offline or on standby

This is an enormous abuse of trust:

“LG smart TVs are almost constantly logging and uploading data about owners and their homes, even when offline or on standby mode. […] Packet captures showed the TVs scanning the local area network for nearby hardware like phones or smartwatches, as well as logging location data and details of nearby Wi-Fi networks, and feeding the information back to LG Ad Solutions. Perhaps more concerningly, the TVs were capable of recording microphone audio when in standby; this continued even after the TV was disconnected from the internet, with audio files stored offline and uploaded once a connection was restored.”

Most households invite at least one television into their homes. It’s almost impossible to buy one without smart TV features; because most television shows are streamed over the internet these days, they’re usually online. You could leave the TV offline while connecting it to a separate box like an Apple TV, but it’ll keep nagging you to connect.

The contract should look like this: you pay for a TV and it shows you stuff. The idea that it will scan your local network for devices, determine what content you like to watch, and maybe even listen to you using a built-in microphone is not something that anybody signs up for. Someone somewhere at LG has been so incentivized to make a graph go up and to the right that they have decided that basic ethical tenets like privacy and transparency aren’t worth holding on to.

That’s particularly important in a world where the Department of Homeland Security has created Minority Report-style Predictive Intelligence Targeting Teams who instruct police to pull people over based on profiled data like their financial activity, despite there being no evidence that they have committed a crime. Data from disparate sources is routinely bought by law enforcement and agencies like DHS in order to create these sorts of profiles; a connected TV in your home could easily contribute. Are you watching the wrong kind of content? Automatic Content Recognition could rat you out. Are the devices connected to your home network outside of the norm? Up goes a flag.

So that’s homes. But most offices have TVs installed somewhere, too. Consider that an installed smart TV could easily be snooping on network devices, content, and even video calls conducted over these screens. Some more sophisticated offices will have them set to a less privileged network or insist on them remaining offline; most will dutifully connect them up. The result is a live microphone and content recognition tech installed in newsrooms, universities, non-profits, and businesses around the country.

Manufacturers like LG can sell this data. They will likely argue that it keeps TV prices down – and maybe that’s true. But this reporting comes after LG promised regulators in Texas to stop collecting viewing data without informed consent; there’s a second mic that may continue recording even when the main microphone setting has been turned off. They’ve shown they cannot be trusted. This kind of invisible data gathering should be illegal. Nobody signed up to be spied on; they just want to watch TV.

AI safety is designed in the West, and failing users everywhere

Amnesty International believes that Facebook was complicit in the genocide against the Rohingya people in Myanmar:

“In 2017, the Rohingya were killed, tortured, raped, and displaced in the thousands as part of the Myanmar security forces’ campaign of ethnic cleansing. In the months and years leading up to the atrocities, Facebook’s algorithms were intensifying a storm of hatred against the Rohingya which contributed to real-world violence.”

It wasn’t that anyone at Facebook actively wanted to enable a genocide: they just didn’t care about not enabling one. Their teams were warned at least fifteen times, but mitigating this obvious harm was deprioritized in favor of other things. They were focused on their own world, with its epicenter in Menlo Park, California. Ultimately, although Facebook was not the source of the genocide, its use contributed significantly, leading to Rohingya deaths. By prioritizing growth in Myanmar but not staffing for local needs, it invested in its valuation rather than preventing harm in a country it didn’t care about.

So it’s more than a little concerning to see AI vendors making the same mistakes. As Rina Chandran writes in Rest of World, failures in the Global South caused by Silicon-Valley-centric product development are becoming more common:

“For example, in Tigrinya, spoken by about 9 million people in Eritrea and northern Ethiopia, machine translation rendered smallpox as syphilis, gonorrhea as diabetes and ‘you have been given intravenous antibiotics’ as ‘you have been given intravenous insecticides.’”

While international efforts like the Bletchley Declaration aim to mitigate what are considered to be frontier risks of AI, it asks for little accountability for the other harms that inevitably arise from product teams that aren’t rooted in the interests, needs, norms, and values of diverse international communities. Those harms can add up to become deep wounds in themselves, but it’s also worth asking another question.

As Rest of World points out:

“At the heart of the issue ‘is the question of who gets to define what counts as a safety problem in the first place,’ Elizabeth Orembo, a fellow at Research ICT Africa, a think tank, told Rest of World. Big tech firms tend to focus on model risks such as deception, autonomous behavior, cyber capabilities, and aiding bioweapons, she said. They do not pay much attention to deployment risks including discrimination, exclusion, surveillance, language failures, and the inability of affected communities to seek remediation.”

Can affected communities be co-owners of those risk frameworks, including the resulting product roadmaps, or are they, once again, just expected to let technology happen to them?

Facebook was warned fifteen times that it was doing the wrong thing in Myanmar, and still did nothing. AI companies are retreating from even the weak commitments they previously made. They need to be forced to do the right thing: if not by markets and investors, then by international regulation.

Weeknote #2017 - Robb Knight • Posts • Atom Feed

2026-09-11T15:54:33.000Z

The St Jude Fundraiser passed $150k overall and we hit $6k on ours last night. We still have drawing slots available and some sticker news is coming soon. Donate here.

Stop Omarchy is a well-cited resource by Brennan explaining exactly why Omarchy is more than just a Linux distro run by a facist.

I caught some of the most recent Dennis the Menace show on TV and I can't believe they made him look like this.

This dotgrid desk mat is also a whiteboard of sorts. If I didn't always use my St Jude × Relay mat, I'd be getting one of these. via SimpleBits

I am obsessed with payphone tag a game that can only exist because all payphones are free in Australia. Go check out the map, it's amazing. via Hemispheric Views #171.

Veronica, of Veronica Explains, did a great video on setting up a podcast site using Eleventy. Definitely not linking this because I got a mention. Nope.

The Ocarina of Time remake looks pretty good but there's no way I'm buying a Switch 2 just for that. I should go back and actually finish this game, I've never made it past the water temple.

Zach came up with a really smart way to have one single opengraph entry point that does all the opengraph images for his site. Furious I didn't think of this.

This breakdown of Iron Man's opening scene is wonderful.

Juhis put up a single page webring implmentation — always worth keeping things as simple as this if you can.

Return to Land of Eem - Joel's Log Files

2026-09-11T15:40:00.000Z

Make sure to read the first adventure of this journey!.

Six months after the first campaign. We finally sat around the table once again, and played Land of Eem! for the second time.

We had set a couple of dates before to meet up, and even a session zero where some of my players made new characters, but we didn’t get to play for months. After all, when a couple of party members are still of young age, you can only do so much! Plus, we could only align after church and sometimes other activities would take precedence.

This time some things are different, I purchased the Deluxe Edition Box Set, and I was able to use the official GM Screen, the map and the pysical core rulebook!

The rulebook comes with a starting adventure: Wally’s Waffles and Rats, which is quite different from the one included in the Quickstart guide played last time. Spoilers ahead if you plan to play this with your own friends! But don’t worry much, it will not go the same.

First off all, I went very much not ready for this. I had the character sheets, I didn’t read them, I had all the rulebook, I didn’t bookmark any important pages for reference before the game.

I didn’t remember a lot, I just went straight into the game, hoping for the best, and this is how it went!

The adventure continues!

I did a half-decent introduction into the world of Land of Eem once again, focusing on the Used T’Be Forest and Wally’s Waffles and Wourgs. a restaurant that’s about to shutdown, because Wally lost his property deed and some conglomerate wants to claim his terrain as theirs. The whole thing happens during one last celebration, giving Waffles to everyone who comes arond before the bad guys arrive tomorrow to tear it down.

The adventure started quickly. The party of characters kind of went straight into the quest without speaking to any of the NPC’s in Wally’s restaurant. I offerend a couple of options and they did chat a bit, but I have to admit I wasn’t doing my best coming up with dialogues of my own and I want to blame the adventure design a bit, since it appears like Wally approaches the party and tells them everything they need from the start (honestly fine for a first adventure though).

Of course, I still could have pushed them a bit to participate in some of the activities inside the tavern, like Wally’s Howling Hot Challenge.

There’s another problem for me when it comes to the English naming scheme of pretty much everything in this fantasy land, since it kinda feels like it references things not in my language, but no biggie.

Last time I didn’t really bring up the party members, but I saw Daniel’s post—he went through this very same adventure with his family so give it a read!!—doing that and I thought I’d steal the format. They introduced to each other and said some things too, though it was not as detailed and a little bit rushed.

Xavi the Bard, played by youngest in the group.
Maujii the Gnome, a newcomer on this campaign!
Cube the Dungeoneer, played by the oldest in the group, a gelatinous goo.
Wibak the Wizard, a new mushroom character from the guy who played Loyal Chum last session.
Lyra the Rascal, played by my sister’s boyfriend.

Another thing, we kind of forgot the special abilities of each class for most of the adventure, but some things came in handy on a couple of occassions.

After my party got the info about the deed and those details, they headed into the storage room. For some reason, my party was always scared to go through doors, and they had some trouble deciding who would go first. This is where something like the negative/positive character traits would have come in handy, but I kind of forgot to ask about that.

By now, I forgot who entered first, but well, the events are what matters more here. The room was filled with boxes and the like, so my characters did a search, found some strong-smelling mustard, a torch and not much else.

Walking there, they stumbled with an underground worm, which bit on the leg of one of the party members. Trying to pull it away, another character slipped and ended up hitting against the corner of a box, that hurt quite a bit, but eventually they managed to scare away the worm-thing.

The mustard was supposed to be useful to keep animals away, but they never even tried to use it!

With the torch in hand, they continued forward. They slightly opened the door to a room filled with wine bottles, but they saw some rats and tried to shut the door. However, one of the party members pushed the other, stumbling very close to the now angered rats. They still managed to run away though, and headed elsewhere.

The next room was a bit of an office space, with papers, an armor stand, and a bottled ship model, which was actually a magical item that becomes real sized when put in water! The armor in the statue was small, and the gnome in the party decided to keep it. I have to admit I completely forgot how defense and combat at all worked but anyway.

There was this huge hole in the wall that appeared to be dug by some animals, it was clear the rats the party saw before would not be the only ones in their way. At the end of the small tunnel, my party found a bloodied dynamite stick, which was a bit creepy, but useful.

They were about to get out of that tunnel when the party found themselves on a pickle, the floor ended, and the tunnel could only go down, they would have to descend thirty foot deep. For this they tried to use some rope, an item a character had in their inventory! None of them attempted a jump, they simply tied the gnome to the end of the rope, holding the torch, although they let go of it and it ended up all the way to the bottom. Thanks to a lucky roll, the torch did not go out, at least they saw the bottom now!

My party was once again, very scared, and since the rope was long, they decided they would let (or force, honestly) their gnome friend to walk alone forward and shout about whatever he could see in the way.

Underground, everything was a network of tunnels, and going through them proved a little challenging while tied to a rope. There were also some rats that showed up, but that Maujii managed to scare off. They tried a couple routes without success and eventually Wibak the Wizard saw fit to use a magic spell!

Magic Spells in Land of Eem’s Wizard class work a little weird, but he can basically say whatever he wants and as long as it makes sense for me as GM, I can let it slide. For some reason, his spell said something akin to “let the stars guide our way!” and well, the spell worked! Except that they were underground and there are no stars visible here—the wizard wasn’t very smart.

Eventually the gnome walked too far, and nobody noticed they ran out of rope, and that it had fallen to the ground and the gnome pulled it. They were now stuck 30 foot above the ground.

At last, they had no rope, but they did have the courage to push Cube the Gelatinous Goo and use his gooey properties to yelp. Using him as a trampoline, everyone managed to jump down almost unscathed. Not without having to scare off a few rats that showed up.

They finally made it to a new bifurcation, and they headed to a place full of mushrooms, only to backtrack when the mushrooms turned out to have very sharp teeth.

My scared friends went carefully the other way, a dark room with an inky smell and some black thread all over the place… Two of them, the Gnome and the Bard, went forward, only to get stuck on the thread, which turned out to be a black spider web made of ink. Only then they noticed some strange oval-shaped stones, which turned out to be Inkpot Spider Eggs, and at the distance, four eyes opened.

Before the creature got any closer, they had the brilliant idea of using the dynamite stick and blow everything up. They didn’t get a good throw and the blast got them unstuck of the web, and thrown away all the way onto the dangerous mushroom field. Thankfully, the rest of the party managed to catch them as they flung, and the spider nest was destroyed!

They moved forward, confident in their mission, and here’s where I as the GM, made a bit of a nasty move. The Spider survived, and she was also very much in shock, after seeing how all her eggs were now gone… A conflict started, and it was time for the party to pray for their lives.

It’s what I would say except they where exceptionally good at parley, and after a short conversation with the Spider, ~~my sister’s boyfriend~~, I mean, the Rascal managed to trick her into believing that the neighbouring mushrooms caused the explosion. The Spider told them she still had some eggs but that were stolen by some rats further deep, so the party offered to at least save those, and that way they felt a little less bad about the whole thing.

The Spider let them pass and they found themselves in front of a chasm. They had recovered the rope from earlier, so they were able to go through it without much difficulty.

In front of them, a cave of crystals shone due to the light of the torch—which has managed to survive the whole way through somehow—soon after, they saw the skeleton of a goblin, with a hat and a document with orders to steal a property deed, from Krog and Sons Inc—another company that also wants Wally’s property. As the party realizes the fortune the presence of the crystals implies, they hear the sound of big steps approaching.

A giant rat with a not so giant crown on its head is seen, proclaiming to be the mighty and powerful King Klik. Clearly in possession of the property deed that belongs to Wally. All of my players were kind of scared to get into combat, so they bet everything on parley and did their best to convince King Klik.

The players learned that apparently, some of the meat used by Wally for the restaurant was actually made out of rat, which is something the party took very seriously—they wanted to blackmail poor Wally. However, they first had to get the property deed from King Klik.

How did they convince the rat to give it away, you ask?

Very simple, after a very lucky roll, my ~~evil sister’s boyfriend~~ I mean, the lucky and mischievious Rascal, used the magic bottled ship and inspired King Klik to become the captain of their own pirate ship, with a crew of rats under his command!

Somehow, that worked out! They managed to avoid conflict and they were able to recover the lost Spider eggs as well. King Klik and the rest of the rats dug up a new tunnel heading to the south, and we may eventually find what happened to them!

Without a lot of trouble left, returning to the surface to meet Wally was easy. The party decided to confront him about the rat meat, but I wasn’t feeling like making Wally such a bad guy and so his innocence was proven after checking the refrigerators.

After that ruckus, the party continued to enjoy Waffles for another while, and the adventure was over, for now!

Finishing words

Returning to Land of Eem was incredibly fun. With the inclusion of two new players into the party—and the absence of one of them—dynamics definitely changed a little bit.

I honestly was feeling guilty about making the Inkpot Spider sentient, and even the party felt bad about the lie. This is a friendly reminder for everyone that setting the tone of the adventure on a Session Zero is very important. This genocidal event did leave everyone feeling uncomfortable, and even though we joked about it and moved on, the rest of the session was a bit sour.

There are many ways in which this could have gone better. First, actually understanding conflict. Had I done a better job learning that, I could have conflicts develop in more interesting ways. For a while I forgot about the limited amount of Parley one can do, which is how pretty much everyone in my party got to try and convince the Spider and King Klik through a variety of ways without having to fight at all.

If they had gone into regular combat, the Spider would have been a worthy enemy, and I even could have made them promise to save the rest of the eggs or something as a last wish. Making the Spider just a mindless beast would have worked out fine, defeating or making it run away in an environment that is kill or be killed is more easy to justify, without guilt being involved.

Some things of note and lessons I learned, even if I may be repeating myself:

I really need to pay more attention to the character traits, and use them to move the story in more fun or chaotic directions
Understanding combat, seriously!
Handling things better when the party splits up so everyone has something to do or react to.
Sticking to an atmosphere everyone is comfortable with.
Trying to work around the rolls we get instead of rerolling until I like the result (yeah we did this sometimes).
Keeping items in mind! We used the rope and the torch but other useful things were never looked at.
Get better at describing environemnts and pushing the players to explore instead of peeking at a room and not going in.
Push the party to stay in character, there were a few immersion breaking moments I wish I’d managed better.

However, for something that was very improvised, I’m very happy things worked out okay, I’m not going to be too hard on myself and will simply try to learn!

As always, any advice is appreciated! and I hope you enjoyed.

This is day 33 of #100DaysToOffload

Reply to this post via email | Reply on Fediverse

2026-09-11 15:02: Because a basic sitemap would be boring! https://kevquirk.com/sitemap - Kev Quirk

2026-09-11T14:02:00.000Z

Because a basic sitemap would be boring!

https://kevquirk.com/sitemap

Thanks for reading this post via RSS. RSS is ace, and so are you. ❤️

You can reply to this post by email, or leave a comment.

[RSS Club] Sneak peek at new DOI functionality - Terence Eden’s Blog

2026-09-11T11:34:12.000Z

If you're reading this, you're part of RSS Club! A top secret society of cool people who subscribe to my feed. This post is not available on the web or via email.

I've been playing about with Rogue Scholar. It's an open-access publication which allows blogs to get a persistent Digital Object Identifier.

If I've set everything up correctly (not a given) then all new posts on this site will be issued with a DOI. Hopefully, this will not include RSS Club posts - as I'd like to keep them as a special private treat just between you and me.

I'm in the process of writing a WordPress plugin to retrieve the DOI and add it to posts. I'm not sure if there's a sensible way to add it into an RSS feed, but I'll give it a go.

Will this be useful? I don't know. My posts sometimes get referenced in proper academic works - I'm not sure if this'll make any difference to that. But it is nice to experiment with these things.

If you have any experience with DOI or Rogue Scholar - please get in touch.

Thanks for being a member of RSS Club - you rock 😃

Two more newsrooms are suing OpenAI. It's complicated. - Werd I/O

2026-09-10T22:39:24.000Z

Link: Seattle Times and Newsday are the latest publications to sue OpenAI and Microsoft, by Anthony Ha in TechCrunch

I have some complicated feelings about these ongoing newsroom lawsuits against AI companies. The latest comes from The Seattle Times and Newsday. From the lawsuit itself:

“AI products like ChatGPT and CoPilot are touted as producers of content, but in fact they are rapacious consumers, devouring human-authored content and delivering back to the world copies and derivative imitations of that same original content they consumed to achieve their commercial objectives.”

The government has argued that training LLMs is fair use, and organizations like the EFF have agreed with it. The EFF’s argument in particular is important to take note of:

“The “market dilution” theory would eviscerate not only the fair use doctrine, but also other limits on copyright that work specifically to prevent rightsholders from unfairly suppressing competition by claiming broad ownership over tropes, genres, styles, and so on. In other words, publishers would wield unchecked veto power over any expression that might conceivably compete with a work they own.”

The Newsday and Seattle Times lawsuits seek to protect corporate interests in a rapidly-changing market, with journalist reward effectively a trickle-down benefit. The licensing deals emerging as the market solution — among them OpenAI with News Corp, Axel Springer, the FT; Amazon with the New York Times — are corporate deals. Individual journalists and freelancers whose work constitutes the value see little of it, except in that it’s revenue that theoretically allows their employers to continue to exist and employ them. We probably need a new deal for creators that touches several levels.

These are all big topics. The shift we have to contend with is seismic in a way that hasn’t been rivaled since the advent of the web itself (and in some ways the impact on creators and publishers may be bigger than that). Each newsroom lawsuit is a kind of shot across the bow; the substantive conversations we need to be having are more expansive. But, in a political environment where AI vendors are aligned with the administration, and in a world where so many people want to be excited about AI in not very nuanced ways, I wonder if the conversations and actions that would lead to more equitable treatment and compensation for creators will be allowed to happen at all. Newsrooms should protect themselves, but they should make sure they’re looking out for the people who create their value, too.

Analogue Defaults - Robb Knight • Posts • Atom Feed

2026-09-10T21:38:32.000Z

A few months ago, Brad came up with analog defaults loosely based on the Hemispheric Views app defaults. I've been meaning to write mine up but having sat on it for a while I don't think it's worth me having a dedicated page like my app defaults or /now. My personal usage is better served by my #currentlyInked tag for fountain pens and this post as a general overview.

On a Sunday evening if I have time, I sit down and pick out new pens for the week for each category I carry in my Rickshaw Filmore.

Fountain pen: I use a single pen each week for my journal although I'll sometimes grab a second one with a different ink colour. Most of my pens are fine or extra fine nib. Currently: Pink Pilot Prera F nib.
Pencil: I'm doing more sketches and drawings, especially this month and next, so I always have a pencil or two on me. Currently: Rotring 600 black.
Fineliner: This never changes, Sakura Micron is the only way to fly. Uni Pin is fine in a pinch but it's not what I like. I also enjoy using the Lumos Pro Duo.
Standard pen: I switch between ballpoints, gels, whatever tickles my pickle that week. Right now? Banana pen.
Heading pen: I always use a coloured pen of some kind for headings in my journal. I pick from Gelly Rolls, [Mattehops](https://www.pentel.co.uk/product/pentel-mattehop-1-0mm-k110/, Pentel dual metallics, and Mildliners.
Journal: I've tried a bunch of different journals but the one I keep coming back to is Scribbles that Matter Pro.

2026-09-10 13:49: The constant outrage on #Mastodon (and maybe other social sites?) for is so tiring. - Kev Quirk

2026-09-10T12:49:00.000Z

The constant outrage on #Mastodon (and maybe other social sites?) for [bad thing of the day] is so tiring.

Thanks for reading this post via RSS. RSS is ace, and so are you. ❤️

You can reply to this post by email, or leave a comment.

Put an AV test at the start of your slides - Terence Eden’s Blog

2026-09-10T11:34:10.000Z

For years, I've had a test-card at the start of my slides. Before I start my talk, I can immediately see if the aspect ratio is wrong, colours are off, or any other visual issues with the presentation.

A few years ago I was invited to give a talk and was assured that the venue was set up for audio as well as video. I dutifully filled my slides with with demo videos containing sound. None of them worked. Somewhere between the HDMI output of the presentation laptop and the speakers, the audio went AWOL.

Ever since then, I've placed an audio test slide at the start of my presentations. There's a good range of videos on YouTube - pick one you like, embed it into your slides, and play it before your talk starts.

Over the years, I've found the following "bugs" with event AV setups:

No sound.
Only left channel working.
Severe latency between audio and video.
Garbled sound.
Sound routing to the room but not the livestream.
Feedback / howl around when sound playing.

Whether events are professionally run or community managed, you can never guarantee that sound will work. Add subtitles to your videos. If possible, add a sign-language interpreter. And, if all else fails, hold your microphone to your laptop's speakers.

Visual; textual - James' Coffee Blog

2026-09-10T00:00:00.000Z

My home page is a poem. I designed it in this way to explore the extent to which a literary medium – a poem – could be used for navigation, for way finding. Poems help me see the world differently, to navigate thoughts. So too does navigation: every link is a bridge to a new place, to new thoughts. While the style is unconventional and less clear than traditional navigation bars, I love it. My home page brings me closer to poetry, and reminds me of my love of words.

For the last few weeks, I have had an idea in the back of my mind: what if my home page poem had a few icons in the background that served as visual cues to different stanzas in the poem? These icons might make it easier to find particular sections of the poem. The would also add a more visual dimension to the poem. While poems are visual in themselves – the spaces between words and stanzas, indentations, the lengths of lines, the space the poem takes on a page, the typography used, and the symbols used, among other factors, all influence how we read a poem – images add a new dimension.

One of the things I love most about the web is that I can ask myself “what would this look like?” and then, through code and tinkering, bring the idea to life. I spent some time this morning searching through Phosphor Icons, an MIT-licensed icon set I use for, among other things, the icons in my mobile navigation bar. I decided on a flower for the first stanza, which speaks of stories and poems and ideas and joy, a notebook for the second, where my most recent blog posts are listed, and footsteps for the third stanza, which is more about navigation. I am not fully set on footsteps for the third stanza, as they don’t quite relate to the invitation to say hello at the beginning of the stanza. Indeed, part of the creative challenge of this concept is to find an image that matches many words.

Here is what I designed:

Faint blue icons appear on alternating sides of each stanza: right, left, right. The icons are all at slight angles. An opacity is applied so that the icons do not stand out as much as the words in the poem. The icons complement the text in each stanza to varying extents.

Thinking about the idea of adding images to a poem brought me back to a list I started curating in the last month of places where words exist next to images. Words appear on album covers as part of the art designed to represent the album. Words appear in front of or near images on book covers. In museums, words appear on some paintings (i.e. signatures, or even, in some cases, stories), next to art (i.e. on information plaques), below art (i.e. on a label on the frame of a painting), and more. Words and images, although separate modalities, appear together so often. Indeed, I have started to add more images to my home page that was originally all-text except for my website mascot; the images I have since added – two buttons – convey information in a way I can’t with words, but also serve as a complement to what is on the page.

While I haven’t rolled out this design on my home page – and I’m not sure yet if I will – it has been interesting to explore the intersection of the visual and the textual in this way. Indeed, my poem also explores a third dimension – navigation – through the links it uses. It is fascinating to try and extend a literary medium with the affordances that hypertext allows. What if a poem revealed a piece of art every time you hovered over a stanza?

My main reservation with the icon design is that it may distract from the words. But it also creates new visual anchors. There is a lot to think about.

This crossing of disciplines relates to a conversation I had earlier this year with an uncle when I mentioned that I don’t think the sciences and the arts are disconnected, but rather are complementary. I can’t remember his exact words, but I was left feeling excited about how someone else also didn’t see them as separate buckets. Similarly, it is interesting to think of words and images not only in the context of each modality, but in the context of all the spaces in between. Indeed, we already have picture books, prose poetry, technical writing, visual communication, and many other forms that combine two concepts or traditions together.

way finding Phosphor Icons

A Year of Silksong - Joel's Log Files

2026-09-09T18:10:00.000Z

It’s been a whole year now since Hollow Knight: Silksong finally released, and it has been a delightful journey.

I wasn’t there for a lot of the hype around it, I was more than happy playing Hollow Knight in the span of a year or so, and beat it only a few days after Silksong was finally released to the public on September 4, 2025, a day after I posted my review.

I was perfectly aware of the meme though, and the time it took for this sequel to finally show up, so I was very clearly hyped, and I had decided that I would buy and start Silksong on the very first day, the first time I even considered doing something like that.

Waiting in line is something I’ve never done. It has always been a bit of a dream of mine, to wait for a whole day behind the closed doors of a videogame shop, like those old videos on YouTube where people are camping for a whole night just to be among the first to get Halo 2 for the Xbox back in the day, though in this case it would be a digital game I guess.

Of course, we all know how that went. The servers on every single gaming platform were overwhelmed for hours, as people tried and failed to purchase this twenty dollar game. I was trying to get to it on the Nintendo Switch, but I failed to do so.

Thankfully, I was actually at work, and I would have been unable to play the game immediately anyway, so I simply waited until later to purchase it and finally get started with it.

The progress I’ve made so far in the span of a year has been… slow. I pick it up when I want and leave it be when I feel like trying something else. I’ve not pushed myself t play it when I don’t want to, and I have even abandoned it for months at a time, until things line up and I can return to it.

Most of my progress has been consistently shared on a long thread that has been around since the game first came out, lots of screenshots and recordings can be seen of the most important steps of my journey through Pharloom.

In case you somehow don’t know this, Silksong is a Metroidvania game with Soulslike elements, in case you don’t know what that means, you basically get lost in a world that is gated by hard to reach areas, so you have to get new powers that let you make progress. Oh, and you also have to fight against enemies and bosses that will kill you in three hits. Incredibly fun!

At this point I could write a review for the game, but since I’m still going through Act 3, I want to finish that first too. Kind of funny considering I didn’t go through a lot of Hollow Knight, avoiding the Path of Pain and much of the DLC content, but well, things happen, I may even revisit that game later on.

As of today, I have been playing this game for over 80 hours, making it the most played title in my Nintendo Switch, surpassing The Hundred Line: Last Defense Academy. Both games still have a bunch of playtime left for me to go through, so I am wondering how long it will be for me to get through it all.

Of course, some titles like Minecraft and Monster Hunter Freedom Unite are still hundreds of hours ahead, but they are completely different and I’ve also played them for many years so they have a big advantage.

Silksong is a triumph, something truly special that I am really happy to be a part of. Dare I say it’s the only game whose release date I have memorized! So of course I just wanted to yap a little bit about it.

Definitely not a game for everyone, even after all the updates that have balanced some of the difficulty, but if you are up for a challenge, it is always worth a try!

Hollow Knight: Silksong, downloading on my Nintendo Switch, a year ago!

This is day 32 of #100DaysToOffload

Reply to this post via email | Reply on Fediverse

Greyscale in Doodle Scan - Robb Knight • Posts • Atom Feed

2026-09-09T13:46:28.000Z

Last night I was reading this excellent post about scanning pencil artwork and the first step the artist mentioned is setting the pallette to greyscale. This made me realise how useful that would be on Doodle Scan — the black and white mode is good but only in some circumstances where the drawing is just lines, greyscale would be much more useful for illustrations with colour or shading.

Like all the other features on Doodle Scan, it wasn't immediately obvious to me how to do this. After some digging and experimenting with changing RGB values, I realised the relative luminance value I use to check for if the colour is light or dark can be rounded with Math.round to get the value I need. So 253.123 becomes 253 and I set the RGB value of that pixel to 253,253,253.

Below are examples of the three colour modes with default settings from Doodle Scan and if you want a drawing a bit like this or anything you want really you can donate to St Jude.

Colour version

Greyscale version

Black and white version

A “proof” of Fermat’s Last Theorem that fits the margin - Trail of Bits Blog

2026-09-09T11:00:00.000Z

Fermat famously claimed to have a “truly marvelous proof” of his Last Theorem, but he never wrote it down, insisting the margin of his page was too narrow to contain it. A few centuries later, Anthropic announced a complete formalization of Fermat’s Last Theorem using 13 million lines of Lean code (clearly not what Fermat intended). Luckily, we found a wonderfully cursed Lean bug, shown below, that suggests the proof may have fit the margin after all. The issue affects all stable versions of Lean up to 4.33.1, and the patch is incorporated in v4.34.0-rc1.

A “checked” proof of Fermat’s Last Theorem using Lean 4.33.1

The blue checkmarks in the screenshot above would suggest that Lean considers this proof correct. This seems odd given the amount of work Sir Andrew Wiles put into this problem and the vast size of Claude’s proof. So what is going on?

The “proof” clearly doesn’t make any sense and exploits an issue in Lean. We found the issue while using GPT-5.6 to experiment with a new skill for code review. We want to clarify up front that the issue is not a kernel soundness issue, but it happens to nicely fit any discussion of strings, lengths, and substrings.

The issue affects String.Pos.Raw.extract, Lean’s low-level string-slicing function. When asked to extract a one-byte slice at an astronomically large position, Lean’s logical definition returns the empty string. But the compiled native code returns the entire original string. That disagreement is enough to manufacture a contradiction. Lean’s ordinary evaluator “proves” that the tiny slice was empty, while native evaluation “proves” that the very same slice contained “a truly marvelous proof.” Put those together, and Lean concludes that the empty string equals a non-empty string. And once you have a contradiction, you can prove anything, including Fermat’s Last Theorem.

On the bright side, the Lean team was considerably faster than mathematical history. About 90 minutes after we reported the issue, hargoniX opened a fix for the memory-safety problem, and it was merged roughly three hours after filing. The remaining semantic mismatch was fixed by Rob23oba five days after the report, closing the issue. We’d like to give a huge shoutout to hargoniX, Rob23oba, and the Lean team for the fast turnaround.

As a reminder, when dealing with external proofs, follow Lean’s guidance for validating a Lean proof. In our proof-of-concept code above, #print axioms flt shows 'flt' depends on axioms: [propext, Classical.choice, Quot.sound, flt._native.native_decide.ax_1_1]. The extra axiom native_decide adds the compiler to the trusted boundary, and therefore needs to be used with care. Machine-checked proofs will increasingly enable an unprecedented level of trust in mathematical results and critical software. However, more work is needed (e.g., lean4lean and alternative kernel implementations) to ensure that proofs aren’t deemed correct through exploitation of issues in theorem provers.

Fermat’s theorem took 350+ years to prove. If you don’t want to wait that long for your code to be audited, contact us.

JD CLI updated: now creates filesystem folders - Johnny.Decimal

2026-09-09T07:35:50.000Z

The JD CLI has been updated.

It's migrated from using environment variables to the new configuration file.

Now if you try to jd 11.11 to a folder, and that folder doesn't exist, and your JDex is readable by the CLI – i.e. Markdown files on disk, i.e. Obsidian - then it'll create the folder for you.

The MCP server has been updated to understand this tool and the configuration file. Just ask it to help me install the jd cli.

Here's a short video walkthrough.

If you installed the CLI before today

Pull:
```
git -C ~/.jd/cli pull
```

In your .zshrc or .bashrc, find these lines. You might only have the first.

source ~/.jd/cli/jd-nav/jd-nav.sh
source ~/.jd/cli/jd-prompt/jd-prompt.zsh

Replace them both with this line.
```
source ~/.jd/cli/jd.sh
```
Start a new shell.

Second year - James' Coffee Blog

2026-09-09T00:00:00.000Z

I woke up in excitement this morning. Today is the day I can start to access my course materials for next year. My second year of university doesn’t officially start for another few weeks, but from today I can start reading through the introductory material. I spent the morning reading about the structure of the year in the art history and creative writing modules that I am taking: the course overview, how assignments are structured, the referencing requirements (which are going to get more intense in art history in particular, because I will be citing more artworks), and more.

I am writing this in the afternoon, when the excitement from this morning still has not waned. If anything, it has grown more intense. I am so excited for the next year. I started reading the introduction to my creative writing textbook and already started to feel challenged in exactly the way I want. The course overview for the art history module – Art and life before 1800 – piqued my interest in several places. In October we’ll be starting with a block on Art and its Environments, where we’ll be studying landscapes and forests and snowscapes and more. I was just thinking yesterday how much I love snowscapes. I wonder what I will learn about them next year. Across all of the art history work for next year, I am especially interested in learning about the role art occupied in society through history, a key theme throughout all of the blocks we will study.

In creative writing, the main focuses will be fiction, poetry, and life writing. I am excited for all of these areas. The course also touches on building a writing practice. While I write often anyway, I have already found the exercises in creative writing have pushed me in new ways. This is precisely what I want from studying: to challenge myself and grow my skills in areas that interest me. There will also be materials on professional publication, which, while not a goal I have right now, will surely be interesting.

After I caught my breath after a morning of reading, I realised that my first year of university is essentially complete. It will be a few weeks before I get the results from my final assignment, but there is no more work to do for my first year. I did it! I finished my first year! It feels somewhat surreal for my first year to be over, but here we are. Time flies. I am proud of all the work I did in my first year, and am looking forward to the next one.

My first year, which was structured as a foundation in the humanities with opportunities to start exploring the subject area(s) we found most interesting in more depth toward the end of the year, was a whirlwind through art history and creative writing and history and religious studies and more. Every week there was something new to study. I studied Jane Eyre, Antigone, the Benin bronzes, Van Gogh, the foundations of Buddhism, and more. While I was eager to get to the art history topics last year, I loved the approach my school took to covering a wide area. It was the inclusion of creative writing in my first year that helped me build more confidence in my writing, especially in fiction, and ultimately led me to change my degree from a sole focus on art history to studying both art history and creative writing. This combination feels right for me.

Here’s to another year of studying!

Less YouTube, Bandcamp Friday, Silksong returns - W36 - Joel's Log Files

2026-09-08T21:50:00.000Z

This was one of those weeks where I kind of expanded upon most of the main topics on their own blogposts already, so all I can do is summarize and share the links here! A couple extra things here and there too.

Here’s some notes on what happened from September 1 to 7, 2026.

📺 I have decided to limit my YouTube usage to one hour per day on my phone. I used the Unhook extension on both my phone and my computer, to remove the algorithmic feed and stick to subscriptions only.
✂️ Unfortunately that also means I’ve had to cutdown on my Subscriptions! There were a lot of constant videos from certain types of channels that flood that page for some reason. I need to categorize a little more. Of course, I should also use YouTube as a search engine instead of relying on titles and thumbnails to grab my attention.
🎙️ Thankfully, no YouTube means I have returned to a few podcasts to have in the background (or while walking) this week! Including Revolutions and The Rest is History.
📰 Since I was already cleaning up my YouTube, I also spent some time checking my FreshRSS subscriptions and cleaning up some of the old ones. It is honestly kind of weird to have so many blogs I follow go 404 in the six or so years I’ve been around this bubble. I hope I can continue writing here for many more years.
📱 A few weeks ago I switched away from KISS Launcher. My search for an ideal replacement is still undecided, right now I am switching between OLauncher and Minimo Launcher, but I still miss KISS…
📞 My phone line was blocked by the government! This is a new measure taken to combat crime, by making every citizen in the country register themselves with their ID card and a bio-scan. I am still refusing to partake in this mess, by the way, I will write on some of that offline experience soon.
📻 Bandcamp Friday happened! and I got myself a couple new purchases, some videogame soundtracks once again for some titles I have played, and one I have not!
- TOEM Original Game Soundtrack by Jamal Green & Launchable Socks
- Dicey Dungeons Original Soundtrack by Chipzel
- Neva Original Game Soundtrack by Berlinist

My 3DS with Fire Emblem Awakening, gameplay of Silksong and Party House, Coyote vs ACME's poster, and some leaves from a tree

Watching

Coyote vs ACME - This one was a great watch. Even as a kid of the 2000s, public TV channels in Mexico aired reruns of the original Looney Tunes for many, many years of my childhood. The Coyote and the Roadrunner were one of my favorite segments, and I’m incredibly happy to see how they used that concept and developed it here. This one gets my thumb of approval, it really managed to capture that nostalgia and use it for something truly awesome. Also the history behind the production of this movie is kind of crazy, and it even reflects on the themes of the movie itself, a must watch.
Ad Astra - I only watched this one partially, I will finish it today since my weeknotes are late. It’s a bit of a more serious Sci-Fi movie with a future humanity that is only starting to conquer the solar system, until some mysterious energy starts messing with electricity, ships and stations all over the place. It really reminded me of Planetes, featuring people born outside Earth, space terrorism and the like. The main plot focuses on Brad Pitt trying to find his missing Dad, Tommy Lee Jones, who was the best astronaut but went missing ages ago.

Reading

Blue Lock - Chapters 357-359. The match against England is proving to be rather interesting! With Blue Lock adopting a unique formation and Isagi trying to fit into it. The England team is a menace, a team that can’t be read or overcome in the same way that any other team has been before. It is kind of impressive to see that this far into the series.
My Wife is from a Thousand Years Ago - Chapters 287-288. Returned to this rom-com and it’s been pretty cozy and nice to read lately. The wedding feels closer than ever, and family shenanigans are happening too! But I still have 150+ chapters left so, we’ll see how it goes.
Spy x Family - Chapters 138-140. As reliable as ever, I love the humor and the dynamics of this manga. We returned to the Eden Academy and had some very fun and wholesome Anya moments there.
Centuria - Chapters 48-50. A bit of an unexpected battle ensued and a weapon is unveiled which is rather surprising. It is kind of epic!

Gaming

Hollow Knight: Silksong - This game has gripped me all over again now that Act 3 has gotten started. The sequel to the beloved Hollow Knight continues to be an absolute masterpiece, and I’ll probably have to gush about it on a separate post, especially since it’s been a whole year since it’s release on September 4th, 2025. Looking forward to that! For now, I am looking for some Ant Queen boss or something like that, if what I hear of the rumors is true, there may be a super cool battle waiting for me.
Fire Emblem Awakening - After a little hiatus I finally decided to give attention to this game, and I have managed to make some decent progress on Chapter 19! unfortunately I ended up dying and having to reset. But well, now I know the truth. Besides the main story I also did the paralogue that unlocked Cynthia, the daughter of Somia, so I have another Pegasus Knight to level up! I still have a few relationships to develop though, we’ll see how it goes.
UFO 50 - On Sunday I had a bit of a fun time with a friend who visited my place. I don’t often get to do 2-player gaming so I decided to go for this one once more. We played a few interesting titles! Including:
- Party House - An awesome game about inviting people to your party, collecting popularity and money, and being able to host bigger and better parties, until you can fulfill an objective! There are a lot of mechanics and scenarios here, it’s a bit of a Deck-Building game, trying to invite certain people that have certain effects on your score and such. Incredibly fun and simple, I want it on my phone!
- Pingolf - This is a very interesting 2D golf game with a bunch of courses to complete. It doesn’t have a lot of uniqueness going for it, but the aesthetics are great, the mechanics are very good and the score-chasing element will definitely make me return to it.
- Lords of Diskonia - A turn-based game where your army is represented by pucks (like those from Air Hockey). The objective is to slide your pucks and hit enemies. Whoever pushes them off the map wins. Each chip has a certain amount of damage and some skills it can use! We only tried it once and had a fun time.
Mario Party 3 - We had an incomplete session with three friends that was going very well! One of them had to leave halfway through, which is why we switched to UFO 50. You can never go wrong with MP3!

Around the Web

Blog Posts

The 5 Ws of Reading - an interesting challenge for people who like reading books!
Let’s stop buying new phones - I couldn’t agree more, but I’m still tempted sometimes.
SciFi Books: The Golden Oldies - Jules Verne and H.G. Wells are an absolute must!
Let’s talk retro doodads! - Lots of cool gaming handheld emulators mentioned here, enjoy!
My last few weeks in Germany - lovely write-up from Daniel talking of his experience in another country and community.

YouTube

The Golden Age of Mobile Gaming - Scott The Woz - A trip down memory lane.
How Rocky’s Models Were Made for Project Hail Mary - Some cool practical props!
Why the Mariana Trench Still Terrifies Scientists - Good documentary about sea exploration.
What Edge of Tomorrow Understands About Aliens That Hollywood Doesn’t - Cool monster design is cool.

This is day 31 of #100DaysToOffload

Reply to this post via email | Reply on Fediverse

Note published on September 8, 2026 at 8:51 PM UTC - Molly White's activity feed

2026-09-08T20:51:29.000Z

made some tiny stamps out of lino scraps to make labels for my jam jars

Your TV is spying on you, and it's worse than you think. - Werd I/O

2026-09-08T16:33:41.000Z

Link: LG TVs caught spying even when offline or on standby, by Dominic Preston in The Verge

This is an enormous abuse of trust:

“LG smart TVs are almost constantly logging and uploading data about owners and their homes, even when offline or on standby mode. […] Packet captures showed the TVs scanning the local area network for nearby hardware like phones or smartwatches, as well as logging location data and details of nearby Wi-Fi networks, and feeding the information back to LG Ad Solutions. Perhaps more concerningly, the TVs were capable of recording microphone audio when in standby; this continued even after the TV was disconnected from the internet, with audio files stored offline and uploaded once a connection was restored.”

ActivityPub - Is it worth defending against replay attacks and message/signature time skew? - Terence Eden’s Blog

2026-09-08T11:34:51.000Z

Here's a problem that I've found with ActivityBot - my little ActivityPub server. Sometimes it receives messages which were originally sent months ago. Why does that happen and is it risky to accept and process them?

My tl;dr is that it probably isn't worth worrying about. But I'd love someone to tell me why I'm wrong.

Here's my thinking:

Causes

All ActivityPub messages should have a "published" timestamp in their body. Some will have an "updated" timestamp. That tells you, unsurprisingly, when the message is alleged to have been originally published or updated. That time might be very different to the time you receive the message.

There are, I think, three different reasons why a server might receive a message which has an out-of-date timestamp.

The first is that sometimes servers are just slow. Processing thousands of messages at the same time means that some of those messages take a while to send. ActivityPub is one big chain-mail so it can take several minutes for a message to be sent to all your followers.

Similarly, your server might be slow. If it doesn't acknowledge receipt of a message, the original server will try sending it again. Sometimes that can take a while.

Finally, some servers take a relaxed view of standards. They send an update to an old message but keep the original publication date. Ideally, they'd use an "updated" timestamp but quite often they don't.

For the purposes of checking the legitimacy of the message, you do not need to check when a message says it was published or updated. You might want to check it isn't an obviously bogus date like far in the future or impossibly far in the past - but that's up to you.

It is normal that your server receives messages which appear to have been published at a totally different time from now.

Is that a problem?

Probably not.

As described above, there are various reasons why a message may be delayed in transit - or may appear to come from the distant past.

What we can check is when the message was cryptographically signed by the sending server. This is independent of its published or updated timestamp.

HTTP requests to your server will have a date header which looks like Tue, 01 Sep 2026 15:54:21 GMT - this is in the slightly peculiar and Anglocentric RFC 5322 format.

New style RFC 9421 headers will also have a signature-input header which will contain something like created=1788278061. That uses the slightly obscure UNIX / POSIX time which counts seconds since the "Epoch" of 1st January 1970.

If you convert the UNIX time to something more modern, you should get an identical value to the date header.

But that isn't always the case. For example, the RFC 9421 standard gives this example:

Date: Tue, 20 Apr 2021 02:07:55 GMT
"@signature-params": ("@method" "@authority" "@path" \
  "content-digest" "content-length" "content-type")\
  ;created=1618884473;keyid="test-key-rsa-pss"

Converting 1618884473 to normal time gives Tue, 20 Apr 2021 02:07:53 - a two second difference.

If the date and created values differ significantly - that may indicate that the message is untrustworthy. Or that there was a delay between the signing and the sending.

The spec says:

The Date header field value represents the timestamp of the HTTP message. However, the creation time of the signature itself is encoded in the created signature parameter. These two values can be different, depending on how the signature and the HTTP message are created and serialized. Applications processing signatures for valid time windows should use the created signature parameter for such calculations. An application could also put limits on how much skew there is between the Date field and the created signature parameter, in order to limit the application of a generated signature to different HTTP messages.

7.2.4. Choosing Signature Parameters and Derived Components over HTTP Fields

But, of course, it doesn't tell you how much skew is problematic. It's up to you how much skew you're prepared to accept.

So that's the difference between the sent time and the signed time. The next time to check is your own. As we've discussed, sometimes servers are slow sending things out. Would you accept a request that was signed five minutes ago? Five days ago? Five months ago? What amount of difference is dangerous?

Here's what various services and sages have to say:

Mastodon

The request contains a Date header. Compare it with current date and time within a reasonable time window to prevent replay attacks.

How to make friends and verify requests

What is "reasonable"? The source code suggests one hour.

Grishka

Time in the Date header must differ from the recipient server’s clock by no more than 30 seconds

A bare-minimum ActivityPub server from scratch

Evan Prodromou

static #maxDateDiff = 5 * 60 * 1000 // 5 minutes

activitypub-bot

SWICG

The standards don't give a concrete time window to use for this comparison. In practice, an hour plus a few minutes buffer in either direction may be a good value, to account for both clock skew and differences in time zone/daylight savings time configuration across systems.

How To Verify a Signature

Others

Without naming names, it looks like a bunch of popular servers don't check whether there's a significant difference between the date the request was signed and the date it was received.

Summary

Various documents and implementations recommend anything between 30 seconds to "a bit more than 60 minutes". Or they just ignore any date difference.

What's the right answer? What happens if the signed date is significantly different from the current date?

What are we trying to protect against?

Replay Attacks. Suppose someone is listening to the communications between the sending server and your server. They copy the message that is sent to you. Later they send it again!

At this point, you might be thinking "so what?" and… I'm inclined to agree with you!

What's the worst that could happen if you received the same message multiple times? Two things that I can think of.

Firstly, it might not be the same message. It is possible to send a new message but with old headers. An attacker could make someone post "I hate Taylor Swift" against their will and watch as legions of fans disembowel the victim.

Except, I don't think this is likely. The signature in the header contains a hash of the message being sent. If you are properly validating the signature, a changed message will have a different hash from the one in the original message. You don't need to check timestamps, you just need to check if the hashes match.

Secondly, idempotence. That's a fancy word for "pressing the button multiple times should only result in one action".

What happens if a user appears to send you multiple "like" messages for a single post? You only record one like.

What if they send multiple messages with the same content? Well, each will have a unique ID in the message - so you only post it once.

What if they send multiple anythings? I can't think of any ActivityPub action which would not be idempotent.

About the worst thing I can think of is this:

Alice sends a message to you saying "I want to follow Bob".
Mallory intercepts this message.
You record Alice is now following Bob.
Alice sends a message to you saying "I want to unfollow Bob".
You record the severed relationship.
Mallory replays the original follow message.
You record Alice is now following Bob.

It's also possible the following could happen:

Alice posts a message saying "I love The Beatles".
You record Alice's message and display it on the timeline.
Alice updates her post to say "I love the Rolling Stones".
Mallory intercepts this message.
You record Alice's updated message and display the new version on the timeline.
Alice updates her post yet again to say "I love the Spice Girls".
You record Alice's updated message and display the new version on the timeline.
Mallory replays the original update message.
You now display that Alice loves the Stones rather than Spice Girls.

Perhaps the same can happen with like/unlike, block/unblock, boost/unboost.

But none of that is significantly prevented by checking the date.

Ultimately, it is up to your sever to check the unique ID of each message and refuse to action any repeated messages. You may not want to trust the unique ID which is sent with the message. If that's the case, you can calculate your own - perhaps using a hash of the contents, the signature, or some other process which will generate an ID based on the message.

Putting it all together

Here's what you need to do to prevent replay attacks:

Independently calculate the hash of the message received.
Validate that your calculated hash matches the hash sent in the message's HTTP headers.
- If not, this is a potential replay attack and the message must be ignored.
Verify that the signature received in the message's HTTP headers includes the message hash and is cryptographically valid.
- If not, the signature is invalid and the message must be ignored.
Has the received message's unique ID already been processed?
- If so, refuse to process it again.

I don't see what checking the timestamp of the HTTP signature has to do with anything. Someone who has access to the original messages and their headers could send them milliseconds after the original delivery.

I think it is probably pragmatic to give messages 60ish minutes grace before dropping them. Delays happen, but anything more significant than an hour might indicate a attack. But, equally, might just mean that the Internet is having a slow day.

If you are correctly checking signatures and hashes, I don't think you need to worry about skew between signature date and delivery date.

No! You're wrong and I can prove it!

Please tell me where I have erred! Stick a comment in the box or drop me an email. If I've made a massive or subtle mistake, I'd love to know what.

Wonders of Web Weaving, Episode 18 - James' Coffee Blog

2026-09-08T00:00:00.000Z

The eighteenth episode of Wonders of Web Weaving is out:

In Episode 18, I chat with Ava, the author of blog.avas.space about, among other things, data protection and privacy, consent in the context of privacy, the armchair of great blogging, and more.

I hope you enjoy the episode!

Wonders of Web Weaving also has an RSS feed you can use to follow along from wherever you get your podcasts.

Ava blog.avas.space The eighteenth episode of Wonders of Web Weaving is out Wonders of Web Weaving also has an RSS feed