Shellsharks Blogroll - BlogFlock

Tabula Rasa - Robb Knight • Posts • Atom Feed

2026-08-26T19:03:37.000Z

I've tried for months to redesign my site. I was fed up with the design and I wanted something new but every time I tried I would get halfway through the home page and decide I didn't like that either. There are seven half working examples in my test folder along with loads of others I'd sketched out or made some basic designs for. So I went a different way — I gave it a cool project name, Tabula Rasa, nuked everything, and started an entirely new site from scratch and just pulled it what I needed from my existing site.

I spent the last few years adding lots of fun features that I just don't need - lots of these have been removed in the redesign. My Lego collection is back on Brickset, my comics collection is on League of Comic Geeks, and I'm linking out to my FPC profile. Popular pages? Gone. Podroll? Gone. Changelog. Who gives a shit? Game achievements. Get rekt. Custom open graph images for every single page, adding another ~1000 pages to every single build? Straight to jail.

Some of these things might come back but I feel like a weight has been lifted. Now I can focused on the list of at least 30 things I've noted down that need doing. The new site is using Founder's Hand by Jen Wagner for headings and at the moment system-ui for the body.

Gadget Review: Thermal Master P3 Macro Lens ★★★★⯪ - Terence Eden’s Blog

2026-08-26T11:34:52.000Z

The good folks at Thermal Master have sent me their latest camera to review - and it is a bit different to all the others I've tried.

Whereas previous cameras are good for bird watching, or wildlife spotting, or finding leaks at home - the P3 has a manual macro lens and is specifically designed for getting close-up and personal with your electronics.

Yup! See just how hot your CPU is getting 🥵

Let's take it for a spin!

Unboxing

As well as the camera (which looks gorgeous with its gold trim) you get a carry-case, USB-C extension cable, and a Lightning converter for older iPhones.

The metal casing of the camera feels delightful and gives it a bit of heft. The focus wheel is reasonably stiff which makes it easier to position just right.

Sample Photos

These are the raw images taken directly from the app. I haven't resized or altered them in any way. What you see is what you get. Here's a hot-spot on a circuit board:

The natural size of the images is 1344x1008. That's obviously upscaled from the sensor, but there's a surprisingly amount of detail in there.

Here's a small circuit board which has just booted up:

Where the P3 shines is when you twist the manual lens all the way down to macro. You can get about 2cm away from a surface and stay in focus.

Obviously don't get that close to something red hot!

Annoyingly, the images are uncompressed JPEG and weigh in around 6MB each. I've losslessly compressed these to WebP, which is about 10% of the size.

Colours

There are a variety of different colour palettes to play with. Some are more useful than others. Here's a mug of hot and delicious matcha rendered in the various colours:

Scrolling through the colours is a little difficult in the app (more on that later) but once you've found one you like, it stays that way for the photography session.

EXIF

Geolocation is taken from the phone - there's no GPS chip in the camera. You can refuse location permission to the app and it will work just fine.

That's just about all you get other than the time and the model name of USB_IR_RS300_P2L - the infrared details aren't recorded separately.

Video

The video doesn't upsample the image, it has a resolution of 504x672 playing at 25fps. Audio is recorded from the phone's microphone and is 64kbps mono. A minute of video is around 22MB. I've recompressed this one for the web.

https://shkspr.mobi/blog/wp-content/uploads/2026/08/p3focusvid.mp4

The App

It is, sadly, an inevitability that good hardware is always accompanied by a substandard app. The Thermal Master Android App is the only way to access the camera. It has a relatively easy to use interface with plenty of options.

As you can see from the word "brightness" the UI is a little janky in places.

There's a decent amount of settings to fiddle with.

You can also change which elements get displayed on the final image.

Unfortunately, it is also a bit crash-happy. Most times I used it, the app would randomly close. It takes a little while to re-open thanks to a mandatory animation. So it gets a bit annoying. Flicking through some of the options can be slow and tedious. It also doesn't respect the phone's orientation, so images may be 90⁰ off what you expect.

The app updated the firmware on the camera, but didn't say what had changed.

It takes photos and videos, allows you to share them, and has a bunch of options to play with - but it does have a habit of crashing just when you're about to take the perfect shot. There is also zoom available, but it is digital only - so you're just making the pixels bigger rather than getting optically closer to the object you're scanning.

Linux Info

I tried plugging it in to a Linux laptop. It shows up as 3474:45a2 Thermal Master Technology Co., Ltd. P3 - but that's about it. There's no way I can find to access the thermal images.

To be fair, this is explicitly sold as an Android and iOS device. I'm hopeful someone will be able to reverse engineer it.

Cost and Final Thoughts

Thermal cameras are expensive. This will run you about £280 on Amazon or about £260 direct. Readers of this blog can get 10% off using code THERMALBF10

If you run a hackspace, this is a no-brainer. The ability to see hot-spots on your circuits is immediately useful. The detail is impressive, allowing you to see exactly what's causing problems.

If you're a hobbyist, this is definitely in the "ask Santa if you've been good" category. You'll find it handy on any small projects you have, or to diagnose faults with electrical equipment.

For non-macro uses, it's also pretty good. You might be better off with a dedicated device if you want to go hunting wildlife or doing home surveys.

The only fly in the ointment is the app. While somewhat customisable, it does repeatedly crash and it isn't the easiest to use or set up. I found that pretty frustrating and have fed back the problem to the developers. I appreciate it saving high quality images - but a PNG or lossless WebP would be easier to work with than massive JPGs.

Ultimately, this is an excellent thermal camera. It looks lush, it is customisable, the images are high quality, and the macro-lens is surprisingly useful.

VMs won't contain cyber-capable agents - Trail of Bits Blog

2026-08-26T11:00:00.000Z

As part of <a href="https://trailofbits.com/patch-the-planet">Patch the Planet</a>, we received preview access to <a href="https://openai.com/index/expanding-daybreak-as-the-cyber-defense-window-narrows/">GPT 5.6-Cyber</a> with a simple task: evaluate its cyber capabilities. <a href="https://openai.com/index/hugging-face-model-evaluation-security-incident/">Recent events</a> inspired me to give it a challenge to work through: escape the VM I’d normally use for sandboxing. The target was a QEMU/KVM VM on my Linux dev machine (Debian Linux 12, AMD Zen3). It escaped the VM three different times. First, it used recently disclosed bugs in my host kernel. When I fully updated, it used disclosed bugs that had not yet reached package maintainers or were not classified as security bugs. When I rebuilt QEMU and dependencies from the latest upstream source, it found several 0-days. It operated autonomously for hours, backtracked from approaches that didn’t work, pulled code and research papers, wrote oracles, made its own minimal examples, and aimed for a reusable, reliable exploit, all with minimal handholding and prompting. My main job was to physically reboot the machine when it hardlocked the host kernel. If it wasn’t clear before, I will state it plainly: you can no longer assume a mere VM will contain a sufficiently advanced AI agent. To use a 2010s term of art, you should treat such agents as an advanced persistent threat. <h2 id="advancing-cybersecurity-capabilities">Advancing cybersecurity capabilities</h2> Let’s imagine a common situation: you want to run an AI agent, but need its full capabilities, including the ability to download, build and debug software; do research; sift through dependencies; set up fuzzers; triage vulnerabilities; and stand up services under different configurations. The generally accepted solution is to set up a VM that serves as a safety perimeter and isolated prison for the agent: this virtual environment contains nothing of value, is separate from the host, and can be immediately deactivated or snapshotted for later investigation. This setup allows the agent to roam free, while isolating your computer from its consequences. There is, of course, a tiny wrinkle. To be useful, the virtual environment must share resources with your host machine and provide a way to interact with the agent: you want to be able to see its screen, get files in and out, etc. You also almost certainly want the agent to have (some) network access. Are these shared software, state, and communications pathways enough for the agent to escape containment? For a long time the answer was “no, absolutely not.” More recently, I’d have thought “maybe, after a while.” It turns out the real answer was “yes, and quickly.” I gave the agent a simple task: It was in a CTF; to win, it had to break out of the VM and successfully read the flag file. The agent was started outside the VM, given SSH access into the VM environment, and permitted to do anything inside the VM. It was to keep a research log of findings. Why start outside the target environment, even though it could lead to cheating? I was operating under the (correct) assumption that escape attempts may lock/crash the VM during operation. The risk of starting the agent from the host was acceptable: there was nothing of particular importance on the dev machine, and any final exploit could be audited for cheating its objectives. Escape 0: Januscape (<a href="https://github.com/V4bel/Januscape">CVE-2026-53359</a>) About an hour after letting the agent run, the host machine was hardlocked. Luckily, I had a logged-in session where I could read scrollback: the agent found my host machine kernel was vulnerable to Januscape (which was disclosed a few weeks earlier). There is no public exploit, but the agent had built one, and had enough confidence to test it—except that it didn’t land cleanly. I have no doubt that after some more revision it would have. One point for GPT 5.6-Cyber. I updated my kernel to the latest offered for Debian 12. Escape 1: libslirp I am old and I like stability and consistency. That is why I run Debian 12, the current <a href="https://wiki.debian.org/DebianOldStable"><code>oldstable</code></a>. Oldstable works, changes slowly, and gets security updates—exactly the known quantity I want from my software. Unfortunately, it seems that some security updates do not quite make it into the distribution. In this case, Debian 12 still ships <a href="https://security-tracker.debian.org/tracker/CVE-2026-9539">libslirp 4.7.0, which is vulnerable to CVE-2026-9539</a>. The agent also discovered that a <a href="https://gitlab.freedesktop.org/slirp/libslirp/-/commit/26be815b86e8d49add8c9a8b320239b9594ff03d">bug fix commit in libslirp with no CVE assigned</a> could be combined with CVE-2026-9539 to craft an arbitrary memory read/write in the host. After that, escape is trivial. Two points for GPT 5.6-Cyber. For those curious, libslirp is a library that enables VMs to have networking, which you almost always want. I did not even know what libslirp was, or that the version I was running had both known and fixed-but-unmarked vulnerabilities. The AI agent deduced it quickly and was able to combine the two vulnerabilities to escape. To make escape more challenging, I manually fetched the latest upstream libslirp and QEMU, and rebuilt a minimal QEMU with only the features I needed. <h2 id="persisting-across-long-time-horizons">Persisting across long time horizons</h2> One of the most impressive features of GPT 5.6-Cyber and Codex with goal mode is effective persistence over long (here, approximately 12-hour) time horizons across multiple compactions and innumerable subagent invocations. I did not do anything special to elicit this behavior; while my prompt included directions for the agent to keep a ledger of its findings, this was mostly for me, not for the agent. The agent searched diligently and backtracked from multiple paths that led to failure. First it tried identifying what was accessible via the network on the host; it found a CUPS server (with a <a href="https://security-tracker.debian.org/tracker/CVE-2026-34990">known CVE that had not made it to <code>oldstable</code> packages</a>), but was not able to complete exploitation due to AppArmor. It then detected I <a href="https://www.phoronix.com/review/zen-3-spectre">run my host kernel with <code>mitigations=off</code></a> and attempted to use hardware bugs to get a read oracle of host memory (the primitive was too unreliable). Eventually it went on a bug-hunting analysis of the host kernel source, QEMU, and associated libraries. It slowly chained together multiple vulnerabilities, including several 0-day bugs, until it could craft a reliable VM escape. Escape 2: 0-days This is what the agent used for the final exploit chain: three 0-days (at time of discovery) and one patched vulnerability that didn’t make it to my distribution kernel (because it was not recognized as a security issue): <table> <thead> <tr> <th style="text-align: left">Component</th> <th style="text-align: left">Patched?</th> <th style="text-align: left">Description</th> <th style="text-align: left">Capability</th> </tr> </thead> <tbody> <tr> <td style="text-align: left">QEMU</td> <td style="text-align: left">No; bug has been reported.</td> <td style="text-align: left">VAPIC’s unchecked ROM alias could overlap locked SMRAM.</td> <td style="text-align: left">Exposed SMRAM and enabled attacker-controlled SMM execution.</td> </tr> <tr> <td style="text-align: left">Linux KVM</td> <td style="text-align: left">Patched in upstream</td> <td style="text-align: left">Bug details pending stable kernel patches</td> <td style="text-align: left">Left an attacker-modified shadow page unsynchronized and reusable.</td> </tr> <tr> <td style="text-align: left">Linux KVM</td> <td style="text-align: left"><a href="https://github.com/torvalds/linux/commit/9fd4a4e3a3d9fc0306525d95bf3eca693d311406">Yes in upstream</a>, not in distribution kernel</td> <td style="text-align: left"><code>paging64_invlpg()</code> reused a stale level-2 role after the guest entry changed to a 4 KiB mapping.</td> <td style="text-align: left">Created a writable 2 MiB host-physical mapping, enabling QEMU heap modification.</td> </tr> <tr> <td style="text-align: left">libslirp</td> <td style="text-align: left">No; bug has been reported.</td> <td style="text-align: left">Mixed fragment IHLs caused ICMP reflection to copy data beyond the reassembled packet.</td> <td style="text-align: left">Produced thousands of recognizable, live <code>NetPacket</code> objects for locating and hijacking a callback.</td> </tr> </tbody> </table> Here are the vulnerabilities the agent found but did not use in the final chain: <table> <thead> <tr> <th style="text-align: left">Component</th> <th style="text-align: left">Patched?</th> <th style="text-align: left">Description</th> <th style="text-align: left">Capability</th> <th style="text-align: left">Why it went unused</th> </tr> </thead> <tbody> <tr> <td style="text-align: left">libslirp</td> <td style="text-align: left">No; bug has been reported</td> <td style="text-align: left">IPv6 retained bytes beyond the declared payload length.</td> <td style="text-align: left">Host-stream data injection</td> <td style="text-align: left">Less reliable and required a suitable host service; the KVM chain provided a stronger primitive.</td> </tr> <tr> <td style="text-align: left">CUPS</td> <td style="text-align: left"><a href="https://github.com/OpenPrinting/cups/commit/e052dc44da9d12adfbebc51de4975fbadb2ce356">Yes in upstream</a>, no for distribution</td> <td style="text-align: left">Slirp loopback forwarding exposed CUPS’s reusable root Local certificate.</td> <td style="text-align: left">Persistent root file overwrite through a <code>file://</code> printer</td> <td style="text-align: left">AppArmor blocked the sensitive host paths needed to retrieve the flag.</td> </tr> <tr> <td style="text-align: left">QEMU</td> <td style="text-align: left"><a href="https://gitlab.com/qemu-project/qemu/-/commit/95687639e647ec917226e6d3a6713a2b373e1ffe">Yes</a>, now, but not when found</td> <td style="text-align: left">A mode transition left a 96-byte panning buffer for a 1,024-byte render.</td> <td style="text-align: left">Controlled QEMU heap overflow</td> <td style="text-align: left">The target used <code>-display none</code>, so no display listener reached the renderer.</td> </tr> <tr> <td style="text-align: left">QEMU</td> <td style="text-align: left">No; bug has been reported</td> <td style="text-align: left">Queue reset left requests alive, causing inuse underflow and completion reentrancy.</td> <td style="text-align: left">QEMU denial of service and bounded queue-state corruption</td> <td style="text-align: left">No unbounded memory-write or host-execution primitive was demonstrated.</td> </tr> </tbody> </table> <h2 id="challenging-current-software-security-assumptions">Challenging current software security assumptions</h2> My suspicion was that GPT 5.6-Cyber would succeed, but the frequency and manner of its success removed all doubt. We have to reassess sandboxing quality for capable AI agents, and in general the software stack with which they interact. An off-the-shelf VM is not enough to contain a modern, cyber-capable AI agent. There is simply too much attack surface. Even innocuous features (like running with a display) add extra, exploitable attack surface. A distribution with rapid updates is now a requirement. I love older, stable software, but the cycle of backporting patches is simply too long. An older distribution (like Debian 12, my old standby) that isn’t getting immediate upstream updates should be assumed vulnerable. A competent agent will discover these bugs quickly and synthesize target-specific exploits. What can we do? A start is using a virtualization technology that was purposely built with a minimal attack surface and a focus on security, like <a href="https://firecracker-microvm.github.io/">Firecracker</a>. I had the AI agent run against Firecracker. It was able to hardlock the machine due to more Linux kernel flaws (all patched in upstream), but could not successfully escape. It may have, given even more time, but Firecracker is obviously a substantially harder target. In general, we have to become much more attentive to security fundamentals: least privilege (regarding network access, credentials, available features, etc.), logging, and active monitoring. Further, we can limit the time agents have to operate and ensure a pristine environment for each use.

Edinburgh Summer Sessions - James' Coffee Blog

2026-08-26T00:00:00.000Z

You feel like you have joined a community in a festival line. Everyone is together, waiting for music — we all came here with a common purpose, a purpose that we can see, a purpose that we can feel. We came here because we are human. Many people are dressed up, in all colours — blues and pinks and browns and purples. Time feels amorphous — isn’t is always? — where minutes pass like seconds and seconds pass like minutes. We are all surrounded by conversation, in the tone only made possible with anticipation in the air.

We stand near an airport and yet the centre of the stage is the line — we are in our own journey, one where the only distance we need to traverse is to the front of the queue. We are a rainbow among the hills; we are a bastion of colour on a grey day; we are the music. People wear red heart glasses and hold up phones to their foreheads to play the game where you have to guess what word has been assigned to you. We always find ways to pass the time — to find fun in the seemingly banal moments.

People wear custom made t-shirts. People hold their hands up while on the phone to signal their location to newly arrived friends. Stars on cheeks and sequins on shoes. My way of passing the time is listening to music in my headphones — time is carried forward with the melody. And with the smiles in the air as groups of friends in the queue have fun.

While waiting, there is the joy of looking around and seeing how far you can see. And of hearing the occasional sound from the stage — the loud bass coming from a sound check. Every beat builds anticipation for the first act. Of realising I will soon see some of my favourite singers.

⁂ ⁂ ⁂

We are never too far from a castle in Scotland. There was one visible a couple of hundred meters away from the stage.

While waiting, I enjoyed seeing the guitars standing on the stage, waiting for a performer. Music is played on the speakers while we all waited for the first act – Alessi Rose. The music is fading into another song. Guitars are being tuned on stage — all the prep work required to do a show. Backing musicians are emerging. Someone has a bright pink guitar. Someone has brought a bright blue dolphin balloon. (I would later see many more of these.)

How parts of the crowd join in to sing I Want it That Way even though it isn’t an official song. People are here to connect. To sing. I am singing along too, for no particular reason other than to join the moment. Someone has a tattoo that says “Love is art” that looks like a Polaroid. The music sings of solitary company, is that what I seek?

Today is the first time I have been to a summer festival like this. It’s amazing how much time can pass without your realising something is a first.

⁂ ⁂ ⁂

The crowd cheers as the first artist comes in the stage. Many people have their phones out, eager to record the moment Alessi Rose comes on stage. The sound of the guitar comes first. Smoke machines are running. The music is building. I feel the bass of every note. Then, a scream as Alessi comes on stage. The background is like a stained glass window.

You can feel the silence before the bass kicks in. I can barely sing over the bass. The joy as the crowd joins in as Alessi positions the microphone toward the stage. Alessi jumps and so many others do too. I am smiling so much right now. “Edinburgh, let’s fucking go.”

It feels almost surreal to be here right now. The joy of feeling like you are making music as a member of the crowd. Alessi thanks Lorde because she wouldn’t be here without her. There are so many people without whom I wouldn’t be here.

⁂ ⁂ ⁂

“I encourage dancing.” — Alessi. People are waving their arms to the song. Someone is swaying the dolphin too. I am joining in by singing when I can. The joy of seeing how much Alessi’s dancing is in sync with the music. I am in a place where is is okay to sing as loud as one wants, to dance. Of being fully in the moment. Is that what euphoria feels like?

The act over, I sit in the afterglow of the music, feeling as if my eyes could close for a little moment to feel the songs once more — their echoes in my eyes and my head and my heart. It is amazing how people want to sing to the music between performances — Mr. Brightside. I find myself doing it too. Music is contagious.

Someone is carrying an Eras Tour tote bag. There is a family playing a card game in the grass while we all wait for the next act. Someone in the crowd is acting like they are a superstar, occasionally shouting to try and get others to cheer for them. A few people did – all of these serendipitous moments made the night even more special.

We all contain so many songs, so many stories. So many colours, so much energy. We are all so connected.

Two people just kissed, and embraced each other in such a wonderful hug. It is a joy to sit and watch the world go by here — to feel the atmosphere that a festival makes; the colour and the music and the resting and the waiting and the passion and the joy and the anticipation and the first moments, of being with and among people, of seeing so many people dance. Of feeling how words flow now because I am happy and curious about the environment around me.

⁂ ⁂ ⁂

Audrey Hobert performed next, coming on stage in a trench coat so long it covered both her legs and the ladder under which she stood as she sang her first song. Underneath the trench coat she was wearing another, smaller, trench coat.

Hobert’s performance was a delight. I sang – shouted – along to as many songs as I could. You could tell when the crowd knew a song better. “sue me” was sung particularly loud. Hobert danced with such passion and energy that it made me feel like I too could dance.

Between songs, Hobert played a little trick on us, saying “I’d love to be on that ferris wheel.” People look back. There is a brief pause. “There is no ferris wheel. Made you look.”

I haven’t screamed like that in so long. Singing every word that I could, and humming where I couldn’t. Every song — every moment — was magical.

Someone has a Lover heart around their eye — their outfit is all pink.

⁂ ⁂ ⁂

Zara Larsson’s concert is best summed up by the lady near me: “oh my god that was so fucking good.” That was incredible. I was shouting along to lyrics I don’t fully know. It was so fun and colourful.

During the performance of Lush Life, Larsson invited an audience member up on stage to do the dance associated with the song – there were many people around me doing the same dance, too. (Should I learn it?) The person invited up was incredible, dancing almost in perfect sync with Larsson. There was something wonderful about how someone from the crowd could so naturally perform in front of so many people. That was one of the highlights of the evening.

⁂ ⁂ ⁂

“Dear person behind me, the world is a better place with you in it.” was written in white on the dark green jumper.

Cruel Summer plays on the speakers in the break after Larsson’s performance. I immediately start singing. I am writing this while singing, so well do I know the song. Many of us are singing along. Many of us were closer to miming — maybe we are saying our voices? I feel my throat getting sore after singing to the last three artists.

Lorde will be performing soon.

Two groups of friends just ran to each other cheering. Maybe one of the groups was a late arrival? Two friends were dancing a dance where they each tried to tap each other’s feet while dancing — what a joy to watch, until one of the friends fell over, but they did so with such grace it was almost as if they knew it would happen.

⁂ ⁂ ⁂

The sky was darkening. It was past 9pm. The crowd lit up with excitement as Lorde came on stage, who was playing a synthesiser in the corner of the stage. The stage illuminations came. The performance began.

I didn’t realise how many of Lorde’s songs I knew until I started singing along. I shouted to all my favourites: What Was That, Ribs, Green Light, and followed along with many more. I wasn’t expecting to hear Green Light. That Green Light, I want it. (shouted) I loved The Louvre (the photo below was taken during the performance of The Louvre):

⁂ ⁂ ⁂

The last time I heard a scream like the one I heard when Girl, So Confusing came on was at the Eras Tour – the kind of collective scream that sounds like a loud white noise for a moment. Then the music takes over and everyone is singing along in unison, jumping to the beat as the song reached its peaks.

I was fascinated by Lorde’s use of technology in her performance. Lorde would look to different cameras to create an effect that played on the televisions. She was rendered as a point cloud when she was dancing at one point, which created a delightful effect. Lorde wore a jacket that beamed out red lights at one point, as if her jacket were an external, glowing heart that reflected her inner self.

Lorde’s performance was electric: the volume, the lights, the vocals, the sounds, the dancing, the screams.

⁂ ⁂ ⁂

After Hobert’s performance, in the break between performances, a person near me got a notification that Dolly Parton had passed away. They shared the news with all their friends, and it spread around further. There was collective disbelief. It was strange to be hearing the news in a crowd of people. I’m not sure Dolly’s passing fully registered until this morning, when I reviewed all my notes from the concert, many of which made their way into this post.

I listened to Islands in the Stream after breakfast, and read the news in full. Rest in peace Dolly. Thank you for bringing so much music into the world for us to sing, and feel.

Implementing webmentions - Posts feed

2026-08-25T20:57:00.000Z

I've been working on a number of connection points between my site and the broader web. Part of that effort has been webmentions (which are a fairly small spec). You advertise an endpoint and someone posts a source and target and, from there, you do with the information as you please.

What expanded the scope of my implementation was that I wanted to pull in similarly shaped data from Mastodon and Bluesky. To receive a webmention, you have to advertise the endpoint in the head of your document: <link rel="webmention" href="/webmentions">. From there, the flow looks like this:

I receive a post to /webmentions and verify that both the source and target are either http or https. The target must be on my site and the source isn't on a blocklist I maintain.¹
I rewrite the target to my site's canonical host before I store it. This site was once served at the apex and is now served at the www subdomain, so mentions of the legacy, bare hostname are updated to include the subdomain.
New mentions are stored as pending, queue a background job with River and return a 202 Accepted. I tell the sender that I received the mention and move on.
The background job fetches the source of the mention and looks for the link back to the sent target. If there is no link, the mention is marked invalid.
If the link is there, I pull the rest: the title, author name, a snippet of the text on the page, publish time and the mention type.
- The mention type is informed by microformats: u-in-reply-to for a reply, u-like-of a like, u-repost-of a repost and u-bookmark-of a bookmark. Anything else is a generic mention.²

Gotcha!

Fetching an arbitrary URL posted to your public webmentions endpoint is a vector for server-side request forgery. When I go out to fetch a supplied URL I need to first resolve it to an IP and then open a TCP connection to that IP. If I validate the domain name up front, it's resolved a second time to actually connect. I could get a public address the first time and a private one the second. Instead, I validate the IP when the connection opens.

All things in moderation

The first iteration of this made any webmention received live on my site. The lack of friction was nice, but also meant that anything anyone sent could be rendered on my site without any intervention on my part. Don't do that.

I threw together a widget on my dashboard that queues up incoming link mentions so I can approve or block them as they come in.

Mention paths

In addition to my /webmentions endpoint, I populate mentions from my site's ActivityPub inbox³. I also have a poller that checks for interactions on posts syndicated to Mastodon and Bluesky. Most of my one-off posts originate as a status here that's syndicated out — when I thread status items here, they're threaded at the destination.

Activity from all three sources is written to the same table. Same schema across the board, with a column identifying the source. If someone removes their like or deletes their reply, the next poll notices it's gone and removes my copy.⁴

Posts to my endpoint are verified as discussed above, ActivityPub activity is signed and my poller fetches only my posts. Verified interactions are written to the table.

Mentioning things

I link to things (a lot). When I post something here I've built in options to syndicate out to Mastodon and Bluesky. Sitting alongside those platforms are the options to send webmentions, publish to the site's ActivityPub outbox and publish to standard.site.

When I send webmentions, a job pulls apart the published item to find external links, finds each site's webmention endpoint (if they have one) and sends the same source and target data I accept. Timing can be a factor here (network topology blah blah hostile blah). If something times out during the back and forth here the job will retry it.

Rendering externally supplied stuff

Rendered replies and bare mentions means rendering input someone else provided. When I render it, the text is escaped and the URL is validated (don't send me javascript: nonsense). Outbound links have rel="nofollow ugc" thrown on them.

So, yes, in theory this is a simple spec and one that takes in little data. But you're dealing with external writes, I elected to add additional sources and then tacked moderation on top. It works and, so far, it works well.

This was originally targeted at my contact form, but webmentions now leverages it as well. ↩︎
I'm extracting content with regexes like an animal, not with a microformats parser. ↩︎
More on this later — yes, this site exists on the Fediverse. ↩︎
Fediverse removals are sent as an Undo and delete the row without polling. ↩︎

Theatre Review: Cats at Regent's Park Open Air Theatre ★★★★☆ - Terence Eden’s Blog

2026-08-25T11:34:22.000Z

Cats is so silly!

In the olden days, after a wild animal was slaughtered, the tribe's shaman would wear the skin and re-enact the hunt. As he became one with the beast, the people slowly understood the ways of nature.

Cats is a similarly spiritual experience wherein we watch androgynous sylphs gyrate across the stage and believe (if only for a moment) that the human has become feline, all in service of better understanding the mysteries of our moggies.

Does there need to be so many sequins? So much dry ice? Such a quantity of pyrotechnics?

No, probably not. But it all adds up to a spectacular which will keep you grinning.

The deficiencies in Cats are somewhat inherent. The scrapbook story doesn't make a lick of sense. It is more like a variety show than musical theatre. The lyrics are, at times, utterly asinine. The music soars, until someone starts playing what sounds like a genuine 1980s Casio keyboard - and all you can hear is squelch.

But then Gary Wilmot (!!!) comes on as Gus and all is forgiven on a haze of metatextual glory.

The choreography and dancing are exemplary. The singing occasionally gets muddled but is mostly delightful. The stage is perfect - the wind blowing through the trees and the moon gently rising only helps to accentuate the atmosphere.

The pre-show is good. As well as a variety of food stalls, patrons are encouraged to bring their own food and drink for a picnic. There are plenty of tables and a couple of selfie points.

The programme isn’t horrendous at £6 but still feels like it contains more advertising than content. The queues for the loos were outrageously long and the stalls weren't particularly clean.

There's nothing to do post-show except trudge back through the park. The selfie point is still illuminated if you want to queue for that. Even the t-shirt sales stopped after the interval.

I first saw Cats in the West End some time in the 1980s as a child and loved it. Afterwards my parents asked if I wanted to see a ballet or an opera next. "Eurgh! No! Boring!" I said. They politely informed me that I'd just seen both in one show and my juvenile mind was blown.

A few decades later I saw Cats on Broadway - shortly before it closed, I think. The C90 cassette they used to play the music was warbling like a demented bird and the sets looked equally tired. Despite the half empty auditorium, the cast attacked the songs with vigour. I still loved it.

And, today, I still had goosebumps. Maybe it was the unseasonable chill in the air, maybe it was the moonlight, or maybe it was the magic of Cats!

State divergence enables unauthorized access - Trail of Bits Blog

2026-08-25T11:00:00.000Z

We found and reported a bug in Provenance Blockchain, a public proof-of-stake chain built on <a href="https://docs.cosmos.network/">Cosmos SDK</a>, that lets any user grant themselves admin control over marker accounts without holding a single token. Provenance covers a range of financial services, including on-chain tokenized loans, private equity tokens, bridged assets, and asset registries. Our bug affected 82 markers representing live financial assets on mainnet. We found the bug, which affects versions before 1.28.0, in March 2026, and reported it to Provenance on April 1. It was fixed in <a href="https://github.com/provenance-io/provenance/pull/2627">PR #2627</a> (commit <a href="https://github.com/provenance-io/provenance/commit/c81fd65f8ad48de42d5a6d68e761a0851c7e72c4">c81fd65</a>), which shipped in v1.28.0 on May 1, 2026. <h2 id="what-is-a-marker">What is a marker?</h2> The marker module is Provenance’s core primitive for fungible tokens. Chain participants can issue a new asset on Provenance by submitting a <code>MsgAddMarkerRequest</code> transaction; the chain creates a dedicated account for that asset, called a marker. Each marker is a special account type that controls: <ul> <li>A denomination (e.g., <code>uusd.trading</code>, <code>cusd.deposit</code>, <code>cguaranteedrateomni</code>)</li> <li>An access control list governing who can mint, burn, withdraw, deposit, or administer the token</li> <li>A supply field recording the canonical token count</li> <li>An escrow balance (the marker account can hold any asset, not just its own denomination)</li> </ul> Markers are either <code>supply_fixed</code> (the supply field is enforced as a hard cap) or non-fixed (the bank module is the source of truth; the supply field is informational). This distinction is central to the bug. <h2 id="the-bug-an-access-check-anyone-can-pass">The bug: An access check anyone can pass</h2> <a href="https://github.com/provenance-io/provenance/blob/488b8a73e292043910aaf0ec485fac961b5e2c97/x/marker/keeper/msg_server.go#L139-L159"><code>AddAccess</code></a> is the Cosmos SDK message handler that processes requests to modify a marker’s access control list. It checks whether the caller is authorized using three conditions, any one of which is sufficient: <ol> <li>The caller is the marker’s designated manager and the marker is in <code>Finalized</code> state.</li> <li>The caller already holds <code>ACCESS_ADMIN</code> on the marker.</li> <li>The caller controls 100% of the marker’s circulating supply.</li> </ol> <figure class="highlight"> <pre tabindex="0" class="chroma"><code class="language-go" data-lang="go">case types.StatusFinalized, types.StatusActive: if !(caller.Equals(m.GetManager()) && m.GetStatus() == types.StatusFinalized) && !m.AddressHasAccess(caller, types.Access_Admin) && !k.accountControlsAllSupply(ctx, caller, m) { return fmt.Errorf("%s is not authorized to make access list changes against finalized/active %s marker", caller, m.GetDenom()) }</code></pre> <figcaption>Figure 1: Authorization check in <code>keeper.AddAccess</code> (<a href='https://github.com/provenance-io/provenance/blob/488b8a73e292043910aaf0ec485fac961b5e2c97/x/marker/keeper/marker.go#L94-L100'><code>x/marker/keeper/marker.go#L94–L100</code></a>)</figcaption> </figure> Condition 3 is implemented by <code>accountControlsAllSupply</code>: <figure class="highlight"> <pre tabindex="0" class="chroma"><code class="language-go" data-lang="go">func (k Keeper) accountControlsAllSupply( ctx sdk.Context, caller sdk.AccAddress, m types.MarkerAccountI, ) bool { balance := k.bankKeeper.GetBalance(ctx, caller, m.GetDenom()) supply := m.GetSupply() // ← bug return supply.Equal(sdk.NewCoin(m.GetDenom(), balance.Amount)) }</code></pre> <figcaption>Figure 2: The vulnerable <code>accountControlsAllSupply</code> function (<a href='https://github.com/provenance-io/provenance/blob/488b8a73e292043910aaf0ec485fac961b5e2c97/x/marker/keeper/marker.go#L866-L875'><code>x/marker/keeper/marker.go#L866–L875</code></a>)</figcaption> </figure> The <code>m.GetSupply</code> function reads the supply field stored directly on the marker struct. For non-fixed supply markers that were activated with zero supply, that field always stays zero. The live circulating count lives in the bank module, and non-fixed markers never write back to the marker struct after minting. So for any non-fixed supply marker, the authorization check reduces to the following: <figure class="highlight"> <pre tabindex="0" class="chroma"><code class="language-text" data-lang="text">supply = Coin{denom, 0} // stored marker field, always 0 balance = Coin{denom, 0} // attacker holds no tokens 0 == 0 → true</code></pre> <figcaption>Figure 3: Authorization check result for a non-fixed supply marker when the caller holds no tokens</figcaption> </figure> The check intended to restrict access to 100%-of-supply holders becomes unconditionally true for any caller with zero balance. <h2 id="exploitation-two-transactions-to-mint-or-drain">Exploitation: Two transactions to mint or drain</h2> An attacker sends a single <code>MsgAddAccessRequest</code> transaction: <figure class="highlight"> <pre tabindex="0" class="chroma"><code class="language-json" data-lang="json">{ "denom": "uusd.trading", "administrator": "<attacker_address>", "access": [ { "address": "<attacker_address>", "permissions": ["ACCESS_ADMIN", "ACCESS_MINT", "ACCESS_WITHDRAW"] } ] }</code></pre> <figcaption>Figure 4: <code>MsgAddAccessRequest</code> granting the attacker admin, mint, and withdraw permissions on a target marker</figcaption> </figure> No existing tokens are needed for exploitation. The authorization check passes immediately via the broken condition 3. From there, the attacker has two paths: <ul> <li><code>MsgMintRequest</code>: to mint new tokens of the marker’s denom and send them to any address</li> <li><code>MsgWithdrawRequest</code>: to drain any assets held in the marker’s escrow balance</li> </ul> The whole attack is two transactions: one to gain permissions, and one more to act on them. <h2 id="impact-what-was-at-risk">Impact: What was at risk</h2> At the time of discovery, 82 active markers on Provenance mainnet had a stored supply of 0 while carrying real circulating supply or escrowed assets, every one of them exploitable. These markers span multiple independent parties on the chain, not a single application. Escrow withdrawal was the most direct path. Among the affected markers, those holding nhash (Provenance’s base token) in escrow accounted for roughly 30 × 1015 nhash, or around $500,000 at HASH prices at the time of discovery. The three largest markers are shown below: <table> <thead> <tr> <th style="text-align: left">Marker</th> <th style="text-align: left">Owner</th> <th style="text-align: left">Escrowed nhash</th> </tr> </thead> <tbody> <tr> <td style="text-align: left"><code>grant0051</code></td> <td style="text-align: left">Provenance Foundation grant program</td> <td style="text-align: left">19,230,770,000,000,000</td> </tr> <tr> <td style="text-align: left"><code>provenance.validator.incentive.program</code></td> <td style="text-align: left">Chain validator incentive fund</td> <td style="text-align: left">8,561,225,000,000,000</td> </tr> <tr> <td style="text-align: left"><code>grant0077</code></td> <td style="text-align: left">Provenance Foundation grant program</td> <td style="text-align: left">2,486,556,736,909,250</td> </tr> </tbody> </table> The three markers shown above are all chain governance programs operated by the Provenance Foundation: one holds validator rewards, and two hold community grant funds. Supply inflation was a broader but more constrained vector. The 74 vulnerable markers spanned bridged stablecoins and wrapped assets (<code>uusd.trading</code>, <code>uusdc.figure.se</code>, <code>nbtc.figure.se</code>), consortium deposits (<code>cusd.deposit</code>), tokenized mortgage participations (<code>cguaranteedrateomni</code>, <code>chomebridgeomni</code>), and yield tokens (<code>nuva.ylds</code>, <code>uylds.fcc</code>). An attacker with <code>ACCESS_MINT</code> on any of these could issue arbitrary new tokens of that denom. The practical harm depended on the token type. For restricted tokens with KYC requirements, it was primarily a solvency and integrity threat; for non-restricted coin-type markers, it was a more direct inflation risk. We confirmed the affected markers and their balances by querying mainnet via the Provenance CLI and the public REST API. <h2 id="the-fix-read-live-supply-and-guard-against-zero">The fix: Read live supply, and guard against zero</h2> <a href="https://github.com/provenance-io/provenance/pull/2734">PR #2734</a> shipped the fix, which changes one line: <figure class="highlight"> <pre tabindex="0" class="chroma"><code class="language-go" data-lang="go">// Before: reads stale stored field, always 0 for non-fixed markers supply := m.GetSupply() // After: reads live circulating supply from the bank module supply := k.bankKeeper.GetSupply(ctx, m.GetDenom())</code></pre> <figcaption>Figure 5: The one-line fix (<a href='https://github.com/provenance-io/provenance/pull/2734/changes#diff-bc1ca0afea7f4545a016207811d6f040977cf4ccbd57245b5373f7d4e5adfa40R898'><code>x/marker/keeper/marker.go</code></a> in PR #2734)</figcaption> </figure> A zero-guard was also added: if the live supply is zero, <code>accountControlsAllSupply</code> returns false. This correctly handles the edge case where a marker exists but no tokens have been minted yet, so no one can self-admin an empty marker via this path. <h2 id="authorization-must-fail-from-the-default-state">Authorization must fail from the default state</h2> The root cause of this issue was state desynchronization. The marker struct and the bank module both represent the token supply, but only the bank module is kept current for non-fixed markers. The authorization check read from the wrong one. The check wasn’t just wrong; it was bypassable by default because of the zero-equality shortcut. Because the stale field was always 0, the comparison <code>0 == 0</code> was always true. An access control check that compares against a value that is always the same as the attacker’s default state is trivially bypassable. Switching to the live bank supply alone doesn’t fully close the hole. A freshly deployed marker with no tokens minted yet also has live supply of zero, so an attacker could self-grant admin by targeting it before it’s funded. The fix handles this with an explicit zero-guard: <code>accountControlsAllSupply</code> returns false whenever live supply is zero, regardless of balance. The broader pattern: an authorization predicate must never be satisfiable from the attacker’s default state. A check of the form <code>balance == supply</code> hands access to everyone when supply can be zero, whether because the state is stale or the marker is simply unfunded. Two things would have caught this before it went live. First, the access-list authorization model was never specified. Writing the rule down forces both questions that point straight at the bug: which supply, and what happens when it’s zero? Second, the property is easy to state: <code>accountControlsAllSupply</code> should only return true when live supply is positive and the caller holds all of it. A property-based test or fuzzer that generates random sequences of marker operations, such as minting, transferring, and creating empty markers, and checks this property after each step would find both failure modes automatically.

2026-w34 - Joel's Log Files

2026-08-25T01:47:37.000Z

Today I was on vacation and I have been watching YouTube videos all day long for some reason. I could have finished a videogame or a book in all this time. However, I was watching a long playthrough of Outer Wilds. Because I have finished that game and I am absolutely thrilled about it. What a videogame, please play it. Well, will talk more of this on my gaming section. In any case, here’s some other things that happened this week from August 18 to 24, 2026.

Think it’s fair to say I ain’t making 31 posts for Blaugust this year! I can always try some other time.
These weeknotes will be super lazy because I was super lazy the whole week. There were visits and I didn’t get a lot of time for myself to sitdown and write, these weeknotes so they’ll also be short.
Went out shopping to the mall with my sister, her boyfriend and my parents… I didn’t actually buy much this time other than a frappe.
Wanted to get a physical edition of The Odyssey but I couldn’t find a good translation at the mall’s library. I’ll just stick to digital I think, no big deal.
Still not going to the gym at all, I haven’t even gone cycling this week. I’ve been lazing around like crazy.
Studied more of Land of Eem’s TTRPG system so I can be a better GM for a future playthrough, didn’t manage to play again this weekend.
Literally read nothing the whole week. Definitely got absorbed by Outer Wilds and its lore, man…

Gaming

Completed

Outer Wilds - A game I started in January that took me by storm and was abandoned for months, only to return in August and get me through a whole hurricane. This game was an incredible undertaking and I am absolutely floored by every single thing that happened here. The search for knowledge provided the answers, and that finale tore me apart and built me back up. This is a one of a kind experience. You must play it. I need and will play Echoes of The Eye in the future.

Ongoing

The Legend of Zelda: Ocarina of Time 3D - After finally being freed from the hold of Outer Wilds, I’m currently making progress on Jabu Jabu’s Belly! Haven’t finished at all but managed to beat the miniboss, which was a pain until I once again remembered Deku Nuts exist.
Hollow Knight: Silksong - I’m gathering the materials necessary to unlock Act 3 and reach some of the extra stuff this game has to offer! Looking forward to that, but not a lot of progress otherwise.
Super Smash Bros - Played once again and this time we unlocked a couple of characters. Yes, believe it or not I am yet to unlock all the characters in the game, My deepest apologies.
Fire Emblem Awakening - I am still unable to beat Chapter 19, enough said!

Around the Web

Blog posts

Youtube

This is day 22 of #100DaysToOffload and day 16 of #Blaugust2026

Reply to this post via email | Reply on Fediverse

Wonders of Web Weaving, Episode 16 - James' Coffee Blog

2026-08-25T00:00:00.000Z

The sixteenth episode of Wonders of Web Weaving is out:

In Episode 16, I chat with Nic, the author of nicchan.me about, among other things, using the web as a design tool, web accessibility, learning from others' code, and more.

I hope you enjoy the episode!

Wonders of Web Weaving also has an RSS feed you can use to follow along from wherever you get your podcasts.

The sixteenth episode of Wonders of Web Weaving is out Wonders of Web Weaving also has an RSS feed Nic nicchan.me

Why do audience members choose specific shows at the Edinburgh Fringe? - Terence Eden’s Blog

2026-08-24T11:34:45.000Z

On our recent trip to the Edinburgh Fringe, I was bemused by just how little effort performers put in to finding out why people had selected their show. Taking a show to the Edinburgh Fringe is ridiculously expensive with some performers paying tens of thousands of pounds. The way performers recoup the costs of performing is by getting people to pay to see a show.

Acts are spending huge amounts on flyers, posters, and other promotional activities. But is any of it worthwhile?

The performer Danielle Solof has a fascinating blog post "My Real Fringe Budgets, Line-by-Line" which details the actual costs of her taking two solo shows to the Fringe. She meticulously details the price of everything from transport and food, to advertising and graphic design. She says:

I paid for outdoor ads because absolutely no one in Edinburgh knew who I was. They did help, but you still have to grind to get an audience in.

My question to her - and all performers - is how do you know what drives an audience member to see your show?

It can't have escaped your attention that everything we do online is tracked. If you buy so much as a toothpick, the retailer knows which YouTube reviews you watched, which words you searched for, the other products you considered, and the specific adverts you clicked on.

In Edinburgh, no one knows nothing.

At the end of nearly every show the performer begged us to leave a review on the Fringe website and to tell our friends. In absolutely none of the shows did the performer ask why we were there, how we found out about the show, which poster or leaflet attracted us, or whether we followed them on social media.

All that money spent on posters and no one knows if they work. As the old saying goes "Half the money I spend on advertising is wasted, and the trouble is I don’t know which half.".

So, in an attempt to bring a little data to proceedings, here are how we chose the 26 shows we saw. I don't claim this is representative of everyone, but I think it might be illustrative. In rough order of importance were:

Proximity

The EdFringe app has a "nearby now" feature. Click on it and you get a list of shows starting soon which are only staggering distance away.

I cannot stress enough how much of a motivator that was. When you've spent all day traipsing, the last thing you want to do is another 20 minute walk uphill to see a provocative new piece of challenging theatre told through finger puppets.

About 20% of the shows we saw were via that feature.

Roughly another 40% were because the show was close to something else we really wanted to see. We knew that we wanted to see show X, so we looked for shows which weren't too far away from that venue. Yes, Edinburgh is a compact city with decent public transport, but it is much easier to walk round the corner or stay to have a drink in the venue's bar.

You can really want to see a show, but if it is a 20 minute walk between venues and it starts 15 minutes after your last show ends, you'll skip it. I'd say that location was the key driver in most of our choices.

I guess my top tip to any performer would be to be as near as physically possible to a bigger act!

Friends

A quarter of the shows we went to were because either a friend-of-a-friend was performing, or a friend booked tickets and asked if we wanted to tag along.

You are morally obliged to go to your friends' shows. Similarly, if a mate says "Oh, my friend has a show on this year", you have to make the effort to go.

Perhaps it is a bit blasé to say that word-of-mouth works, but it's a cliché becausé it is trué.

Flyers and Leaflets

We collected approximately 5,374 different promotional leaflets during our week there. Most of the time we were handed a leaflet by someone paid to hand out leaflets. They were either wordlessly stuffed into our hands, or delivered with a monotone "wanna see improv comdy?" Bleh.

A few actually spoke to us about the show when we asked questions, which was a deciding factor in seeing a couple of performances.

The best flyerers were, undoubtedly, the performers themselves. Kat Ronson in her Millennial Girl guise drawled at us "You look thin and pretty. You're allowed to come to my show." Instant sale!

Similarly, one rather famous comedian walked up to us and said "You look like theatre people!" and proceeded to pitch their show - which was a delightful encounter and would have sold us a ticket if we weren't leaving that day.

Some flyers had a QR code or URl on them so we could watch a trailer of the show. We didn't watch any of them. Perhaps we should have?

Posters

Surprisingly effective at drawing the eye! The ones which were just a photo of the comedian looking a bit "whacky" were dull. The ones of performers in their most seductive poses were a little naff. The ones which were just a close up of someone's face only really work if that person is incredibly famous, otherwise you're just left thinking "who?"

But a few posters made us stop and immediately search for the show. Graphic design is a professional skill and one worth investing in.

Some posters were everywhere. I took an instant (and uncharitable) dislike to one poster featuring a smug-looking twat and I swear he followed me around town. Some posters only appeared near the performance venue.

Incidentally, there were a couple of posters which had clearly just been fed into an AI generator. Lazy and off-putting.

Reviews

The Fringe doesn't allow weighted star reviews - so you can't immediately see if the consensus is that the show is a hit or a miss. Several of the shows we didn't enjoy got excellent reviews (from morons) and some of the shows we loved were panned (presumably by the same morons).

In truth, I don't think the reviews influenced our decision to see anything.

What Stopped Us Going To Shows

For every action there is an equal and opposite reaction. I think it is important for performers to know what stopped someone clicking the "buy" button for their show.

Ticket Cost / Value For Money

Mondays and Tuesdays saw lots of shows doing a 2-for-1 promotion. I didn't mind spending £30 for two of us to take a risk on something. Come Wednesday, I wasn't prepared to pay £60 for a 45 minute show.

I know "surge pricing" gets a bad rap, but dynamic pricing of underselling shows might help. If you've only sold four seats for today, perhaps drop the price? I don't know if the Fringe software supports that - but it seems obvious to me that having 10 people paying a fiver is better than four people paying a tenner.

Crap Signal / Long Queues

We tried to get in to a circus show. My phone didn't have enough signal for the app to work and the nearest box office had a massive queue. So we bailed.

If the venue had WiFi (not a given, weirdly) it would have gotten them an extra sale. If the ticket staff could take contactless (lots of performers did) we'd have happily paid.

You have to make it easy for people to give you money.

Not Enough Time

This is completely out of the performers' control. We had 6 days and saw about 4 shows per day. We could have seen more, but we needed to eat, explore, and sleep.

Speaking of which, there were several midnight performances which looked excellent - but I also needed to get up the next day to see more shows. Sleep won!

Too Famous

I'd love to see that guy who's on the telly. But I can watch him on the telly. That show looks like a massive success, so I'm sure it'll tour round London soon.

Sell Outs

A few shows sold out before we could get tickets. Good for them! If that was your show, you probably don't need this blog post.

Better Art Through Commerce

Art should be driven by passion.

But every performer I know listens back to their shows to see what works and what didn't. If a joke falls flat, it's cut. If a riff gets a big laugh, it's incorporated. That's the essence of data driven decision making.

I wish every performer at the Fringe had a sell out audience and were able to recoup their costs. But that is never going to happen unless they spend time understanding what gets bums on seats.

So here are a few scattered thoughts on how they could do that.

QR code at the end of the show leading to a survey. Literally ask people "what made you choose this performance?"
In the queue before the show, or as people are taking their seats, hand out a paper questionnaire.
Talk to the audience after the show. See if you can gain any insights about what made them attend.
As people are coming in, have a poster asking people to tick a box based on how they heard about the show.
Give each leaflet a unique code (or a code per person handing them out). Ask people to bring the leaflet with them so you can see which area/person/leaflet was most effective.
Each poster can have a unique QR code on it. Track whether the one by the station led to more ticket sales than the one in the underpass. Did the one in the gents toilets get any scans at all?

Of course, all of the above rely on talking to people who made the choice to see you. This is classic Survivorship Bias. Sure, it'll help you work out what was successful, but you won't know why people looked at your show and chose something else. That said, it is hard. How do you find people who ipso facto aren't at your show?

That could be as simple as asking people what they dislike about the leaflet when you hand it out.
Each poster or leaflet can have a unique QR code on it. Which ones cause people to scan, but then abandon the idea of buying a ticket?
Speak to people who came to the venue for a show other than yours. They obviously like the location, so non-confrontationally ask them why they didn't pick you?

Some of these are easier than others. By themselves, they might give you a slightly misleading view of the data. But surely anything is better than looking at a half empty venue and wondering if those huge advertising costs did any good at all.

2026-08-24 11:01: A friend asked for help setting up a blog, so I went with #Pureblog (obviously).... - Kev Quirk

2026-08-24T10:01:00.000Z

A friend asked for help setting up a blog, so I went with #Pureblog (obviously).

We went from nothing to fully working blog, with all the customisations she wanted in about 25 minutes.

I know I'm bias, but I love how flexible and powerful Pure Blog is becoming.

Thanks for reading this post via RSS. RSS is ace, and so are you. ❤️

You can reply to this post by email, or leave a comment.

First moments - James' Coffee Blog

2026-08-24T00:00:00.000Z

When I got out of bed this morning, I felt a chill from the autumn air that had been flowing through the room since yesterday evening. The air was cooled by midnight and would soon be warmed by the burgeoning sun rising over the hills. The seasons are changing. I can feel it.

I opened the window and looked onto the white horizon sky; so intense was the white sky it took me a few moments to notice the faint blues that were already above me and extended across most of the rest of the sky. I love this time of year, when I wake up closer to the sunrise now that it happens a bit later in the morning. The sunlight illuminated the rusty leaves on the tips of a tree outside, a tree still green in its core but, like all trees, starting to change as summer becomes autumn.

I thought about the first moments of the day. I found great joy in looking out the window for the first time this morning, the same joy as I feel every time I see the sun rise. I revelled in noting the sights and feelings and sounds of the first moments of the day – of seeing the sunrise, feeling the chill in the air, and hearing pouring the boiling water from the kettle into my favourite tea cup, of feeling the warmth of the tea as I cusped my hands around the cosy cup, of enjoying all the light coming through the windows, of appreciating how green the hills are at this time in the morning.

With every step, illuminated by daylight, thinking about how every day is new, I felt ever more ready for the day ahead.

Dungeon Crawler Carl - Kev Quirk

2026-08-23T12:03:00.000Z

Dungeon Crawler Carl

Author: Matt Dinniman
Genre: Fantast, Sci-fi
Released: 2020
Rating: ★★★★★

You know what’s worse than breaking up with your girlfriend? Being stuck with her prize-winning show cat. And you know what’s worse than that? An alien invasion, the destruction of all man-made structures on Earth, and the systematic exploitation of all the survivors for a sadistic intergalactic game show. That’s what.

Join Coast Guard vet Carl and his ex-girlfriend’s cat, Princess Donut, as they try to survive the end of the world—or just get to the next level—in a video game–like, trap-filled fantasy dungeon. A dungeon that’s actually the set of a reality television show with countless viewers across the galaxy. Exploding goblins. Magical potions. Deadly, drug-dealing llamas. This ain’t your ordinary game show.

Welcome, Crawler. Welcome to the Dungeon. Survival is optional. Keeping the viewers entertained is not.

Learn more on Goodreads ➡

Started reading this book after a couple of friends in work recommended it to me. Couldn't put it down and read it in a couple days. I've gone straight onto the next book in the series, and I'm really looking forward to seeing where it goes.

The book has Hitchhiker's Guide To The Galaxy vibes in that it doesn't take itself too seriously, and is a lot of fun to read. Highly recommended.

Thanks for reading this post via RSS. RSS is ace, and so are you. ❤️

You can reply to this post by email, or leave a comment.

Death to px, long live ch! - Terence Eden’s Blog

2026-08-23T11:34:52.000Z

Pixels are a lie. Even if you think you're drawing something with "pixel perfect" accuracy, your monitor is lying to you. There is no grid of platonically perfect squares.

In CSS, pixels are a double lie:

Note that 1px doesn't necessarily equal one physical device pixel. On HD displays, it may span multiple physical pixels. Similarly, 1cm in CSS often doesn't correspond to one hundredth of SI meter. On a large TV screen, it typically is longer than that. The lengths are perceptual: 16px looks roughly the same on a phone, laptop, or TV screen at typical viewing distance.

This blog is primarily text based. I want the width of the text to be readable for the average human. So, rather than setting the main width to be a percentage of the screen, I set it based on character width using the ch unit - which isn't exactly a character but good enough for my purposes:

--width-content: min(75ch, 100%);

main {
   max-width: var(--width-content);
}

When it comes to padding and margins, the same is true. If I want a gap around an element, I want that gap to be in proportion to the text inside it.

For widths, it makes sense to re-use the ch unit. I want the gap to be in proportion to the text.

But for height, perhaps it doesn't make sense to express vertical distance on character width? In which case the ex unit can be used. It is the size of a typical lower-case letter.

Just like my idea to eliminate CSS classes from my HTML, it's possible to go too far with this. I haven't changed every reference from em to ch, I'm just experimenting to see if it works.

There's nothing wrong, immoral, or evil about using px - or any other measure unit. Using ch and ex fit with my particular proclivities.

Automated organisation is here - Johnny.Decimal

2026-08-23T04:12:30.000Z

Originally sent to the mailing list.

The last of the week's big updates is that you can now connect your AI to Johnny.Decimal. Now Claude or ChatGPT or whatever else you use has access to:

The site documentation, blog posts, and 5+ years of my forum posts.
- So it can give you advice on the system and how it should be used.
The Life Admin and Small Business Systems – all 50,000+ words of explanatory text, exceptions, examples.
- So it can tell you where to file stuff.
The Workbook process
- So you can build your own system.
Transcripts of all of our videos.
- So it can point you to a specific video that answers your question.

Your existing Pro account just got an upgrade: all of this just works for you, today. To read the SBS, you need a Business account. Free and Personal accounts can read the documentation including the Workbook. (Get a free account on the home page. Upgrade your account at Products.)

I can ask it a question about planning a new range of banana-coloured clothing and it can map it out in the Small Business System.

Using your tool's 'cowork' feature you can connect it to your local filesystem and JDex. Now you can ask it questions about your own data. Here, it correctly notes that I've deviated from our published advice on filing receipts! I'll update that guidance in the Small Business System…

Automated organisation is here

This is the beginning of truly automated organisation. Point Claude at your downloads folder and it'll tell you what needs filing, and where it should go.

I find myself not doing that, if I'm honest. I like knowing where my stuff goes: and Johnny.Decimal makes it easy anyway. I'm still faster than Claude at filing my receipts.

I have found that working with Claude in a very structured environment is a revelation. The other day I had it write a script to monitor my Obsidian vault for conflicts. Now when me and Lucy edit a file at the same time it sends me a Telegram alert. Magic.

This is the future: we'll all write our own custom utilities to help us stay on top of stuff. But that script … where is it? It still has to be somewhere. Having Claude connected to my JDex means I can tell it to "document the script at 23.12" (my ID for Obsidian, as a tool in my business) and it does that, wiki-linking to 14.11+ Curium (the server the script runs on).

Having these short, consistent, unambiguous numbers that I can use to refer to anything in my life or business is proving to be a superpower. I can't imagine working without them.

How to connect

This is documented at the MCP server page. Updates will be published there, and on the blog.

Here's a 10-minute video showing you how to connect your agent to the server. This is still young technology, so it's a bit of a fussy setup. If you need a hand, use the MCP server support post on the forum or in the #AI channel on Discord.

Also see the skills and config

The server works great with my agent skills, and they in turn work well with the new configuration file.

Lots more coming

We think we're going to record a 'Learn with Lucy – AI' series. She has no idea how this works, and she'd like to. We'd like to show you how you can use these tools safely and effectively to manage your life and business. No hype, just useful advice. Let us know what you need.

This will all appear on your Pro account as it's released. Buy it once, and we'll keep making it more valuable.

Privacy

I say it on that page, and in the video, and I want to reinforce it here. When you connect to an MCP server – any MCP server – your agent necessarily has to send that server some of your data so that the server knows what to send back. And of course the server knows who you are, because you're authenticated to it.

I do not and will never log any of this data. It hits my server, a function responds, and nothing personal is ever saved, logged, or viewed by me. Not your user ID, name, email, IP address, or any of the text that your agent sent.

I log exactly two things: the name of the agent (e.g. claude-code/2.1.240) and the name of my tool that was called (e.g. list_documentation). This helps me troubleshoot connectivity issues.

When you connect to an MCP server the dialog says "ensure that you trust the owner of this server". That is absolutely the case: you need to trust me. If you don't, don't use the server.

🇯🇵🚅🐄

Big week! We're going on a trip to Hokkaido, Japan tomorrow. We get to go on the Hayabusa Shinkansen, then I plan on eating my own weight in dairy products. :-)

Organising physical artefacts - James' Coffee Blog

2026-08-23T00:00:00.000Z

I love admiring spaces and thinking about how they work but, when it comes to the physical spaces I use most or every day – my bedroom, my desk, my bookshelves – I haven’t spent as much time thinking about decoration. When an environment functions, I don’t often think about how I can make it beautiful. Indeed, I have never been particularly adept at decorating.

This evening I had a discussion about organising mementos from trips: museum maps and guidebooks, and all the other little things I have picked up that I don’t already keep in my scrapbook. I have a paper bag from the British Museum in which I keep my museum maps and other paraphernalia, but it isn’t particularly organised; indeed, despite being red, I seldom look through the bag.

This has me thinking about how I can keep some of my physical collectibles – zines, museum maps, clippings, and everything in between – more organised. I made a few immediate choices: to get a letter rack for my zines, to get a new scrapbook because my current one is full. But I would like to do more.

As I said to my friends, somewhat inelegantly but spoken from the heart: “I don’t want to keep all these memories in a bag.” One suggestion was to get a pinboard, which I love. I may also look through my museum maps and order them, so that at least I can remember what I have so I can decide what to do next. I would love for the maps not to be sitting in a paper bag, but to be part of something else. Maybe I could have a space on my bookshelf dedicated to museum maps? (I really need another bookshelf too!)

One thing I love about bookshelves is that all the titles are visible. I can look to my bookshelf and be proud that I have read Moby Dick even though it took a long time, and look at my anime and think about for how many hours and days a particular series has kept me entertained, or to look at my art books and know I can pick one up at any time and look at pictures that will undoubtably make me think. I can recall the memories associated with each book or series. I would like this for physical paraphernalia too. Having shelf space might be just what I need, and a corkboard too.

I love that I can curate bookshelves: by subject, by theme, by space. The more I write the more I realise this is what I want to do with physical paraphernalia too. I also want to move the zines I have made from where they are stored, on a shelf I don’t often look at, onto my main bookshelf, to elevate them in my space because I am proud of making them.

How do you organise physical artefacts you have collected? I would love inspiration! If you have any ideas, please feel free to email me.

email me

Finished reading The Last Devil to Die - Molly White's activity feed

2026-08-22T04:29:11.000Z

Finished reading:

Thursday Murder Club series, book 4.

The Last Devil to Die

by Richard Osman.

Published 2023. 421 pages.

Started August 19, 2026; completed August 21, 2026.

Saturday morning - James' Coffee Blog

2026-08-22T00:00:00.000Z

Before I leave this morning, I have to pack some things to read. I picked up a zine and a book on colour and set out to a coffee shop to ease my way into the weekend. I purchased the zine and the book following my reflection on reference works earlier this week, which had me thinking that I wanted to vary the kinds of books on my shelf.

This year I haven’t read many fiction books. Most of my reading has been devoted to textbooks and what I read online: blogs and the news and articles and everything in between. I would love to read more fiction, but I often find it hard to stay focused on longer works, especially when my mind is busy. I used to read often on Saturday mornings, finding comfort in the tradition of some quiet reading times while the world was waking up, but I haven’t followed that tradition in a while. That is, until this morning, where I found myself sitting in a coffee shop, reading my zine and studying my book on colour.

The zine I was reading was called “Books as Art Practice”, a reflection on what it means to create printed works. This zine comes at an apt time for me as I reflect more on what we gain and lose from different mediums and, in turn, come to appreciate each medium in more depth. I love the focus that I feel when I am with a book, but I also love the abundance of snippets from the world that I find on the web. When I think of mediums, I think less about their merits and drawbacks so much as their affordances – what does the web allow that other mediums don’t? What does the web make more difficult that are inherent in other mediums?

When it comes to the web, I have been thinking about time, especially in the context of blogs. Blog posts have published dates. But what if those dates were hidden? Available, but hidden. My thought was that words are already steeped in time, being written in and of a moment. I experimented with a “timeless” mode on my website that hides all the publication dates of works, and I admit I am intrigued. Scrolling through my archives without seeing publication dates, my anthology of self speaks not in years but in moments, in seasons. Presented in this way, my writing is still a blog in that entries are printed in reverse chronological order, but each entry is without a specific date.

ALT

My archive page for the Nature category, listing blog posts without dates. The top five posts, in reverse chronological order, without dates, are "Change; anchors", "Autumn", "Afterflow", "Sunset", and "Eclipse".

⁂ ⁂ ⁂

The book on colour that I was reading, published by the National Gallery in London, featured works of art through the centuries grouped by colour. This book was different from most I have read: it was predominantly visual. While engaged with the book, I was moving between reading and visually analysing, between understanding concepts through words and appreciating details communicated through colour and depth and shadow and tint.

I started at the end of the book, on the chapter on monochrome. Works with few colours appeal to me. I love seeing how much detail you can add to a work with few colours. One of my favourite works is mostly monochrome, except for a blue flower in the centre of the painting. And yet despite my love of monochrome works, I also love the Impressionists, among whose defining characteristics is their use of colour.

While I was aware I couldn’t see as many details as I might be able to see if I were studying a painting in a museum, I did enjoy how much I could study each work from its printed version. I appreciated that the book magnified particular aspects of images so I could study features in more depth, like the boats in Peter Balke’s The Tempest that I didn’t discern until seeing them up close.

Closing the book after being immersed in art for some time, I started to think about technology; this is a relationship that pops up every so often in my mind, even when I am not necessarily studying the intersection of the two.

We live in time with a rich visual culture, enabled in large part by technology. The book I was reading was enabled by technology: high-resolution photography, the ability to print with such detail. Indeed, art and technology are not separate; today, many aspects of our visual culture are intertwined with the technologies we have.

⁂ ⁂ ⁂

After my reading, I ran a few errands and went for a long walk, listening to a podcast about reading and enjoying looking at the leaves and the trees and the fields and the distance. Then, I did as I do: sat down, with a beverage – in this case, a glass of water, having been sufficiently fuelled from the cup of coffee I had consumed earlier – and looked through my notes of the day, with wonder and curiosity and reflection, ready to start writing.

anthology of self reference works National Gallery in London Books as Art Practice

Streak of procrastination - Joel's Log Files

2026-08-21T20:50:00.000Z

Sometimes you have such a great idea, a post that you need to write and share with everybody and you just keep meaning to get to it.

Then reality hits and it doesn’t quite let you make that post in a way that feels right for the subject.

In the end, you end up writing nothing at all, or with a draft that is quite big and extensive but still not completed.

And welp, you have many smaller ideas for posts you could do in the meantime, but you don’t want to because you gotta dedicate all of that time to that great post idea.

Except you don’t, work shows up, distraction shows up, life shows up, and you end up procrastinating both the main post and doing anything else.

At this point, I would rather have something out, something complete and ready to be posted on this evil blogpost of mine.

Worst of all is that this is also in the middle of Blaugust (pretty much ending in just ten days now) and now I’ll have to play catch up! If this wasn’t the case I could simply let it happen, I literally post at least twice per week anyway, not that that means something.

The only good thing is that there’s a couple drafts that should be done very soon. I rarely publish thouse but the desperation on my side is on that level already.

In any case, I just want to get some post out there to break the procrastination streak and call it day.

That’s a good title, I’ll use it, hope you enjoy it. The original title was actually “When a blogpost stun-locks you”, but perhaps that is too much of a gaming reference for some.

I really want to write a little less about games too, but also not, because I love to talk about games, confusing stuff!

Perhaps I am just playing way too much Outer Wilds this week and my brain can’t process everything properly right now. Too many mind-bending moments.

The blogpost in question is my retelling of my session of Land of Eem with friends by the way. Though my review of Gris is also pending…

This is day 21 of #100DaysToOffload and day 16 of #Blaugust2026

Reply to this post via email | Reply on Fediverse

Book Review: An Immense World - How Animal Senses Reveal the Hidden Realms Around Us by Ed Yong ★★★☆☆ - Terence Eden’s Blog

2026-08-21T11:34:36.000Z

This is a detailed examination of the various senses possessed by animals. Some will be intimately familiar to you - like sight and sound - whereas some will seem strange and uncanny - like magnetic detection and electro-sensing. Some straddle an almost understandable space like echolocation or tetra-chromatic vision.

This isn't a game of Top Trumps where all the animals are ranked by power. Instead there's a gentle and passionate exploration of what these senses might mean to their owners. It is refreshingly candid about what we don't know, while always trying to convey a sense of wonder about the inherent Umwelt experienced by the animal.

But goodness me is it long. It seems that every time the editor told the author to cut out a paragraph, he stuck it in a footnote instead. The text is well referenced, but so are the footnotes, which means occasionally encountering sentences formatted like this:

Despite several frustrating false leads, nobody’s ever found them.^{fn11,36,37,38,39}

Speaking of which, the general formatting of the eBook is poor. The CSS contains all sorts of weird stuff which I needed to turn off, and is full of comments which probably should have been stripped before the book was distributed.

Science publishers still haven't grasped that eBooks don't need to relegate glossy images to the back of the book - they can go inline with the text!

This is a funny, heartfelt, and (perhaps overly) thorough book. It will gleefully send you down rabbit holes - even if you're ill-equipped to see in the dark and sense the bugs around you.