Shellsharks Blogroll - BlogFlock

Proposed Events for Meetable - Articles by Aaron Parecki

2026-10-14T17:06:31.000Z

Meetable can now replace your Doodle polls! Meetable, my open source event listing website, now lets you propose an event with several possible dates/times. People vote on which one works for them, and the organizer can choose the best date from the votes later.

Up until now, every event in Meetable needed a date before it could be created. That works fine when the date is already known, but a lot of events start out as "we should do this, when can everyone make it?" That part of the planning had to happen somewhere else, in a poll or a chat thread, and then someone would create the event on the calendar once the date was decided. In the meantime, nobody browsing the calendar would know the event was being planned at all.

I was a little unsure of how best to add this since almost everything in Meetable is built around the event date. The home page sorts by it, the ics feeds need it, and even the permalink of the event is made from it. I also didn't want the calendar to end up full of events that are "maybe" happening, mixed in with events that are actually scheduled. So the goal was to support this without the proposals getting in the way of the regular calendar.

Here's how it works:

Proposed events are off by default, and can be turned on in the site settings.
Anyone who can create events can also propose one. There is a new "Propose an Event" option in the "Add Event" menu.
It's the same form as creating a regular event, except instead of a date, you enter at least two possible dates. Times are optional, and you can give a date an end date to propose a multi-day event.
Proposed events don't appear in the main event list, ics feeds, Discord notifications or search. Instead they're listed on a new "Proposed Events" page in the navigation, and there is a banner on the home page when any events are looking for a date.
Anyone who is logged in can vote "Yes", "If need be" or "No" on each date. Votes are saved as soon as you click, and the profile photos of everyone who voted are shown with each answer so you can see who can make which date.
The date with the most "yes" votes is marked as "Leading". (Ties are broken by the most "if need be" votes, then the fewest "no" votes.)
When it's time to decide, anyone who can edit the event clicks "Schedule this date" next to one of the options. The event gets that date, shows up on the calendar at its normal permalink, and voting closes.
The old proposed event URL redirects to the new permalink so that any links shared during the vote keep working.
The poll is kept on the event page after the date is chosen, collapsed under a note like "The date was chosen from 4 proposed dates", so you can see how the decision was made.
If you ask for a Zoom meeting when proposing the event, the meeting is scheduled once the date is chosen, since there is no time to schedule it for until then.
If you edit the proposed dates later, votes are kept for the dates that didn't change. Removing or changing a date removes its votes, since those votes were for a different date.

There is currently no deadline for voting and no reminder sent to the organizer, so a proposed event will sit there until someone chooses a date or deletes it. I'd like to see how this gets used before adding anything more to it, so if a voting deadline or something like that would be useful for your community, let me know.

Hopefully this makes it easier to get events on the calendar earlier in the planning process! You can install your own copy of Meetable from the source code on GitHub.

Argentina's top news app was made by two 23 year olds using AI - Werd I/O

2026-10-14T17:05:34.000Z

Link: Two 23-year-olds used AI to create a daily audio briefing. It’s now the top news app in Argentina., by Hanaa' Tameez in Nieman Lab

I think there are several notable things about this story.

The first, most obvious one is that two 23 year olds were able to create a news app that rose to become the top-ranked news app in their country, using AI. There is no way they would have been able to build this with the time, team, and resources at their disposal otherwise. From an engagement perspective, this is a bona-fide AI-in-journalism-distribution success story.

The second is that it’s not a success story for incumbent newsrooms. Clearly, a short, personalized news briefing is something people wanted; every existing newsroom could have built it, at least using their own content, but they didn’t. The gap they left meant that two newcomers could come in with very few resources and gain an audience off the back of existing journalists’ work. The app credits stories in audio and leaves citations in the chat, but my guess is that most people aren’t looking at their screens as they listen to their audio briefing. Very few people will click through; I think these listens won’t translate to pageviews or subscriptions.

The third is that outsiders are clearly much more free to build experiments than existing newsrooms. The latter have the weight of their brands and existing revenue operations to consider. Most outsiders have none of that: nobody expects anything from them, so they’re free to experiment. Most experiments will fail, but some may succeed. Left alone, this represents intermediation that could undermine the connection between newsrooms and their communities. But there’s an opportunity to partner more deeply and represent newsroom needs in the app. And then consider how they can foster an ecosystem with more experimentation, not less.

Why is Pure Blog so ugly? - Kev Quirk

2026-10-14T17:03:00.000Z

Someone emailed recently to tell me that they like the idea of Pure Blog, but they thought the admin interface was "really ugly" so they can't use it. Fair enough - beauty is in the eye of the beholder and all that, but I don't think that was a fair evaluation of Pure Blog's admin UI.

When I built Pure Blog, I wanted it to be different from the rest of the crowd. The whole point of it was to have just enough features, and no fluff. So to me a more brutalist/utilitarian UI made sense.

The likes of Grav, WordPress, Ghost, and Bludit all have similar interfaces. White and grey with blues, purples, and greens. Rounded corners etc. All very iOS-ish. All very...safe. I wanted Pure Blog to stand out from the crowd and have its own identity, and honestly, I'm thrilled with the results.

Pssst. If you haven't tried Pure Blog yet, check out the demo site.

But what I like may not be what you like, which is why I built Pure Blog to be very customisable from the start. You can change the fonts from mono, to sans, or serif with the click of a button, or you can change the look of the entire UI if you know some CSS.

And this is what I said to the person who emailed me saying it was ugly. But they came back with...

Great. Do you have any examples?

I didn't! So I decided to create some examples and show them here so you can see just how customisable Pure Blog really is. I know other CMSs can customise their UI too, but unlike them, Pure Blog needs no plugins, hacks, or bullshit. This can all be done with standard Pure Blog right out of the box.

So here are some examples of the Pure Blog admin UI where all I've added is custom CSS within settings.

Cupertino

How about bringing a macOS / iOS vibe to your Pure Blog site?

Purely Ghost

Or maybe you like the super clean lines of the Ghost UI? Well, you can have something similar to that too if you like:

Pure Press

Are you a WordPress purist who really wants to be as faithful as possible to their design? Well guess what - you can have that too!

Windows 4 lyfe

Maybe you're a lover of anything Bill Gates touches. If so, a Windows theme might be more your thing.

How about Windows 11?

Or Windows XP?

Or if you're really old, Windows 95

Terminal FTW

Maybe all this GUI stuff isn't your jam? Do you yearn for the days of yore when the interface to a computer was terminal-only with a monochrome CRT monitor?

Well, Pure Blog can do that too:

Green – the connoisseur's terminal.

Or orange, the truly old-school terminal.

Your imagination is the limit

I think these screenshots show what Pure Blog is capable of. Your imagination really is the limit. So just because you think the default look of Pure Blog is ugly, don't fret - you can easily change it to be whatever you want it to be.

If you're interested in grabbing any of these themes for your Pure Blog installation, all the CSS is available over on the docs site.

Thanks for reading this post via RSS. RSS is ace, and so are you. ❤️

You can reply to this post by email, or leave a comment.

Now (October 2026) - Robb Knight • Posts • Atom Feed

2026-10-14T11:36:06.000Z

Doing...

I hand-delivered the final drawing for St Jude this morning and we're almost halfway through Inktober — I am furious to confirm that practicing actually works and does indeed improve your skills. Some of the art I've done in the past month I'm properly proud of. Jim loved his so much, he framed it.

The Knightlings have been ill on and off for the past month while the weather can't make it's mind up. We've had a couple of hospital visits as well — one for scary breathing-related things and one because Baby Knight the first is clumsy af and had to have her head glued back together.

A few weeks later, the same nurse who did the aforementioned gluing also fixed my finger when I sliced it open sideways with a Stanley knife^[1]. Can't imagine why my children are so clumsy, could come from anywhere.

Eagle-eyed people might have noticed I added a single illustration to the home page of some hats. I have some more I'm going to add in the next few weeks.

Making...

Shotbox is the third utility along with Doodle Scan and Favicons To Go in my little webapp trilogy.

I've not made much progress with the self-hosted version of EchoFeed but I do have a solid plan so that should be happening soon. I want to make it as easy as possible to self-host it.

I've made a minimal (~10 lines of CSS, !10 lines of JS) image gallery using the dialog element to showcase the St Jude drawings once they arrive with everyone who donated.

Listening...

Still going through Connor Price's back catalog including the tracks he's done with Nic D
Czarface Meets Frankie Pulitzer. Frankie Pulitzer is Tom Hardy, which was news to me and he goes hard.
Unshatter by Linkin Park. Emily Armstrong was such a great choice.
Ekoh, Lø Spirit & Ninth Key are dropping banger after banger in their 2000s-era Linkin Park style. I love it.

Watching...

We've been rewatching My Name is Earl and it's so wholesome. I wasn't sure if it would hold up given when it was made but it really does. It's a damn shame it never got it's final season to wrap everything up.

I'm two episodes into the new Reacher and I'm into it.

Writing with...

Pilot Prera pink, F nib with Pilot black ink. I really love writing with this pen.
Neon Pink Pentel P205

Americans: I have been informed you might know this as an exacto knife rather than the British generic trademark usage of "Stanley" ⤾

The Internet of Very Cheap Things - Terence Eden’s Blog

2026-10-14T11:34:08.000Z

Twelve years ago, I was complaining that IoT devices were too expensive. Last week I bought a colour changing Zigbee lighbulb for £4. Not a typo - less than a fiver.

While the aipocalypse is devouring RAM with its insatiable appetite, Moore's Law appears to be keeping up its end of the bargain when it comes to domestic gadgetry.

This blog posts compares today's prices with those from a little over a decade ago. Some of the changes are startling, others less so. I'm basing the prices on what a customer can easily get today from Amazon. Yes, AliExpress is cheaper - but delivery takes and age and returns are a faff. Also, I get delicious affiliate revenue when you click the links which allows me to buy more tech crap to review. Everyone's a winner!

Door / Window Sensors

I don't know how many doors and windows you have in your property - we have about fifteen, not including internal doors and cupboards. Back then a single sensor cost around £30. Today you can get Zigbee door sensors for between £15 - £30 for a pack of four!

Prices are at least quartered. Do you need a sensor on every cupboard door or drawer? It is useful to be able to check your phone to see if the toilet seat is up or down? These are reaching the price where you might as well hook them up to anything.

Lightbulbs

Hue's WiFi lightbulbs were about fifty-quid each. Again, count the number of lights you need in your home and run to your bank-manager for an overdraft!

Today, Hue Bulbs are about £16 each. That's a pretty steep drop. If you want generic Zigbee Bulbs you can expect to pay a tenner each. That's down to a fifth of the price from 2014. If you're happy buying from AliExpress, they're usually under a fiver.

Smart Electrical Sockets

It's useful to be able to remotely control a power socket. It used to be the case they'd cost £30 per plug. Nowadays smart plugs are about £7.50. These ones come with energy monitoring and will easily integrate with HomeAssistant and other smarthome controllers.

There's still a limit to the things which can be directly controlled from a socket. That said, I'm love my IoT Electric Blanket.

Bluetooth Finders

The dream is to have a magic tag stuck on everything you might lose. Back in 2014, we thought iBeacons / Eddystones would win out. Sadly that dream died and instead we're stuck with proprietary "Find My" networks from Google and Apple.

The iBeacons were about a tenner each back then. Today they're £5 - £10 each depending on the features you want. That's still not cheap enough to attach to every sock - but there's no excuse for losing your keys, wallet, bag, or spouse again.

Annoyingly they don't use an open standard, so you'll need a Google or Apple account to use them.

NFC Tags

I still prefer QR codes (free!) to NFC, but I concede they do have their uses. Their capacity and features are much the same as they were a decade ago, but prices have dropped from about 75p per tag down to about 10p-20p per tag.

At that price, it's just about cheap enough to stick them in every book you own or sew them into all your underpants. Quite why you'd want to do that is left as an exercise for the reader.

Internet Fridge

You know what, I didn't bother looking at the actual cost of an Internet Fridge all those years ago. But earlier this year I got a WiFi enabled tumble dryer. It was as cheap as all the other models and means I can shout "ALEXA! MAKE DRY!" then receive a notification from HomeAssistant when the dry is fully maked.

I hope my next fridge comes with a sensor that alerts me if the door is left open or the freezer is getting too warm. That would be handy.

The cost of an ESP32 is basically a rounding error for most large appliances, especially when bought in bulk. If it uses electricity, it is probably trivial to add WiFi and Bluetooth.

What's Next?

There's probably a realistic limit to how low prices can go while the products still remain safe and durable. For smaller items that appears to be between a fiver in bulk direct from China to about a tenner sourced from a mainstream UK supplier.

For domestic appliances, there doesn't seem to be any significant extra cost. Take a look at these heat pump tumble dryers - even the cheapest of them comes with an app.

There are a few bits of my home which haven't yet been given their own IP address - although they're mostly towards the mechanical side of things.

Locks
- There are some smart-locks for doors. I've not seen any for windows. I'm not sure how well I'd trust their security.
Opening / Closing Mechanisms
- It's a cold day, how do I get my windows to automatically close? Would involved either running wiring everywhere or constantly recharging batteries.
Drawing Curtains
- These do exist! But are mainly for blinds. Again, power requirements make this a bit more difficult.
Cooking
- I have a smart rice cooker. For everything else, I have to rely on an Alexa beep-detector to know when my kitchen needs attention.
Water Pipes
- I already have a basic leak detector and a smart meter for gas / electric. How about a smart water meter? Not sure I want to start sawing into my plumbing though!

But I Don't Want To Live In A Smarthome 😡

Literally no one is forcing you. If you don't want your TV to spy on you, it'll work just fine if you don't connect it to your WiFi.

If you like getting out of bed to make sure you switched off the downstairs lights, that option is still available to you.

There's no law which says you have to connect your solar panels to the web - but I like seeing exciting graphs each day.

I cannot pre-heat my smart toilet seat, nor can I change the bidet's water pressure from my phone. That's probably a good thing?

But I like gadgets! Sure, some of them are crappy - but I find it fun to get them working with HomeAssistant. Might they get hacked and send all my data to Arstotzka? Meh, they're all on a separate LAN and are connected to things which are unlikely to burn down my house. Might I wake up one day and find that the machine has stopped and my ability to draw my own curtains has atrophied? That's a chance I'm willing to take.

The practical advantage I get from being about to check my security cameras on my phone from the other side of the planet is worth the theoretical risks.

I wonder what other domestic gadgetry will fall prey to the irresistible lure of cheap connectivity?

Package managers have an integrity problem - Trail of Bits Blog

2026-10-14T11:00:00.000Z

I tested 25 of the most popular package managers to check whether they detect a compromised package repository injecting malicious code into legitimate packages. This code integrity problem could be solved using cryptographic hashes or signatures, but many package managers are still vulnerable to this threat. Of the 25 package managers reviewed¹, fewer than half used lockfiles that checked for tampering by default, and only two verified the integrity of every package they downloaded.

Supply-chain attacks caused by developer compromise are a common story, but imagine what happens if ongoing mitigation attempts, including work by Trail of Bits², are successful. If developers of popular packages are no longer the easiest targets, attackers will shift their focus to the next weakest link in the system: the package repositories that serve the code. The cryptographic answers to this problem are more subtle than they appear, and many implementations fall short due to deliberate design choices, resource prioritization, or the complexity of developer-friendly solutions.

One natural answer is to include a cryptographic hash of a package’s contents in a lockfile and compare hashes after downloading the package. This automatic verification was the default behavior in about half of the package managers I tested, but others required extra configuration to include or verify these hashes, used hashes in a cryptographically insecure way, or lacked hashes entirely. This is summarized in the following table.


Verifies integrity	Go, vcpkg
Verifies if lockfile is present	Bun, Bundler, Cargo, npm, pnpm, Poetry, SwiftPM, uv, Yarn
Verifies with lockfile + extra steps	Conda, Gradle, Pip, NuGet, Pub
Does not verify with lockfile or N/A	CocoaPods, Composer, Conan, cpanminus, Gem, Maven, PowerShellGet, PSResourceGet, R

Table 1: Lockfile-based security of a package manager fetching dependencies from a malicious repository, categorized by how much work it takes a developer to achieve integrity. Experimentally verified for a particular configuration. Caveats detailed below.

Another natural approach is to use signatures, avoiding the need to securely distribute a hash for every package. However, in my tests, only Go verified signatures by default; others required extra configuration, lacked verification code, or did not support signatures.


Verifies signatures	Go
Verifies with configuration	Bundler, Gem, Gradle, Maven, npm, NuGet
Missing or incomplete verification	Bun, cpanminus, Pip, pnpm, Poetry, PowerShellGet, PSResourceGet, uv, Yarn
No signatures available for verification	Cargo, CocoaPods, Composer, Conan, Conda, Pub, R, SwiftPM, vcpkg

Table 2: Signature-based security of various package managers. Also experimentally verified and subject to similar caveats.

As both tables show, I found a surprising variation in the cryptographic designs and the level of protection they provide. Despite the challenges, I also found several communities on the frontier of this integrity problem that are bringing improved designs to reality. This post explores those variations, showing where certain designs fall short, why code integrity is harder to solve than it appears, and what cryptographic designs might be adopted in the future.

Simulating malicious package repositories

Studying the cryptographic behavior of 25 package managers is quite the challenge. I wanted to minimize manual analysis, but also be 100% confident when I claim an attack from a malicious package repository is possible. To solve this problem, I built a testing harness based on Docker containers and mitmproxy that dynamically evaluates the security of package managers against a malicious server.

Figure 1: Experimental design of the test harness used to simulate malicious package repositories

The Ubuntu-based Docker images include a package manager, sample code, and optionally a lockfile. There are conflicting opinions about whether to include lockfiles in source code repositories, so I tested both configurations. The harness instructs the package manager to fetch dependencies from the repository, and the resulting network request routes through a WireGuard network to a custom mitmproxy addon.

Because the mitmproxy TLS CA is installed in the Docker image, the addon can fully manipulate the plaintext from the package repository, simulating a compromised server. I assumed any web-facing server could be compromised (e.g., Composer fetches metadata from Packagist and packages from GitHub), but backend resources, like any private signing keys, remain secure. The simulated repository embeds malicious code into the downloaded packages, and if the sample code executes the malware, the attack is successful.

I tried to keep the experimental setup reflective of real-world usage, but there are limitations. I installed the latest package manager versions, followed quickstart guides for setting up sample projects inside the container, and picked popular packages from public repositories to infect. I ran package manager commands with default flags to see if extra steps, like modifying the project manifest or running extra commands, were needed to enforce cryptographic integrity. However, I am limited to testing a single package with a single package manager version on a single platform, and the test conditions (e.g., PowerShell and CocoaPods on Ubuntu) may not represent the most common usage patterns. The setup isn’t meant to show that every developer is vulnerable to a malicious package repository, just that a developer following reasonable conventions is.

With the package managers installed and network intercept functional, one (mostly) promising observation is clear.

HTTPS is (almost) everywhere

Our harness architecture captures all network traffic, so it’s easy to test that package managers are using TLS and validating the certificates. In almost every package manager, they are.

The exception is cpanminus, the frequently recommended package manager for Perl. cpanminus uses unencrypted HTTP by default to connect to the Perl package repository, allowing any active network attacker to inject malicious code into downloaded packages. This vulnerability has been known for years, but the cpanminus developer has not switched to HTTPS, since doing so would be a breaking change to default behavior.³

Hash functions don’t always provide integrity

By using the mitmproxy addon to modify the package repository responses, I could investigate how different package managers use cryptographic hashes. Hashes are a natural way to ensure that a downloaded file has not been tampered with, but the main question is how the package manager learns the correct hash in the first place.

Microsoft’s vcpkg package manager for C and C++ libraries offers an interesting example. The package manager source code includes content hashes for thousands of dependencies. When a developer updates their library and wants to register the new content in vcpkg, they recompute the hash of their package and open a pull request against the vcpkg source code with the new hash and link to the package. When a package is downloaded by vcpkg, the hash is checked. So as long as the package manager is trusted, this approach is fully secure against a malicious package repository.⁴

Hashes in lockfiles

It is significantly more common that the package manager learns the correct hash via a lockfile. A lockfile is frequently created by a package manager, resides alongside a project’s source code, and references specific versions of dependencies needed by the project. If a developer checks a lockfile with cryptographic hashes into the source code repository, and the user’s package manager validates downloaded packages against the hashes, then the user’s dependencies perfectly match the developer’s.

This is how it works for the Bun package manager for JavaScript projects. Installing a package with bun add updates the bun.lock lockfile; committing the lockfile to Git and calling bun install on another copy of the repo verifies the hash in the lockfile against the new copy of the dependency. Similar behavior is found in npm, pnpm, and Yarn (also JavaScript package managers); uv and Poetry (Python package managers); Bundler (for Ruby); Cargo (for Rust); and SwiftPM (for Swift).

Other package managers support lockfiles, but with more steps than the standard add/restore process. Python’s Pip has experimental support for the pylock.toml format, and Conda has the optional library Conda lock. NuGet, the .NET package manager, generates a lockfile after adding the RestorePackagesWithLockFile property to the project.

Many package managers (Maven, R, PowerShellGet, PSResourceGet, and cpanminus) do not have dedicated lockfiles, and some have lockfiles (Gradle’s gradle.lockfile⁵ and Gem’s Gemfile.lock) without hashes in them.

Hashes present, but not for integrity

Surprisingly, I found a few examples where the lockfiles had a hash, but could still be compromised by a malicious server. This is not necessarily reflective of a vulnerability, since the underlying behavior is clearly documented, but it shows how there are multiple valid opinions about how lockfiles should be structured and consumed. Nevertheless, a user who is accustomed to the behavior of one package manager may be surprised by that of another.

The first example is the Pub package manager for Dart and Flutter. The following excerpt of a pubspec.lock file includes a SHA-256 hash for the uuid package.

uuid:
 dependency: "direct main"
 description:
 name: uuid
 sha256: "9b129329f58692f6e6578329498a8fe9fbe98f090beb764ffbb8ee2eadd01dcd"
 url: "https://pub.dev"
 source: hosted
 version: "4.6.0"

If a user calls flutter pub get to fetch dependencies, Pub downloads the package from the pub.dev server and computes the hash of the returned binary. If there is a mismatch, Pub detects the error, but installs the package anyway.

The existing content-hash from pubspec.lock doesn't match contents for:
 * uuid-4.6.0 from "https://pub.dev"

This indicates one of:
 * The content has changed on the server since you created the pubspec.lock.
 * The pubspec.lock has been corrupted.

The content-hashes in pubspec.lock has been updated.

This is documented behavior, and requires the non-default --enforce-lockfile option to block installation⁶.

Overwriting the lockfile after a hash mismatch was also the default behavior in pnpm until version 11.4 from May 2026, when it was changed to close “supply-chain holes.” Like Pub, pnpm also supported a non-default --frozen-lockfile flag, indicating that the previous behavior which updated the lockfile was expected.

Next, here is an excerpt of a conan.lock file, used by the Conan package manager for C and C++.

"requires": [
 "zlib/1.3.1#cac0f6daea041b0ccf42934163defb20%1765284699.337"
],

This includes the package name (zlib), the version number (1.3.1), a recipe revision cac0f6daea041b0ccf42934163defb20, and a timestamp. The 128-bit revision is an MD5 hash that includes source code. However, this hash is not intended to provide cryptographic security, but rather serves as a unique identifier. When Conan installs dependencies using this lockfile, it uses the recipe revision hash to download a particular file from the ConanCenter repository, but it does not recompute the recipe hash. Even if it did, there’s a separate package revision hash for platform-specific binaries that is not in the lockfile, and MD5 collisions could allow an attacker to create two distinct recipes with different behavior but the same hash.

The CocoaPods dependency manager for Swift and Objective-C has a similar pattern. Here is part of a Podfile.lock file for a project that uses the popular Files dependency.

SPEC CHECKSUMS:
 Files: d88e31b84d65e754935053b1c584ea8e2320698a

This 160-bit checksum is the SHA-1 hash of the Files Podspec, which contains the following link to the source code. CocoaPods uses this link to fetch the Git repository.

"source": {
 "git": "https://github.com/johnsundell/files.git",
 "tag": "4.0.2"
},

So even though the lockfile can prevent tampering with the GitHub URL in the Podspec (setting aside expensive SHA-1 collision attacks), a compromised GitHub server could just serve a malicious version of the repository with the same tag.

Finally, the Composer dependency manager for PHP includes commit hashes in the composer.lock file, as in the following excerpt.

"dist": {
 "type": "zip",
 "url": "https://api.github.com/repos/guzzle/psr7/zipball/b094ded77ee97a6027ad6cf0e8c7b9f88381814c",
 "reference": "b094ded77ee97a6027ad6cf0e8c7b9f88381814c",
 "shasum": ""
},

However, even though the b094ded... commit hash uniquely identifies the code, the ZIP archive in the URL does not include the Git tree as a way to verify the hash. Once again, GitHub could serve a malicious ZIP archive without detection by Composer.

Lockfiles have many roles besides supply-chain integrity

The previous experimental results show that lockfile hashes often can be used to enforce package integrity, but this is not their sole or even original purpose. Alternatively, they can lock dependencies to a particular functionality, enable an easy way for application developers to share a consistent environment, or facilitate reproducible builds. Analyzing package manager lockfiles through the lens of supply-chain security is a recent interpretation that can be at odds with their original design. The recent change to pnpm’s --frozen-lockfile is one example.

Another example of this tension is the question of whether the lockfile should be committed to version control. Most modern guidance recommends committing the lockfile for applications, since the final build environment is fully controlled. The question is more complicated for libraries, since package managers often ignore libraries’ lockfiles to avoid locking to conflicting transitive dependencies. Committing the lockfile makes it easier to develop the library by sharing a consistent build environment with other developers, but excluding the lockfile makes it easier to catch conflicts with different dependency versions before they are found by users. Many package managers recommend committing the lockfile for libraries (e.g., npm, pnpm, Poetry, uv, and Yarn), some recommend excluding it (e.g., Bundler), and some leave it up to the developer (e.g., Cargo).

Many of these questions are explored in a recent study by Gamage et al. The authors explore lockfile design decisions for seven package managers, analyze published projects, and perform semi-structured interviews with 15 developers. They find that the practice of committing a lockfile varies by which package manager is used, and categorize five benefits to using lockfiles, as perceived by the interview subjects: build determinism, integrity, transparency into indirect dependencies, debugging, and security scanning. Some of the developers also preferred to not use lockfiles, citing a preference for end users to resolve to the latest version of a dependency, which may have more bug fixes and vulnerability patches.

The diversity of package manager designs and views surrounding the purpose of lockfiles makes it difficult to prescribe a single recommendation. With regard to supply-chain integrity, it is common, but not universal, to view lockfiles as a source of integrity that should be committed with the source code. For package managers with lockfiles that do not provide cryptographic integrity, it is worth considering whether their users share that expectation. Even when lockfile hashes can provide cryptographic integrity, locking to specific package hashes means that users do not immediately receive subsequent updates or security fixes, since the newer package has a different hash. This leads to frequent lockfile bumping to distribute the latest hashes. Wanting immediate updates is a separate concern from wanting package integrity, but the current, common approach of using hashes in lockfiles is at odds with that goal. In conclusion, lockfile hashes are often, but not always, effective at providing cryptographic integrity, but do not work in every situation.

Signatures are common; verification is not

Signatures are a natural way to address these shortcomings, but implementations frequently fall short. In theory, developers could sign every release with their own private key, and the package manager could check the signature of the package it downloads from the package repository. In fact, signatures are relatively common in different package ecosystems, but proper signature validation is surprisingly lacking. The reality of using signatures to provide code integrity is more nuanced than it seems, and package managers have different approaches to the problem.

Many package managers have no signatures available. Arguably, vcpkg does not need them, because all package hashes are distributed with the manager, but this leaves Cargo, CocoaPods, Composer, Conan, Conda, Pub, R, and SwiftPM⁷. The Conan developers are aware and previously decided not to fix it, citing several implementation challenges and suggesting organizations where integrity is critical could run their own repository server. Cargo developers are actively considering different signing designs, but this effort is still in progress. Composer developers have been implementing many new protections against supply-chain attacks, with future plans for artifact integrity.

Repository signing

One straightforward approach, known as repository signing, is when the package repository signs every package once it’s uploaded, and the repository’s public key is distributed with the package manager. This doesn’t solve the problem of a totally compromised package repository, since a malicious package repository could legitimately sign a malicious package, but it would protect against untrusted mirrors or a partial compromise of a package repository’s serving infrastructure.

Repository signatures are used by the npm Registry, the NuGet Registry, and the PAUSE server for Perl module distribution. In the npm Registry, signatures are distributed within package metadata with repository-specific public keys. NuGet Registry repository signatures are found in .signature.p7s files within the distributed ZIP package, again with repository-specific public keys. The PAUSE server takes a different approach, using its GPG key to batch sign the cryptographic hashes of several packages at a time.

Developer signing

Developer signing involves the developer maintaining the private key and signing the package before uploading it to the repository for distribution. This prevents the package repository from tampering with the contents, but it also provides a way for the package repository to authenticate the uploader.

There are two common approaches for a developer asserting their public key. In the first approach, the public key is distributed out-of-band. The Maven Central repository (used by Maven and Gradle) and the RubyGems repository (used by the gem and Bundler package managers) both support this type of developer signing. Maven Central uses PGP signatures, and developer keys are distributed by public keyservers. RubyGems uses self-signed certificates, and their distribution is left to the developers (e.g., rspec). The major difference is that developer signing is mandatory for Maven Central, and optional for RubyGems. Developer signing is rare for RubyGems, due to the lack of an established chain of trust, and a previous attempt to introduce a certificate authority failed.

The second approach involves a chain of trust. The NuGet Registry and PowerShell Gallery both support developer signatures. Neither makes signatures mandatory, but the PowerShell Gallery recommends it and the NuGet Registry has strict requirements if developer signing is used. In both, the developer’s key must chain to a trusted CA, and acquiring a valid code-signing certificate can cost hundreds of dollars per year. The benefit of this approach is that trusted root certificates can be preinstalled on the platform, allowing package managers to verify public keys.

One downside of developer signing is that developers are responsible for key management, and they can lose the ability to update their code if they lose access to their key.

Identity-based signing

An increasingly common middle ground is “identity-based” or “keyless” signing from Sigstore. Rather than require developers to manage long-term private keys, a developer can use Sigstore’s Fulcio CA to issue a fresh signing certificate on demand, for free. To prevent impersonation, the developer proves their identity with an OIDC token: a cryptographically signed statement from a third party like Google, Microsoft, or GitHub that attests to the email address, username, or potentially other claims about the developer’s identity. The verifier can check that the username is correct and the certificate chain links back to Sigstore Fulcio’s root certificate, proving that someone with access to that account created the signature.

Keyless signing is particularly useful because it can be integrated into a developer’s existing workflow-based deployment pipeline. This is frequently called provenance attestation or trusted publishing⁸. GitHub and GitLab provide OIDC tokens to Actions and CI/CD workflows that attest to the build workflow, the repository, and the commit hash. A workflow can use this token to obtain a signing certificate from Sigstore, sign the built package, and upload the signed package to the package repository. Since the signing certificate includes the commit hash and workflow details, this cryptographically links the built binary artifact to its source code.

Provenance attestation via Sigstore is supported by Python’s PyPI, the npm Registry, RubyGems repository, and Maven Central. While Sigstore attestations are not mandatory, there is already better adoption than RubyGems’ optional support for developer-managed signing keys.

Verification code is skipped, unconfigured, or nonexistent

Unfortunately, just because these signatures exist does not mean they are being verified by package managers.

In the npm package manager, the repository signatures are not checked when running npm install. Checking the signatures requires running npm audit signatures, which uses Sigstore to validate the registry public keys and then validates the signatures of the installed packages. pnpm recently added the pnpm audit signatures command, but that implementation fetches the registry public keys from the potentially malicious registry rather than verifying with Sigstore, so an adversary could simply add their own key and signature. Bun and Yarn currently lack an equivalent audit signatures command.

In the NuGet package manager, the default signatureValidationMode is accept, which installs invalidly signed packages. The user must set this to require and configure the list of trusted signers, such as with dotnet nuget trust source. These configurations (which include the repository public keys) can be securely distributed within a nuget.config configuration file, functioning as a lockfile that locks the trusted signers.

Ruby’s Gem and Bundler, and Java’s Maven and Gradle, which all use repositories with developer signatures, do not verify signatures by default. They require the user to manually add developer public keys (gem cert --add) or list the allowed public keys that should be trusted. In Maven, one can use the third-party pgpverify-maven-plugin with pgp-keys-map.list to specify the trusted PGP fingerprints. Gradle offers dependency verification, which works similarly.

Finally, several package managers seemingly lack any sort of verification code at all. Pip, uv, and Poetry do not currently have a way to verify identity-based attestations described in PEP740. cpanminus does not have a way to verify the integrity of the repository-signed CHECKSUMS file. It once did, but in response to a verification bypass vulnerability, this verification code was removed. Even though PowerShell is supported on non-Windows platforms, Authenticode signature verification is not⁹. At one point, the PowerShell repository noted that this issue “should be fixed in a future release.”

Go package management and transparency logs

Go’s built-in package manager is the only one I tested that verifies signatures by default, and it also introduces one final concept for cryptographic package integrity. When go get or go mod download fetches a package¹⁰, it hashes the package contents and compares the hash, package name, and version against the checksum database. The contents of the database are registry-signed (analogous to PGP signatures in Perl’s PAUSE server), and the default checksum database public key is hardcoded in Go’s source code. As long as the checksum database’s private key is used honestly, this design ensures that the package name and version are enough to uniquely identify the binary contents of a package. As a result, the go.mod lockfile achieves package integrity without needing to store cryptographic hashes.¹¹

Go’s checksum database is an example of a transparency log, or an immutable, global, tamper-resistant log of metadata. The same capability is provided by Sigstore’s Rekor and certificate transparency logs. In package managers, it cryptographically ensures that the package manager only ever installs the same binaries recorded by the transparency log. If everyone agrees on the transparency log, then everyone agrees on the package contents. This makes it more difficult for an adversary to selectively and undetectably target a victim with a malicious package. Transparency logs can still fail if there are other vulnerabilities, the log’s private key is compromised, or no one checks the transparency log for malicious behavior.

Of all the package managers I tested, Go performed the best at maintaining cryptographic integrity in the face of a compromised package repository or proxy. However, the registry-signature-like design means that much of the system’s trust is concentrated in a single private key.

A proposed cryptographic design for package managers

One potential approach that combines the ideas in this post is to include signature information in the lockfile. Rather than commit to the hash of a particular package, the lockfile could commit to a developer’s identity or public key. This reuses much of the infrastructure in place for lockfile hashes, but it separates the question of immediate updates from the question of package integrity.

With this design, the lockfile could specify a single dependency version (for build reproducibility) or a lower bound (for immediate updates), and the included identity ensures that a malicious repository or proxy cannot easily tamper with whatever package version the manager resolves to. In addition, a transparency log can protect against selective targeting, building on Sigstore’s identity-based signing and transparency log service. Sigstore avoids long-lived keys by default, but it also supports self-managed keys, KMS providers, and hardware tokens. This gives an easily adopted and secure default while still giving flexibility to developers who desire more control over their keys.

This idea is not new and not my own. Attestation identities are part of the pylock.toml Python lockfile specification, the trusted-keys in Gradle’s verification metadata, and the pgp-keys-map.list file in the pgpverify-maven-plugin for Maven. This is the direction that many package managers are already moving towards, as evidenced by the increasing adoption of Sigstore into publishing workflows, attention on supply-chain security, and bugfixes that specifically cite potential tampering by a malicious adversary. There is increasing recognition that this is a problem, and increasing appetite to fix it.

It won’t be easy. There are many subtle nuances that have to be considered and addressed, signing verification code needs to be developed and audited, and developers need to adopt the resulting design. In many of the package managers I reviewed as part of this project, I found communities of people who have been thinking about and pushing for cryptographic integrity and package signing for years. They know best what those package managers need, and they deserve the resources to make this a reality.

One of the greatest cryptographic success stories in the past decade has been the nearly universal adoption of HTTPS, driven in part by industry and community recognition of the security risks of unencrypted traffic, and the nonprofit Let’s Encrypt providing free and easy-to-use TLS certificates as a public good. Package signing is in a similar state now to where HTTPS was a decade ago: persistent adversaries are a huge concern, and cryptographic security is nearly nonexistent. Universal package signing is not here yet, but it is on the horizon. With the right attention and investment, we can make it a reality.

Acknowledgments

Thank you to William Woodruff for valuable discussions about lockfiles, identity signing, and the challenges of package manager security.

This post focuses on dependency managers for source code rather than system package managers like APT, Chocolatey, or Homebrew. The line between the two is blurred, but concentrating on one helps highlight particular usage and deployment patterns in that group. ↩︎
Trail of Bits has several ongoing and completed projects to improve supply-chain security in some of these package ecosystems, including helping address both account takeover threats and the cryptographic integrity problem. ↩︎
cpanminus is included in the default Docker container for Perl, but the container build scripts patch cpanminus to use HTTPS by default. ↩︎
A subtle distinction here is that vcpkg must be updated using git pull in order to fetch the latest package hashes, shifting the question from securely installing packages to securely updating the package manager. For consistency with other package managers, we do not consider this question, and we note this as a limitation of our threat model. ↩︎
Gradle can have a verification-metadata.xml file with content hashes, even though gradle.lockfile does not. ↩︎
Note that some flutter subcommands, including flutter run and flutter test, call flutter pub get by default, so these commands can also overwrite the pubspec.lock file unless called with --no-pub. ↩︎
The SwiftPM client has two main ways to download packages: via Git and via the custom Swift Package Registry Service Specification. The latter supports signatures, and the server protocol is implemented by private services such as JFrog Artifactory and AWS CodeArtifact. As far as I can find, there is no repository for the general public that implements this protocol, so I tested the signatureless Git format. ↩︎
Trusted publishing can also refer to using OIDC tokens to authenticate to a package repository, and it does not necessarily involve identity-based signing. ↩︎
Although I did not test PowerShell on Windows, the documented default ExecutionPolicy behavior is to block scripts on Windows client machines, and to require a valid signature for Windows servers. This achieves package integrity. ↩︎
Go calls these downloadable artifacts “modules,” which consist of “packages.” For the sake of consistent terminology with the rest of the post, I use “package” in the general sense, not the Go-specific one. ↩︎
The go.sum file stores hashes, but it is not a lockfile. Instead, it is a local cache for entries from the checksum database. ↩︎

2026-10-14 11:53: Out for coffee this morning with my wife, as is our Wednesday morning routine, and... - Kev Quirk

2026-10-14T10:53:00.000Z

Out for coffee this morning with my wife, as is our Wednesday morning routine, and this little guy came to sit with us.

Thanks for reading this post via RSS. RSS is ace, and so are you. ❤️

You can reply to this post by email, or leave a comment.

Meaning - James' Coffee Blog

2026-10-14T00:00:00.000Z

What does the concrete path mean to me?

In the mirrored ground I see many meanings. Here is a place I have stopped to think. Here is a place over which I have idly walked on my way to somewhere familiar or somewhere new. Here is a vein of the city, made by all those who walk through. Here is where I feel an invigorating air where I feel at home even among the rain – a place where, no matter how many times I have been here, I see something new.

⁂ ⁂ ⁂

If, in my mind, I go back to where I stood still, I see both mirrored puddles and the past and the future. I carry with me the hope that has accompanied many of my walks; the kind of hope that borders on romanticism, a kind of romanticism I like because there is energy to be had in knowing that there is a mere possibility of something new existing in places we know well. I walk on old paths while I find new ones; while I become more comfortable with the world I know. With time, I find the confidence to step somewhere new, revealing new worlds – new thoughts, new questions. I have never seen the city like this before. I can’t remember the last time I saw a tree this way. I didn’t know trees could be this colour. Or, I did, but I had forgotten.

Perhaps the reason I write so much about Nature is that to better understand Nature I need to exist with its presence over time. New shades of light and seasons and people and days reveal attributes that I had previously not noticed, like the progression of green to burgundy to orange trees on a familiar path (how amazing it is that a tree can have a colour as intense as a deep red wine) that entertained me on my last walk. The path was the same, but the surroundings had changed. I was changing, with the walk, with the seasons, with the environment whose air was chilling and in which I need to rely more on myself to make warmth.

⁂ ⁂ ⁂

I walk along treaded paths because they help me get to where I want to go; the path on which I stood frozen one day is one that has taken me to worlds of art and Nature, rooms of stories, and plazas where my mind feels clearer. I love places where I can see far, where I stand in front of an incomprehensible amount of detail and let myself live in the moment, seeing what stands out. I love looking out to hills I know well and thinking about them. Yet it was only recently that I started to ask the question “what do these hills mean to me?” I started with what I know, and I keep looking, waiting to see what I might notice.

In writing, I feel the intersection of time and knowledge. These words flow into existence as I formulate them into thoughts; as I process what I have seen and felt and think about their significance. I feel the weight of questions I cannot answer fully. What does the concrete path mean to me? I feel the weight of questions that have been with me for a long time. What’s next? If nothing else, each word gives a contour to a thought – a potential foundation for something new. In writing I feel the chance to sit with a question.

Paintings and art in galleries has a similar effect on me. In looking at a painting I know well or have never seen before, questions always come to mind, questions I may not yet be able to answer, but that I can stow away. I can imagine what a world might have been like. I can think about what the world is like as I see it. I can be with time. I can feel my limits, as well as the energy that drives me forward, fuelled by the part of me that sees something and wants to think about it more, like the concrete path with the mirrored puddles on which I walked months ago and in which I still see something.

⁂ ⁂ ⁂

What does Nature mean to me? This is one of those questions I’ll need to hold in my mind and my heart for a while. - Me, last week

Me, last week

Emio - The Smiling Man - Joel's Log Files

2026-10-13T19:00:00.000Z

After the masterpiece that is Outer Wilds, I wanted to chill for a moment, and what a better way to do so than by going through a detective story!

Famicom Detective Club is a pretty niche series by Nintendo, with only a couple games that were only on the NES—though recently remade for Nintendo Switch.

Emio The Smiling Man came out in 2024, and it brings the formula to current times!

I first heard of this game a couple of years ago in an episode of Into The Aether, brought up by Brendon Bigley, and literally this past week, now that Stephen is finally playing it as well.

I decided to give it a go during my Summer Game Challenge, and it’s finally time to write a review for it here.

Artwork of the game

Story

The game happens in Japan, and it seems to be dated somewhere in the 80s or 90s. The story begins when a high school student is found dead, wearing a paper bag with a creepy smiley face drawn on it.

You take control of a junior detective—which you get to name! Jules Poirot in my case—working for the Utsugi Detective Agency and the police to uncover the truth of this murder.

The case is linked with the urband legend of Emio, the Smiling Man—it’s the name of the videogame, wooooow!—which mentiones a creepy man wearing a paper bag who approaches young girls crying and—unless they smile when seeing him—murders them, covering their face with a paperbag with a smiley face drawn. Matching almost exactly with the event that triggered the game and investigation.

At the same time, this murder is linked with a different case that went cold eighteen years ago, involving the serial murders of girls who died by strangulation too, although there are differences that need to be accounted for. You’ll have to research from multiple perspectives to find out the truth.

Besides your character, you’ll work with Ayumi Tachibana, another junior in the agency that will go through her own investgation with a different group of characters to question. Both of you work for Shunsuke Utsugi, the private detective that runs the agency and mentors you both. He follows yet another lead in the case and seems to have a history working on the previous murders as well…

The game will switch perspectives between both junior detectives as the plot unfolds, and feature separate cutscenes and sequences that will keep you on the edge of your seat until the end!

These characters are very suprised by some newfound information!

Gameplay

It’s basically a visual novel. You can Ask/Listen, Look/Examine, Think, Call with your cellphone, check your notebook and such.

During any talk with a character, the conversation won’t simply be fed into you, you’ll have to react to things in a way that sort of makes sense, and it’s not just about mindlessly pressing talk over and over. The game provides hints of what could be done next as well.

Sometimes you’ll have to think before talking again, sometimes a character will make a nervous face and you’ll have to look at them before continuing a conversation. There are a couple simple puzzles where you’ll look at the environment to figure out what to say next, and the like.

At the end of every day, there’s a review time, where you go through all you’ve learned, fill up some blanks and check notes of your notebook to link clues together.

Although the order in which you find out clues can change slightly, the game itself is rather linear, the reviews are a nice challenge for yourself, but getting something wrong doesn’t punish you much, it only leads to a correction later on to put you in the right track.

The overall gameplay is really simplistic, but it can get confusing sometimes, when a chain of dialogue cuts off suddenly and you have to figure out what to do next. Thinking often helps a lot if you need a hint, but there are definitely situations where I was like a whole minute stuck and making no progress.

You also have the Travel option, that shows up at the end of some dialogues, or while exploring the city. Most of these actions are pretty self-explanatory and will make sense as the game goes on.

Admittedly, tha game it’s rather linear, don’t expect multiple endings and such. It’s a mystery slowly revealing itself to you and it’s very much worth it!

Characters in the game are quite relatable

Art

This game is absolutely beautiful, as long as you are okay with the anime artstyle. It is easy on the eyes, minimal in interface and features plenty of high quality animation as well, such as mouth movements, expressions, hand gestures and the like. This is not your regular visual novel or JRPG with drawings being swapped around. Blinking, changes in posture, there are details everywhere. It kinda feels like they are rigged characters, like some VTuber streamers and YouTube channels. Looks fantastic.

The backgrounds are also very well crafted, with a great amount of detail and many descriptions for you to find using the Look action. There are city streets, forests, the police station, and plenty of other environments, some of them featuring multiple NPCs in the background that have some small animations as well.

This is the kind of stuff that a big company like Nintendo can do within a genre often lead by indie developers and small budgets. The budget doesn’t reach the heights of a Mario or a Zelda at all, but it’s clearly superior to what most visual novels would get, and it really shows in the presentation here.

Is this an accurate description, teachers who read this?

Music & Sound

The soundtrack of this game is fitting of the occassion, it has a nostalgic 80s vibe that makes me think of the origins of this series back in the Famicom, exclusively for Japan. The main theme already sets the mood of the whole thing, but it’s not all there is to it!

It will get tense and emotional, as well as happy, carefree and even comical! The game is not afraid to jump between high stakes moments and comedic relief, and this is perfectly showcased on its soundtrack!

Emio also features fully voiced lines in Japanese. This is absolutely wonderful stuff. Even though I don’t understand the language itself, the emotional expressions and tone is easy to pick up from the excellent performances, and they really enhance every scene during revelations and the like.

If I could speak Japanese this investigation would be even easier!

Overall

Something I really appreciate about this game is how well it manages the tone of its story. There are really gruesome implications and dark moments here, some stuff that I would have never thought Nintendo would even publish, but this game does handle things well.

There are also quite a few fun moments, the game is not afraid to play with your assumptions and use them for comedic relief. There are also a couple genuinely charming moments between the characters. The dialogue is quite fun and easy to go through (as long as you don’t get stuck in a dialogue trying to figure out what’s next!) and the writing of the whole thing is really marvelous, drip-feeding you information in the best of ways.

The final chapters and the build up of the big reveal is genuinely fantastic, and I really think it makes every little nitpick worth it! However, it did feel a bit rushed, and some things are not explained after the credits rolled, so make sure you stick until the end to see that side of things. Definitely worth it in my opinion.

At the end of the day, this is still a visual novel. If you don’t want to basically read and read and click on things, this game will not be for you.

If you want multiple pathways and different endings, this is also not the game you’re looking for.

However, if you are up for an excellent murder mystery story to read through and find out clues before the game gives them to you, this is genuinely fantastic stuff.

The readers who reached the end of this review be like:

This is day 50 of #100DaysToOffload

Reply to this post via email | Reply on Fediverse

Young people trust AI more than the people in their lives. - Werd I/O

2026-10-13T18:28:49.000Z

Link: Young People and the Future of Free Expression, by the Knight Foundation

Worth paying attention to:

“New Knight Foundation-Ipsos research among young adults and high school students points to a generation that strongly values free speech as a democratic principle, but is less confident about exercising it without consequences.”

Workplaces and classrooms feel the least free, but it’s good to hear that home is generally a space where they feel more free.

What’s surprising, and a bit worrying, is that AI chatbots are also one of the spaces where they feel free — and, in fact, 48% of high school aged respondents that used AI chatbots said they felt more free to speak to them than the people in their lives. Those conversations might feel like intimate spaces, private to them; in reality, they may be available to their vendors for analysis and even training. People from low income backgrounds felt this more than most. Young people worry about conflict: they hold back because of peer censorship and the fear of being judged. The perception is that the AI won’t judge them. In a world where chatbots have been linked to self-harm and suicide in young people, that’s quite dangerous.

The other findings here dovetail together to paint a pretty bleak picture. White and wealthier people feel more able to exercise their freedom of speech without consequence, and that number plummets to just 28% of Black respondents. Only around a half of college aged respondents felt like other democratic rights like voting were secure.

So we find ourselves in a world where people don’t feel free to express themselves — except to AI chatbots that happen to be produced by some of the tech companies who have directly contributed to this underlying authoritarianism. It’s obvious how those conversations could be compromised, and there are certainly betrayals to come — but more than that, it’s just sad that young people don’t feel they can speak and share with each other.

I'm thinking about making some changes - Cool As Heck

2026-10-13T12:55:34.000Z

In recent months, the cost of running DMV.community has increased. At the same time, donations have been decreasing.

To be fully transparent, there have been times where I've considered shutting it down. I've been experimenting with running a GoToSocial instance from my home server, just in case. I've been running more things from my home server in general anyway. I recently started up a BBS/forum at https://bbs.snakepit.us, if anyone is interested in joining.

I'm not sure what I'm going to do yet, just wanted to put it out there in the interest of honesty and transparency.

Book Review: The Thousand Deaths of Romeo and Juliet - Caroline Finch ★★★★★ - Terence Eden’s Blog

2026-10-13T11:34:37.000Z

The thing about Romeo and Juliet is that it is a true story. It isn't literally true, but it is literary true. We see the same motif repeated throughout all cultures and all times. Caroline Lea (writing as Caroline Finch) asks an important question - what if every pair of star-cross'd lovers were reincarnations of the original Verona duo?

The essence of tragedy is that the end is unavoidable. You've probably watched Romeo sup poison a hundred times. It is inevitable that Juliet will take her own life in response. Horrific! Yet, not only do you refuse to look away, you gleefully seek it out for another viewing. There's a reason why Tony and Maria cannot escape their destinies in West Side Story - something more than fate is pushing them onto a path that will accept no deviation. The only way through is, of course, death.

The Thousand Deaths starts slowly - the first "act" felt like an excuse to retell the classic tale in a new setting. Nothing wrong with that, of course, and it is suffused with lovely writing - but it felt a bit "so what?"

And then they die.

As the acts progress and they get closer to the their thousandth death the pace picks up. The writing is absolutely gorgeous, packed with allusions and references for the careful reader (more on that later). The story is heartbreaking - as well you know - and the author has the perfect knack of keeping her characters on just the right side of histrionics.

I'd sort of classify this as almost romantasy. There's an undercurrent of sci-fi and fantasy which can't be ignored - but you can also hear the stirring of the violins in the background. Our hero and heroine come together and are violently broken apart for our insatiable entertainment. Do we care about whether that's good for them? What does it feel like to be a Mercutio forever used as a pawn-sacrifice? Does Tybalt resent his forcible reincarnation into a perpetual baddie? Are we culpable for insisting that they strut upon an endless stage just so we can wipe tears from our eyes?

The book builds to a fine crescendo. It is heartfelt and utterly tragic. The ending will, I suspect, divide people. I found it mostly satisfactory and completely in keeping with the rest of the story.

One final thing - the end notes are superb. They go through all the references you might have missed, explain where certain phrases came from, and point the curious reader to the books which were an inspiration. Too many authors treat their literary allusions as a precious puzzle and jealously guard them. I'm delighted that Caroline Finch is generous enough to share her secrets with us.

Many thanks to NetGalley for the review copy. The book will be released in 2027 - I strongly recommend putting it on your pre-order list.

Wonders of Web Weaving, Episode 23 - James' Coffee Blog

2026-10-13T00:00:00.000Z

The twenty-third episode of Wonders of Web Weaving is out:

In Episode 23, I chat with Ben, the author of werd.io about, among other things, connection on the indie web, community building, growing the indie web, and more.

I hope you enjoy the episode!

Wonders of Web Weaving also has an RSS feed you can use to follow along from wherever you get your podcasts.

The twenty-third episode of Wonders of Web Weaving is out Wonders of Web Weaving also has an RSS feed Ben werd.io

Cycling, Jigsaws and Ice - W41 - Joel's Log Files

2026-10-12T23:00:00.000Z

Another week of October is gone, just like that. The coldness of the air is finally felt enough for me to wear a long-sleeved shirt every once in a while, I am yet to actually keep a jacket on for a whole day honestly!

🗓️ I made a plan! Detailing the videogames and books I want to complete by the end of October (plus one week of November). So far very good, a book finished, a game started.
📚 Updated the firmware of my XTEINK X4 to the latest version of CrossPoint 1.6.5. There have been plenty of changes that I am yet to actually explore! In any case, it’s pretty cool to see the support for even more devices since then.
🕹️ Decided to buy Astral Ascent for Nintendo Switch, I’ve wanted to have a fast-paced 2-player roguelike for those times I want something challenging for a friend and I. We didn’t get around to playing it this time though.
🎮 Realized that Steam finally let’s me gift games outside my region! I’ve been meaning to gift my favorite games to my online friends sometimes, and it wouldn’t work. Now they let you pay the international price (just like GOG has done for ages). I already made use of this feature for a few of my buddies based on their wishlists. Are you one of the lucky ones?
🛍️ Had a fun time going out for lunch with my parents. This was a more normal visit to the mall. We also went to the library there but nothing caught my eye this time around. I also got a Rice Krispies Treat bar which I hadn’t eaten in ages. So good.
🚲 Finally went out on my bicycle after a bunch of lazyness, the day was cloudy and the air was fresh, I still only wore shorts and a t-shirt though. I went downtown and enjoyed the scenery quite a bit!
📖 I actually stayed in the plaza downtown and read a book sitting on a bench under a treeright in front of the city’s cathedral. The weather got very cold while I read some of the latter chapters of The Left Hand of Darkness, an atmosphere that fit the narrative perfectly.
🙏 This note deals with loss of life
My church visited the hospital to give food, coffee or water to people there. During this, a family outside got news of a patient, a loved one, which passed away. It was a sad and difficult moment, my church gathered around them, we prayed, and cried with them. Hope and solidarity among the suffering.

A bar of Rice Krispies Treats, a panel from Alita Battle Angel, my Kobo and my bicycle in the background, some coffee and sweet bread, art from Echoes of the Eye, a puzzle!

Reading

A magazine, two books and a manga this time around. Some great speculative fiction, cyberpunk, horror and the like.

Started

Clarkesworld Magazine #212 - I decided to return to my XTEINK X4 and start this at last! I managed to complete the first short story: Fishy by Alice Towey. I absolutely fell in love with that short story, it was very charming and it brought me joy.

Completed

The Left Hand of Darkness - Chapters 8-20. In just about a week I managed to bring this book to completion! It only got better as the chapters went on. The world grew on me, the characters, the dire situation, a sense of understanding that deepened over time, similarly to the plot of the book and the development of the characters. This was a very interesting read, and I’m glad I gave it a go at last!

Ongoing

The House on the Borderland - Chapters 13-14. I only did a few pages of this book, but they were extremely powerful stuff. It was one of those moments in the story that barely contain any detail, as the understanding of what’s in front of you is null. Pages and incomplete fragments, frightening stuff. Looking forward to what’s next.

Alita Battle Angel - Chapters 45-48. The final volume of the manga has begun, and some more battles are still on the horizon. I have to say I am quite hyped to bring an end to this. A lof of the cyberpunk aesthethic can be seen in this work, although the story was a little mixed, it reached great highs nonetheless. We’ll see if it sticks the landing.

Watching

A movie and a TV show, both of pretty entertaining!

Bumblebee - I thought I had seen this movie before but it’s not on my Letterboxd… In any case, I really enjoyed this Transformers film, the original designs of these characters are just so awesome to see! This kinda feels like a strong edition of E.T./The Iron Giant and I love it.

Lanterns - Watched chapter 5 of this one which seems to have ended an “arc” or big bad guy and I’m curious to see how the show progresses after the very interesting events that happened at the end of this one.

Gaming

A puzzle game completed, a new mystery begins, and some classic multiplayer fun.

Started

Outer Wilds: Echoes of the Eye - The first game on my October plan. My breath was taken away the moment I ventured into this adventure within the main game… I have to say I am extremely surprised by where this DLC is going. I will not make any more spoilers. Just play Outer Wilds

Completed

Strange Jigsaws - I got this on a whim a while back and decided I’d finally give it a shot. It absolutely hooked me and I got it beat in a single day. This is a mind-wrecking title and you really owe it to yourself to give it a go. I definitely had to search a couple hints on the website though, I admit. Superb concepts.

Ongoing

Nintendo Switch Sports - I continue to get decent at Golf but I also played with friends locally this time! Fun times.

Ultimate Chicken Horse - Returned to this epic game and it continues to surprise us, we unlocked a whole new map to play through, and the Fox character! There’s only two maps left to unlock.

Kirby and the Forgotten Land - Played this one for a little while again, I completed one level and then I was asked to put another game, some day!

Around the Web

I’m doing better! I had covid. by Hollie - This was a very interesting summary of what Hollie has been going through lately. COVID is still a danger, and shouldn’t be dismissed.
Laptop Stickers: Yay Or Nay? by Wouter Groeneveld - I have stickers on my laptop and I’m actually surprised I’ve not written about it.
Más cacharros que me gustaría probar by Adrian Perales - In Spanish. A post from Adrian sharing some neat tech he doesn’t have. I want him to have some of these though, what to do?
My Hobby Is Learning by Kev Quirk - This is what I enjoy as well, very well put here.
Here Is a Person: Enter the Tildeverse by Brennan Kenneth Brown - I really love Tildes, and this run down some of their history was very epic to go through.
Outer Wilds (2019) by Robert - I’m glad to be a part of this wonderful journey of making everyone I know play Outer Wilds.

This is day 49 of #100DaysToOffload

Reply to this post via email | Reply on Fediverse

I paid people to try and follow my README - Terence Eden’s Blog

2026-10-11T11:34:39.000Z

Developers suck at writing documentation. We like to say RTFM but often there ain't no FM to R. At best we have a half-arsed collection of notes, some obsolete tips, and a link to a desolate forum full of people asking the same questions again and again. That's no way to treat our users.

I naïvely believe there's a better way. As I've written before, you should sit down and actually test your readme. Spin up a fresh Virtual Machine, go through what you've written, and see if it makes sense.

But it is really hard to ignore your own biases. Of course you know that certain commands require sudo and obviously when you wrote -foo you meant --foo and everyone knows that you have to reboot afterwards.

How do you get rid of those biases? I paid people!

As part of my NLnet grant application for ActivityBot, I said I wanted to test the install experience with real users and I was prepared to pay them €25 for an hour of their time. I stuck out the call on Mastodon, gathered a few people, and had a video call with them.

The format was simple. I explained that I was looking for feedback on the first-run experience. I knew that it wasn't perfect and actively wanted constructive criticism. I asked the volunteer to share their screen and, crucially, to speak aloud. Tell me what they were doing. What they didn't understand, what confused them, what delighted them, what frustrated them, etc.

I took notes by hand (fuck feeding the machine) and spent several hours being told what incorrect assumptions I'd made.

Amongst the highlights I discovered were:

The link to the demo tool was wrong.
Some people read a README in the terminal.
What does it actually mean to rename a file?
How do you rename a hidden file?
Should a demo tool be available on the web or just the user's local machine?
Why does some text explicitly need to be quoted and some not?
My jokes aren't funny and are actively confusing.
Some of the technical terminology needed explaining.
The ordering of the different sections was confusing.
I hadn't actually explained what the software would do.
A whole section which was technically interesting to me was utterly confusing to everyone else.
Not all web servers use permissions in the same way.

And on it went!

After each session I updated the README based on what people found difficult, then I re-tested it with the next person.

In total, I paid out around €150 to have a bunch of people criticise me to my face. Hey, cheaper than therapy, right?

I know someone is going to say "why not just ask an LLM to simulate a range of users?" The answer is very simple - I want to speak to real people. People are brilliant! They can make you laugh, you can see their cat when it wanders on to the call, they bring a unique perspective to the problem, and they're really happy when you give them a €25 voucher. Some will gladly do it for free and make you happy!

When I was doing technical writing for GOV.UK, all my beautiful prose was given a second-eye by another human. They eviscerated all my flowery phrases and turned the document into something more readable. They were the ones who caught the mistakes that no spell chequer could. They were able to have a proper conversation with me. More importantly, I could hear the frustration in their voice - that's the thing which lets you know a mistake needs to be corrected.

I don't claim that ActivityBot's README is now perfect - far from it - but it is now demonstrably easier to follow. Developers need to talk to real people. You don't have to pay them if you can't afford it - but find a few people who will talk aloud while they try to follow your instructions. I guarantee you that your README will become much better for it.

Johnny.Decimal en français - Johnny.Decimal

2026-10-11T11:16:22.000Z

Si vous parlez français, allez voir le site de Monique. Elle écrit sur Johnny.Decimal et d'autres techniques d'organisation.

Monique a eu la gentillesse de m'écrire pour me demander si elle pouvait republier certains de nos concepts.

Vous trouverez son site sur monauberson.ch.

Johnny.Decimal in French

If you speak French, check out Monique's site. She's writing about Johnny.Decimal and other organisation techniques.

Monique was kind enough to write and ask me if it was okay to republish some of our concepts.

You'll find her site at monauberson.ch.

French by Claude. Sorry, Mrs. Haddad. It's been a long time.

Wonders of Web Weaving, Episode 22 - James' Coffee Blog

2026-10-11T00:00:00.000Z

The twenty-second episode of Wonders of Web Weaving is out:

In Episode 22, I chat with Tracy, the author of tracydurnell.com about, how websites fit into writing, writing series of posts, websites as part of conversations, and more.

I hope you enjoy the episode!

Wonders of Web Weaving also has an RSS feed you can use to follow along from wherever you get your podcasts.

The episode was released on Tuesday, October 11th. I usually publish the blog post announcement on the day, but I forgot this week.

Tracy tracydurnell.com The twenty-second episode of Wonders of Web Weaving is out Wonders of Web Weaving also has an RSS feed

Some quick thoughts on Unit Testing ActivityPub - Terence Eden’s Blog

2026-10-10T11:34:15.000Z

I'll be radically honest here - I never really got the idea of "Test Driven Development". I'm much more of a "telnet into production and damn the consequences" kind of guy. Look, it's much more fun and my cardiologist recommends severe shocks every now and again.

The essence of unit testing is pretty simple:

Feed a function some data
See how it responds

Send it good data and if it returns "true" the test passes. Send it bad data and make sure it returns false. Easy peasy lemon squeezy.

As part of my NLnet funded work on ActivityBot, I'm writing some proper tests for my bot framework. I am hopeful that some of them will be useful to other projects doing similar things.

There are four major classes of tests - here are the problems I've found while writing them.

Basic text validation

A basic test might be how to validate that an ActivityPub username is valid. Typically it would be something like @edent@mastodon.social - what assumptions do we make with that? It starts with an @ and has another @ somewhere in it, dividing into two parts, the user and the server. The server has to be a valid domain name - but that can include non-ASCII Internationalised Domain Names and Emoji domains.

What about the user part? Is it just A-Z and 0-9? Can it have dots? What about apostrophes like an email address?

Basically, how easy is it find the specifications for all the various component parts of ActivityPub? Not very!

Message validation

What does a WebFinger response look like? Which parts are mandatory and what values can they contain?

With any message that your project generates, how can you be sure that other ActivityPub servers will understand it?

Similarly, when we receive a follow message from an external server, what should it look like?

There are some JSON Schemas which can be used to validate some type of messages.

But, again, there are many scattered specifications.

Signature verification

As I've written about before, HTTP Signatures are difficult. There are two main problems. The first is verifying signatures.

In order to do that, you need to gather a bunch of signatures and then find a way to replay them into the test. So I'm in the process of saving signatures which I can then share with others.

The second problem is generating signatures. Sure, you can run tests on the signatures - but there's only one real way to test where's they're acceptable…

Communicating with others

Passing tests means nothing if you can't communicate with others and they can't communicate with you.

Some tests are easier than others. Sending a signed request should be easy and repeatable. But receiving messages isn't easily automated. It requires being able to control an external server and asking that to send messages.

With the Mastodon API it is possible to make requests which will interact with your server - but only if it is a public server.

Putting it all together

I'm putting all my tests online. I'm also sharing a collection of messages and signatures which you can use in your tests.

I'd love to know if you find them useful.

Weeknote #2021 - Robb Knight • Posts • Atom Feed

2026-10-10T06:12:00.000Z

I'm not updating my personal Mac so this isn't relevant to me but this script turns off all the Apple Intelligence shit on MacOS and gets the model space back.

I did link to this post from Cory but it's worth linking again now — this is like the sabotage field manual for the modern web.

Crawler Zoo is fun.

Blake made his own Solitaire game and I got distracted for a lot longer than I should when he linked it.

Da Vinci, the guy who totally "invented" the helicopter, drew some legged penises in his sketchbook. Inside every man there is a burning desire to draw knobs.

I wanted some new coloured pencils and I ended up down a rabbit hole of comparisons and information about who manufactures what for who. This comparison was my ~~gateway drug~~ starting point. I landed on this Melifluo/Brutfuner set.

This recreation of the Commodore 64 keycap font is perfect.

This AI generated copy of the Abode suite is certainly something to watch if only to see how long it lasts.

This person hired an artist to draw their house and now they're using it for their home assistant dashboard and it's cool as fuck.

Walking - James' Coffee Blog

2026-10-10T00:00:00.000Z

I stand before Nature, looking up to a castle bathed in gold light. What are perfect places? I wonder if this is the closest I’ll find: with the air of home and the light of Day, with the breeze in the trees and history to see; with life in the moment and rhythm and movement; with gentleness bathing the Earth, winds propelling leaves into the air, painting the picture of the season.

⁂ ⁂ ⁂

Going on a long walk through the city has become something of a tradition for me over the last few weeks. I like to take the long way to run errands: through the beautiful, expansive parks in which I see so many other people walking as the sun beams through the trees; through the streets with beautiful architecture, whose buildings leave me in awe; walking on the paths I love, while holding an eye toward discovering new ones.

Every walk is different, my feet going where they would like, guided by direction and experience but also wonder and curiosity. “What if I take this path?” I can walk with and through the feelings in my own heart, while listening to whatever songs seem to fit the mood, the energy moving from my ears to my mind to my legs that walk forward and forward. Occasionally, a song asks me a question. "What the fuck are perfect places anyway?" (Lorde)

The light from the sky was anew today; the sun lowers as autumn progresses. Paths I usually take become blindingly bright by mid-day. Whereas other places – like the aforementioned castle, or the pastry shop into which an intense glow beamed, drawing attention to the pastries in the front while I enjoyed the pleasing scent permeating through the open door – are illuminated in a way that brings me joy.

I thought about the familiar and the new. How the places I walk were once new and, with time, and walking, became familiar – how there is a spectrum of familiarity: of the places I know well, and of the places I am yet to discover. Standing outside one of my favourite bookshops, enjoying the powerful, cooling autumn breeze that, until this week, I didn’t realise how much I missed, I thought about how life is a mix of what we know and what we experience for the first time. Every moment is new, but holds associations to what we know.

I have visited my favourite bookshop a few times since they moved. But I have never visited it today, on this exact date – therein, the familiar and the new, together.

By the end of my journey today I felt my legs more than any other day this week; tense from all the walking, from all the exploration. I enjoyed my favourite muffin for lunch while watching the world go by, carrying with me a book on art history that caught my eye earlier in the day. Later on, I started to read the first chapter of the book with excitement – a relaxing moment after an invigorating day.

⁂ ⁂ ⁂

And now I write, holding onto a question I have been thinking about ever since I started my second year at university, one provoked by our present studies of art and its environments: what does Nature mean to me? This is one of those questions I’ll need to hold in my mind and my heart for a while. For now, however, the question lives here, in the story of today.