Shellsharks Blogroll - BlogFlock

Skiing in Tūroa - The Weblog of fLaMEd

2026-09-07T08:32:09.000Z

What’s going on, Internet? This is a later post. It’s been a minute since I’ve been skiing. We left the kids at home with their aunty and headed south to Ohakune.

Was made aware before the trip that Ohakune’s main water pipe was recently damaged during an earthquake. Repairs were being made but this weekend the township was without water. Restaurants had to close, hotels and motels had to close and cancel reservations.

We wanted to stay at the Powderhorn this trip for two nights, but the Monday night was fully booked so we couldn’t. Ended up working in our favour as they had to cancell all bookings.

We ended up in a rental house that was owned and managed by a local couple. No running water, but we were able to flush the toilets with water from the spa pool and was hands etc with bottled water supplied by the council.

The view of the mountain from the rental house.

Not much was open in town for food but a few of the takeaways were open so we were able to get a decent feed.

Weather wasn’t looking too flash for Monday up the mountain but it held out in the end. Sure visibility was rubbish off and on during the day, it snowed around lunch time, a great time to take a break, but the snow was pretty good up there.

Like I mentioned, it had been a while (three years) since my last time up the mountain, I went up the top of the Movenpick chair lift and had a rough time getting down. The visibility was horrible up there for the first run.

Visibility for the first run.

I made it down to the top of the Park Lane chairlift and spent the morning at the Wintergarden tow rope and it’s gentle slop getting familiar with the skiis again.

The view from the Wintergarden, tow rope on the right.

After lunch I head back up to the top of Park Lane and spent the next couple hours heading down the Park Lane chairlift.

Once I was confident with that run I headed back up to the top of the Movenpick. The first part of the slope was a bit of a challenge but I struggled through and made it back to the top of Parklane to finish the run.

The base of the mountain, with the Movenpick and Parklane chairlifts heading up.

One day up the mountain is not enough. Next trip I want to spend at least three days on the slopes, a couple hours of private lessons would do me well.

Hey, thanks for reading this post in your feed reader! Want to chat? Reply by email or add me on XMPP, or send a webmention. Check out the posts archive on the website.

Standard zero .05 now reserved for 'AI' - Johnny.Decimal

2026-09-07T04:58:04.000Z

Standard zero .05 has until now been reserved for expansion. I am claiming it for use by your AI agent. I'll duplicate the section from that page below.

⚠️ This blog post is frozen in time. If you're reading this later than September 2026, view the latest text on the standard zeros page in case it has been updated.

.05 AI

A place for your AI agent.

Agents work best when you write things down. Your JDex is an amazing communication tool: both you and your agent can read and write anything in it. Best memory ever.

Sometimes it's useful to have a dedicated space that the agent controls. This is a place that it can store persistent information for recall across sessions.

You can also use it to provide per-system instructions to your agent. For example at 00.05 I have a 'style guide' that tells it how I like my frontmatter properties to be organised (alphabetically).

The skills and MCP server both assume they have control over AC.05.

Emoji ✨

The standard emoji is – obviously – ✨

Note published on September 6, 2026 at 5:27 PM UTC - Molly White's activity feed

2026-09-06T17:27:48.000Z

make bad art

Deleted YouTube again - Joel's Log Files

2026-09-06T13:53:52.000Z

For a little while I have been using YouTube way more, and even paid for the Lite subscription model, simply to test it out.

Honestly, it hasn’t been too bad, and I actually really, really enjoy a lot of the videos I’ve gotten through the algorithm.

But of course, YouTube Shorts have caught up with me and continue to be a very annoying problem, wasting seconds, minutes and hours of my time at every moment.

The algorithm does show some interesting things, or funny content I enjoy, but things go downhill pretty quickly with the usual AI-generated slop videos and recycled content.

A few of the saving graces I’ve seen is shorts made from genuinely awesome videos that came out like 5 years ago, so I think it’s an interesting way to bring life to evergreen videos about science and the like.

With Outer Wilds playthroughs and essays running rampat, my feed slowly phased into more space and astronomy themed topics, which has been pretty fun to get into until I realize half the videos are way too long for what they have to say and use genAI graphics for everything.

So whatever, I just deleted YouTube and cancelled my subscription now. I will continue to use it via Fennec Browser and Newpipe, though maybe a full YouTube detox would be a good idea to try.

Yesterday alone I wasted almost 6 hours on the platform, and I think like 4 of them were just Shorts. Even now I just had to have a video on the background while writing this, what is going on?

You know what, I will try it, I will limit my YouTube time to one hour a day for the rest of the month. It’s possible I’ll fail completely, but hey, at least you will know if that happens and you are free to bully me for it. The weeknotes next Monday will also be the last ones where I share YouTube links this month, as I also feel like a part of me watches more videos because I have a need to find stuff worth sharing here. The less excuses I have the better!

Alright, let’s do this.

This is day 30 of #100DaysToOffload

Reply to this post via email | Reply on Fediverse

The purpose of DNS is to spread scams - Terence Eden’s Blog

2026-09-06T11:34:20.000Z

I imagine everyone here has received an unsolicited message telling them that their tax is overdue and that they urgently need to visit Genuine-Tax-Payment-Website.fart or that a parcel is delayed at customs and you can pay a small sum for its release at Almost-The-Right-Acronym.ak

You know it is a scam. Most people just mark as spam and move on with their day. But a significant number of people don't. They hastily visit the site, tap in their credit card details, give it their mother's maiden name, confirm address, upload a nude selfie, and only then realise that they've been had.

The Internet works at pretty close to the speed of light. You can register a .uk domain and a minute later it's accessible from the other side of the planet. Brilliant for users who want to quickly launch a website. Also brilliant for abusers who want to launch a spam campaign.

By the time enough people have reported the scammers' domain as suspicious, it is too late. In the time it takes for a registrar to disable the domain, or for its name to make its way to the Safe Browsing List, a million messages have already been sent and enough people have handed over their details.

We're told that "the purpose of a system is what it does". At the moment, the Domain Name System's purpose seems to be a vector for criminals to run scams on people at a terrifyingly high rate.

How big is this problem?

BIG!

There's a great blog post by Andrew Campling which reports on this startling claim:

The study found that at least 10% of all new gTLD domain names registered during the year had subsequently appeared on security blocklists by the time of analysis. It estimated that, taking account of subsequent blocklisting and associated domains not themselves blocklisted, the share of names registered by malicious actors may be closer to 20%.

DNS Abuse and Criminal Infrastructure: Beyond Definitions and Blocklists (emphasis added)

That links to a presentation by Interisle which contains some rather shocking statistics (albeit with disputed methodology). It looks at generic Top Level Domains (gTLD) - those are things like .com and .fun rather than country code TLDs (ccTLD) like .uk and .de.

It says 85 million new registrations of gTLDs were made in 2025. Of those 8.5 million were added to blocklists by May 2025. It reckons that a 10% abuse rate is the likely floor for these numbers and it's probably closer to 20%. One in five newly registered domains with a gTLD are scams. That's a bloody crisis.

13 TLDs had more than 50% of their registrations blocklisted.

I can understand why .bid and .loan are popular with scammers. But why .mobi?! What did I ever do to you, eh?

Who are the scammers registering these through?

Ah, our old friends at NameCheap. See Why do scammers love NameCheap?

If those five registrars had more effective policies, it might significantly dent the scammers' ability to ply their devious wares. Or they might just move on to other registrars.

As the report points out:

suspension rates for blocklisted domains were 7.4% to 16.3%.

The full report is on the Interisle website.

What can be done?

I don't know.

In the first instance, it might make sense for registrars to do strong Know Your Customer (KYC) checks on anyone buying a domain. But that stops anyone who wants to anonymously register I-Hate-Nintendo.whatever without risking the wrath of Intellectual Property lawyers.

Also, criminals have access to stolen money and stolen cards. They can convince a hapless mule to register a domain on the criminals' behalf.

Registrars could ask for an escrow payment. Pay €9 for the domain name put €900 in escrow. If your domain appears on a blocklist within the year, you forfeit the money. Criminals with stolen funds are unlikely to care but it would probably put off lots of people from getting a new domain.

There are various banned words and phrases depending on the TLD. For example, South Sudan has a list of political words which they don't want associated with their .ss ccTLD.

But if one gTLD bans a word, a different one might not. A scammer doesn't care if the gTLD is .arse or .elbow - they just want the start of the domain to look legitimate.

Some registrars have strings that they don't allow. In fairness to NameCheap, when I tried to register dwp-payments-gov-uk.pizza it told me that domain was banned. It wouldn't let me get any gTLD with that name.

But all it takes is one registrar to be slightly lax and the scammers get through. Increasing the complexity of the rules is also a hell of a burden on smaller registrars.

Besides, it's pretty easy to get a generic enough looking domain and stick the confusing bit on a subdomain. Here are a clutch mentioned in the report:

https://gov.uk-dwpaph.bond/uk/
https://gov.uk-dwpcjh.bond/uk/
https://gov.uk-dwpclc.bond/uk
https://gov.uk-dwpclw.bond/uk
https://gov.uk-dwpclj.bond/uk/

Perhaps there ought to be a delay before a new domain goes live to allow people to object to it? That would give governments, banks, delivery companies, and a dozen more "important" organisations a right to veto any "dodgy" looking domain.

But suppose someone wants to register gov-uk-stole-my-horse.horse to protest the government's cruel policy of stealing horses - is that a legitimate use of a domain? What if the Darwin Pensioner Divas - a group of elderly singers - want to take payments for their new album of goth/punk covers, can the DPD delivery company veto dpd-payments.music?

Do we want a domain name system where powerful companies control exactly which domains we can register? If I have an idea for a domain on a Friday night do I have to wait until Monday before it can be launched? Are those companies realistically able to parse millions of domains per year and have a low false-positive rate?

All of these things are possible - but all of them come with an impact on legitimate users. To be clear, I don't know what the right answer is.

What is ICANN doing about it?

Lots! It has been a few years since I've been to an ICANN meeting, but even back then the topic of abuse was high on the agenda. They appear to be looking at ways to coordinate abuse reports between various entities, along with some other policies which should hopefully work.

There are two salient points from one of the discussions held at the recent meeting

If anybody thinks that in our current age of AI and as we move into different kinds of computing, DNS abuse is going to numerically stay steady and we will have a downward effect on that baseline 2027 number. I'm not sure that that's an accurate assumption. I think it's going to be the other thing, which is […] it's going to be easier to abuse the DNS.

And

Abusers are going to abuse because it's just too lucrative, because no matter what we do, they will find the way to make profit off of that, and will try to circumvent everything that we do. That is not a reason not to do it, though.

Quite!

As I said, I don't know the answer to this. What I do know is, much like Android's app ecosystem being a haven for scammers, DNS is facing a crisis. When trust in a system goes, only chaos follows.

I don't want to live in a world where I have to show my passport and pay thousands of pounds to register a domain which is only available after being vetted by private interests. But I also don't want to live in a world where scammers have effectively no deterrent from abusing millions of people.

The purpose of a system is what it does. I hope DNS's purpose can become less dangerous while still remaining open.

Complements: Art history, writing - James' Coffee Blog

2026-09-06T00:00:00.000Z

Earlier this week I was chatting with a friend about the skills I am learning from art history. One of the most influential concepts I have learned is to “look closely”. The idea is to spend time with a single thing – to study it closely – and think about what you see in more depth. This helped formalise an experience I was already having in galleries: I didn’t want to see every piece as fast as I could, rather I wanted to slow down.

⁂ ⁂ ⁂

Galleries, and the works within them, feel as if they have a certain magnetism, that magnetism sometimes varying over time. For instance, I was recently fascinated by a work of still life painted in the National Gallery of Scotland. I don’t usually gravitate toward still life paintings, but on that day I wanted to explore them more: to spend time with a genre with which I was less familiar, and to see what I could see.

Similarly, there are paintings that, no matter how many times I look, I see something new and beautiful: paintings that I only need to see in the corner of my eye before I stop and know I have to go over and look at the work in more detail. This year, the painting that has caught my attention the most is Turner’s sunrise over Norham Castle. The colours are transfixing. The scene is beautiful. The art is infinitely intriguing. I must have spent at least half an hour over several visits looking at this painting, and longer thinking about it.

I am studying both art history and creative writing next year. This is perhaps not as common of a mix as, for example, English Literature and creative writing, but mixing the study of art history and the theory and practice of creative writing feels right to me.

I haven’t coalesced a complete vision of the complements between these two subjects but, today, as I write, I feel like the concept – and application – of looking closely lends itself well to both my studies in art and my writing. Art history has helped me look closely. In writing, I similarly need to look closely at the world and capture as many details as possible, everything I see in the rhythm of the world, in Nature, in cities, and everything I feel, being a potential detail to use in a story.

⁂ ⁂ ⁂

Studying art has helped me refine my visual description skills. This starts with thinking about the artwork. The kinds of questions I may end up answering are things like: What do I see? What is the art about? How do I know? How is a work composed? How do different parts within a work of art relate? How does the work at which I am looking compare to others I have seen? As I think, I enjoy writing down what I see. Other times, I enjoy just looking at a work, knowing that I don’t need to write anything to get something out of the experience.

These visual description skills blend in with my writing: the more I know what to look out for, the more details I know that I can write down, and the better I can incorporate those details into my writing. This connects with my creative writing where details about what I see can be an integral part of both life writing (an introspective kind of writing, which I enjoy) and creative writing (poetry, fiction, and more). Using written descriptions of art as part of storytelling even has its own term: ekphrasis.

⁂ ⁂ ⁂

Art galleries have also helped me wander more: to slow down.

When I am in a gallery, I like to go towards whatever stands out, and spend time with it – to wander a room and see what works appeal to me, to get up close with a piece and spend time with it, to walk closer and further away from a piece to see what I see. In many cases, I can see specific places I have seen paintings, my memories of the spaces being so vivid. Perhaps this is because I like to slow down in galleries. ¹

Slowing down complements the pace at which I write and code. When it comes to writing and coding, I am often moving quickly: capturing ideas on paper, thinking about and formalising logic in code. I am moving fast because I love making things. In contrast, studying art invites me to slow down. Indeed, one of the most delightful experiences in galleries is when I have been looking at a piece for a few minutes and I notice something new. It is delightful to feel the process of seeing new things as you spend more time with something.

I am excited for the next year of my studies as a time to refine my visual description skills, to learn more foundations of the history of art, and to see and feel how writing and art history combine for me.

If you are curious, I am the sort of person who likes to diligently look at every piece one by one in an art gallery, moving through the space slowly. I like slowing down.

[↩]

ekphrasis 1 [↩]

Note published on September 5, 2026 at 3:19 PM UTC - Molly White's activity feed

2026-09-05T15:19:08.000Z

Other platforms will soon follow, a senior administration official told POLITICO on Tuesday. “We got Lake America changed on Google Maps, and many other maps are changing in a couple days. And Wikipedia is going to change as well,” said the official, who was granted anonymity to speak frankly.

A Wikipedia editor put it well: "You almost want to pat them on the head and say 'Yes, of course it will' in the same way you'd tell a small child that Santa Claus will be delivering their presents."

Note published on September 5, 2026 at 3:05 PM UTC - Molly White's activity feed

2026-09-05T15:05:23.000Z

Huge congratulations to the US-based Wikimedia Foundation employees who voted with 92% support in favor of unionizing, and shoutout to the tireless work of the organizers.

Book Review: The Passing of the Dragon and Other Stories by Ken Liu ★★★★☆ - Terence Eden’s Blog

2026-09-05T11:34:47.000Z

This is a gorgeous set of short stories - and a good deal more accessible than some of the heavyweight prose Liu has previously been involved with. Some of the stories contain sentences which are complex jewels to be savoured.

What I particularly like is the way he moves between almost-prosaic Earth-bound stories to the the most extraordinary flights of fancy. One story might be set in a downtown art gallery, the next in the ice-rings of a far-off planet. The creeping feeling of senescence haunts the reader as they flit from story to story.

Much like his full-length novel All That We See or Seem, Liu has an incredible knack for tapping in to modern fears and weaving tall tales around them. There's a tenderness in all his character - even when a couple of the stories go nowhere, it is still pleasant to spend time in the worlds he has created.

It is, perhaps, missing a cohesive theme - the dragons come and go throughout the stories. Nevertheless, a compelling work chock full of fantastical ideas.

If you're in the mood for a wide and varied selection of stories, this is well worth picking up.

Many thanks to NetGalley for the review copy. Passing of the Dragon is available to buy now.

morning - James' Coffee Blog

2026-09-05T00:00:00.000Z

rabbits leaping, birds tweeting,
the sun rising, hills welcoming,
breeze blowing, paths winding,
potential painting, colours calming:
skies awakening, day breaking.

Friendly names for private services using Headscale, CoreDNS and DNSimple - Posts feed

2026-09-04T20:44:00.000Z

When I started setting up private, self-hosted services one of the things I wanted to maintain was a pattern of friendly, human readable names to access them. I didn't want the overhead of bookmarking domains available via Tailscale's MagicDNS and I wanted real SSL certificates that were trusted and that clients wouldn't complain about.

The tools

To accomplish this, I have DNSimple managing the public zone (for things like this site, my Mastodon instance and so forth).

I have Headscale set up as the control plane and I use Tailscale's apps to connect to it. It assigns addresses to each node, dictates what each node can reach and which resolver each uses for a given domain.

I'm using CoreDNS to map friendly names to mesh addresses:

coryd.dev {
    cache 300
    hosts {
        100.xx.xx.xx  music.coryd.dev
        100.xx.xx.xx  books.coryd.dev
        100.xx.xx.xx  photos.coryd.dev
        100.xx.xx.xx  git.coryd.dev
        fallthrough
    }
    forward . 45.90.28.0 1.1.1.1
    log
    errors
}

fallthrough allows anything not defined above it in the hosts block to hit forward, returning the public answer.

Connecting things

Headscale distributes the resolver config to each client with the split DNS config looking like this:

dns:
  magic_dns: true
  base_domain: net.coryd.dev
  nameservers:
    global:
      - https://dns.nextdns.io/
    split:
      coryd.dev:
        - 100.xx.xx.xx
        - 100.xx.xx.xx

All members of the mesh route queries to coryd.dev through CoreDNS and send everything else upstream. I configure the mesh in the Tailscale client, connect and get access to everything.

Certificates you can trust

Because everything here is private, HTTP-01 challenges needed to obtain certs will fail. Thankfully, DNSimple supports DNS-01, which lets me prove domain ownership via a TXT record and obtain a wildcard cert (*.coryd.dev).

On my Linux boxes I'm using certbot with the dns-dnsimple authenticator to write certs to /etc/letsencrypt. Caddy mounts this directory as read-only, has auto_https off and the file names are referenced explicitly. On my NAS, I'm running Caddy as a native binary with the DNSimple module handling the challenge.

Breaking things

Because I'm an idiot, I have the mesh running on the same domain CoreDNS resolves. If a client can't resolve a name, it can't connect to the mesh. I have a second instance of CoreDNS running on a separate server to mitigate this.

If you're using MagicDNS, use separate subdomains. It'll refuse a base domain that's equal to, or a parent of, the control plane's hostname. The client would end up taking over the zone holding the server it needs. I used mesh and net as independent names.

Point Docker's dns settings at the bridge address or you'll run into lookup delays with CoreDNS. CoreDNS listens on the mesh address, containers live on a bridge, so packets go in a loop, the resolver times out and then it tries the next resolver and succeeds.

That CoreDNS binds to the mesh address created another issue — the address only appears after tailscaled registers with Headscale and Headscale is a container on the same host. I opened the socket first before the address was available by setting net.ipv4.ip_nonlocal_bind = 1.

The other thing — the addresses behind these names spread out everywhere: they're in the Corefile, yes, but they're also in my ACL policy, port bindings, extra_hosts, daemon.json and deploy scripts, so documentation is crucial.

It works! It all works! So far, anyways. Most things I host are private and they have addresses I can remember. They have certificates so there are no complaints by clients and browsers when I access them. Better yet: if my family needs to access something, the address is intelligible. Adding a new subdomain is easy, changing the address tied to one is tedious given the myriad places they flow through.¹

There's probably a better way to do this, so enlighten me. ↩︎

My phone number doesn't work anymore - Joel's Log Files

2026-09-04T18:00:00.000Z

Don’t worry, I can connect to Wi-Fi networks, I just lost mobile data access and phone calls with my current SIM chip.

You see, the silly government of my beautiful country decided that the best way to stop scam, blackmail and other crimes via phone calls would be to force everyone into registering their phone numbers with their ID card and a face scan with the phone’s camera.

A huge percentage of the population never did this on the original deadline and the plan utterly failed no phone company disabled any phone numbers because the monetary losses would be too much. So things were fine, at least for a little more time.

They decided instead to give a different deadline to every phone number based on the last digit (0-9), a slower rollout that would make people more nervious, as the peer pressure would slowly build up. Since my phone ends with a 1, my line was deactivated on October 31st, 2026.

Of course, I can still get my phone back, by doing the proper registration process, and everything would go back to normal in no time. But a part of me just doesn’t want that. I just don’t understand the need for this.

First off, the criminals have already circumvented this, there are still scam calls, there are criminals who have registered phones on behalf of other people, this is doing absolutely nothing to actually stop crime.

Then there’s the security of it all. We have no idea where that database is going, and as much as they promise that the face scan is a one-time thing that doesn’t get stored anywhere, we can’t actually be sure of it.

This is honestly just messed up in many levels, but it’s also just ridiculous. It’s the government! They already have our IDs, they already could have all the data they want from us. Why exactly do they need another database for this? Some people even expose their numbers and address on their ID already.

The registration process is also super badly implemented, and there’s people who have gotten around it with AI images and fake credentials, plus those using stolen information from other people and getting away with it. Seriously, it’s probably some vibecoded slop checker or something, I haven’t even bothered to open the page myself, I am just angry that it has to be like this.

Ugh, this is also yet another form of surveillance isn’t it? Now that phones are directly linked to individuals (if the whole database and infrastructure works well), then that would mean any individual can easily be silenced by having their phone access blocked like this right? Just bad vibes everywhere.

Our only hope is that telecommunication companies are still losing a lot of money, with people that are not paying their phone plans anymore and maybe realizing that they don’t even need a phone line at all nowadays.

Many individuals are happily making phone calls via Wi-Fi with WhatsApp (I know, I know, but it’s how it’s) and other messaging apps, without relying on their SIM chip.

Personally, since I have a work phone that was registered by my company, I simply use that as a hotspot and stay communicated with it when necessary.

Look, I am super angry, but if more people start to register their phone I may have to give it up and register my face on their silly database that is probably stored in a publicly accesible AWS bucket or whatever. Who cares at this point?

It will be one more of the many silly things I do despite being a privacy/FOSS/tech enthusiast, I guess.

This is day 29 of #100DaysToOffload

Reply to this post via email | Reply on Fediverse

New Design for Sept 2026 - Kev Quirk

2026-09-04T16:19:00.000Z

I decided I was bored with the previous design, but wanted something that was in keeping with the previous design (brutalist and using a monospace font) yet different.

I abandoned the yellow accent and went back to blue, my favourite colour. I also changed the font to Victor Mono.

I like how the new design draws from different versions of the site's history - lots of neo-brutalist design, clean colours and font, plus a bit of whimsy. If you're reading this via RSS, here's what the new design of the site looks like (although I'd recommend you head to the site and experience it properly):

I love how Pure Blog makes it so easy to change things like this. All I really did was pick a new colour palette, then add some custom CSS. The rest is all default Pure Blog, pretty much.

Hope you like the new lick of paint!

Thanks for reading this post via RSS. RSS is ace, and so are you. ❤️

You can reply to this post by email, or leave a comment.

Weeknote #2016 - Robb Knight • Posts • Atom Feed

2026-09-04T08:22:00.000Z

Our St Jude Fundraiser has blasted past $5k, and I had to make a an Obsidian base to keep track of all the drawings I need to do. The first one arrived yesterday and if you want one for yourself there's one slot left right now. You can donate here.

Thanks to Melanie pointing it out, I fixed a bug in Lens where it would catch SVG title elements when it shouldn't.

It’s not for me but the detail on this Wallace and Gromit set is fantastic.

Matt reviewed the Ulanzi D100H. I love buttons and knobs.

This project by Chris generates an Internet Phone Book 88x31 badge for you. I had my own version I'd made but the animated one from here is way better so I swapped it out.

There's a proposal for a .well-known URL for changing passwords which seems so obvious now I see it.

How to write a short story in five sentences — it does exactly what it says it will and nothing more.

There is nothing better than a pencil manufacturing video and this one about how Blackwings are made is great.

An art gallery using a slop poster is so stupid I can't even.

Terence Eden has a post about verifying ActivityPub signatures which was a colossal ballache when I did it previously.

Visual design rules you can safely follow every time. I love articles like this with simple and understandable actions I can take to make my sites better.

autumn, winter - James' Coffee Blog

2026-09-04T00:00:00.000Z

colours shimmering,
sun lowering.

leaves leaving,
seasons deepening.

trees lightening:
branches preparing.

winds cooling,
time wintering.

I wrote this poem with reference to a series of key words in the first edition of Planet Persephone's Go Offline zine. I used "lightening", "time", "shimmer", "colour", "deep", "leaves", "wind", and "winter".

Planet Persephone's Go Offline zine

2026-09-03 14:47: Why do so many calendar apps offer Sunday as the first day of the week?... - Kev Quirk

2026-09-03T13:47:00.000Z

Why do so many calendar apps offer Sunday as the first day of the week? It's not the first day of the week, it's the last.

Why is that even an option FFS?

Thanks for reading this post via RSS. RSS is ace, and so are you. ❤️

You can reply to this post by email, or leave a comment.

A reasonably practical guide to validating RFC 9421 HTTP Signatures for ActivityPub in PHP - Terence Eden’s Blog

2026-09-03T11:34:12.000Z

If you're reading this, you've probably been hitting your head against a brick wall trying to parse and decipher the new HTTP Signatures sent by Mastodon and other Fediverse servers.

This is a basic and somewhat incomplete guide to accepting these signatures. I'm sure there are various gotchas, but it works with the signatures I've seen in the wild.

Shut Up And Show Me The Code!

OK, wow, no need to be a dick about it! Here's how I validated a real signature that my server received.

$verified = openssl_verify(
    data:       '"@method": POST
"@target-uri": https://example.viii.fi/inbox
"content-digest": sha-256=:tFdB/ENGczHMlZMDb66pXoUi2d0OqH2iBHdnN/WV1mc=:
"@signature-params": ("@method" "@target-uri" "content-digest");created=1787780262;keyid="https://mastodon.social/users/Edent#main-key"',
    signature:  base64_decode( "sIfmNsM/Q8iG6AJlne1IkZVjQSVFDEYIPsnoSOXQY+W3Eb4+SOn9o4J5SQmFOP+Jecjf3ioFwUdsrFjAGkUUOHPvSbNWkGKtNuGm+C6r3aI3JBCFGPqX3ITgZYV76CF7JJJ5hPGaG8YH/XdmxVIeFfD3M39FQCncMyyq7xJJvwKKP1mzS5s1vNQie8hbQ9owRjtqvoWcmM9GEYCUHNcMPLjZc+CBrj8sfBbNTYgIFI4UtirOaRJvYymxXjmXuzeVYxQujMjAjgobxQ8QFv0zlYsHk+gS5EYyafpJG9zmfCFSoF9+ZwqKNADmuADbISD9LZIH/bmkPoNXhxaeFPqYog==" ),
    public_key: "-----BEGIN PUBLIC KEY-----\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAsYMEs4waqk/6gaS+xn1T\nYygElTtNIFNkBcEdEBMaeoGVhyZiVKtSjJCS4z+X+394PKvcfSTcFILIt2GI2jOB\nHD0M2fFgxc8mmdSdCQkgEh9jF3bFI3kopDvzYf726iioYKlHXKpfPKvFt7EJgKH7\naCtS25NQkek3YUd6y3VBcT3R6Xhze9P3QNoZMIsFXklgXDKj+EllfbUqLf1vxt3s\nmD9ETxy2bJi9FheE0uY2WhARn49XAvwczM5Wzt+zqxVEtgpi5v2+ZZAVKhDnJkiC\nCCuI6hrSnKNIx/5mSlX0a0S5h5d03djrCkYsqmwelu01rhOXP2grsz4BXp0y2wrO\n3QIDAQAB\n-----END PUBLIC KEY-----\n",
    algorithm:  "sha256"
);

echo $verified;

Copy and paste that into PHP and you should see that $verified is true.

NOW EXPLAIN THE CODE

Say please.

PLEASE!!!

Along with the message sent to your server, you will have received HTTP headers like this:

content-digest: sha-256=:tFdB/ENGczHMlZMDb66pXoUi2d0OqH2iBHdnN/WV1mc=:
signature: sig1=:sIfmNsM/Q8iG6AJlne1IkZVjQSVFDEYIPsnoSOXQY+W3Eb4+SOn9o4J5SQmFOP+Jecjf3ioFwUdsrFjAGkUUOHPvSbNWkGKtNuGm+C6r3aI3JBCFGPqX3ITgZYV76CF7JJJ5hPGaG8YH/XdmxVIeFfD3M39FQCncMyyq7xJJvwKKP1mzS5s1vNQie8hbQ9owRjtqvoWcmM9GEYCUHNcMPLjZc+CBrj8sfBbNTYgIFI4UtirOaRJvYymxXjmXuzeVYxQujMjAjgobxQ8QFv0zlYsHk+gS5EYyafpJG9zmfCFSoF9+ZwqKNADmuADbISD9LZIH/bmkPoNXhxaeFPqYog==:
signature-input: sig1=("@method" "@target-uri" "content-digest");created=1787780262;keyid="https://mastodon.social/users/Edent#main-key"

The signature-input tells you how to construct a "Signature Base". You have to build a text string which places the various components in the order specified and separated with a newline:

"@method": POST
"@target-uri": https://example.viii.fi/inbox
"content-digest": sha-256=:tFdB/ENGczHMlZMDb66pXoUi2d0OqH2iBHdnN/WV1mc=:
"@signature-params": ("@method" "@target-uri" "content-digest");created=1787780262;keyid="https://mastodon.social/users/Edent#main-key"

Where @method is the HTTP method used to send data to your server (usually GET or POST), and @target-uri is the URl the message was sent to (usually your inbox).

The publicKey is slightly trickier. As you can see, the signature-input ends with keyid="https://mastodon.social/users/Edent#main-key

If you make a signed request to that URl, you'll get back an ActivityPub Actor document. It will look something like this:

{
  "@context": [
    "https://www.w3.org/ns/activitystreams",
    "https://w3id.org/security/v1",
  ],
  "id": "https://mastodon.social/users/Edent",
  "webfinger": "Edent@mastodon.social",
  "type": "Person",
  "name": "Terence Eden",
  "publicKey": {
    "id": "https://mastodon.social/users/Edent#main-key",
    "owner": "https://mastodon.social/users/Edent",
    "publicKeyPem": "-----BEGIN PUBLIC KEY-----\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAsYMEs4waqk/6gaS+xn1T\nYygElTtNIFNkBcEdEBMaeoGVhyZiVKtSjJCS4z+X+394PKvcfSTcFILIt2GI2jOB\nHD0M2fFgxc8mmdSdCQkgEh9jF3bFI3kopDvzYf726iioYKlHXKpfPKvFt7EJgKH7\naCtS25NQkek3YUd6y3VBcT3R6Xhze9P3QNoZMIsFXklgXDKj+EllfbUqLf1vxt3s\nmD9ETxy2bJi9FheE0uY2WhARn49XAvwczM5Wzt+zqxVEtgpi5v2+ZZAVKhDnJkiC\nCCuI6hrSnKNIx/5mSlX0a0S5h5d03djrCkYsqmwelu01rhOXP2grsz4BXp0y2wrO\n3QIDAQAB\n-----END PUBLIC KEY-----\n"
  },

The publicKeyPem is the string you need. There's no need to convert the \n to literal newlines.

Is that it?

Not quite! All we've done so far is verify the headers. It is possible that these are genuine headers but attached to a fraudulent body.

This takes us back to the header "content-digest": sha-256=:tFdB/ENGczHMlZMDb66pXoUi2d0OqH2iBHdnN/WV1mc=:

That says that the body of the message sent has a Base64 encoded SHA256 hash of tFdB/ENGczHMlZMDb66pXoUi2d0OqH2iBHdnN/WV1mc=.

To calculate your own content digest in PHP:

$digestCalculated = base64_encode(
    hash(
        algo: "sha256",
        data: $body,
        binary: true
    )
);

Does your digest match the one sent along with the headers? If not, something dodgy is going on.

Putting it all together

The steps are:

Get the headers.
Get the body.
From the headers' content-digest extract the algorithm and hash.
Using the body, calculate your own hash using the algorithm from content-digest.
Does your hash match the sent hash? If not, stop. If so, proceed.
From the headers' signature extract the base64 encoded signature.
From the headers' signature-input extract the signature-input string.
From the signature-input string extract the order of the Signature Base.
Construct the Signature Base.
From the signature-input string extract the keyid.
Get the Public Key from the keyid.
Use openssl_verify() to verify the Signature Base and the base64 decoded signature, against the Public Key using SHA256.

Note, Mastodon only uses SHA256. I think it should explicitly say which algorithm it is using and have raised the issue.

In Code Form

This is how you do it in PHP. Please read this carefully as there are some hard-coded assumptions.

 =::
$digestString = $headers["content-digest"];
//  The Base64 encoding may have multiple `=` at the end. So split this at the first `=`.
$digestData = explode( separator: "=", string: $digestString, limit: 2 );

//  Hashes are in lowercase, but have a `-` in their name.
//  This is not what hash_algos() expects.
$digestAlgorithm = str_replace( search: "-", replace: "", subject: $digestData[0] );

//  The hash is surrounded by `:` characters.
$digestHash = str_replace( search: ":", replace: "", subject: $digestData[1] );

//  Check if the hash algorithm is one known about to PHP.
//  If not, reject and record an error.
if ( !in_array( needle:$digestAlgorithm, haystack: hash_algos() ) ) {
    return false;
}

//  Manually calculate the digest based on the data sent.
$digestCalculated = base64_encode( hash( algo: $digestAlgorithm, data: $input, binary: true ) );

//  Does our calculation match what was sent?
if ( !( $digestCalculated == $digestHash ) ) {
    return false;
}

//  The signature format is signature => =::
$signatureString = $headers["signature"];
//  The Base64 encoding may have multiple `=` at the end. So split this at the first `=`.
$signatureData = explode( separator: "=", string: $signatureString, limit: 2 );
$signatureName = $signatureData[0];

//  The signature is surrounded by `:` characters.
$signatureB64 = str_replace( search: ":", replace: "", subject: $signatureData[1] );

//  The signature-input format is complicated!
$signatureInputString = $headers["signature-input"];

//  Get the parameters. Assume there is only one signature.
$signatureParamsString = explode( separator: "=", string: $signatureInputString, limit: 2 )[1];

//  Get the different elements of the signature.
$signatureInputData = explode( separator: ";", string: $signatureInputString );

//  Construct the data.
$signatureInput = [];
foreach( $signatureInputData as $signatureInputParts ) {
    $partsData = explode( separator: "=", string: $signatureInputParts );
    //  Strip quotes from keyid and parentheses from sig1.
    if ( "keyid" == $partsData[0] ) {
        $partsData[1] = str_replace( search: "\"", replace: "", subject: $partsData[1] );
    }

    if ( $signatureName == $partsData[0] ) {
        $partsData[1] = str_replace( search: ["(", ")"], replace: "", subject: $partsData[1] );
    }

    $signatureInput[ $partsData[0] ] = $partsData[1] ;
}

$signatureStructure = $signatureInput[$signatureName];
$signatureKeyID     = $signatureInput["keyid"];

//  Remove quotes.
$signatureStructure = str_replace( search: "\"", replace: "", subject: $signatureStructure );
$signatureStructureData = explode( separator: " ", string: $signatureStructure );

//  https://www.rfc-editor.org/info/rfc9421/#section-2.5
$signatureBase = "";
foreach ( $signatureStructureData as $signatureStructureParts ) {
    if ( "@method" == $signatureStructureParts ) {
        //  https://www.rfc-editor.org/info/rfc9421/#name-method
        $signatureBase .= "\"@method\": " . strtolower( $_SERVER["REQUEST_METHOD"] . "\n" );
    }
    if ( "@target-uri" == $signatureStructureParts ) {
        //  https://www.rfc-editor.org/info/rfc9421/#section-2.2.2
        //  Change the domain name to your own.
        $signatureBase .= "\"@target-uri\": https://EXAMPLE.COM" . $_SERVER["REQUEST_URI"] . "\n";
    }
    if ( "content-digest" == $signatureStructureParts ) {
        $signatureBase .= "\"content-digest\": $digestString\n";
    }
}

//  https://victoronsoftware.com/posts/http-message-signatures/#how-the-signature-is-created
$signatureBase .= "\"@signature-params\": $signatureParamsString";

//  Get the signing user's public key.
//  This is usually in the form `https://example.com/user/username#main-key`
//  This is to differentiate if the user has multiple keys.
//  This may need to be a signed request. You will need to write your own getDataFromURl() function to get the sending user's key.
$userData  = getDataFromURl( $signatureKeyID );
$publicKey = $userData["publicKey"]["publicKeyPem"];

//  Verify the request
$verified = openssl_verify(
    data:       $signatureBase,
    signature:  base64_decode( $signatureB64 ),
    public_key: $publicKey,
    algorithm:  $digestAlgorithm
);

//  Convert the result to boolean.
if ( $verified === 1 ) {
    $verified = true;
} elseif ( $verified === 0 ) {
    $verified = false;
} else {
    $verified = null;
}

return $verified;

Thanks to NLnet

This blog post was funded in part by the work I'm doing for my NLnet NGI0 grant. Thanks!

Drawing for St Jude: Petrichor - Robb Knight • Posts • Atom Feed

2026-09-03T10:48:36.000Z

If you missed it, Adam and I are raising money for St Jude this month and you can donate here. One of the rewards I offered this year and last is I will do a drawing of whatever the donator wants. These vary from the very simple "a horse" to the detailed like "a platypus on a unicycle in Japan at night". George ordered one with this in the notes:

Did you know, petrichor is "the smell of dirt after rain"? It's a pleasant smell that indicates that life is returning. Like Spring, but your smell. What's your petrichor?

I don't think I'd ever heard of "petrichor" but it's nice to learn things. Not only is George making me draw he's making me think which is pretty rude. After a bit of clarification I thought on this for a day or two about what smell makes me the most happy it's Marmite on crumpets, no contest.

Morning impressions - James' Coffee Blog

2026-09-03T00:00:00.000Z

Opening the window, a vivid dancing shadow of the trees between the glass and the sun appears the wall, illuminating yesterday’s ideas written across my whiteboard. The shadow is a temporary, moving work of art, detailing the contours of leaves and, when I stand in front, the stray hair from my head still unbrushed from having woken up half an hour prior. As the minutes pass, the impression of the trees becomes hazier, more abstract: the sun is moving. The limited conditions that made the art possible fade by the minute.

I think of all the possibilities of morning: of the songs to be sung by the birds – on the forefront of my mind as I hear the soothing, familiar call of a pigeon outside – and the way the light wakens both outside and inside. The artwork is intensifying again; perhaps one of the clouds outside was obscuring it temporarily. The trees once again dance, moving with the September wind. I stop and notice a faint breeze coming from the window; I, too, feel the September breeze, a cooling touch after a warm summer.

I take a sip of my warm tea whose temperature contrasts with the cool air outside, and, a moment later, look out the window, seeing amber leaves and rainy roads, and the peace of morning – essences of Day. I look forward to the day ahead.

fishing - James' Coffee Blog

2026-09-03T00:00:00.000Z

trees and canopies
shelter for the fisherman
stoic as a river: he is still
in movement
engaged like a painter
watching the moment.

This poem was inspired by Jules-Louis Dupré's "Willows, with a Man Fishing".

Willows, with a Man Fishing