Shellsharks Blogroll - BlogFlock

Discoverability Is Only Solved If You Can Be Discovered - Kev Quirk

2026-10-31T13:58:00.000Z

Discoverability Is Only Solved If You Can Be Discovered

by Widdershins

This is a follow up to my post where Widdershins talks about how they agree with certain parts of my argument, but that the discoverability piece is flawed.

Read post ➡

Saw this in my RSS feed and thought it was an interesting take that's worth sharing - also Widdershins' blog is excellent. I'd recommend adding it to your feed reader.

I think the argument around other people controlling the gate to discoverability is a sound one, generally, but sites like Bubbles tend to add most sites, unless they're somehow obnoxious. So inclusion (and therefore discoverability) is only an email away. Having said that, one person's obnoxious is another person's heaven, so it's all subjective.

Either way, it's an interesting debate and I'm glad we're having it. Go check out Widdershins' blog too!

Thanks for reading this post via RSS. RSS is ace, and so are you. ❤️

You can reply to this post by email, or leave a comment.

Open Tabs October 2026 - The Weblog of fLaMEd

2026-10-31T13:00:07.000Z

What’s going on, Internet? If you don’t follow my Bookmarks through the feed, then here’s the bookmarks from October. Enjoy.

Bit of a theme this month, the old web was messier and more fun, and running a site now keeps getting harder.

Jenny O’Connor on why the embarrassing internet was the good internet. My old fan pages agree.
Winnie Lim on why running a personal website is not fun anymore. Rough read. Between AI bots scraping the fuck out of the open web and hackers using AI agents to find holes, no wonder.
Aaron’s Early Web Links is a one-person directory of personal homepages, covering all types of personal websites.
wulfpaper on why making websites shouldn’t seem so hard. Start with the writing, worry about code and design later.
A big alphabetised list of old linkware webset graphics sites. Handy if you’re after that old-school look.

For more, check out the bookmarks archive, and subscribe to the feeds if you want these as they happen.

Hey, thanks for reading this post in your feed reader! Want to chat? Reply by email or add me on XMPP, or send a webmention. Check out the posts archive on the website.

Gig Review: The Witcher in Concert ★★★★☆ - Terence Eden’s Blog

2026-10-31T12:34:18.000Z

The most common way people experience classical style music these days is via movies and video-games. After seeing The Force Awakens - live in concert, I've become rather a fan of watching movies performed with a live soundtrack.

But what about watching a video game with orchestral accompaniment? We travelled up to Wolverhampton to see "The Witcher":

A one-of-a-kind live event that transforms the lasting legacy and emotional storytelling of The Witcher 3: Wild Hunt into an immersive concert

Obviously you can't have someone sat there with a PS5 controller while a band plays (although that'd be a hell of a Twitch stream!) instead a large screen projects various cut-scenes and in-game footage. It works pretty well - most of the popular scenes are in there (Geralt in the bathtub got a big cheer) although there was no hyper-extended Gwent session. The videos were a little repetitive. Some of the music is obviously composed to be swelling in the background and so repeated shots of swords looking cool or Geralt looking grumpy were sprinkled throughout.

The highlight was seeing Percival Schuttenbach play a variety of instruments with absolute joy and gusto. The entire band look like they're having a whale of a time, and the conductor encouraged us to whoop and cheer for our favourite scenes (with perhaps a few boos for some of the more notorious enemies).

As soundtracks go, it isn't particularly varied. There's a decent mix of tunes, some with singing, but they do tend to blur into one after a while. Nevertheless, a brilliant time for fans of the game who want to soak up the music.

The Witcher in Concert is on tour around the world now.

Pre- and Post-Show

There was a merchandise stall hidden in one corner of the venue. Between doors opening and the start of the show (about an hour) a video looped through three screens - one of which encouraged up to share our photos with a hashtag. That's fine, but a few more videos wouldn't have gone amiss.

After the show, the conductor said the band would stick around for selfies - which was nice of them.

A touring show like this probably can't spare too much space for large scale models for people to pose with, or a couple of cosplayers to photograph, but it might have been nice if there were something to interact with before and after the show.

Identity Assertion JWT Authorization Grant Draft 06 - Articles by Aaron Parecki

2026-10-31T00:55:21.000Z

We've just published draft -06 of the Identity Assertion JWT Authorization Grant (ID-JAG):

https://datatracker.ietf.org/doc/draft-ietf-oauth-identity-assertion-authz-grant/

It's been great to see so many new implementations of ID-JAG over the past few months, across identity providers, authorization servers, clients and libraries. -05 and -06 are mostly about bringing what we've learned from these implementations back into the spec. The diff looks big, but most of it tightens the wording so independent implementations interoperate better. The flow and the overall design haven't changed.

Most of the changes are clarifications, such as:

How resource and audience values are compared and validated
Which sub value the IdP selects for the Resource Authorization Server, and how subject identifiers are mapped
Whose claims the ID-JAG carries (End-User, client, etc)
How the Resource Authorization Server finds and validates the ID-JAG signing keys
SAML NameID handling
Using a Refresh Token as the subject token
Error codes for common failure cases, and when a Client should request a new ID-JAG
Fixes to examples and references

A few changes are new, or make explicit what implementations were already doing:

The IdP authenticates the Client at the Token Exchange step, and the request carries a single audience value
When a subject token fails validation, the IdP now returns invalid_request instead of invalid_grant, as RFC 8693 requires. If you've implemented the Token Exchange step, please check your error handling.
At the Resource Authorization Server, a key-bound ID-JAG can be used in place of client authentication
mTLS is defined as another option besides DPoP for binding the ID-JAG
New id_jag_signing_alg_values_supported IdP metadata
A new Privacy Considerations section

The full list is in the Document History section.

Diff from -04

Thanks to everyone who has been implementing this and sending feedback, and especially to Karl for working through so many of the issues. I'm hoping to get time at IETF 127 to go over the remaining open issues. In the meantime, comments are welcome on the list or at https://github.com/oauth-wg/oauth-identity-assertion-authz-grant

Morning - James' Coffee Blog

2026-10-31T00:00:00.000Z

A golden glow peeked through the edges of the curtains. What colour is the sky this morning?, I wondered, knowing in the back of my mind that the colours may only be there for a few more minutes – such is the pace of the sunrise. No moment can be taken for granted. I opened the curtains and saw a salmon-esque glow in the sky: not quite pink, but not quite orange: a mix of both colours. The sun was rising in the opposite direction, at the stage where the whole landscape seems transformed by ephemeral colours.

I later thought about how the landscape is always changing with the day – the sunrise on a relatively clear day like this morning’s, where the sky was only dotted with clouds, brought forth the aforementioned pink-ish colour, and golden colours, too. Trees not yet touched by the sunlight had a faint patina, as if they were in a Renaissance painting that had long since aged. But these trees were real, right in front of me, bathing in the rhythms of the day.

If only I could describe the trees with the same precision of a painting.

Was that an eagle, soaring through the field? I haven’t seen one as long as I could remember. The interlaying golden light rises from the distance; the streams in the valley were woken on their own accord, always flowing, for the sparkling sunlight has not shone on them yet. I watched the landscape with wonder, as I always do.

⁂ ⁂ ⁂

I went on a long walk today, to make up for the time lost from last weekend where I stayed mostly indoors to weather the storm. The last week has been one of missed routines and reminding myself that this too shall pass. While last night I sat by my piano playing sad songs, later resting my tired head between my arms on top of the keys, this morning I woke up with newfound energy and vigour. I can never remember exactly how I get better when I feel down, but going out for a walk surely helped.

The morning sky ushered forth darkness’ bye.

In the park, I walked on wood chips sprinkled with yellow trees under relatively low canopies. The path on which I walked was only meters away from the concrete one with which I was more familiar, but I wanted to feel something new under my feet – to get closer to the ground; to feel whether the wood chips would be softer than the concrete. Although I was so close to the concrete path, what was ahead was different, the sounds and sensations of the ground were different; the view of the sky, intermediated by low hanging yellow and orange and green leaves, is new.

I walked for miles, finding a rhythm that meant I was walking up the hilly streets faster than I expected. At one point, I stopped at a gallery window to admire an artist whose works depicted landscapes over the sea. The pink and orange and blue colours were breathtaking, the kind of works that stop you in their tracks. The gallery was one where works were for sale. It makes me think about how much I love that there are still new artists making works. I don’t know if the works I saw today were new, but they did feel more contemporary, capturing the world in a different way to pieces I have seen in museums.

A man walking down the street wore a shirt that caught my eye. “Creatives are the new athletes.”

Note published on October 30, 2026 at 10:13 PM UTC - Molly White's activity feed

2026-10-30T22:13:53.000Z

In July 2024, I reported that Coinbase appeared to be violating campaign finance law by making contributions while holding federal contracts. I filed an FEC complaint alongside Public Citizen. The FEC hasn’t acted. Since, Coinbase has given $60M more and landed another federal contract.

Coinbase responded to the initial complaint by arguing that, despite having received a federal contract, they were not a federal contractor — then insinuated I had secret funders and made lightly veiled legal threats against me.

“It’s bad enough when the laws are weak or there are loopholes in the law, but it’s almost worse when you have laws on the books that aren’t being enforced because the regulator is inadequate, and that’s the situation where we’re finding ourselves now,” said Eric Petry, counsel in the Brennan Center for Justice’s elections and government program.

I track Coinbase’s (and its top executives’) campaign spending. They’ve spent $100 million+ since 2024 across super PACs, Trump campaign committees, and other individual candidates.

Published on Citation Needed: "It’s always North Korea" - Molly White's activity feed

2026-10-30T17:03:56.000Z

Published an issue of Citation Needed:

It’s always North Korea

Answering your questions about who was behind the Binance hack, how they launder the money, and where it goes

SocialSpec Seems...Pointless - Kev Quirk

2026-10-30T16:36:00.000Z

I've seen a few people talking about SocialSpec which claims that "the future of social media is websites". Something I strongly agree with. However, I don't see the point of this fledgling spec on top of all the other IndieWeb complexity that's flying around.

From what I can gather, it's 3 files that you upload to /.well-known which provide a bio, a means of contact, and what blogs you follow. Step one is to have an RSS feed, actually, but everyone should have an RSS feed anyway. But aside from this, I already have a bio, a means of contact, and a list of blogs I follow. So what is SocialSpec trying to achieve?

Again, from what I can gather from the site, you publish these 3 files on your site and you're magically enrolled in the new website social network. Where you can peruse a timeline of posts from fellow bloggers, based on who you follow in your OPML file.

Fuck yeah! Win for the open web. Sign me up!

But hang on a second. This open spec, based on open protocols, for the open web doesn't even have a web app. Nope. The only client that actually uses it is sitting behind a fucking iOS app.

Now I'm sure other apps will come with time, but if this were truly a platform for the open web, wouldn't a website that supports a PWA have been a better solution initially? I think so.

What does it solve?

Even if someone takes the time to publish and maintain these files, what does SocialSpec offer over an RSS feed reader, and a couple of pages on your site?

Nothing.

I like how people are thinking of ways to interconnect sites in this way, but I don't think this is the right approach. It's trying to solve a problem that doesn't really exist in my opinion. The only issue it may fix is discoverability. But I still think it's flawed as the service would need a decent user base to make discoverability viable.

Sites like Bubbles, PowRSS, and Bear Discover are far better than this solution as they're easier to use and have no barrier for entry.

Maybe I'm being a curmudgeon here, but I really don't get it. This is a solved problem, and has been for decades.

Thanks for reading this post via RSS. RSS is ace, and so are you. ❤️

You can reply to this post by email, or leave a comment.

Notable links: October 30, 2026 - Werd I/O

2026-10-30T15:55:30.000Z

Most Fridays, I share a handful of pieces that caught my eye at the intersection of technology, media, and society.

Did someone forward this to you? Subscribe for free.

ChatGPT Is Building Detailed Psychological Profiles of Its Users

It probably shouldn’t be a surprise that chatbots like ChatGPT are profiling their users. Still, there are some surprising numbers here:

“A staggering 96 percent of memories were created unilaterally by the chatbot, according to the study, meaning that the users had little overt control over the data points that ChatGPT logged as their interactions wore on. Stored memories were also deeply revealing about users. About 28 percent of the memories examined contained personal data as defined by Europe’s strict General Data Protection Regulation standards, and 52 percent contained rich “psychological insights” about users.”

I think back to Gina Chua and Adiel Kaplan’s three-layer cake analogy for the AI stack. In their analysis, the consumption layer profiles the user; this new report makes clear how deep that profiling goes.

As I said in my commentary then:

“Profile data is accumulated, private, and usually non-portable. The consumption layer also represents the greatest risk to creators from platform business decisions, both in terms of the business models of those platforms and which creators they choose to feature. Open portability standards and protocols — combined with full user control of their data — can scale, create useful competition, and empower users in the process.”

Nothing here dissuades me from that view. To be as useful as possible, AI tools need to dig into our most personal information, make inferences about who we are and what’s interesting to us, and maintain highly personal profiles. Our AI agents are not some kind of trusted friend: they are products owned by a third party that needs to justify a trillion dollar valuation and may not have our best interests at heart. All the major vendors provide services used by the military and law enforcement. What happens if one of those agencies wants to get hold of that profile information? These companies simply cannot be trusted with our most private information, and should not have access to it.

But, of course, legislators have also been negotiated into a position of alignment with AI accelerationism. We need to gather all of this personal information about individuals in a supposed democracy, they argue, because otherwise China will win! These concerns seem to trump the fact that privacy is considered a fundamental human right, for very solid and defensible reasons: it makes dissent, organizing, a free press, and a well-lived life possible.

I am not arguing that there are not legitimate uses for AI or that the technology is not transformative. But there should not be an argument that we should let go of our core human values or the fundamental protections needed to maintain a robust democracy — of which privacy is one — because this tech is cool and we need it to grow really fast and by the way it’s also now propping up our economy. Trading privacy for growth is not a smart long-term strategy: it will bite us.

As individuals, we can protect ourselves by using different tools. But privacy is a group inoculation. If the chatbot is profiling its users, I suspect it’s also profiling the people its users are talking about. We need to demand better behavior from our vendors while taking steps to also demand it from our friends.

Manifestos, Fear, and ‘Loser Thinking’: Inside Proton’s AI Reckoning

Proton, based in Switzerland, offers encrypted email, file storage, calendars, and more. It markets itself as a privacy-oriented alternative to Google Workspace, based in a neutral territory that is generally outside of the jurisdiction of the United States. I’ve generally been glad that it exists — but stories like this give me pause.

404 Media reports:

“Our reporting also paints a picture of Proton that is likely very different to the public’s perception of a company with a goal of carefully protecting privacy: one that in reality is barreling ahead with AI as quickly as possible so it can achieve the explicit goal of more annual revenue.”

CEO Andy Yen comes across as a bully who is pushing his staff to adopt AI as quickly as possible in order to maximize Proton’s revenue because its ARR was slipping. That’s not an approach you would hope a security-oriented, encryption-based organization would take.

This follows an unwise decision to praise a Trump nomination at the beginning of his second administration. Yen said it wasn’t intended as a political statement. I don’t think that he’s necessarily a Trump supporter, but it was part of a series of incidents that follow a troubling pattern: an action that undercuts Proton’s brand and stated values, followed by defensive excuses. It suspended journalist accounts at the request of a cybersecurity agency and then called the outcry “blown out of proportion”; it handed over the recovery email address for a Catalan activist, an iCloud address that led to Apple providing their full personal information, and said its hands were tied.

And then there’s this:

“Andy Yen, the CEO of Proton, had a message for an employee in the company’s security Slack channel who urged the company to at least take a few days to pentest newly written code before pushing it live. “That’s bullshit and loser thinking. Of course it’s possible to be fast and secure,” Yen wrote in the channel at the end of August. “Stop thinking always of how to be slower, and focus more on how to be faster.””

Services like Proton need to exist. Privacy is an important prerequisite to democracy: it protects journalists, activists, vulnerable communities, and everyone’s ability to live well and with dignity. But it’s a serious business. A move-fast culture of bullying that apes startup-land and calls caution “loser thinking” does not instill confidence, and implies it’s only a matter of time before something much worse happens.

'It's offensively cheap': How solar power is quietly becoming bigger than nuclear

This is something we should all be excited about:

“The world's solar power is crossing a threshold. A decade ago, it barely registered on a global scale, providing just 1% of the world's power. In 2026, it will almost certainly increase to 10% of power, and overtake nuclear, a mainstay of electricity since the late 1970s.”

Solar energy is abundant, and the cheaper and more efficient it gets, the more electricity there will be to power anything we want. On that level alone, we should be cheering for its success.

But the other property solar energy has is relative decentralization. While not anyone can build a solar panel, anyone can plug one in — and, obviously, the sun belongs to everyone. It represents real energy independence, not just internationally, but from large energy companies (at every level from fossil fuel multinationals to utilities) that have enjoyed enormous influence for over a century.

Or it should. Energy companies have sponsored laws, rules, and regulations in the US and elsewhere that have made it harder for people to plug solar in. Those should be defeated, and our electrical systems should be upgraded to take decentralized solar into account.

But the power dynamics don’t end at the influence of energy companies: a large share of the polysilicon in solar panels is produced in Xinjiang, where there have been well-documented allegations of forced labor of Uyghurs and other minority groups. Batteries often contain cobalt, which is dug from the Democratic Republic of Congo, often by hand and often by children and slaves. They also contain lithium, drawn from brine operations that drain water from Indigenous communities in the Andes.

The next frontier needs to be freeing these technologies from harm — and there’s a long way to go. There’s some promise from tech like nickel-and-cobalt-free LFP batteries, more ethical lithium extraction, and recycling, but these need further investment, and the underlying issues require sustained attention. There is an energy revolution, but everyone should see the benefits.

And more:

Here are some of the articles I didn't get a chance to go into in depth this week.

It’s now official, tech is the new tobacco

Following in the footsteps of tobacco and the fossil fuels industry, tech companies have been sponsoring academic research that conveniently produces findings in their favor, while working hard to discredit research that might undermine their businesses. Internal documents from Meta, made public through an ongoing lawsuit against them, confirm it.

The Subculture Flywheel

In common with all of Corey Ford's guides, this is an easy-to-follow way to build culture and practices in your team that further the values and outcomes you want to see. It's simple, human, and effective.

Silicon Valley wants you to invest in miracles

Anthropic's S-1 filing is bananas. It's openly cult-like: it wants you to "be part of something bigger" that, by the way, might destroy humanity. As one Wall Street leader put it to me this week: either they're lying about the impact and they shouldn't be allowed to go public, or they're telling the truth about the impact and they shouldn't be allowed to go public. Also, they acknowledge that they might never be a viable business. Fun times.

Book Review: The God of Small Things by Arundhati Roy ★★☆☆☆ - Terence Eden’s Blog

2026-10-30T12:34:22.000Z

I did not care for this one bit. I found it cloying, infantilising, and far too circuitous.

It starts off as a bit of an overwritten melodrama, where every phrase is a delicious flower waiting to bloom, but ends up being a over-sugared mess with a rotten heart. Parts are just exhausting to read, with no time to catch your breath between scenes. That can work in some books when spaced out - here I just found it annoying.

My main problem with it, though, is that it feels like it is entirely exposition. Because of the (unnecessarily) jumbled order of the story, every paragraph feels like it is introducing us to something or someone. Rather than progress the plot, I felt like I was being drip-fed morsels for what was coming up. In the end, the story just isn't interesting enough to support that.

Parts of the writing are gorgeous, but they're in service of so little that it seems like an unfair sleight of hand; you're too busy admiring the prose to realise how dull and uneventful everything is. The repetition hammers away like a vocal tic - wearing out its welcome by the tenth occurrence. The mannered spelling, punctuation, and extemporising is similarly grating after a while.

I don't mind characters being unsympathetic - but every single one is painted as a monster or a simpleton. It's hard to keep reading when nearly all the main characters are so relentlessly unlikeable. I know I'm not a big fan of sad or upsetting books, but there was so little joy or happiness in this one that I felt grimy reading it. Afterwards I was left wondering what the point of it was. I do not doubt that the depictions of casteism were well done but, again, to what end?

I read this for a book club and wondered what my fellow readers made of it. All of us found it a challenging read, with most raising similar criticisms to mine. We all found the prose to be beautiful but the plot lacking. Only one of use gave it a positive review - but we all agreed it was a fascinating book to discuss.

Perhaps we were all just philistines? Yet each of us came up with a compelling reason why we found it so unpalatable. There truly was something for everyone to complain about.

Weeknote #2024 - Robb Knight • Posts • Atom Feed

2026-10-30T11:06:00.000Z

WordArt is back, baby.

This is fun. Put in a postcode or area and Local Wikipedia shows you articles local to you.

Postmark make games that are printable and just need common game components like cards or dice to play. Neat.

Wonders of Web Weaving, a podcast I was a guest on back in August, has just published it's 25th and final episode. James has some behind the scenes info here about the show.

Shep, a prolific maker of web things, posted about Instant Fail which is a soundboard of fail sounds and that led me to find his F16 Bit project — "Real Formula 1 race data, redrawn as a 16-bit arcade broadcast". So good.

Stupid game trailer made me feel things.

Lou reminded me I needed to do my llms.txt. So I did.

The trailer for the new Jumanji dropped and it looks as stupid as ever. I can't wait.

I learned about Psalty and I can never unsee it.

Proton is AI-pilled and calls caution "loser thinking". - Werd I/O

2026-10-30T03:25:48.000Z

Link: Manifestos, Fear, and ‘Loser Thinking’: Inside Proton’s AI Reckoning, by Joseph Cox at 404 Media

Proton is a service based in Switzerland that offers encrypted email, file storage, calendars, and more. It markets itself as a privacy-oriented alternative to Google Workspace, based in a neutral territory that is generally outside of the jurisdiction of the United States. I’ve generally been glad that it exists — but stories like this give me pause.

404 Media reports:

“Our reporting also paints a picture of Proton that is likely very different to the public’s perception of a company with a goal of carefully protecting privacy: one that in reality is barreling ahead with AI as quickly as possible so it can achieve the explicit goal of more annual revenue.”

And then there’s this:

“Andy Yen, the CEO of Proton, had a message for an employee in the company’s security Slack channel who urged the company to at least take a few days to pentest newly written code before pushing it live. “That’s bullshit and loser thinking. Of course it’s possible to be fast and secure,” Yen wrote in the channel at the end of August. “Stop thinking always of how to be slower, and focus more on how to be faster.””

Proton is AI-pilled and calls caution "loser thinking". - Werd I/O

2026-10-30T03:21:00.000Z

Link: Manifestos, Fear, and ‘Loser Thinking’: Inside Proton’s AI Reckoning, by Joseph Cox at 404 Media

404 Media reports:

“Our reporting also paints a picture of Proton that is likely very different to the public’s perception of a company with a goal of carefully protecting privacy: one that in reality is barreling ahead with AI as quickly as possible so it can achieve the explicit goal of more annual revenue.”

And then there’s this:

“Andy Yen, the CEO of Proton, had a message for an employee in the company’s security Slack channel who urged the company to at least take a few days to pentest newly written code before pushing it live. “That’s bullshit and loser thinking. Of course it’s possible to be fast and secure,” Yen wrote in the channel at the end of August. “Stop thinking always of how to be slower, and focus more on how to be faster.””

Published on Citation Needed: "North Korea gets away with around $3 billion from Binance" - Molly White's activity feed

2026-10-30T01:07:37.000Z

Published an issue of Citation Needed:

North Korea gets away with around $3 billion from Binance

Stablecoin issuers froze about $2.4 billion of the roughly $6.3 billion stolen. The rest exceeds Binance’s insurance fund, and the man promising to make users whole isn’t supposed to be running the company.

Note published on October 29, 2026 at 9:30 PM UTC - Molly White's activity feed

2026-10-29T21:30:40.000Z

It looks like Binance is getting drained right now, across multiple hot wallets, for $2B and counting.

Pretty normal for exchanges to migrate wallets, NOT normal for them to then swap to Tether and dump

Putting music data to work - Posts feed

2026-10-29T19:38:46.000Z

I had someone ask me the other day why I collect all the music data that I do and I wasn't sure how to answer. Some of it's an interest in my own listening patterns, and another part of it is nostalgia for the last.fm I used heavily during its heyday. I guess I like quantifying those things. It's become a bit more than that too — I curate artist bios, I pull in genre descriptions from Wikipedia, and I fiddle with metadata. I also put some of this data to work.

I use Navidrome to listen to music. I've written a client and written at length about it. It's had plugin support for a little bit now and I have, of course, written a few. Since I have artist bios stored on my site for each artist, I wrote and exposed an API that returns those bios in HTML. I wrote a plugin for Navidrome that scans this endpoint periodically and pulls in those bios to display on artist views.

I have art for every single album in Navidrome (mirrored to my site to scrobble against) that sits in a pull zone over at bunny. I wrote a macOS screensaver (you can still do this!) that queries an endpoint with all of the album cover URLs and mimics the iTunes/Apple Music album cover screensaver. My Google TV has a screensaver option that shuffles a Google Photos album. I have an automated job that pushes album art to a dedicated album as it's added.

When I import an artist from Navidrome, the MusicBrainz ID is imported with it. I run a nightly job to query MusicBrainz for new releases from all of the artists in my collection. I've added a widget on the dashboard for my CMS that allows me to quickly scan these releases and dismiss or import them. If I import them, they're added to my anticipated albums page and used to generate an ICS file I subscribe to so I can view them in my calendar.

Recommendations are hard. The best ones are personal and sourced from fans. That's part of what made last.fm so compelling — the similar artists are derived from a trove of genuine listening data. AudioMuse-AI does an eerily good job of generating similar artists (which I have available in Navidrome via the plugin for it) but can't offer novel recommendations. ListenBrainz has listening data (much like last.fm) and offers solid recommendations. I can query these recommendations using the MusicBrainz IDs I store (while filtering out artists in my library).

I've built a separate concerts tracking app. It's a single page containing a table and it's populated by pulling the list of artists in Navidrome and comparing them to a query of the Ticketmaster API scoped to a 75-mile radius of the town I live in. I can hide concerts, buy tickets, or look up the venue.

So, I suppose, I have a lot more than just vanity metrics. But those are nice too.

Fixing Illustrations on a Dark Background with CSS - Robb Knight • Posts • Atom Feed

2026-10-29T19:38:11.000Z

If you've visited my site recently you might have noticed some illustrations I've done appear on some pages, notably the home page and my 404 page. I wanted to use this brick drawing I did for Inktober but on the dark mode background is doesn't look good:

My first thought was to just get rid of dark mode completely and just have light mode. I spoke to a handful of people about it and came to the conclusion that this was an extreme solution. Also, I like dark mode in general so it seems stupid to nuke it just for this.

I tried a handful of different things like changing the line colour to white and just loading the correct version depending on the theme. This worked, but still looked shit on dark mode. I tried some other things like adding an outline or even a thicker line like a sticker might have but all of them had the same problem — I would need to make two versions of every drawing which I really didn't want to do.

I had a vague recollection of being able to do a drop shadow on transparent PNGs and after some digging I found it can be done with filter and drop-shadow. Stacking two drop shadows give the best outline for what I wanted.

filter: drop-shadow(0 0 1px #ececec) drop-shadow(0 0 1px #ececec);

It's not perfect but it does the job, especially on drawings that have a more defined outline like the hats.

Now I can start adding some more illustrations I've got lined up for the site.

2026-10-29 14:56: Been having some fun with my 404 page. I love discovering little Easter eggs like... - Kev Quirk

2026-10-29T14:56:00.000Z

Been having some fun with my 404 page. I love discovering little Easter eggs like this on other people's sites. Just visit a random page, like https://kevquirk.com/mjkk

Thanks for reading this post via RSS. RSS is ace, and so are you. ❤️

You can reply to this post by email, or leave a comment.

A whimsical CSS :target design for headings - James' Coffee Blog

2026-10-29T00:00:00.000Z

The headings in my blog posts, and some pages, have HTML fragments so that each heading can be linked to. I seldom use this feature, most likely because, at present, I don't have a visual affordance to create such links. Occasionally, though, I find myself wanting to link directly to a heading, so I will make sure there is an anchor.

One such occasion was yesterday, when I was adding a new section to my categories page that lists all of my “Advent” series of posts. I placed the Advent heading at the bottom of the page and added an ID so I could target it with a fragment link. See the Advent section.

By default, unless you see the #advent part in the URL, it was not immediately clear to the viewer to what part of the page I was linking, because the Advent section is at the bottom and the browser doesn't highlight the specific linked section. This encouraged me to make a more explicit highlight for headings. My site mascot now appears, rotated 15 degrees, next to a linked heading, to draw attention to that heading.

Here is a screenshot of the feature:

And here is the code I used to implement the feature:

h2:not(a):target::before {
  content: url("https://jamesg.blog/assets/mascot/mascot.svg");
  height: 2rem;
  width: 2rem;
  display: inline-block;
  margin-right: 0.5rem;
  rotate: 15deg;
}

The CSS selector applies to any h2 that does not contain an a tag and where the h2 is targeted using a HTML fragment. The selector uses the ::before pseudo-element to add my site mascot.

I got the idea at Front End Study Hall today. I had an earlier design where the heading would turn yellow and have a black background, but this, while drawing attention to the heading, was more explicit than required. Someone said the word “playful” and I immediately thought “maybe my site mascot could be used here!”

Front End Study Hall today See the Advent section

Caching, bot defense and a CDN - Posts feed

2026-10-28T23:59:40.000Z

I've been wary of and interested in putting a CDN in front of my site. I had tools in place to block bots (and several countries), but they were fragmented and it was an ongoing rock fight. I had a Go job that banned IPs after too many 404s, a crawler denylist that mirrored my robots.txt, and an SQL-injection probe filter (regex). I also wanted the improved load times and other niceties that come with a CDN. The catch (and cause for my concern) is that I wanted my existing Redis caching, live routes (like the now playing block on the home and music pages), and other bot-related mitigations to keep working.

Setup

I've been using bunny.net to serve images here (and on my Mastodon instance) for ages, so it was a natural shift to put their CDN in front of the site itself. I pointed the domain you're reading this on to a new pull zone, while leaving the apex and my admin pointing at the origin server. The "public" origin is accessible only via requests from the edge through bunny. Each request has a header set with a shared key, and Caddy rejects any requests to www without it. Anything live is excluded from edge caching: now playing, my contact form, and a few other APIs.

Caching

I opted to have Go set cache lifetime per page with Cache-Control headers. There's a short default and longer ranges for pages that rarely change. I skipped bunny's Smart Cache (sometimes predictability is better than heuristics).

Cache invalidation is handled using tags (much like I do with Redis): every response has a CDN-Tag; saving things in my admin is debounced for a few seconds and then purges the appropriate tag. The cache is also purged at startup.

Redis caches database queries, bunny caches rendered HTML at the edge, and the page re-renders on every request that hits the origin.

Database migrations run when the new server starts. They write to the database directly, don't invalidate tags (or go to jail or collect $100), and benefit from the startup check that dumps the public content cache.

Blocking things

The important part! (Sort of.) I ran bunny's WAF in learning mode and tuned rules. If you block things outright, you block things you shouldn't (e.g. don't block contact form submissions in English). I maintain the list of crawlers I block in my CMS: each agent is a string tied to a path, and my robots.txt is generated, in part, from that relationship. These are now also synced into the CDN's rule set to block the same crawlers at the edge. bunny also provides their own block lists, and one of those lists blocked folks on Tor and VPNs (oops—that's set to challenge now).

Analytics

My analytics are hand-rolled and minimal. I have country data displayed in a graph, and that was previously populated using a GeoIP lookup. bunny, conveniently, supplies a country header, and the analytics now use that. I tweaked the implementation to record visits on page load rather than exit (exit events don't fire as reliably). Crawlers get excluded altogether (yay blocking!).

Reliability

bunny has a feature called Origin Shield that sets up an additional caching layer in front of my origin. Cache misses get consolidated into one point, and my origin server ends up seeing fewer requests. The added benefit (in addition to the performance) is that some of bunny's edge locations couldn't hit my origin (which is IPv4-only). Putting the shield behind an edge node that can reach the origin fixes that. The network topology is hostile and unknown and weird and unpredictable and magical.

Breaking things

Feed readers rely on If-None-Match to avoid redownloading unchanged feeds. I've left mine uncached so my (minimal) feed analytics can count polls. bunny drops conditional-request headers headed for the origin even for pass-throughs it doesn't cache, which means every poll is a 200. If I can't see the 304, I can't handle it properly, and, for that, I am appropriately apologetic.

Request coalescing: this will break live routes. It's super handy for near-simultaneous requests for the same relatively static thing where a single copy can be returned in a performant fashion. This is antithetical to the notion of things that return unique and/or live responses. I put in an explicit skip list for those routes.

When I deploy, visitors will briefly see 502s. A new copy of the Go binaries gets copied to the origin server, the app restarts, and Caddy hasn't reloaded its config yet (said config gets copied over as part of the deploy). There's now a short retry for Caddy to help mitigate this.

For my now playing display: a page cached on the edge could flicker when it rendered older album art next to a live stream. Stale vs. live data: bad experience. The new cover is decoded off-screen and swapped into the view.

Done, mostly

Hand-maintained IP banning is gone, crawler lists are out of Caddy, GeoIP is gone, and most of that now lives at the edge. Oh, and I added an analytics chart of blocked bots. They've been fucking off more over time, which is nice. Things should be faster, too!