Shellsharks Blogroll - BlogFlock

People are transcribing your conversations without asking. That puts you at risk. - Werd I/O

2026-07-21T02:40:50.000Z

Link: This Conversation Is Being Recorded. They All Are., by Katherine Bindley at the Wall Street Journal

I’ve been thinking about this story for days.

“A Zoom call isn’t complete without an artificial-intelligence note taker. Phones are out at meetings, capturing every word. During impromptu conversations with co-workers, someone might turn on the Granola transcription app, which can turn the interactions into one-page summaries or a list of action items. Even at bars and on dates, people are using AI-infused listening apps to analyze conversations later on.”

The story goes on to talk to a woman who uses Granola to record her dates, then pours the transcripts into Claude to give her feedback about how she could have done better. And there’s account after account of people using it in meetings without asking for consent or revealing that they’re recording.

Certainly in Silicon Valley, a societal shift seems to be underway. It’s likely much more widespread than that. I’ve been present in meetings outside the tech industry where Granola’s watermarking was visible but I wasn’t asked to consent. The watermarking is optional; I have to assume I’ve been in meetings where I’ve been recorded without my knowledge.

Pair this trend with the story that the Trump Administration actively sought the phone records of journalists — and their families — who reported on the new Qatari-gifted Air Force One. Subpoenas were issued to the phone carriers, and the Department of Justice notified the newsroom a week later. In some cases, subpoenas can be issued to carriers and service providers privately, allowing the data to be retrieved without the newsroom’s knowledge; in this case, the DoJ did try to gag the phone company from alerting the newsroom.

A world in which every conversation is recorded and transcribed is one where every conversation can be subpoenaed or surveilled. Here, the surveillance is decentralized through people who actively want to conduct it for their own benefit, but the data is still stored centrally and available for authorities to subpoena or someone else to mine. Granola’s security page makes clear that the data is accessible to them — and therefore to a third party that compels them to hand it over — and notes that:

“Granola trains on your anonymized data so we can keep making Granola better. You can opt out of this in your Settings.”

Granola makes a point of saying that audio is not stored, but given that transcriptions are, this seems moot: the words in a conversation carry its meaning. Subpoenas for your conversations go to it, not to you, and you may never know they were served. If you record someone’s conversation without letting them know, you’re putting them at risk.

Don’t get me wrong: I would love to have an automatic summary of meetings I’ve taken part in. I have also run meetings on non-sensitive topics where I’ve asked for consent before starting transcription. It’s the ubiquity and covert nature of the transcription that bothers me, paired with its central storage in what amounts to a honeypot for subpoenas and hackers.

Recording a conversation with someone without their consent is illegal in many states and countries, so this behavior may be forced to change. California is one of them, and Granola appears to be thriving there, so there is a world where the law changes to meet the new ubiquitous surveillance norm. Until the dust settles one way or the other, anyone who wants to talk about a sensitive topic, particularly in Silicon Valley, will need to be more wary than usual.

Wonders of Web Weaving, Episode 11 - James' Coffee Blog

2026-07-21T00:00:00.000Z

The eleventh episode of Wonders of Web Weaving is out:

In Episode 11, I chat with flaMEd, the author of flamedfury.com about, among other things, web communities around games and television shows, sharing music interests with a personal website, community in the indie web, and more.

I hope you enjoy the episode!

Wonders of Web Weaving also has an RSS feed you can use to follow along from wherever you get your podcasts.

flaMEd flamedfury.com The eleventh episode of Wonders of Web Weaving is out Wonders of Web Weaving also has an RSS feed

The Odyssey, air bubbles, and Monument Valley - W29 - Joel's Log Files

2026-07-20T22:40:00.000Z

The World Cup final is over, and justice has been made. As much as I love Messi as a player, Argentina just fell off this tournament and I didn’t want them to win at all. Spain managed to play fair and attack during the whole game, and even though two of their goals were invalidated, they still managed to score and snatch victory at last.

I would like to apologize for becoming a football fan all of a sudden. I’m actually surprised how little I mentioned the World Cup back in 2022 since I actually followed it quite a bit, but alas, To the weeknotes we go!

🎂 My dad’s birthday happened this week! So we went out to have some food and also shopping for gifts! I even got out of my workplace early so I didn’t double my lunch intake. My siblings made him get a couple of free things from some mall shops because of his birthday, so that was fun.
🪟 Took the time to install screen protectors to my XTEINK X4 and to my Nintendo 3DS… I didn’t take the time to do it… properly. Now every single screen on those devices has one (or more) bubbles on it, and I’m sure a lot of you will feel extremely annoyed by the thought. I just wanted to let you feel uncomfortable out of nowehere, yes I am that evil. I will keep playing Fire Emblem Awakening and happily ignore such little things.
🎮 In case you didn’t read my post about tracking my gaming, it was all just to share a PSP homebrew called GameDiary, which let’s you track your gaming on the PSP! It’s super cool and quite reliable so far, a great tool that gives the 3DS’ Activity Log a run for its money!
🤖 Wrote about the AI-generated webinar about using LLM for work and yeah, in case you missed it, it was a pain! though I had fun laughing about how ridiculous it was.
🍿 I was completely unaware that my family was going to kidnap me to go watch The Odyssey on Friday, but at least this time my sibling paid for the tickets, and I got a single popcorn bucket for everyone, which served its purpose well.
🍗 My family bought some food before the movies—it’s why a single popcorn bucket worked out—but I had already eaten lunch at my workplace, so I was a little mad about it, but still ate a bit out of everyone’s plate without paying a cent, I am not sorry.
📚 The movie got me interested on the original works by Homer, I’ll be reading a Spanish translation since it’s still my native language and it might be fun for a change of pace. I went for the translation in prose by Carlos García Gual, by Editorial Alianza… I may read the Illiad first though.
☕ My mom actually invited my friend—the one I invited to the movies a couple weeks ago—out of nowhere and without me knowing it, not to the movie, but to meet up later with everyone (especially my siblings who hand’t seen her in a while). Hovever, the movie was so long she ended up waiting for like an hour. I didn’t realize this until the movie ended, and was a bit upset my mom didn’t even bring it up. At least she brought a book. We all got some coffee afterwards and had a nice conversation. I made a couple discoveries that made me think this will only ever stay as a friendship, which is probably for the best.
🚲 On Saturday I went to the gym by bike again! This time was not as painful as I only did some back exercises. I locked my bike a bit better than last time, where my back wheel could have been totally stolen, so that’s nice! I am yet to go consistently for four days a week though, I keep missing here and there.

Watching

The Odyssey - Well well well, I found this movie to be really enjoyable! Being almost three hours long, it managed to catch my attention the whole way through. The visuals were fantastic, the mix of fantasy and reality was rather amusing to me. I have seen a lot of discussion online about how it botchered the original work and the character of Odysseus, so I have made it a goal of mine to read the original works soon enough. As a standalong work of fiction and cinematography, I have to say it’s probably my favorite of the year. Even the all-star casting somehow worked for me, yes, even the choice of Zendaya for Athena felt fitting by the end. I want to hear your thoughts and talk about it though.

Gaming

Finished

Monument Valley 2 + The Lost Forest - After beating the last DLC of Monument Valley, I had to continue on my geometry defying adventure. The sequel added a couple of great mechanics, such as controlling multiple characters at once. Most of the levels are still amazing pieces of art and puzzle design, with a story too! Music and sound design continue to be great. A great continuation to the story and it ended up with one of the most difficult puzzles of the trilogy too!
Monument Valley 3 + The Garden of Life - The latest entry to the series, this is the one with the most amount of actual story and narrative behind the puzzles! I really enjoyed the new mechanics added here, such as curved and spherical shapes, portals and mirrors, and a few other surprises! There was also a bunch of extra single-screen levels that ended up unlocking the most innovative and complex puzzle of the game. Won’t say more, a trilogy worth experiencing, in my opinion.

Started

The Legend of Zelda: Ocarina of Time - Well, I was chatting with Syl the other day and she mentioned playing this game on her 3DS! So, of course I decided it would be a good idea to play along. She has only finished the first dungeon, so I asked her to wait for me to catch up. I played to the point where I find the Kokiri Sword, and I’m collecting rupees to buy myself a shield. You know how it goes, let the adventure begin!

Ongoing

Fire Emblem Awakening - I’m on Chapter 17 of the story now! I spent some time doing a bunch of the paralogues and leveling up the character support levels of many people to get them to marry! I also restarted a bunch of those battles because I kept making somewhat clumsy mistakes. Still really enjoying the mechanics of this game, though I must admit I’ve been craving a different tactics RPG, maybe returning to Jeanne D’Arc, or trying something new like Unicorn Overlord. I want to finish this though, and the story is still excellent.
Black Rock Shooter - I finished all the missions of the first stage! Including the first real boss, which was another cool/cute anime girl who even said some things in Spanish—reminding me of Asuka’s Feliz Jueves! meme—so that’s neat. After losing once, I defeated her, which unlocked a cool cutscene, as well as the free roaming mode to grind XP, including an extra boss. I ought to play so more still.
Ys I & II Chronicles - What a surprise this was! I decided to return to yet another PSP action rpg title, and after talking to a bunch of people in town I finally realized where I’m supposed to go next. Looking forward to what this game has to offer, at some point.
Ridge Racer - Tried a couple of course tracks of this wonderful game once again. I was unable to win the last race of the tours though.
Lumines - Played it like five minutes, still rocks but I was only testing GameDiary.

Reading

Leviathan Falls - Up to chapter 11. Finally managed to make progress, a single chapter of this epic book… Yeah barely anything but whatever. I am returning to this now that the World Cup is over, you’ll see next week, I will definitely reach chapter 18 or even 20.
Uncle from Another World - Up to chapter 22. Somehow I returned to this! The adventures of Uncle continue on this fun reverse-isekai manga, the gags just keep working for me and getting me to laugh too much, even after leaving this for months, cool stuff! I need to find more manga to read though.

Around the Web

Blog posts

On ethics and usefulness - Linus Torvalds, the guy who made Linux, has always shown a certain “pragmatism” to things which made me feel he would eventually embrace AI, not great stuff, but I saw it coming. Manuel shares some thoughts.
What’s a computer? - Dom is back with an update post of his shenanigans, his job and life has kept him away from most news in the tech space, and that has been a blessing for the most part. Good for him!
I’m Volunteering for My Library! - Syl is doing wonderful things as she now does some work in the local library. That’s so awesome and I am yet to visit mine! If I ever do so I’ll write about it for sure…
I Spent 2 Weeks Without Video Games - Josh did what the title says, and concluded that videogames don’t affect him negatively in any significant way. I am on a similar boat, they are just a way to pass time for me and would easily be replaced by any other hobby of mine if I had to abandon them.

YouTube

Lots of videos this time around. They are all genuinely great, so I hope you give them a watch!

Why Japan and China See Handheld Gaming So Differently - Short video, straight to the point.
I found the next best thing - Handheld console review + slice of life stories recreated with paper cutouts.
The Best Games Are Kinda Bad - Featuring Tears of the Kingdom, over/underrated games and the like.
Yea… no wonder it won the Oscar - About the Rocky movie, its history and place in cinema.
the moment you realize the technology doesn’t exist yet - On Shrek, its evolution and animation.
I rebuilt this PSP from scratch - A whole redesign from scratch with CNC machining and custom PCBs
The Giant Monster Design Pacific Rim Got Right - Analysis on Kaiju monster design
Can A Game Be Objectively Bad? - Featuring Final Fantasy XIII and other titles.
How Civivi is doing the impossible - 275 years of bizarre, brilliant folding knives - Evolution of long knives that fold.

This is day 99 of #100DaysToOffload.

Reply to this post via email | Reply on Fediverse

Note published on July 20, 2026 at 10:14 PM UTC - Molly White's activity feed

2026-07-20T22:14:02.000Z

alcoholic trying to get sober after a relapse tells Google's "Health Coach" about it.

it tells them to drink every hour and messages them to make sure they're drinking as soon as they wake up.

Disabling Siri - Posts feed

2026-07-20T21:59:00.000Z

I only ever use Siri to set timers and turn on Do Not Disturb. It's pretty good at those things. It is very, very bad at many other things.

I'll often have one AirPod in for music or podcasts when I'm doing chores around the house (I tend to function better with background noise). But, increasingly, Siri has taken it upon itself to activate itself for no apparent reason. It could be a stray noise, a show, one of our kids — it happens a lot. At best, this is annoying, at worst it's calling someone in my contacts I haven't talked to in ages.

So, given Siri's extremely limited utility, I went about figuring out how to shut it off.

In the Settings app on any of Apple's platforms, you can scroll to Apple Intelligence & Siri and flip Apple Intelligence off. Then, you can scroll down and disable all the invocation methods in Talk & Type to Siri. This mostly does it — but if you press and hold the big button on the right hand side of your iPhone, it'll prompt you to enable Siri.

To address this, go back to settings, navigate to Screen Time, then Content & Privacy Restrictions. Enable said restrictions, tap on Intelligence & Siri and turn off everything you can.

Congratulations, your phone is less annoying.

Feedback on mailmaint OAuth Profile for Open Public Clients - Articles by Aaron Parecki

2026-07-20T17:39:06.000Z

Hi all,

I owe the working group a review of the "OAuth Profile for Open Public Clients", and apologies for sending this so late after the last IETF meeting, and the night before this IETF meeting.

Please note that I have not followed all of the discussion about this draft on the mailing list or recent meetings. If any of my suggestions have already been discussed and decided against, the justification for the decision would be worth noting in the draft for future reference.

My feedback is ordered most significant to least significant.

Overall, this spec is in good shape. It avoids defining new OAuth mechanisms, it establishes no new relationships between OAuth roles and it uses the standard Resource Owner / Client / AS / RS model.

Client Registration

My largest piece of feedback is about the use of Dynamic Client Registration. The use of DCR in "open world" OAuth will lead to significant operational burden. I believe I already shared this feedback a couple of years ago. Since then, there has been another large scale deployment of DCR that has since moved away to an alternative.

The initial version of the MCP spec from March 2025 required MCP clients register using DCR. Many of the authorization servers that immediately added support for it have since come to regret the challenges with operating it long term, and there are many other authorization servers that refused to add support in the first place, requiring manual configuration instead.

In the time between then and now, the OAuth working group has adopted Client ID Metadata Document (CIMD) https://datatracker.ietf.org/doc/draft-ietf-oauth-client-id-metadata-document/ which provides a way for a client to publish its metadata at a URL and use that URL as the OAuth client_id. Both the BlueSky/atproto ecosystem as well as the MCP ecosystem now recommend CIMD as the default client registration option. Since both of these ecosystems are also "open world" OAuth like the email ecosystem, it would also be a natural fit here.

While it is not yet an RFC, it is already getting quite a lot of adoption, and I expect that to continue.

Despite the client_id being a URL, this works just fine with desktop and native apps. The URL would be hosted on the app's website, and since most apps have a website you can download them from, this isn't a problem in practice. And for the clients that are already web based, this is a natural fit. Which also leads me to the next point...

Client Authentication

I realize that most of the clients that will implement this spec are desktop/mobile clients, so will be considered public clients since they won't have a way to be provisioned with credentials. However there will also be clients that are running on a web server, in which case they do have the ability to manage credentials.

Paired with CIMD, a web-based client would publish its public key and link to it from the jwks_uri property in the CIMD, and would then be able to strongly authenticate all outgoing requests using private_key_jwt (described in Section 8.2 https://www.ietf.org/archive/id/draft-ietf-oauth-client-id-metadata-document-02.html#section-8.2). For these clients, it means the client metadata is not only hosted at a URL, but the metadata can actually be considered to be authenticated so is much more trustworthy than both unauthenticated CIMD metadata and especially DCR metadata. The other nice thing about this is if an authorization server doesn't care about client authentication it can just ignore the header and process the request identical to a client that doesn't use client authentication.

`offline_access` scope

The offline_access scope is not defined in any OAuth RFC, it originates from the OpenID Connect Core spec. Using it in a non-OIDC OAuth profile is fine, but registering it in the IANA "OAuth Scope" registry is probably not appropriate. I think you can just remove this from the IANA registration section and the references to it in the scope sections are sufficient.

DPoP

Requiring DPoP would provide meaningfully stronger security, as token theft is a realistic threat against long-running desktop clients. The draft acknowledges DPoP's value but leaves it optional. Given that the minimum access token lifetime is one hour (see below), a stolen token has significant value. DPoP substantially limits the risk.

Combining with the feedback above, an option could be to require DPoP for public clients, but leave it optional for clients using client authentication published in the CIMD.

Token Lifetime

Most OAuth security guidance recommends short-lived access tokens, in the order of minutes, not hours. Setting a minimum of 1 hour in the spec is unusual and goes against the direction of most OAuth security profiles. This isn't necessarily a dealbreaker, but is at least worth justifying in a little more detail.

If you are using DPoP, you can also generally justify longer-lived access tokens, so another option is to have different recommendations depending on whether DPoP is used.

Pushed Authorization Requests

Pushed Authorization Requests (RFC 9126) prevents authorization request parameters from appearing in browser history and eliminates certain parameter-manipulation attacks. For this use case, where the client constructs the full authorization URL locally before handing it to the browser, PAR would provide meaningful additional protection. To my earlier point, if there was a conscious decision to not require PAR, it would be worth noting the reasons at the very least.

Discovery from Email Address

There is a mention in Security Considerations that "The issuer is expected to be autodetected from the user's email address", but there is no description of how this is expected to be done. I see that this mechanism is described in the "Automatic Configuration of Email, Calendar, and Contact Server Settings" draft, but there should probably be a reference to that from somewhere in this profile.

Missing reference to RFC 9700 (OAuth Security BCP)

The spec references RFC 6819 as the OAuth threat model but not RFC 9700 (OAuth 2.0 Security Best Current Practices, published 2025). RFC 9700 supersedes much of RFC 6819's threat analysis and is the current normative security reference. This should be added.

Thanks, and I am happy to discuss any of this further during the meeting or if you find me during any breaks this week.

American AI is locked down and proprietary. It's losing. - Werd I/O

2026-07-20T14:15:38.000Z

Link: China delivers a one-two punch to America’s AI dominance, by Robert Hart in The Verge

AI models, as a product in themselves, have very little moat beyond what amounts to brand loyalty and superficial switching costs. Instead, the moat is in the enterprise services that sit around them: the deals and contracts, connectivity with enterprise systems, and quality of life features in an enterprise context.

If we consider the models themselves, it’s easy to switch between them: someone could be using ChatGPT today and Claude tomorrow, with very little impact on their workflows. This is particularly true in the engineering world, where models are accessed via API: you can swap out the API and use the same prompt.

Those companies can make deals to lock their customers in, but in practice there’s very little long-term technical incentive to use one vendor over another. You pick the best model for your needs and change models and vendors if another one becomes better.

The US government has placed export controls on GPUs. There are also strong regulations that (reasonably) prevent sharing certain kinds of data with Chinese servers. The result is that while Chinese companies have enough compute to train models, they can’t really provide the kinds of global-scale centralized services that we see from OpenAI and Anthropic — at least, not in the same way.

And open almost always wins when it comes to infrastructure adoption. Open technologies can be used permissionlessly and therefore can be at the center of more innovation. You can host them where you want, experiment with them, alter them, and tweak to fit your use case. Open weights models are not open source, but they are portable and permissionless.

With all this in mind, it makes sense for China to release its AI models openly. It turns a US-created compute disadvantage into a distribution advantage; it commoditizes the layer where American companies make money; and it creates a far more effective global ecosystem than could be established through locked-in, centralized services. It’s obvious to me that there are ecosystem benefits throughout China, from manufacturing to scientific research; every sector can just plug in these models.

The saving grace for American companies has been that US frontier models have outperformed open ones. That gap is now closing:

“Moonshot and Alibaba unveiled models they claim can go toe-to-toe with the best from OpenAI and Anthropic at a fraction of the cost. The rapid-fire releases suggest America’s lead at the AI frontier is increasingly tight, just as the technology is becoming central to national security, economic power, and geopolitical influence.”

Even without these new capabilities, the strategy has already been working. a16z partner Martin Casado noted in the Economist that there’s an 80% chance that any given startup is using Chinese models, and Chinese models are poised to take the lead.

It’s worth taking a step back and considering the surprising underlying dynamics. We think of China as being a locked-down society — and it is in many ways. I have serious concerns about how these models might reflect Chinese government perspectives (try asking them about Tiananmen Square). But it’s American companies that are keeping tight control of their technology rather than releasing it as openly as possible. This is in stark contrast to the strategy behind US government support for the open internet, for example.

Locked-down business practices for a technology with no real moat but significant potential ecosystem benefits is an obviously losing strategy; permissively releasing it with an open, collaborative approach is obviously a winning one. But the incentives in the US aren’t there: instead, these companies are forced to chase first-order profits rather than ecosystem benefits, and the government tries to put its finger on the scale through forcible measures like tight export controls. We should consider what would need to change to make those incentives more aligned. That’s particularly important given how much of the US economy is currently driven by AI spending. If the bottom falls out of that spending — and I think it clearly will, given the dynamics — the outcome could be severe.

I care about having open technology that can be run in the public interest, aligned with the public’s values. Threads like public AI, federated services, and open research have traction but need backing. Getting there in the US needs more nuanced strategy and support than we’re seeing today.

Public Transport - Don't Make Me Think! - Terence Eden’s Blog

2026-07-20T11:34:23.000Z

In the last year, I've been through over a dozen cities and used public transport in all of them.

It is wild just how confusing and complex buying a ticket can be. While some cities obviously take a user-centred approach to ticketing, others appear to take a Kafkaesque delight in a bureaucratic maze of zones, apps, and intricate restrictions.

One of the seminal texts in computer systems design is "Don't Make Me Think". Every time a service forces the user into making a decision, it is placing a cognitive burden on them. Computers' jobs are to make things easier for us fleshy meatbags.

There are some intractable problems with navigating unfamiliar spaces (looking at you Kyoto Station!) and a transport authority can't publish signs and make announcements in every conceivable language, but there's one thing they can control - ticketing.

Let me take you through some of the public transport ticket experiences I had - and explain how easy or hard they were to use.

Basel, Switzerland - free

Upon checking in to our hotel I was given a free Basel Card. It entitled me to free public transport across the city.

Zero extra cost. I didn't have to remember to take a physical card with me - the details were emailed as a PDF directly from the hotel on check-in.

I didn't have to show the bus driver when I entered a tram. If a ticket inspector was present, they could have asked to scan it.

This is close to the platonic ideal of "Don't Make Me Think" public transport. I didn't have to work out zones, fares, or timings. I didn't need to interact with people or machines. I didn't worry that I was somehow doing it wrong and was going to get shouted at.

Milano, Italy - contactless

I tapped my credit card on the reader. Whether it was a bus, tram, or metro the process was the same. Tap, wait a few milliseconds, beep. On the metro the gates opened automatically. On the tram, I just sat down after the beep.

The fares have a bit of complexity based on how frequently you travel. If you catch another bus within 90 minutes it only counts as one fare.

I didn't care because the daily price was capped.

Once I'd taken a few journeys it wasn't going to cost me any more. With a fee-free credit card it was simplicity itself.

If I had been on an extremely tight budget, I might have done some thinking - but as the daily cap was less than the price of a cocktail, I didn't bother.

Warsaw - paper ticket validation

I walked up to a touchscreen kiosk, selected the 🇬🇧 flag, and bought a 3 day paper ticket for a few € using contactless. The machine spat out a small paper ticket.

I hopped onto a tram, shoved the ticket in a slot and the machine printed a timestamp on it. Well, in theory. It didn't work the first few times for inscrutable reasons.

From then on, I didn't have to do anything. I jumped on whatever public transport I wanted. Only once did a ticket inspector come round demanding to see everyone's proof of validity.

The ticket was a slightly inconvenient size for my wallet - being much smaller than a credit card - and I think the kiosk should have validated it automatically. But, for general transport purposes, it was great at not forcing me to think.

Tallinn - scan the app

Install an app, choose ticket type, pay, done.

Every time I entered public transport, open the app, click the ticket, wave the resultant QR over a scanner.

Obviously choosing a ticket type is a little thinky. Do I want a single ticket, a day pass, something longer?

I'm not averse to installing an app when necessary. Thankfully, this transit app worked on GrapheneOS. There was an optional registration step which I skipped because I was unlikely to come back any time soon.

Riga - scan the bus

OK, this was just weird!

Much like above, install app, choose ticket, pay.

Despite buying an all-you-can-eat ticket, I still had to register on every bus/tram I got on. That meant hopping on, finding a QR code, opening the app, and trying to scan it while the driver attempted a new land-speed record.

Paris - ridiculous

Fuck Paris. The only way to buy a metro ticket is to download an app. Fair enough. But, after downloading the app it tells you to install another app!

What the actual fuck? A convoluted, messy, and frustrating situation which has resulted in awful reviews for them.

Trains and metro travel require separate tickets at different prices. You can't easily hop from one to another. You need to think carefully about the route you're taking. A more convoluted route may be significantly cheaper because it doesn't involve swapping between services.

Madness!

The ticket readers use your phone's NFC chip to validate. So there's no technical reason why they can't just use contactless payment cards.

To be fair, change is coming… in 2030!

So what's best?

In an ideal world, all public transport would be free and plentiful. In our less-than-ideal reality, it seems obvious to me that public transport should above all be simple.

Tourists don't want to grapple with the complexities of zones, split tickets, random charges, and a different app for each city.

Regular travellers don't want yet another piece of plastic tat in their wallets, or to work out in advance what precise combination of journeys they need to take in order to optimise their spending.

One app is fine. Having to install a different app for each city you visit - even within the same country! - is infuriating.

Visitors should not have to think about how, where, when, or why they need to validate their tickets. Nor should anyone need to figure out which modes of transport are inclusive or not.

For the casual visitor, contactless payment with a daily / weekly cap is the simplest possible charging mechanism. It's cheaper for the cities to not have to build, develop, and support apps.

If you've come across a better public transport ticketing system - please let me know in the comments.

📝 2026-07-20 08:10: Yup. Goat-proofing the chicken door really worked a treat. FML. 🤦🏼‍♂️ - Kev Quirk

2026-07-20T07:11:00.000Z

Yup. Goat-proofing the chicken door really worked a treat. FML. 🤦🏼‍♂️

Thanks for reading this post via RSS. RSS is ace, and so are you. ❤️

You can reply to this post by email, or leave a comment.

Music - James' Coffee Blog

2026-07-20T00:00:00.000Z

the direction of music; the music of direction.

Note published on July 19, 2026 at 11:13 PM UTC - Molly White's activity feed

2026-07-19T23:13:51.000Z

Just had to patch a bug on the Tech Influence Watch Michigan House District 13 election page, stemming from Shri Thanedar reporting -$1.1 million in receipts.

Why is Thanedar reporting negative receipts? He put $3.7 million of campaign funds into crypto.

📝 2026-07-19 19:09: Today was spent goat-proofing the automatic chicken door. We recently moved it to ground level... - Kev Quirk

2026-07-19T18:09:00.000Z

Today was spent goat-proofing the automatic chicken door. We recently moved it to ground level and now the goats use it as a scratch post. 🐐

Thanks for reading this post via RSS. RSS is ace, and so are you. ❤️

You can reply to this post by email, or leave a comment.

I've Moved Back to GitHub - Kev Quirk

2026-07-19T12:25:00.000Z

Back in May, I wrote a post about how I'd migrated all my repos away from GitHub. This ended up being a combination of my self-hosted Git server on my Synology (for my private repos) and Codeberg for my public ones.

Well, since then Codeberg has just given me problem after problem. I had issues working with repos via SSH for weeks. It just kept timing out, or taking an age to actually do anything. So I switched to HTTPS instead, which seemed a little better, albeit still generally very slow.

This morning I came to do a bit of work on some issues and PRs that have been logged against the Pure Comments repo and (unsurprisingly at this point), I was greeted with this:

I've been trying to get to the repo for around 30 minutes now, and it just keeps failing. I can't work like this - I'm a busy guy, so when I do get time to work on these fun side projects, my shit needs to work.

People give GitHub a hard time for outages, scraping, etc. but in all the years I've used it, I've never had an issue. It has always been quick, and it always worked.

In my boredom while waiting for Codeberg to sort themselves out, I decided to peruse my RSS feeds and I came across this post by Sal. It seems he's been having similar problems with Gitlab.

Moving back

This was the final straw. I've had enough of battling with Codeberg, so I've switched back to GitHub. Some may not like this decision as Codeberg is generally considered the more community friends code hub, but I need to make a pragmatic choice here as the constant issues are sapping most the fun out of these projects.

I'll continue to host my private projects on the Synology, as that works great. But as of right now, we're back on GitHub for all [my projects. I think I've caught all references to Codeberg across the various sites and docs (thanks to Gemini), but if you see a problem, please log an issue.

There is 1 final update on Codeberg for both Pure Blog and Pure Comments. This points the updater back to GitHub, from then on, subsequent releases will be on GitHub.

What about...

I'm bound to get some comments and suggestions about other options other than moving back to GitHub, so I'll try and hit them before you take the time to comment/email with recommendations:

What about a self-hosted Forgejo instance?
Absolutely not. I don't have time to maintain something like that. I'd rather spend my free time working on fun projects than managing infrastructure.
But GitHub are really bad because of [reason(s)] what about [other tool]?
Nope, sorry. I don't want to use other platforms that potentially introduce the same issues I've been having with Codeberg. Look at Sal's post further up - he was on Gitlab and having similar problems to me.
This is disappointing, are you sure about your decision?
I'm very sure. It is disappointing, I agree. But I've given it a lot of thought over the last few weeks and I'd rather go with the tool that I know will work, than the one I have to battle with. Plus, this is all public code, so I don't think I'm giving anything away by switching back.
I'll NEVER use GitHub. I'm gonna stop using [project] now.
That's a shame, but it's your call.

Thanks for reading this post via RSS. RSS is ace, and so are you. ❤️

You can reply to this post by email, or leave a comment.

Of Day - James' Coffee Blog

2026-07-19T00:00:00.000Z

I close my eyes and listen to the church bells reverberate through the city — the air, the street, the park; the hearts.

Usually when I go into a bookshop, I find myself looking at all the books. Often, for nothing in particular, but rather to see what is new. Who knows what I might find; what stories might stand out today. My time spent wandering around the walls of words today, however, was characterised more by writing than by reading. The books were my anchor. The word was in my spirit. My disposition was to capture what I heard and saw and felt; to let my thoughts flow onto a new page.

I took notes on art galleries, places where we can feel both oriented and lost; where we can discover and ponder discovery; where we can let the present pass while considering the past and the future; where the colours of Monet and the shadows of Rembrandt exist a few rooms away. What does it mean that I can see Rembrandt and walk through a few rooms to see Monet?

I realised I was lost, not in place but in thought. I recognised the shelves in front of me while I stood at the frontier of my imagination, asking questions with increasing momentum – questions of magnetism and enchantment and on the nature of significance.

“My dream is to have one of each of these.” “The classics?” “Yeah.” “We should do it as a wee Christmassy thing: each of us should pick four or five that we like…” — a gift exchange? “Oh, that’s the one you keep telling me to read.”, as one of the three friends points to the shelf. The conversation flowed. “So you’re having a book stand in your next [flat?]”. I realised they spoke in the kind of sentences where you don’t need to finish for your friends to know what you mean – therein, the language of friendship.

I learned today that I can be in a bookshop and an art gallery at the same time, and that I can move between them; that the sounds and physicality of stories can ground me as my mind wanders. A book of poetry caught my eye. Opening the book to a page at random – Serendipity being my guide – I pondered the literal shape of the words in poems. One poem was a rectangle of aligned text. Another poem was written in couplets. One was short. Another, long. How does form influence what we read? I wonder. This is why I love bookshops.

After having walked around all of the shelves of fiction at a slow pace, I went back outside and let my legs take me where they wanted to go. I wandered, on my journey seeing Georgian architecture, hearing the roar of a lion from a parent entertaining their child, and feeling the fresh air of Scotland rush through my lungs as I looked up to the blue and white sky.

Eventually, I made my way to the National Gallery of Scotland, not the gallery of I was imagining earlier – that one was four hundred miles away – but one in which I always feel enchanted immediately after walking in. I found myself standing in front of works of Turner and Lievens, Da Vinci and Gainsborough, thinking about the nature of the space I had on my mind since the hour of wandering through the bookshop, and my imagination.

Book Review: A City on Mars - by Dr. Kelly Weinersmith and Zach Weinersmith ★★★★⯪ - Terence Eden’s Blog

2026-07-18T11:34:18.000Z

I'm pretty sure this book is a psyop designed to demoralise a generation of starry-eyed dreamers. It is obviously written by the same people who told us not to land on Europa. A malignant energy designed to limit the scope of human ambition and thwart our plans to colonise the universe.

The problem is, I can't find fault with any of their logic.

The Weinersmiths make a compelling case that space is much harder than any of the propagandists are willing to admit. Even if it were faster, safer, and cheaper - there's still very little point. Any of the technologies we could point at the skies would be infinitely more useful (and profitable) pointed back at our pale blue dot.

Along the way they take in biology (is it even possible to breed in space?), legality (OK, but what jurisdiction will it be under?), and moral philosophy (will we actually become more enlightened beings?)

And yet, space is cool. I know that "because it is there" isn't a logical argument; but it is a hell of an emotional pull. In amongst all their (justified) snarky cartoons are occasional pearls in the rubble:

As with the cathedrals of Earth, those of us who cast the first few bricks may not be around to see the spire placed on top, but we might nevertheless want to start building.

They excel at making the dull delightful. There are a lot of big and serious facts to get through, but they have a gift for communicating them simply and eloquently. I just wish they'd've come to a different conclusion.

WwJD: Spend less time doing boring admin (video) - Johnny.Decimal

2026-07-18T06:22:15.000Z

A 'Working with Johnny.Decimal' video.

This video shows how my system helps me calmly complete two simple, infrequent tasks. They're far enough apart that I forget how to do them, and they've previously caused more disruption than necessary. One of the benefits of Johnny.Decimal is that it takes the edge off my computer use, turning it into a neat room where I can work efficiently and spend less time doing boring admin.

Finished reading Gideon the Ninth - Molly White's activity feed

2026-07-18T02:00:13.000Z

Finished reading:

The Locked Tomb series, book 1.

Gideon the Ninth

by Tamsyn Muir.

Published 2019. 448 pages.

Started July 16, 2026; completed July 17, 2026.

Self hosting a PDS isn't hard (so far) - Posts feed

2026-07-17T21:23:00.000Z

Due to my compulsive need to self-host whatever I possibly can¹, I decided to set up a self-hosted PDS. All that's on it so far is my Bluesky profile data, but it was a surprisingly painless process.

Why bother? Well, I get to own my identity (DID) and my data. The relay and AppView remain Bluesky's, but the authoritative copy of my account is mine. I already syndicate from my site to Bluesky and controlling the PDS is the last part of this infrastructure I can reasonably control.

I've been bolting features on to my own CLI to manage my infrastructure for a bit². I use Hetzner for hosting and it wraps their hcloud CLI for my own convenience. I spun up a CX23 box with backups turned on and then ran another CLI command to bootstrap the server.

The server is running only two things: the canonical ghcr.io/bluesky-social/pds container maintained by Bluesky and Caddy. I use forwardemail.net for transactional emails.

With the server provisioned, I updated the _atproto record for my domain and added a pds A record. I use DNSControl to manage DNS records, so this only took a few minutes.

The migration

Migrating my data from Bluesky's PDS to my own was the only part of this process that made me a little nervous. I needed to preserve my DID, followers and just over 1,000 account records. I used Bluesky's goat tool to manage this process.

I generated a recovery key using goat key generate --type k256
Logged in to my old (Bluesky) account: goat account login -u <username> -p <app-password> --auth-factor-token <email-code>
Created a PDS invite for myself using my CLI (or SSH into the box and run pdsadmin create-invite-code).
Ran the migration — it pauses and emails a PLC confirmation code that you paste into the prompt:

goat account migrate \
    --pds-host <host> \
    --new-handle <username> \
    --new-password "<password>" \
    --invite-code "<pds-invite-code>"

Added my recovery key to the identity so it's my highest-priority rotation key (this also emails a confirmation token): goat account plc add-rotation-key <recovery-pubkey> --first

It ran faster than I expected and worked without any issues (shocking, I know). I syndicated a post, opened my profile in an incognito window and it loaded without issue. I also verified that DID doc #atproto_pds pointed at my new host and threw my private recovery key in my password manager.

Cleanup

The last step was to add support for a custom PDS URL to my site and the PWA I built myself to browse Mastodon and Bluesky simultaneously. This consisted of a migration to update the database schema to save the URL and the corresponding field in the UI. The app passwords I use for both also needed to be recreated on the new PDS which I did from the aforementioned CLI.

I have yet another server running which, at this point, I'm starting to collect like trading cards. My ATProto data sits on its own server, free to be used with any apps that support it (for my purposes that's only Bluesky — for now). It was a surprisingly straightforward process and I'm thankful for that.

I'm still getting my head around ATProto, but I appreciate that you can own your own data, if not all of the application infrastructure. I was used to the Mastodon mental model where, while you can migrate between instances, not all data comes with you. You own the identity but, perhaps, not all of the content. You can't own everything in either case, for now, but it feels like we're heading in the right direction.

Except email. ↩︎
More on that in a future post, probably. ↩︎

One of those webinars - Joel's Log Files

2026-07-17T14:15:00.000Z

Don’t worry, it was fully optional.

I assisted to a webinar about “the potential of AI” in the workplace, and you can already guess what sort of conference I had to go through yesterday. I shared a livestream of my thoughts on my Polymaths’ profile in case you want to see my reactons to what was said there, it’s hilarious stuff.

Something I didn’t mention on that thread was a little quizz at the start, where people filled out polls and the like, and one of the pages was actually a word cloud, they asked “what words come to mind when you think about AI?”.

Of course, I typed a few: “Wasteful”, “lazy”, “slop”, “unethical”… there was no limit I found to how many I could add, but I stopped with those. They didn’t even show up in the word cloud.

“Useful”, “automation”, “future”, “tool”, “assistant”.

Each word got bigger as more and more people typed them in real time.

This wasn’t a multiple choice question, they were chosen and submitted by many.

It is unfortunate, and undeniable, how many people today are perfectly okay with all this, even when they are aware of the bad they caused and continue to cause—they simply look the other way.

“It’s a necessary evil now, there’s nothing we can do about it.”

“We need to catch up with the times, it’s the same as the calculator or the personal computer”

One of the common themes during the presentation was how “you should learn how to use it, don’t stay behind”, because “you will not be replaced by it, but by those who know how to use it”.

Honestly though, as grim as it sounds, I couldn’t help but cringe at every example and slide showed through the whole thing. The generated graphics, the generated prompts, pretty much all the information there was not made by the presentator, none of the examples or problems solved were real.

It’s such a big charade, and the fact everything started with how much running these things can cost and how “it’s not that the AI is inneficient, it’s just that you don’t prompt it properly” let me know it’s all just a joke.

At some point the host shared their screen and started to copy-paste example prompts, while the sidebar featuring a chat history was in full display. “Answer this email”, “summarise this email”, and almost out of frame… “I’m doing a webinar about[…]”.

Check the thread if you want, it’s a good laugh. Watching the bubble pop will be fun.

This is day 98 of #100DaysToOffload.

Reply to this post via email | Reply on Fediverse

Notable links: July 17, 2026 - Werd I/O

2026-07-17T13:28:46.000Z

Most Fridays, I share a handful of pieces that caught my eye at the intersection of technology, media, and society.

Did someone forward this to you? Subscribe for free.

Mamdani invests in tech capacity to “solve real problems”

There’s a lot that newsrooms can learn from Zohran Mamdani’s mayoral administration in New York City. His latest announcement is the Public Interest Technology (PIT) Crew, a set of dynamic, cross-disciplinary digital teams that will solve problems across the city using a rapid, human-centered approach.

As Pamela Herd notes here, this is a shift from contracting out to building internal capacity:

“Traditionally, the conventional wisdom since the 1990s and before was that governments could buy tech products like an off-the-shelf product. This led to a massive turn to contracting out, which was great for consultants but bad for government capacity. The outsourced approach often cost too much, delivering too little and too late.

[…] What people who know tech and government have been screaming for years is that building good tech needs in-house capacity, even when you are using contractors. It requires the government owning the design, development and delivery of technology, relying on rapid iteration to fix problems in a way that is impossible when contractors are running things.”

This dynamic is also highly prevalent in newsrooms, resulting in the same problems. If you rely too heavily on buying existing technology or working with outside contractors, you are building operational, functional, and intellectual dependencies on those organizations. You import their values and ways of working, which in the case of some vendors may be catastrophic in itself, but you also put yourself on their timelines and make yourself subject to their feature priorities and interests. And that’s before you consider security and trust profiles, which may radically differ between newsrooms and the vendors that serve them.

New York City isn’t alone; other governments are beginning to shift from outsourcing back to internally owned technology. The article links to a report explaining Colorado’s move back to internally-run IT, which states the issue plainly:

“There is an alignment problem: the issue is not effort, but that we have organized around internal structures rather than outcomes, and that misalignment has made excellent work harder.”

Mamdani’s PIT Crew sounds a lot like how a product team should work: directed groups of experts rapidly prototyping solutions to concretely defined problems anchored in real people’s needs. By doing it internally, he can make sure these solutions are built exactly the way the city needs, build institutional capacity and knowledge, and, theoretically at least, do it far more cheaply in the long run.

As these sorts of civic measures succeed, I think (or, perhaps, I hope) we’ll see more newsrooms translate those outcomes to their own businesses and begin to understand that they need to prioritize technical capacity too. All the same reasons apply here.

Of course, most newsrooms don’t have the budget of the New York City Mayor’s office. I think the solution to that is third entities: non-profit organizations that exist to provide shared technical capacity across newsrooms, based on newsroom needs, that behave as if they were part of newsroom teams. Think of it as a kind of PIT Crew for news, operated independently but in deep collaboration with newsrooms. By using a radically open source approach, newsrooms can pool resources together and solve shared technical problems more easily, on their terms and according to their values.

While there are always places for startups and tech platforms, the idea that the tech industry can always serve needs better than building institutional capacity is fundamentally broken; it’s also fundamentally right-wing. I’m delighted to see the New York City Mayor’s office move in a more productive direction. I hope it becomes an example for everyone.

We are not alone

I was delighted to be included in this roundup by Adiel Kaplan, the Program Director at the Tow-Knight Center for Journalism Futures at the Craig Newmark Graduate School of Journalism at CUNY.

As Adiel says:

“Having a say in what the future of news looks like will likely require not just that collaboration across newsrooms, but also outside them, with other institutions that want to shape a future with informed communities at its center — which is, after all, the mission. Right?

[…] It will also require a different way of thinking about our role in this ecosystem, beyond creating content and distributing it. It might mean getting more involved in building technology, or joining forces in new ways with government-funded institutions.”

This is exciting to me: I’ve been saying for a while now that news needs to get more involved in building technology. My flippant line is that news treats technology as something that happens to it, like an asteroid — but it’s actually a creative work, like an article. Although many newsrooms are too small to build a strong capacity in themselves, it’s perfectly possible for news as an industry to build capacity and create the technology that is unique to its use cases on its terms. So I think it’s a very good thing that news institutions are talking about this need.

The people listed in the article are exceptional. I’m just happy to be on the list in such fine company. Don’t sleep on any of them; I feel most connected to Ivan Sigal’s ambitious and vital work at the Modal Foundation and what Trei Brundrett is building (in collaboration with Blaine Cook and others) at New_ Public. But these are all worthy endeavors: the Library Newsroom Project is a genius on-the-ground effort to create local newsrooms based in every public library in the US, and Sannuta Raghu’s news atoms embed meaning and provenance in natural language articles. All are promising.

We need to move forward. There are certainly more people who could have been added to such a list; my hope is that if one were written a year from now, it would be exponentially longer. Let’s innovate.

White House Directed Patel to Oversee Investigation Involving Times Reporting

The White House personally directed FBI Director Kash Patel to issue subpoenas to journalists reporting on the President’s new Qatari-gifted Air Force One.

“The White House’s deep involvement in the case came after officials said that President Trump was enraged about the coverage of the Qatari-donated plane, which The Times reported Thursday lacks the same defensive countermeasures of the previous Air Force One.”

These subpoenas were delivered by hand to some of the reporters at home, echoing the FBI’s raid of a Washington Post engagement reporter’s home earlier this year. In both cases, it’s highly likely that these were attempts to discover who leaked information to their respective newsrooms.

There’s lots to say about first amendment issues here, and commentators like Dan Kennedy at Media Nation have pertinent thoughts. It’s clear that journalism is under attack by the administration, and they rescinded rules that protected journalists in leak investigations last year. The US Press Freedom Tracker is a sobering read. But it’s also important to take a moment to talk about the technology side of this story.

When the administration wants to issue a subpoena to a newsroom, it has a few avenues available to it. The first is to issue it directly to the newsroom or to its reporters, as they did here. In some ways, this is the best outcome: then the newsroom knows about the subpoena and can actively fight it in court.

The other avenue is to subpoena the newsroom’s service providers. If source information is stored unencrypted on a service like Google Workspace, the administration could subpoena Google. If a gag order is added — which might well happen if it’s a criminal subpoena or labeled a matter of national security — then the newsroom would never find out and have the chance to fight it. This is true even if the service provider nominally promises to notify the newsrooms about subpoenas: a gag order is a gag order.

Larger newsrooms have strong data security practices for this reason: they know to create policies and architectures which force subpoenas to come through them. But not every newsroom has the capacity to build a strong security strategy. Which means for every story we hear about that involves these newsrooms, there may be many more that took place in secret.

The Freedom of the Press Foundation maintains digital security resources and runs training for newsrooms and specific advice about source protection. The EFF also has some great resources. More resources are out there. But there is more of a need than ever for every newsroom to make sure they have access to someone who can advise them on digital security both holistically and on a case-by-case basis. Not every newsroom can afford a permanent member of staff, but finding access to some kind of resource is vital.

Likewise, journalism funders should focus on providing access to experts, understanding that these issues are existential for the organizations they fund. Not only is this an attack on press freedoms, but it’s also an attack on trust. Every newsroom can do its reporting because sources feel safe to reach out to it; if their safety is in question, they may be less likely to leak, and we may be less likely to read the stories that help us make good democratic decisions. That’s what the administration seems to be banking on.

Trump dismantled a federal climate website. These women rebuilt it.

This shouldn’t have been necessary, but is still wonderful to see. Climate.gov had been the go-to resource for climate data, but it went offline when the Trump Administration radically cut NOAA’s funding. At that point:

“[Rebecca] Lindsey joined forces with former NOAA employees Anna Eshelman, and Mary Lindsey, her older sister, to become the core team behind the deactivated site’s successor, Climate.us, preserving over 15 years of key climate data and resources. The trove features key maps, educational materials and climate indicator reports, including the now-deleted Fifth National Climate Assessment, the government’s most comprehensive analysis of climate change that was at risk of being lost to the public.”

This is possible because US government data is public domain by law. Had it not been available under a permissive license, the administration’s act of vandalism would have meant the data was gone for good. But because it was, the datasets can find a new home.

It’s a joy to use. Check out the climate dashboard, which tracks numbers like the total area of the Arctic Ocean that was at least 15% ice-covered each September. It also hosts a set of resources for teaching climate and energy. The dataset gallery includes crucial information like the NOAA’s archive of oral histories from people whose lives were affected by climate change.

But it’s also precarious. The whole thing relies on donations to keep it afloat, which is really what tax dollars are for. Still, for the moment it’s wonderful to see people pick up the slack when government is no longer doing its job. In the absence of government support, archives like this are works of journalism in themselves: ways to help us make stronger decisions. They deserve stronger support, and ultimately, we all deserve the restoration of such important government infrastructure.

A Leak of San Francisco Police Drone Footage Exposes the New Reality of Urban Surveillance

I’m not sure I agree with this article’s implication that the problem with SFPD’s drone policing was that it accidentally leaked the data.

““There’s a certain trust given to the police to use these things correctly,” says Curry. “When you're watching a drone feed live, you can look into dozens of different apartments, you can see police zooming in on people, you can see arrests. The fact that all of this was exposed feels like a really big issue from a privacy perspective.””

I’d humbly submit that the privacy problem exists regardless of whether the footage was leaked or not: this is ubiquitous surveillance of a city’s citizens from above. That footage can be analyzed, both by humans and software, to track people and target them for any reason. There is very little oversight, and because the police department is using a private company to run it, the teams there presumably have access to an enormous amount of private footage.

The thing is, none of this actually makes us safer. As the ACLU of Northern California points out in its Seeing Through Surveillance report:

“The evidence is clear that while surveillance has increased exponentially, public safety has not. On the contrary, surveillance systems often make people less safe, especially for groups that have historically been in the government’s crosshairs. Modern surveillance technology makes it possible for the government to track who we are, where we go, what we do, and who we know. It fuels high-tech profiling and perpetuates systems of biased policing. It facilitates deportations, chills speech, and imperils the rights of activists, religious minorities, and people who need reproductive and gender-affirming care.”

Most importantly, it doesn’t actually help. As the report points out, the city of San Francisco itself learned that adding cameras to its highest-crime neighborhoods had no impact on crime. Regardless, it added more funding to the program and voted to remove oversight in 2023. The result is more money spent, less privacy, with no impact on public safety. And now we know that the footage is being accidentally leaked, the privacy footprint is obviously even worse.

In a world that is becoming markedly more authoritarian, it’s unconscionable that supposedly permissive cities would add more surveillance. It doesn’t work, it misuses funds that could be spent helping the vulnerable, and it’s data that could be used for undemocratic purposes. It needs to stop — and to do that, we need to apply pressure to our elected representatives and raise awareness of how backwards it is.

Shellsharks Blogroll - BlogFlock

People are transcribing your conversations without asking. That puts you at risk. - Werd I/O

Wonders of Web Weaving, Episode 11 - James' Coffee Blog

The Odyssey, air bubbles, and Monument Valley - W29 - Joel's Log Files

Watching

Gaming

Finished

Started

Ongoing

Reading

Around the Web

Blog posts

YouTube

Note published on July 20, 2026 at 10:14 PM UTC - Molly White's activity feed

Disabling Siri - Posts feed

Feedback on mailmaint OAuth Profile for Open Public Clients - Articles by Aaron Parecki

Client Registration

Client Authentication

offline_access scope

DPoP

Token Lifetime

Pushed Authorization Requests

Discovery from Email Address

Missing reference to RFC 9700 (OAuth Security BCP)

American AI is locked down and proprietary. It's losing. - Werd I/O

Public Transport - Don't Make Me Think! - Terence Eden’s Blog

📝 2026-07-20 08:10: Yup. Goat-proofing the chicken door really worked a treat. FML. 🤦🏼‍♂️ - Kev Quirk

Music - James' Coffee Blog

Note published on July 19, 2026 at 11:13 PM UTC - Molly White's activity feed

📝 2026-07-19 19:09: Today was spent goat-proofing the automatic chicken door. We recently moved it to ground level... - Kev Quirk

I've Moved Back to GitHub - Kev Quirk

Moving back

What about...

Of Day - James' Coffee Blog

Book Review: A City on Mars - by Dr. Kelly Weinersmith and Zach Weinersmith ★★★★⯪ - Terence Eden’s Blog

WwJD: Spend less time doing boring admin (video) - Johnny.Decimal

Finished reading Gideon the Ninth - Molly White's activity feed

Self hosting a PDS isn't hard (so far) - Posts feed

The migration

Cleanup

One of those webinars - Joel's Log Files

Notable links: July 17, 2026 - Werd I/O

`offline_access` scope