Shellsharks Blogroll - BlogFlock

How I Customised Pure Blog for This Site - Kev Quirk

2026-11-01T17:10:00.000Z

A few people have reached out to me to ask how I did X, or Y with my site, so I thought I'd talk about the customisations I've made to this site, and how they work.

Firstly, this site runs on Pure Blog, a CMS that I've been building over the last year or so. As it's matured, I've added features that allow more advanced users to do clever things without having to fiddle with the core platform. This means that people generally shouldn't have to fork the project and should continue to get all the new goodness as I release it.

This site is no different. I haven't done anything clever that Pure Blog can't do out of the box - everything is documented so by reading the docs and using a bit of creativity, you can do quite a lot with this plucky little CMS. I'll link out to the appropriate docs as we go through this post.

Ok, so what customisations have I made? This is going to be a fairly long post, so I'll list them here with links to each header so you can jump around and read the parts that interest you.

If you want to see specific code examples for any of these customisations, feel free to contact me.

Post layouts

I have three custom post types on this site - notes, links, and books. Notes are used as short-form social media type posts, links are links to other blog posts that I've enjoyed, and books are short reviews of the books I read.

Each has their own layout and in the case of notes, they have a different view on the homepage too. To do this I've created a custom post-list.php partial, but we will come to that later.

I could just use the default post type for all these posts, but I prefer to have a customised UI at the back-end for each. Here's what books and links look like in my editor:

Book editor layout

Link editor layout

Notes are a little different as I use a custom page for them that only I can access. This looks more like a social media post window than a blog post window:

Read the custom post layout docs ➡

Hooks and automations

I like to think of hooks as little tripwires that are set to go off when certain conditions are met. For example, something happens when an image is uploaded, or a new post is published. They're extremely useful and I have a number of them on this site:

Email Obfuscation (on_filter_content): Scans rendered content and encodes the site email address into hexadecimal HTML entities to protect against scrapers. This has been pretty effective at reducing spam - I wrote more about this feature in this post.
Post Sanitisation & Metadata Preservation (on_filter_post):
- Automatically generates date/time titles for new notes.
- Normalises layout values by stripping quotes (turning layout: "notes" into layout: notes), ensuring posts written in external editors like Obsidian don't break layout checks.
- Preserves mastodon_url in post frontmatter when saving via the admin interface so the Mastodon card at the bottom of every post continues to work.
Image Optimisation (on_image_uploaded): Automatically resizes images exceeding 2560px width whilst maintaining aspect ratio, also converts them to lossless WebP, and cleans up original unoptimised files.
Mastodon Cross-Posting & Syndication (on_post_published): Automatically crossposts all published post types to Fosstodon via the Mastodon API.
- Notes posts are cross-posted with full body text and media attachments (uploaded to Mastodon's media endpoint).
- Articles, links, and books are crossposted with their description and permalink URL.
- Captures the returned Mastodon status URL and automatically persists mastodon_url into the post's frontmatter which is then used for the Mastodon card at the bottom of every post.
Custom Font for Open Graph Images (on_og_image_font): Makes dynamic Open Graph image generation to use my custom font.

Read the hooks docs ➡

Templates and partials

Beyond custom post types, Pure Blog lets you drop PHP files into content/includes/. These can either override default pieces of the site (like navigation or post footers), or serve as entirely bespoke standalone pages, like my quick-publish notes screen, or the terminal 404 page.

Here's a full list of the templates and partials used on this site:

post-list.php (partial): This replaces the default post-list.php and adds post-type filter buttons, preserving query parameters across pagination. It also displays notes in full, while other post types show only the title and excerpt.
post-meta.php (partial): A customised version of the default post-meta.php file from Pure Blog. On top of the default tag list and post pagination, this version adds the obfuscated "Reply by email" button, a client-side Mastodon conversation card displaying live stats (favourites, boosts, replies) as well as a link to the post on Fosstodon, Pure Comments integration, and a subscription call-to-action.
discover.php (template): Dedicated discovery hub combining Pure Blog's full-text search with an alphabetical, weighted tag cloud showing post frequencies.
sitemap.php (template): An interactive metro map that lists all of the pages on this site. There's also an option to see the pages as a list.
social.php (template): My quick-publish admin screen for composing and publishing short-form note posts.
100.php (template): Dashboard for tracking the 100 Days to Offload challenge streaks in batches of 100 posts.
masthead.php (partial): This replaces the default masthead template in Pure Blog. It adds a custom layout, as well as 404 handoff ($is404) to render the custom 404.php template without modifying core Pure Blog files.
404.php (template): A fun interactive terminal-styled 404 page with custom commands that include goats!
random-post.php (template): Endpoint that resolves and redirects visitors to a randomly chosen published post.

Read the layout partials docs ➡

RSS feed enhancements

I've replaced the default feed with one that allows for filtering on post type. So one feed file, 5 feeds - one for each post type, and a fifth for everything.

My custom feed template allows you to visit /feed/ for everything, or /feed/[post-type] (e.g. /feed/books) for the posts of that particular type. This custom feed file lives in /content and I then used .htaccess redirects to redirect the default /feed URL to /content/feed.php.

All the feed URLs are available here.

Newsletter subscriptions

I use a self-hosted instance of Sendy to send out email "newsletters" whenever I publish a new post. These emails always contain the entire post, so people can read my content from their inbox if they wish.

Because I write notes much more frequently than long-form posts, I let readers choose what they receive: everything, long-form content only, or notes only.

To make that work without sending people through clunky third-party forms, I wrote a custom server-side handler (content/subscribe-handler.php). When someone submits the form on the subscribe page, the handler:

Checks a simple verification question ("What is Kev's surname?") to keep bots at bay.
Silently discards submissions that trigger a honeypot field, or exceed IP rate limits.
Subscribes the user to the correct Sendy list(s) via Sendy's API in a single click.

This not only helps segregate the emails people receive, but it has also had a dramatic effect on spammy sign ups. Which, if you've ever run a newsletter, you will know is a common problem.

Functions and helpers

Pure Blog allows you to add your own PHP helper functions for all kinds of things. On my site, I only have 1 function defined:

render_star_rating(string $rating) which transforms fractional score strings in my book posts (e.g. "4/5") into accessible star glyph strings (e.g. "★★★★☆"). I just think that "★★★★☆" looks far nicer in a post than "4/5".

But how is this star rating accessible? Well, it's rendered on the front-end like this so screen readers can parse it:


    ★★★☆☆

Read the custom functions docs ➡

Design and typography

I don't do anything magical with the design on this site. I use the Victor Mono font, and around 850 lines of CSS, which I've added to the custom CSS field within settings. Combined with the custom masthead, post-list and post-meta files above, it gives me everything I need to customise the site from the default look to what you see now.

I have a custom theme palette that I've defined too, also in settings. The colours used can be found at the bottom of my colophon.

Read the design customisation docs ➡

Data driven pages

One of the most powerful things about using a static site generator is the ability to use data files. With data files you can have a structure data file, like YAML, that contains repeated data, which can then be looped through on the front-end to render content.

I really wanted Pure Blog to be able to support data files, so I added support very early on. Personally, I use two data files on this site:

data/blogroll.yml which is then used to render my blogroll page.
data/projects.yml which is used for my projects.

Data files are fantastic as they reduce the amount of repetitive code you have to write. Instead of typing div, after div, after div manually, you write your div once, then loop through it with a data file and Pure Blog does the rest.

Read the data files docs ➡

`.htaccess` rules

The final thing I customise is my .htaccess file. There's a number of things I do to the standard Pure Blog .htaccess file to either redirect URLs, or protect various locations:

Admin Access Restriction: I restricts /admin/ access to specific allowed IP addresses.
Legacy URL & Feed Redirects:
- 301 redirects mapping historical /blog/* and /categories/* URLs to clean root and /tag/* routes that Pure Blog uses.
- Redirects for legacy feed and social endpoints (/feed.xml, /social-feed, /social-feed.xml, /rss, /blog.rss, etc.) to /feed or /feed/notes to make sure the feed URLs from various versions of this site don't break.
Route Rewrites: clean URL routing for all my RSS feeds so they have simple to share URLs.

Final thoughts

This ended up being an even longer post than I anticipated, but hopefully it shows just how much you can bend Pure Blog to your will, by design.

None of this requires hacks to the core code, or maintaining your own fork. Everything you see here is achieved using Pure Blog as designed: settings, custom CSS, hooks, custom layouts, and partials. Because all these files live inside /content, /config, and /data, I can upgrade Pure Blog the moment a new release drops without worrying about overwriting my site's bespoke features.

That was always my goal with Pure Blog - a super simple, distraction-free blogging platform out of the box, with enough flexibility under the hood for tinkerers (like me!) to build whatever they want.

If you're running Pure Blog and have built your own customisations, or if this post inspired you to try something new with your setup, hit the reply button below, or find me on Mastodon. I'd love to see what you've done with it.

Thanks for reading this post via RSS. RSS is ace, and so are you. ❤️

You can reply to this post by email, or leave a comment.

Note published on November 1, 2026 at 3:17 PM UTC - Molly White's activity feed

2026-11-01T15:17:40.000Z

If you are reading this, you are someone who reads the news, and if you are someone reading the news, that hand is throttling your heart right now. On some level, you know this, but you are likely so used to it that you do not really know how hard it’s squeezing, and how much it saps your strength.

There is a difference between burying your head in the sand and periodically reminding ourselves that the world can be beautiful and good. We have somehow become convinced that turning away even for a second is a betrayal of the most vulnerable amongst us, but constant activation paralyzes us with dread and leaves us too exhausted to take action. Hyperawareness is not a virtue, it’s a symptom of mental illness—ask your complex post-traumatic stress disorder friends about it sometime. We are not betraying the cause by turning off our phones for a few hours; we are not lazy pieces of shit who deserve to be poor when we opt for sleep over pseudoproductivity.

Note published on November 1, 2026 at 2:48 PM UTC - Molly White's activity feed

2026-11-01T14:48:44.000Z

The healthcare marketplace would like me, a self-employed person with no recorded disabilities who has never served in the military, to prove that I DON’T have insurance through an employer, the VA, or Medicare.

Apparently I am meant to do this with things like a letter from my employer saying they don’t over me coverage?? “Dear me, I regret to inform us...”

10 Years on Mastodon - Terence Eden’s Blog

2026-11-01T12:34:18.000Z

As of today, I've been on the Mastodon social network for 10 years. I think that deserves a little reflection and celebration.

Post by @Edent@mastodon.social

View on Mastodon

Social networks often launch in a blaze of glory but limp out of existence within a year or so⁰. How many services have you signed up to, only to gradually drift away from? If you're anything like me¹, your password manager is a graveyard of unloved services and your MFA app is filled with icons of websites you barely remember.

It could easily have been that way with Mastodon. I gradually drifted away from Slashdot. Despite a promising start, AppDotNet died an untimely death. Slack works as a meta-social-network - but there are half-a-dozen communities which I know I'll never check in on. Once in a blue moon I'll think about uploading a photo to Flickr. I tried quitting Twitter several times - only to walk away cold turkey to prevent my soul being polluted by its filth.

I lurk on LinkedIn mainly to gawp at the brainworms. Threads just pushed too much crap into my feed. I think I have a tumblr and a dozen other social media accounts which fell into disrepair.

So what made Mastodon so sticky for me?

Silence Brand

Brands on social networks is an anti-pattern. You cannot be friends with a company.

In the early days of Twitter, brands were desperate to join the global conversation. They saw people complaining about them and wanted to intercede. Sadly that just promoted maladaptive behaviour as people (especially those with large followings) found they could bully brands into submission.

So brands retreated into the only thing they know how to do; advertise.

Mastodon has been remarkably resistant to corporations coming along to plant their flags. The few that are on there are either genuinely interested in the technology or are broadcast only.

Algorithms and Filters

It's wrong to say that Mastodon doesn't have an algorithm. It displays posts in chronological order - that's an algorithm. It has decent enough spam filtering - again, an algorithm. But it never tries to promote far-right hate posts to me.

Even better, it has proper support for a user's personalised filters. I can easily block discussion of politics² and sport. I can turn off reposts from individual accounts that I follow - you know the guy who reposts every puppy video he finds.

That makes for a relaxing and stress-free experience.

Fun Technology

I wasted years on the Twitter API. While I got some lovely swag from Twitter for faffing about with their tech, it was always clear that certain sections of Twitter's leadership hated that 3rd parties could use their APIs. Similarly, Facebook's API started as fun but quickly descended into a locked-down corporate hellscape.

Mastodon's API is mostly a delight to use. There aren't weird and arbitrary restrictions. Even better, because of the inherent open nature of the Fediverse, I can write my own ActivityPub software to interact with it.

I'm even getting paid to develop ActivityBot!

Nice People

Most of the people who join Mastodon³ feel rejected from more corporate social media. They've either made an active choice to try something different or they've been thrown off the mainstream apps. That's (mostly) good - and means that they're invested in making work something that's different.

I'd be lying if I said I didn't miss some of the people from Twitter. I think most of them are on BlueSky now - so I'm on there as well. Think of it like quitting smoking by taking up vaping. Sure, not ideal, but better than the alternative.

What it is missing

I can't pretend everything is brilliant. In no particular order, here are some of the papercuts which annoy me daily.

Reply Controls

BlueSky allows me to set a limit on who can reply to my posts. It is bliss. Sometimes I don't want the world chatting back to me. Yes, there's the ability to restrict who can see my posts in the first place, or who can quote my posts, but it isn't the same.

Super Block

Similarly, I want to be able to remove replies to me. If someone is being abusive or annoying, I don't want my friends to see that. If I block them, I want their replies to vanish from view in my threads.

I can moderate replies to my blog posts - why can't I moderate replies to my microblog posts?

Reply Guys

The two issues above are caused by the same strain of reply-guy. There's something about Mastodon which attracts a certain class of person. I get so many replies from people who either have never heard of this Earth concept called humour, or think that their inexpert Googling is helpful, or want to argue about something I haven't said.

It can be infuriating and I understand why it drives people away.

Geolocation

I just think social geolocation would be nifty!

More People

I'm in two minds about this. Services like Brid.gy allow me to follow my BSky friends on Masto, and vice-versa. Having more people on the Fediverse and away from corporate-owned social media would (hopefully) make it more viable in the long-term.

But more people means more spammers, grifters, and agents provocateur. There's a delicate balance to be found - not enough people and the network fails, too many people and it collapses.

I don't know what the right number is.

The nice thing about the Fediverse is that it literally cannot fail completely. Much like IRC survives despite "everyone" moving to Discord and WhatsApp, it chugs along in the background. ActivityPub servers will be around for the foreseeable future. So I'll be available on Mastodon (or its successor) until the bitter end.

Here's to the next ten years!

I'm looking forward to seeing what happens to Mastodon (and the Fediverse as a whole) by 2036. I am sure it'll have some wobbles, I hope it will see a renaissance, I look forward to shitposting far into the future.

You can follow me on Mastodon - @edent@mastodon.social.

I'm pulling these numbers out of my arse. But, come on, that feels about right, doesn't it? ↩︎
Poor you! ↩︎
I am grateful that so many politicians have reasonably unique names! ↩︎
Yes, I know it is the Fediverse and they're not all on one platform. Cut me some slack. ↩︎

in their season - James' Coffee Blog

2026-11-01T00:00:00.000Z

The leaves are in their “flying season".
Coating the skies in colour, brilliantly.

The trees are in their “wintering season".
Branches bearing and silvering, beautifully.

The sunrises are in their “November season".
Pink comes later in the day, unpredictably.

Leaves, trees, sunrises and all, perpetually
Delighting day, cyclically.

Weeknotes W3 - James' Coffee Blog

2026-11-01T00:00:00.000Z

Today I got to see one of my favourite places in the world – a park I really like – in its full autumn colours. The paths were lined with autumn trees and scattered with yellows and oranges and reds. I heard crisp sounds with almost every step on certain straights of the walk. I forgot how beautiful the trees get here. The colours get more beautiful by the day, even though the trees are more sparse.

For the first time this autumn, I thought to myself that it will only be a few weeks before the oranges and reds will be mostly gone. I will have to make the most of the next few weeks and soak myself in the colours of the season for as long as I can.

The highlights

After last weekend’s storm had me inside for the weekend, I was especially excited to get out this weekend. I went for a long walk – one of my longest this year – and enjoyed the weather. I was surprised by how warm it was, though; I was expecting a chillier air. I went to places I haven’t visited in weeks, visited a new bookshop (where I bought a poetry zine with a layout that caught my eye), and generally appreciated all the time outside, breathing in the fresh air of day.

Today – Sunday – I spent the whole day away from the computer. When I sat down this evening to check in with notifications and prepare to write this weeknote, I realised that the day passed by quickly and I seldom thought of my computer. So too was true of yesterday: I spent many hours walking, checking my phone occasionally. I love being outside.

I spent some time in a coffee shop and started journaling. I am still not in the mood for reading on the weekends, but I was in the mood for writing. I let my stream of consciousness flood onto the pages, writing about all that came to mind while I looked around and watched the world go by. I haven’t written as much prose by hand in quite some time, even though the sum of my writing was less than a page in my writing journal. I wonder if I will write more on paper in the coming weeks. I did enjoy the experience.

In terms of studying, I got back my final grades for last year. I am pleased with how I did. Admittedly I am a bit nervous for my first art history assignment this year, but I am sure I will get through it. This is the first time I have felt nervous about an assignment weeks before it is due, and before we have even been fully introduced to it. I have a lecture about the topic of the assignment tomorrow, on Monday, in which I expect to take many notes. I am already feeling more confident by the day.

In the creative writing section of my studies. I submitted my assignment for the first block last week, marking the end of our block on defining ideas. I am already in love with the next module, fiction writing. Next week I will be starting to study character building, for which I am excited. I have found my confidence in fiction writing has come on leaps and bounds this year, owing, I think, in large part to my studies. We also had a lecture on poetry that I really enjoyed, studying Hayden’s Full Moon.

On that note, this is Writing Month. I am not sure whether I will participate, but this morning I had a burst of creative inspiration and ended up writing a few paragraphs toward a story. I am unsure whether what I wrote has a strong enough foundation to be a longer work – and whether the plot went in the way I want – but it did give me more confidence. I will make a decision about Writing Month by the end of the day. I like that you can set your own goal rather than committing to a longer project such as the 50,000 word total that NaNoWriMo formerly set.

Music corner

On Saturday I picked out a few songs from Bandcamp at random to listen to. I can’t remember any in particular, but I did enjoy many of the songs I heard. With that said, there are a few other songs I remember listening to this week.

This acoustic recording of Soon You’ll Get Better by Taylor Swift.
Little Feat’s Long Distance Love.
A cover of Bon Iver’s Perth, performed by the Coastal Sound Youth Choir: Indiekör 2016.
This cover of Bon Iver’s 715 Creeks.
Maisie Peters’ “It's Your Bed Babe, It's Your Funeral” EP from 2019.
The album “we’re all feeling the same” by lovelytheband.
I am enjoying music by Alice Kristiansen.

Thoughts, wandering

After a Homebrew Website Club meetup this week, I worked on a feature in Artemis that lets users opt in to see boosts from an ActivityPub account. Previously Artemis only showed posts originally authored by the ActivityPub user, but now there is a checkbox to opt in to see boosts in the settings for a subscription. My implementation shows the title of a post to be “Shared a post by @accountname”, rather than showing the actual post. This was inspired by Colin who has a similar implementation in their web reader. I much prefer this minimal approach to showing materials from an account I do not directly follow in my reader.
A little snippet from this morning: “The joy of the first sip of coffee — of how that may beget words, words that beget more words for there is rhythm to be found after starting. I am listening to electronic music. Despite having few words I am starting to appreciate the music for its own qualities — for the repetition, for the moments of change, for the pitches that I seldom hear. There is joy to be found in so much music. I started my morning thinking about ambitions and potential adventures — where I want to go, what I want to try.”
I opened a box of chocolates that I received as a gift a while ago. I love chocolate. Especially the ones in the box that is open now.
I am hoping to “lock in” to my fiction writing next week. I am really excited to see what I learn. I have a feeling that I am going to go through the phase of writing stories that aren’t great while I find my feet, fiction being so new. With that said, yesterday I did a writing exercise and I ended up writing way more than I expected. I found something of a flow state that I feel with other kinds of writing that I enjoy. That was a real delight to feel.
I am starting to get used to the darker nights again. It was nice to see the stars so early last night. There was a forecast that indicated the Northern Lights might be visible later in the night, but I didn’t see them. One of my dreams is to see the Northern Lights. I really hope to see them one day.
I have had this idea of “building bridges” in my mind related to the indie web for several weeks now. I don’t really know what I want to say, but I think the message is how I wish the indie web was more interconnected with other interest groups. My zine “A Creative’s Guide to Personal Websites” is an experiment in communicating the value of websites to creative people (artists, photographers, painters – anyone who thinks of themselves as creative) and how to get one set up while trying to avoid as much technical language as possible. If the words “building bridges” mean anything to you as it relates to the indie web, do let me know. I am still trying to piece this idea together.
I want to make another zine in the next few weeks!
I had a note that is almost a year old nearby with three questions I thought I’d put here: “How did Michelangelo feel when he painted the Sistine Chapel?”, “Has anyone painted HTML code?”, and “Is reading a creative art?”. I don’t plan to actively search for answers to these questions, but I thought I’d give them space here both for future reference and in case they are interesting to you, dear reader.

Miscellanea

I read Ralph Waldo Emerson’s Nature for the first time. I think I will have to re-read the work before I would feel comfortable sharing any thoughts, but I certainly thought this was worth reading. I have known Emerson’s name for a long while as he was friends with Thoreau, so it was good to finally read something written by him.
I love Frances’ link-roundups, and was overjoyed when I saw a few of my recent posts linked in the last edition.
I love the idea of showing a count of how many images have alt text as detailed in the article “Number go up”. This is one case where I am in firm support of “number go up.”
I was listening to the episode of the In Our Time podcast on Logic earlier this week. I think it was in that podcast I heard the term “syncategorematic term”. The term was so full of character I knew I had to bookmark it.
I love the Why Cheap Art manifesto by Bread and Puppet.
The 3D virtual museum linked in “Virtual museum for my wife's artworks” is unbelievable. I have never experienced a museum on the web like I have that one.
The “Historical www-talk archives made complete” publication by the W3C is worth perusing. The “Guido van Rossum writes a web robot that "tries to map out the entire web", distributed along with python 0.9.8” link caught my attention in particular.
I haven’t read this piece in full, but I bookmarked “'It's offensively cheap': How solar power is quietly becoming bigger than nuclear” so I could link to it. Quoting from the piece: “By 2030, the IEA thinks solar power generation will have reached double that of 2025's levels, with solar overtaking hydro to become the world's third-largest electricity source.”

Thank you for reading! My inbox is open if you have any recommendations or ideas that follow from this weeknote.

Artemis Why Cheap Art manifesto Virtual museum for my wife's artworks syncategorematic term last edition A Creative’s Guide to Personal Websites My inbox is open Guido van Rossum writes a web robot that "tries to map out the entire web", distributed along with python 0.9.8 Number go up Colin Writing Month Full Moon 'It's offensively cheap': How solar power is quietly becoming bigger than nuclear Ralph Waldo Emerson’s Nature Historical www-talk archives made complete Soon You’ll Get Better This cover of Bon Iver’s 715 Creeks. Long Distance Love Bon Iver’s Perth, performed by the Coastal Sound Youth Choir: Indiekör 2016

Discoverability Is Only Solved If You Can Be Discovered - Kev Quirk

2026-10-31T13:58:00.000Z

Discoverability Is Only Solved If You Can Be Discovered

by Widdershins

This is a follow up to my post where Widdershins talks about how they agree with certain parts of my argument, but that the discoverability piece is flawed.

Read post ➡

Saw this in my RSS feed and thought it was an interesting take that's worth sharing - also Widdershins' blog is excellent. I'd recommend adding it to your feed reader.

I think the argument around other people controlling the gate to discoverability is a sound one, generally, but sites like Bubbles tend to add most sites, unless they're somehow obnoxious. So inclusion (and therefore discoverability) is only an email away. Having said that, one person's obnoxious is another person's heaven, so it's all subjective.

Either way, it's an interesting debate and I'm glad we're having it. Go check out Widdershins' blog too!

Thanks for reading this post via RSS. RSS is ace, and so are you. ❤️

You can reply to this post by email, or leave a comment.

Open Tabs October 2026 - The Weblog of fLaMEd

2026-10-31T13:00:07.000Z

What’s going on, Internet? If you don’t follow my Bookmarks through the feed, then here’s the bookmarks from October. Enjoy.

Bit of a theme this month, the old web was messier and more fun, and running a site now keeps getting harder.

Jenny O’Connor on why the embarrassing internet was the good internet. My old fan pages agree.
Winnie Lim on why running a personal website is not fun anymore. Rough read. Between AI bots scraping the fuck out of the open web and hackers using AI agents to find holes, no wonder.
Aaron’s Early Web Links is a one-person directory of personal homepages, covering all types of personal websites.
wulfpaper on why making websites shouldn’t seem so hard. Start with the writing, worry about code and design later.
A big alphabetised list of old linkware webset graphics sites. Handy if you’re after that old-school look.

For more, check out the bookmarks archive, and subscribe to the feeds if you want these as they happen.

Hey, thanks for reading this post in your feed reader! Want to chat? Reply by email or add me on XMPP, or send a webmention. Check out the posts archive on the website.

Gig Review: The Witcher in Concert ★★★★☆ - Terence Eden’s Blog

2026-10-31T12:34:18.000Z

The most common way people experience classical style music these days is via movies and video-games. After seeing The Force Awakens - live in concert, I've become rather a fan of watching movies performed with a live soundtrack.

But what about watching a video game with orchestral accompaniment? We travelled up to Wolverhampton to see "The Witcher":

A one-of-a-kind live event that transforms the lasting legacy and emotional storytelling of The Witcher 3: Wild Hunt into an immersive concert

Obviously you can't have someone sat there with a PS5 controller while a band plays (although that'd be a hell of a Twitch stream!) instead a large screen projects various cut-scenes and in-game footage. It works pretty well - most of the popular scenes are in there (Geralt in the bathtub got a big cheer) although there was no hyper-extended Gwent session. The videos were a little repetitive. Some of the music is obviously composed to be swelling in the background and so repeated shots of swords looking cool or Geralt looking grumpy were sprinkled throughout.

The highlight was seeing Percival Schuttenbach play a variety of instruments with absolute joy and gusto. The entire band look like they're having a whale of a time, and the conductor encouraged us to whoop and cheer for our favourite scenes (with perhaps a few boos for some of the more notorious enemies).

As soundtracks go, it isn't particularly varied. There's a decent mix of tunes, some with singing, but they do tend to blur into one after a while. Nevertheless, a brilliant time for fans of the game who want to soak up the music.

The Witcher in Concert is on tour around the world now.

Pre- and Post-Show

There was a merchandise stall hidden in one corner of the venue. Between doors opening and the start of the show (about an hour) a video looped through three screens - one of which encouraged up to share our photos with a hashtag. That's fine, but a few more videos wouldn't have gone amiss.

After the show, the conductor said the band would stick around for selfies - which was nice of them.

A touring show like this probably can't spare too much space for large scale models for people to pose with, or a couple of cosplayers to photograph, but it might have been nice if there were something to interact with before and after the show.

Identity Assertion JWT Authorization Grant Draft 06 - Articles by Aaron Parecki

2026-10-31T00:55:21.000Z

We've just published draft -06 of the Identity Assertion JWT Authorization Grant (ID-JAG):

https://datatracker.ietf.org/doc/draft-ietf-oauth-identity-assertion-authz-grant/

It's been great to see so many new implementations of ID-JAG over the past few months, across identity providers, authorization servers, clients and libraries. -05 and -06 are mostly about bringing what we've learned from these implementations back into the spec. The diff looks big, but most of it tightens the wording so independent implementations interoperate better. The flow and the overall design haven't changed.

Most of the changes are clarifications, such as:

How resource and audience values are compared and validated
Which sub value the IdP selects for the Resource Authorization Server, and how subject identifiers are mapped
Whose claims the ID-JAG carries (End-User, client, etc)
How the Resource Authorization Server finds and validates the ID-JAG signing keys
SAML NameID handling
Using a Refresh Token as the subject token
Error codes for common failure cases, and when a Client should request a new ID-JAG
Fixes to examples and references

A few changes are new, or make explicit what implementations were already doing:

The IdP authenticates the Client at the Token Exchange step, and the request carries a single audience value
When a subject token fails validation, the IdP now returns invalid_request instead of invalid_grant, as RFC 8693 requires. If you've implemented the Token Exchange step, please check your error handling.
At the Resource Authorization Server, a key-bound ID-JAG can be used in place of client authentication
mTLS is defined as another option besides DPoP for binding the ID-JAG
New id_jag_signing_alg_values_supported IdP metadata
A new Privacy Considerations section

The full list is in the Document History section.

Diff from -04

Thanks to everyone who has been implementing this and sending feedback, and especially to Karl for working through so many of the issues. I'm hoping to get time at IETF 127 to go over the remaining open issues. In the meantime, comments are welcome on the list or at https://github.com/oauth-wg/oauth-identity-assertion-authz-grant

Morning - James' Coffee Blog

2026-10-31T00:00:00.000Z

A golden glow peeked through the edges of the curtains. What colour is the sky this morning?, I wondered, knowing in the back of my mind that the colours may only be there for a few more minutes – such is the pace of the sunrise. No moment can be taken for granted. I opened the curtains and saw a salmon-esque glow in the sky: not quite pink, but not quite orange: a mix of both colours. The sun was rising in the opposite direction, at the stage where the whole landscape seems transformed by ephemeral colours.

I later thought about how the landscape is always changing with the day – the sunrise on a relatively clear day like this morning’s, where the sky was only dotted with clouds, brought forth the aforementioned pink-ish colour, and golden colours, too. Trees not yet touched by the sunlight had a faint patina, as if they were in a Renaissance painting that had long since aged. But these trees were real, right in front of me, bathing in the rhythms of the day.

If only I could describe the trees with the same precision of a painting.

Was that an eagle, soaring through the field? I haven’t seen one as long as I could remember. The interlaying golden light rises from the distance; the streams in the valley were woken on their own accord, always flowing, for the sparkling sunlight has not shone on them yet. I watched the landscape with wonder, as I always do.

⁂ ⁂ ⁂

I went on a long walk today, to make up for the time lost from last weekend where I stayed mostly indoors to weather the storm. The last week has been one of missed routines and reminding myself that this too shall pass. While last night I sat by my piano playing sad songs, later resting my tired head between my arms on top of the keys, this morning I woke up with newfound energy and vigour. I can never remember exactly how I get better when I feel down, but going out for a walk surely helped.

The morning sky ushered forth darkness’ bye.

In the park, I walked on wood chips sprinkled with yellow trees under relatively low canopies. The path on which I walked was only meters away from the concrete one with which I was more familiar, but I wanted to feel something new under my feet – to get closer to the ground; to feel whether the wood chips would be softer than the concrete. Although I was so close to the concrete path, what was ahead was different, the sounds and sensations of the ground were different; the view of the sky, intermediated by low hanging yellow and orange and green leaves, is new.

I walked for miles, finding a rhythm that meant I was walking up the hilly streets faster than I expected. At one point, I stopped at a gallery window to admire an artist whose works depicted landscapes over the sea. The pink and orange and blue colours were breathtaking, the kind of works that stop you in their tracks. The gallery was one where works were for sale. It makes me think about how much I love that there are still new artists making works. I don’t know if the works I saw today were new, but they did feel more contemporary, capturing the world in a different way to pieces I have seen in museums.

A man walking down the street wore a shirt that caught my eye. “Creatives are the new athletes.”

Note published on October 30, 2026 at 11:03 PM UTC - Molly White's activity feed

2026-10-30T23:03:27.000Z

this is a very weird headline to run alongside an article that essentially says that an organization that believes in the importance of fair use thinks that fair use should not be interpreted in a way that narrows existing copyright law

Note published on October 30, 2026 at 10:13 PM UTC - Molly White's activity feed

2026-10-30T22:13:53.000Z

In July 2024, I reported that Coinbase appeared to be violating campaign finance law by making contributions while holding federal contracts. I filed an FEC complaint alongside Public Citizen. The FEC hasn’t acted. Since, Coinbase has given $60M more and landed another federal contract.

Coinbase responded to the initial complaint by arguing that, despite having received a federal contract, they were not a federal contractor — then insinuated I had secret funders and made lightly veiled legal threats against me.

“It’s bad enough when the laws are weak or there are loopholes in the law, but it’s almost worse when you have laws on the books that aren’t being enforced because the regulator is inadequate, and that’s the situation where we’re finding ourselves now,” said Eric Petry, counsel in the Brennan Center for Justice’s elections and government program.

I track Coinbase’s (and its top executives’) campaign spending. They’ve spent $100 million+ since 2024 across super PACs, Trump campaign committees, and other individual candidates.

Published on Citation Needed: "It’s always North Korea" - Molly White's activity feed

2026-10-30T17:03:56.000Z

Published an issue of Citation Needed:

It’s always North Korea

Answering your questions about who was behind the Binance hack, how they launder the money, and where it goes

SocialSpec Seems...Pointless - Kev Quirk

2026-10-30T16:36:00.000Z

I've seen a few people talking about SocialSpec which claims that "the future of social media is websites". Something I strongly agree with. However, I don't see the point of this fledgling spec on top of all the other IndieWeb complexity that's flying around.

From what I can gather, it's 3 files that you upload to /.well-known which provide a bio, a means of contact, and what blogs you follow. Step one is to have an RSS feed, actually, but everyone should have an RSS feed anyway. But aside from this, I already have a bio, a means of contact, and a list of blogs I follow. So what is SocialSpec trying to achieve?

Again, from what I can gather from the site, you publish these 3 files on your site and you're magically enrolled in the new website social network. Where you can peruse a timeline of posts from fellow bloggers, based on who you follow in your OPML file.

Fuck yeah! Win for the open web. Sign me up!

But hang on a second. This open spec, based on open protocols, for the open web doesn't even have a web app. Nope. The only client that actually uses it is sitting behind a fucking iOS app.

Now I'm sure other apps will come with time, but if this were truly a platform for the open web, wouldn't a website that supports a PWA have been a better solution initially? I think so.

What does it solve?

Even if someone takes the time to publish and maintain these files, what does SocialSpec offer over an RSS feed reader, and a couple of pages on your site?

Nothing.

I like how people are thinking of ways to interconnect sites in this way, but I don't think this is the right approach. It's trying to solve a problem that doesn't really exist in my opinion. The only issue it may fix is discoverability. But I still think it's flawed as the service would need a decent user base to make discoverability viable.

Sites like Bubbles, PowRSS, and Bear Discover are far better than this solution as they're easier to use and have no barrier for entry.

Maybe I'm being a curmudgeon here, but I really don't get it. This is a solved problem, and has been for decades.

Thanks for reading this post via RSS. RSS is ace, and so are you. ❤️

You can reply to this post by email, or leave a comment.

Notable links: October 30, 2026 - Werd I/O

2026-10-30T15:55:30.000Z

Most Fridays, I share a handful of pieces that caught my eye at the intersection of technology, media, and society.

Did someone forward this to you? Subscribe for free.

ChatGPT Is Building Detailed Psychological Profiles of Its Users

It probably shouldn’t be a surprise that chatbots like ChatGPT are profiling their users. Still, there are some surprising numbers here:

“A staggering 96 percent of memories were created unilaterally by the chatbot, according to the study, meaning that the users had little overt control over the data points that ChatGPT logged as their interactions wore on. Stored memories were also deeply revealing about users. About 28 percent of the memories examined contained personal data as defined by Europe’s strict General Data Protection Regulation standards, and 52 percent contained rich “psychological insights” about users.”

I think back to Gina Chua and Adiel Kaplan’s three-layer cake analogy for the AI stack. In their analysis, the consumption layer profiles the user; this new report makes clear how deep that profiling goes.

As I said in my commentary then:

“Profile data is accumulated, private, and usually non-portable. The consumption layer also represents the greatest risk to creators from platform business decisions, both in terms of the business models of those platforms and which creators they choose to feature. Open portability standards and protocols — combined with full user control of their data — can scale, create useful competition, and empower users in the process.”

Nothing here dissuades me from that view. To be as useful as possible, AI tools need to dig into our most personal information, make inferences about who we are and what’s interesting to us, and maintain highly personal profiles. Our AI agents are not some kind of trusted friend: they are products owned by a third party that needs to justify a trillion dollar valuation and may not have our best interests at heart. All the major vendors provide services used by the military and law enforcement. What happens if one of those agencies wants to get hold of that profile information? These companies simply cannot be trusted with our most private information, and should not have access to it.

But, of course, legislators have also been negotiated into a position of alignment with AI accelerationism. We need to gather all of this personal information about individuals in a supposed democracy, they argue, because otherwise China will win! These concerns seem to trump the fact that privacy is considered a fundamental human right, for very solid and defensible reasons: it makes dissent, organizing, a free press, and a well-lived life possible.

I am not arguing that there are not legitimate uses for AI or that the technology is not transformative. But there should not be an argument that we should let go of our core human values or the fundamental protections needed to maintain a robust democracy — of which privacy is one — because this tech is cool and we need it to grow really fast and by the way it’s also now propping up our economy. Trading privacy for growth is not a smart long-term strategy: it will bite us.

As individuals, we can protect ourselves by using different tools. But privacy is a group inoculation. If the chatbot is profiling its users, I suspect it’s also profiling the people its users are talking about. We need to demand better behavior from our vendors while taking steps to also demand it from our friends.

Manifestos, Fear, and ‘Loser Thinking’: Inside Proton’s AI Reckoning

Proton, based in Switzerland, offers encrypted email, file storage, calendars, and more. It markets itself as a privacy-oriented alternative to Google Workspace, based in a neutral territory that is generally outside of the jurisdiction of the United States. I’ve generally been glad that it exists — but stories like this give me pause.

404 Media reports:

“Our reporting also paints a picture of Proton that is likely very different to the public’s perception of a company with a goal of carefully protecting privacy: one that in reality is barreling ahead with AI as quickly as possible so it can achieve the explicit goal of more annual revenue.”

CEO Andy Yen comes across as a bully who is pushing his staff to adopt AI as quickly as possible in order to maximize Proton’s revenue because its ARR was slipping. That’s not an approach you would hope a security-oriented, encryption-based organization would take.

This follows an unwise decision to praise a Trump nomination at the beginning of his second administration. Yen said it wasn’t intended as a political statement. I don’t think that he’s necessarily a Trump supporter, but it was part of a series of incidents that follow a troubling pattern: an action that undercuts Proton’s brand and stated values, followed by defensive excuses. It suspended journalist accounts at the request of a cybersecurity agency and then called the outcry “blown out of proportion”; it handed over the recovery email address for a Catalan activist, an iCloud address that led to Apple providing their full personal information, and said its hands were tied.

And then there’s this:

“Andy Yen, the CEO of Proton, had a message for an employee in the company’s security Slack channel who urged the company to at least take a few days to pentest newly written code before pushing it live. “That’s bullshit and loser thinking. Of course it’s possible to be fast and secure,” Yen wrote in the channel at the end of August. “Stop thinking always of how to be slower, and focus more on how to be faster.””

Services like Proton need to exist. Privacy is an important prerequisite to democracy: it protects journalists, activists, vulnerable communities, and everyone’s ability to live well and with dignity. But it’s a serious business. A move-fast culture of bullying that apes startup-land and calls caution “loser thinking” does not instill confidence, and implies it’s only a matter of time before something much worse happens.

'It's offensively cheap': How solar power is quietly becoming bigger than nuclear

This is something we should all be excited about:

“The world's solar power is crossing a threshold. A decade ago, it barely registered on a global scale, providing just 1% of the world's power. In 2026, it will almost certainly increase to 10% of power, and overtake nuclear, a mainstay of electricity since the late 1970s.”

Solar energy is abundant, and the cheaper and more efficient it gets, the more electricity there will be to power anything we want. On that level alone, we should be cheering for its success.

But the other property solar energy has is relative decentralization. While not anyone can build a solar panel, anyone can plug one in — and, obviously, the sun belongs to everyone. It represents real energy independence, not just internationally, but from large energy companies (at every level from fossil fuel multinationals to utilities) that have enjoyed enormous influence for over a century.

Or it should. Energy companies have sponsored laws, rules, and regulations in the US and elsewhere that have made it harder for people to plug solar in. Those should be defeated, and our electrical systems should be upgraded to take decentralized solar into account.

But the power dynamics don’t end at the influence of energy companies: a large share of the polysilicon in solar panels is produced in Xinjiang, where there have been well-documented allegations of forced labor of Uyghurs and other minority groups. Batteries often contain cobalt, which is dug from the Democratic Republic of Congo, often by hand and often by children and slaves. They also contain lithium, drawn from brine operations that drain water from Indigenous communities in the Andes.

The next frontier needs to be freeing these technologies from harm — and there’s a long way to go. There’s some promise from tech like nickel-and-cobalt-free LFP batteries, more ethical lithium extraction, and recycling, but these need further investment, and the underlying issues require sustained attention. There is an energy revolution, but everyone should see the benefits.

And more:

Here are some of the articles I didn't get a chance to go into in depth this week.

It’s now official, tech is the new tobacco

Following in the footsteps of tobacco and the fossil fuels industry, tech companies have been sponsoring academic research that conveniently produces findings in their favor, while working hard to discredit research that might undermine their businesses. Internal documents from Meta, made public through an ongoing lawsuit against them, confirm it.

The Subculture Flywheel

In common with all of Corey Ford's guides, this is an easy-to-follow way to build culture and practices in your team that further the values and outcomes you want to see. It's simple, human, and effective.

Silicon Valley wants you to invest in miracles

Anthropic's S-1 filing is bananas. It's openly cult-like: it wants you to "be part of something bigger" that, by the way, might destroy humanity. As one Wall Street leader put it to me this week: either they're lying about the impact and they shouldn't be allowed to go public, or they're telling the truth about the impact and they shouldn't be allowed to go public. Also, they acknowledge that they might never be a viable business. Fun times.

Book Review: The God of Small Things by Arundhati Roy ★★☆☆☆ - Terence Eden’s Blog

2026-10-30T12:34:22.000Z

I did not care for this one bit. I found it cloying, infantilising, and far too circuitous.

It starts off as a bit of an overwritten melodrama, where every phrase is a delicious flower waiting to bloom, but ends up being a over-sugared mess with a rotten heart. Parts are just exhausting to read, with no time to catch your breath between scenes. That can work in some books when spaced out - here I just found it annoying.

My main problem with it, though, is that it feels like it is entirely exposition. Because of the (unnecessarily) jumbled order of the story, every paragraph feels like it is introducing us to something or someone. Rather than progress the plot, I felt like I was being drip-fed morsels for what was coming up. In the end, the story just isn't interesting enough to support that.

Parts of the writing are gorgeous, but they're in service of so little that it seems like an unfair sleight of hand; you're too busy admiring the prose to realise how dull and uneventful everything is. The repetition hammers away like a vocal tic - wearing out its welcome by the tenth occurrence. The mannered spelling, punctuation, and extemporising is similarly grating after a while.

I don't mind characters being unsympathetic - but every single one is painted as a monster or a simpleton. It's hard to keep reading when nearly all the main characters are so relentlessly unlikeable. I know I'm not a big fan of sad or upsetting books, but there was so little joy or happiness in this one that I felt grimy reading it. Afterwards I was left wondering what the point of it was. I do not doubt that the depictions of casteism were well done but, again, to what end?

I read this for a book club and wondered what my fellow readers made of it. All of us found it a challenging read, with most raising similar criticisms to mine. We all found the prose to be beautiful but the plot lacking. Only one of use gave it a positive review - but we all agreed it was a fascinating book to discuss.

Perhaps we were all just philistines? Yet each of us came up with a compelling reason why we found it so unpalatable. There truly was something for everyone to complain about.

Weeknote #2024 - Robb Knight • Posts • Atom Feed

2026-10-30T11:06:00.000Z

WordArt is back, baby.

This is fun. Put in a postcode or area and Local Wikipedia shows you articles local to you.

Postmark make games that are printable and just need common game components like cards or dice to play. Neat.

Wonders of Web Weaving, a podcast I was a guest on back in August, has just published it's 25th and final episode. James has some behind the scenes info here about the show.

Shep, a prolific maker of web things, posted about Instant Fail which is a soundboard of fail sounds and that led me to find his F16 Bit project — "Real Formula 1 race data, redrawn as a 16-bit arcade broadcast". So good.

Stupid game trailer made me feel things.

Lou reminded me I needed to do my llms.txt. So I did.

The trailer for the new Jumanji dropped and it looks as stupid as ever. I can't wait.

I learned about Psalty and I can never unsee it.

Proton is AI-pilled and calls caution "loser thinking". - Werd I/O

2026-10-30T03:25:48.000Z

Link: Manifestos, Fear, and ‘Loser Thinking’: Inside Proton’s AI Reckoning, by Joseph Cox at 404 Media

Proton is a service based in Switzerland that offers encrypted email, file storage, calendars, and more. It markets itself as a privacy-oriented alternative to Google Workspace, based in a neutral territory that is generally outside of the jurisdiction of the United States. I’ve generally been glad that it exists — but stories like this give me pause.

404 Media reports:

“Our reporting also paints a picture of Proton that is likely very different to the public’s perception of a company with a goal of carefully protecting privacy: one that in reality is barreling ahead with AI as quickly as possible so it can achieve the explicit goal of more annual revenue.”

And then there’s this:

“Andy Yen, the CEO of Proton, had a message for an employee in the company’s security Slack channel who urged the company to at least take a few days to pentest newly written code before pushing it live. “That’s bullshit and loser thinking. Of course it’s possible to be fast and secure,” Yen wrote in the channel at the end of August. “Stop thinking always of how to be slower, and focus more on how to be faster.””

Proton is AI-pilled and calls caution "loser thinking". - Werd I/O

2026-10-30T03:21:00.000Z

Link: Manifestos, Fear, and ‘Loser Thinking’: Inside Proton’s AI Reckoning, by Joseph Cox at 404 Media

404 Media reports:

“Our reporting also paints a picture of Proton that is likely very different to the public’s perception of a company with a goal of carefully protecting privacy: one that in reality is barreling ahead with AI as quickly as possible so it can achieve the explicit goal of more annual revenue.”

And then there’s this:

“Andy Yen, the CEO of Proton, had a message for an employee in the company’s security Slack channel who urged the company to at least take a few days to pentest newly written code before pushing it live. “That’s bullshit and loser thinking. Of course it’s possible to be fast and secure,” Yen wrote in the channel at the end of August. “Stop thinking always of how to be slower, and focus more on how to be faster.””

Shellsharks Blogroll - BlogFlock

How I Customised Pure Blog for This Site - Kev Quirk

Post layouts

Hooks and automations

Templates and partials

RSS feed enhancements

Newsletter subscriptions

Functions and helpers

Design and typography

Data driven pages

.htaccess rules

Final thoughts

Note published on November 1, 2026 at 3:17 PM UTC - Molly White's activity feed

Note published on November 1, 2026 at 2:48 PM UTC - Molly White's activity feed

10 Years on Mastodon - Terence Eden’s Blog

in their season - James' Coffee Blog

Weeknotes W3 - James' Coffee Blog

The highlights

Music corner

Thoughts, wandering

Miscellanea

Discoverability Is Only Solved If You Can Be Discovered - Kev Quirk

Discoverability Is Only Solved If You Can Be Discovered

Open Tabs October 2026 - The Weblog of fLaMEd

Gig Review: The Witcher in Concert ★★★★☆ - Terence Eden’s Blog

Identity Assertion JWT Authorization Grant Draft 06 - Articles by Aaron Parecki

Morning - James' Coffee Blog

Note published on October 30, 2026 at 11:03 PM UTC - Molly White's activity feed

Note published on October 30, 2026 at 10:13 PM UTC - Molly White's activity feed

Published on Citation Needed: "It’s always North Korea" - Molly White's activity feed

SocialSpec Seems...Pointless - Kev Quirk

What does it solve?

Notable links: October 30, 2026 - Werd I/O

And more:

Book Review: The God of Small Things by Arundhati Roy ★★☆☆☆ - Terence Eden’s Blog

Weeknote #2024 - Robb Knight • Posts • Atom Feed

Proton is AI-pilled and calls caution "loser thinking". - Werd I/O

Proton is AI-pilled and calls caution "loser thinking". - Werd I/O

`.htaccess` rules