Shellsharks Blogroll - BlogFlock

2026-09-10 13:49: The constant outrage on #Mastodon (and maybe other social sites?) for is so tiring. - Kev Quirk

2026-09-10T12:49:00.000Z

The constant outrage on #Mastodon (and maybe other social sites?) for [bad thing of the day] is so tiring.

Thanks for reading this post via RSS. RSS is ace, and so are you. ❤️

You can reply to this post by email, or leave a comment.

Put an AV test at the start of your slides - Terence Eden’s Blog

2026-09-10T11:34:10.000Z

For years, I've had a test-card at the start of my slides. Before I start my talk, I can immediately see if the aspect ratio is wrong, colours are off, or any other visual issues with the presentation.

A few years ago I was invited to give a talk and was assured that the venue was set up for audio as well as video. I dutifully filled my slides with with demo videos containing sound. None of them worked. Somewhere between the HDMI output of the presentation laptop and the speakers, the audio went AWOL.

Ever since then, I've placed an audio test slide at the start of my presentations. There's a good range of videos on YouTube - pick one you like, embed it into your slides, and play it before your talk starts.

Over the years, I've found the following "bugs" with event AV setups:

No sound.
Only left channel working.
Severe latency between audio and video.
Garbled sound.
Sound routing to the room but not the livestream.
Feedback / howl around when sound playing.

Whether events are professionally run or community managed, you can never guarantee that sound will work. Add subtitles to your videos. If possible, add a sign-language interpreter. And, if all else fails, hold your microphone to your laptop's speakers.

Visual; textual - James' Coffee Blog

2026-09-10T00:00:00.000Z

My home page is a poem. I designed it in this way to explore the extent to which a literary medium – a poem – could be used for navigation, for way finding. Poems help me see the world differently, to navigate thoughts. So too does navigation: every link is a bridge to a new place, to new thoughts. While the style is unconventional and less clear than traditional navigation bars, I love it. My home page brings me closer to poetry, and reminds me of my love of words.

For the last few weeks, I have had an idea in the back of my mind: what if my home page poem had a few icons in the background that served as visual cues to different stanzas in the poem? These icons might make it easier to find particular sections of the poem. The would also add a more visual dimension to the poem. While poems are visual in themselves – the spaces between words and stanzas, indentations, the lengths of lines, the space the poem takes on a page, the typography used, and the symbols used, among other factors, all influence how we read a poem – images add a new dimension.

One of the things I love most about the web is that I can ask myself “what would this look like?” and then, through code and tinkering, bring the idea to life. I spent some time this morning searching through Phosphor Icons, an MIT-licensed icon set I use for, among other things, the icons in my mobile navigation bar. I decided on a flower for the first stanza, which speaks of stories and poems and ideas and joy, a notebook for the second, where my most recent blog posts are listed, and footsteps for the third stanza, which is more about navigation. I am not fully set on footsteps for the third stanza, as they don’t quite relate to the invitation to say hello at the beginning of the stanza. Indeed, part of the creative challenge of this concept is to find an image that matches many words.

Here is what I designed:

Faint blue icons appear on alternating sides of each stanza: right, left, right. The icons are all at slight angles. An opacity is applied so that the icons do not stand out as much as the words in the poem. The icons complement the text in each stanza to varying extents.

Thinking about the idea of adding images to a poem brought me back to a list I started curating in the last month of places where words exist next to images. Words appear on album covers as part of the art designed to represent the album. Words appear in front of or near images on book covers. In museums, words appear on some paintings (i.e. signatures, or even, in some cases, stories), next to art (i.e. on information plaques), below art (i.e. on a label on the frame of a painting), and more. Words and images, although separate modalities, appear together so often. Indeed, I have started to add more images to my home page that was originally all-text except for my website mascot; the images I have since added – two buttons – convey information in a way I can’t with words, but also serve as a complement to what is on the page.

While I haven’t rolled out this design on my home page – and I’m not sure yet if I will – it has been interesting to explore the intersection of the visual and the textual in this way. Indeed, my poem also explores a third dimension – navigation – through the links it uses. It is fascinating to try and extend a literary medium with the affordances that hypertext allows. What if a poem revealed a piece of art every time you hovered over a stanza?

My main reservation with the icon design is that it may distract from the words. But it also creates new visual anchors. There is a lot to think about.

This crossing of disciplines relates to a conversation I had earlier this year with an uncle when I mentioned that I don’t think the sciences and the arts are disconnected, but rather are complementary. I can’t remember his exact words, but I was left feeling excited about how someone else also didn’t see them as separate buckets. Similarly, it is interesting to think of words and images not only in the context of each modality, but in the context of all the spaces in between. Indeed, we already have picture books, prose poetry, technical writing, visual communication, and many other forms that combine two concepts or traditions together.

way finding Phosphor Icons

A Year of Silksong - Joel's Log Files

2026-09-09T18:10:00.000Z

It’s been a whole year now since Hollow Knight: Silksong finally released, and it has been a delightful journey.

I wasn’t there for a lot of the hype around it, I was more than happy playing Hollow Knight in the span of a year or so, and beat it only a few days after Silksong was finally released to the public on September 4, 2025, a day after I posted my review.

I was perfectly aware of the meme though, and the time it took for this sequel to finally show up, so I was very clearly hyped, and I had decided that I would buy and start Silksong on the very first day, the first time I even considered doing something like that.

Waiting in line is something I’ve never done. It has always been a bit of a dream of mine, to wait for a whole day behind the closed doors of a videogame shop, like those old videos on YouTube where people are camping for a whole night just to be among the first to get Halo 2 for the Xbox back in the day, though in this case it would be a digital game I guess.

Of course, we all know how that went. The servers on every single gaming platform were overwhelmed for hours, as people tried and failed to purchase this twenty dollar game. I was trying to get to it on the Nintendo Switch, but I failed to do so.

Thankfully, I was actually at work, and I would have been unable to play the game immediately anyway, so I simply waited until later to purchase it and finally get started with it.

The progress I’ve made so far in the span of a year has been… slow. I pick it up when I want and leave it be when I feel like trying something else. I’ve not pushed myself t play it when I don’t want to, and I have even abandoned it for months at a time, until things line up and I can return to it.

Most of my progress has been consistently shared on a long thread that has been around since the game first came out, lots of screenshots and recordings can be seen of the most important steps of my journey through Pharloom.

In case you somehow don’t know this, Silksong is a Metroidvania game with Soulslike elements, in case you don’t know what that means, you basically get lost in a world that is gated by hard to reach areas, so you have to get new powers that let you make progress. Oh, and you also have to fight against enemies and bosses that will kill you in three hits. Incredibly fun!

At this point I could write a review for the game, but since I’m still going through Act 3, I want to finish that first too. Kind of funny considering I didn’t go through a lot of Hollow Knight, avoiding the Path of Pain and much of the DLC content, but well, things happen, I may even revisit that game later on.

As of today, I have been playing this game for over 80 hours, making it the most played title in my Nintendo Switch, surpassing The Hundred Line: Last Defense Academy. Both games still have a bunch of playtime left for me to go through, so I am wondering how long it will be for me to get through it all.

Of course, some titles like Minecraft and Monster Hunter Freedom Unite are still hundreds of hours ahead, but they are completely different and I’ve also played them for many years so they have a big advantage.

Silksong is a triumph, something truly special that I am really happy to be a part of. Dare I say it’s the only game whose release date I have memorized! So of course I just wanted to yap a little bit about it.

Definitely not a game for everyone, even after all the updates that have balanced some of the difficulty, but if you are up for a challenge, it is always worth a try!

Hollow Knight: Silksong, downloading on my Nintendo Switch, a year ago!

This is day 32 of #100DaysToOffload

Reply to this post via email | Reply on Fediverse

Greyscale in Doodle Scan - Robb Knight • Posts • Atom Feed

2026-09-09T13:46:28.000Z

Last night I was reading this excellent post about scanning pencil artwork and the first step the artist mentioned is setting the pallette to greyscale. This made me realise how useful that would be on Doodle Scan — the black and white mode is good but only in some circumstances where the drawing is just lines, greyscale would be much more useful for illustrations with colour or shading.

Like all the other features on Doodle Scan, it wasn't immediately obvious to me how to do this. After some digging and experimenting with changing RGB values, I realised the relative luminance value I use to check for if the colour is light or dark can be rounded with Math.round to get the value I need. So 253.123 becomes 253 and I set the RGB value of that pixel to 253,253,253.

Below are examples of the three colour modes with default settings from Doodle Scan and if you want a drawing a bit like this or anything you want really you can donate to St Jude.

Colour version

Greyscale version

Black and white version

A “proof” of Fermat’s Last Theorem that fits the margin - Trail of Bits Blog

2026-09-09T11:00:00.000Z

Fermat famously claimed to have a “truly marvelous proof” of his Last Theorem, but he never wrote it down, insisting the margin of his page was too narrow to contain it. A few centuries later, Anthropic announced a complete formalization of Fermat’s Last Theorem using 13 million lines of Lean code (clearly not what Fermat intended). Luckily, we found a wonderfully cursed Lean bug, shown below, that suggests the proof may have fit the margin after all. The issue affects all stable versions of Lean up to 4.33.1, and the patch is incorporated in v4.34.0-rc1.

A “checked” proof of Fermat’s Last Theorem using Lean 4.33.1

The blue checkmarks in the screenshot above would suggest that Lean considers this proof correct. This seems odd given the amount of work Sir Andrew Wiles put into this problem and the vast size of Claude’s proof. So what is going on?

The “proof” clearly doesn’t make any sense and exploits an issue in Lean. We found the issue while using GPT-5.6 to experiment with a new skill for code review. We want to clarify up front that the issue is not a kernel soundness issue, but it happens to nicely fit any discussion of strings, lengths, and substrings.

The issue affects String.Pos.Raw.extract, Lean’s low-level string-slicing function. When asked to extract a one-byte slice at an astronomically large position, Lean’s logical definition returns the empty string. But the compiled native code returns the entire original string. That disagreement is enough to manufacture a contradiction. Lean’s ordinary evaluator “proves” that the tiny slice was empty, while native evaluation “proves” that the very same slice contained “a truly marvelous proof.” Put those together, and Lean concludes that the empty string equals a non-empty string. And once you have a contradiction, you can prove anything, including Fermat’s Last Theorem.

On the bright side, the Lean team was considerably faster than mathematical history. About 90 minutes after we reported the issue, hargoniX opened a fix for the memory-safety problem, and it was merged roughly three hours after filing. The remaining semantic mismatch was fixed by Rob23oba five days after the report, closing the issue. We’d like to give a huge shoutout to hargoniX, Rob23oba, and the Lean team for the fast turnaround.

As a reminder, when dealing with external proofs, follow Lean’s guidance for validating a Lean proof. In our proof-of-concept code above, #print axioms flt shows 'flt' depends on axioms: [propext, Classical.choice, Quot.sound, flt._native.native_decide.ax_1_1]. The extra axiom native_decide adds the compiler to the trusted boundary, and therefore needs to be used with care. Machine-checked proofs will increasingly enable an unprecedented level of trust in mathematical results and critical software. However, more work is needed (e.g., lean4lean and alternative kernel implementations) to ensure that proofs aren’t deemed correct through exploitation of issues in theorem provers.

Fermat’s theorem took 350+ years to prove. If you don’t want to wait that long for your code to be audited, contact us.

JD CLI updated: now creates filesystem folders - Johnny.Decimal

2026-09-09T07:35:50.000Z

The JD CLI has been updated.

It's migrated from using environment variables to the new configuration file.

Now if you try to jd 11.11 to a folder, and that folder doesn't exist, and your JDex is readable by the CLI – i.e. Markdown files on disk, i.e. Obsidian - then it'll create the folder for you.

The MCP server has been updated to understand this tool and the configuration file. Just ask it to help me install the jd cli.

Here's a short video walkthrough.

If you installed the CLI before today

Pull:
```
git -C ~/.jd/cli pull
```

In your .zshrc or .bashrc, find these lines. You might only have the first.

source ~/.jd/cli/jd-nav/jd-nav.sh
source ~/.jd/cli/jd-prompt/jd-prompt.zsh

Replace them both with this line.
```
source ~/.jd/cli/jd.sh
```
Start a new shell.

Second year - James' Coffee Blog

2026-09-09T00:00:00.000Z

I woke up in excitement this morning. Today is the day I can start to access my course materials for next year. My second year of university doesn’t officially start for another few weeks, but from today I can start reading through the introductory material. I spent the morning reading about the structure of the year in the art history and creative writing modules that I am taking: the course overview, how assignments are structured, the referencing requirements (which are going to get more intense in art history in particular, because I will be citing more artworks), and more.

I am writing this in the afternoon, when the excitement from this morning still has not waned. If anything, it has grown more intense. I am so excited for the next year. I started reading the introduction to my creative writing textbook and already started to feel challenged in exactly the way I want. The course overview for the art history module – Art and life before 1800 – piqued my interest in several places. In October we’ll be starting with a block on Art and its Environments, where we’ll be studying landscapes and forests and snowscapes and more. I was just thinking yesterday how much I love snowscapes. I wonder what I will learn about them next year. Across all of the art history work for next year, I am especially interested in learning about the role art occupied in society through history, a key theme throughout all of the blocks we will study.

In creative writing, the main focuses will be fiction, poetry, and life writing. I am excited for all of these areas. The course also touches on building a writing practice. While I write often anyway, I have already found the exercises in creative writing have pushed me in new ways. This is precisely what I want from studying: to challenge myself and grow my skills in areas that interest me. There will also be materials on professional publication, which, while not a goal I have right now, will surely be interesting.

After I caught my breath after a morning of reading, I realised that my first year of university is essentially complete. It will be a few weeks before I get the results from my final assignment, but there is no more work to do for my first year. I did it! I finished my first year! It feels somewhat surreal for my first year to be over, but here we are. Time flies. I am proud of all the work I did in my first year, and am looking forward to the next one.

My first year, which was structured as a foundation in the humanities with opportunities to start exploring the subject area(s) we found most interesting in more depth toward the end of the year, was a whirlwind through art history and creative writing and history and religious studies and more. Every week there was something new to study. I studied Jane Eyre, Antigone, the Benin bronzes, Van Gogh, the foundations of Buddhism, and more. While I was eager to get to the art history topics last year, I loved the approach my school took to covering a wide area. It was the inclusion of creative writing in my first year that helped me build more confidence in my writing, especially in fiction, and ultimately led me to change my degree from a sole focus on art history to studying both art history and creative writing. This combination feels right for me.

Here’s to another year of studying!

Less YouTube, Bandcamp Friday, Silksong returns - W36 - Joel's Log Files

2026-09-08T21:50:00.000Z

This was one of those weeks where I kind of expanded upon most of the main topics on their own blogposts already, so all I can do is summarize and share the links here! A couple extra things here and there too.

Here’s some notes on what happened from September 1 to 7, 2026.

📺 I have decided to limit my YouTube usage to one hour per day on my phone. I used the Unhook extension on both my phone and my computer, to remove the algorithmic feed and stick to subscriptions only.
✂️ Unfortunately that also means I’ve had to cutdown on my Subscriptions! There were a lot of constant videos from certain types of channels that flood that page for some reason. I need to categorize a little more. Of course, I should also use YouTube as a search engine instead of relying on titles and thumbnails to grab my attention.
🎙️ Thankfully, no YouTube means I have returned to a few podcasts to have in the background (or while walking) this week! Including Revolutions and The Rest is History.
📰 Since I was already cleaning up my YouTube, I also spent some time checking my FreshRSS subscriptions and cleaning up some of the old ones. It is honestly kind of weird to have so many blogs I follow go 404 in the six or so years I’ve been around this bubble. I hope I can continue writing here for many more years.
📱 A few weeks ago I switched away from KISS Launcher. My search for an ideal replacement is still undecided, right now I am switching between OLauncher and Minimo Launcher, but I still miss KISS…
📞 My phone line was blocked by the government! This is a new measure taken to combat crime, by making every citizen in the country register themselves with their ID card and a bio-scan. I am still refusing to partake in this mess, by the way, I will write on some of that offline experience soon.
📻 Bandcamp Friday happened! and I got myself a couple new purchases, some videogame soundtracks once again for some titles I have played, and one I have not!
- TOEM Original Game Soundtrack by Jamal Green & Launchable Socks
- Dicey Dungeons Original Soundtrack by Chipzel
- Neva Original Game Soundtrack by Berlinist

My 3DS with Fire Emblem Awakening, gameplay of Silksong and Party House, Coyote vs ACME's poster, and some leaves from a tree

Watching

Coyote vs ACME - This one was a great watch. Even as a kid of the 2000s, public TV channels in Mexico aired reruns of the original Looney Tunes for many, many years of my childhood. The Coyote and the Roadrunner were one of my favorite segments, and I’m incredibly happy to see how they used that concept and developed it here. This one gets my thumb of approval, it really managed to capture that nostalgia and use it for something truly awesome. Also the history behind the production of this movie is kind of crazy, and it even reflects on the themes of the movie itself, a must watch.
Ad Astra - I only watched this one partially, I will finish it today since my weeknotes are late. It’s a bit of a more serious Sci-Fi movie with a future humanity that is only starting to conquer the solar system, until some mysterious energy starts messing with electricity, ships and stations all over the place. It really reminded me of Planetes, featuring people born outside Earth, space terrorism and the like. The main plot focuses on Brad Pitt trying to find his missing Dad, Tommy Lee Jones, who was the best astronaut but went missing ages ago.

Reading

Blue Lock - Chapters 357-359. The match against England is proving to be rather interesting! With Blue Lock adopting a unique formation and Isagi trying to fit into it. The England team is a menace, a team that can’t be read or overcome in the same way that any other team has been before. It is kind of impressive to see that this far into the series.
My Wife is from a Thousand Years Ago - Chapters 287-288. Returned to this rom-com and it’s been pretty cozy and nice to read lately. The wedding feels closer than ever, and family shenanigans are happening too! But I still have 150+ chapters left so, we’ll see how it goes.
Spy x Family - Chapters 138-140. As reliable as ever, I love the humor and the dynamics of this manga. We returned to the Eden Academy and had some very fun and wholesome Anya moments there.
Centuria - Chapters 48-50. A bit of an unexpected battle ensued and a weapon is unveiled which is rather surprising. It is kind of epic!

Gaming

Hollow Knight: Silksong - This game has gripped me all over again now that Act 3 has gotten started. The sequel to the beloved Hollow Knight continues to be an absolute masterpiece, and I’ll probably have to gush about it on a separate post, especially since it’s been a whole year since it’s release on September 4th, 2025. Looking forward to that! For now, I am looking for some Ant Queen boss or something like that, if what I hear of the rumors is true, there may be a super cool battle waiting for me.
Fire Emblem Awakening - After a little hiatus I finally decided to give attention to this game, and I have managed to make some decent progress on Chapter 19! unfortunately I ended up dying and having to reset. But well, now I know the truth. Besides the main story I also did the paralogue that unlocked Cynthia, the daughter of Somia, so I have another Pegasus Knight to level up! I still have a few relationships to develop though, we’ll see how it goes.
UFO 50 - On Sunday I had a bit of a fun time with a friend who visited my place. I don’t often get to do 2-player gaming so I decided to go for this one once more. We played a few interesting titles! Including:
- Party House - An awesome game about inviting people to your party, collecting popularity and money, and being able to host bigger and better parties, until you can fulfill an objective! There are a lot of mechanics and scenarios here, it’s a bit of a Deck-Building game, trying to invite certain people that have certain effects on your score and such. Incredibly fun and simple, I want it on my phone!
- Pingolf - This is a very interesting 2D golf game with a bunch of courses to complete. It doesn’t have a lot of uniqueness going for it, but the aesthetics are great, the mechanics are very good and the score-chasing element will definitely make me return to it.
- Lords of Diskonia - A turn-based game where your army is represented by pucks (like those from Air Hockey). The objective is to slide your pucks and hit enemies. Whoever pushes them off the map wins. Each chip has a certain amount of damage and some skills it can use! We only tried it once and had a fun time.
Mario Party 3 - We had an incomplete session with three friends that was going very well! One of them had to leave halfway through, which is why we switched to UFO 50. You can never go wrong with MP3!

Around the Web

Blog Posts

The 5 Ws of Reading - an interesting challenge for people who like reading books!
Let’s stop buying new phones - I couldn’t agree more, but I’m still tempted sometimes.
SciFi Books: The Golden Oldies - Jules Verne and H.G. Wells are an absolute must!
Let’s talk retro doodads! - Lots of cool gaming handheld emulators mentioned here, enjoy!
My last few weeks in Germany - lovely write-up from Daniel talking of his experience in another country and community.

YouTube

The Golden Age of Mobile Gaming - Scott The Woz - A trip down memory lane.
How Rocky’s Models Were Made for Project Hail Mary - Some cool practical props!
Why the Mariana Trench Still Terrifies Scientists - Good documentary about sea exploration.
What Edge of Tomorrow Understands About Aliens That Hollywood Doesn’t - Cool monster design is cool.

This is day 31 of #100DaysToOffload

Reply to this post via email | Reply on Fediverse

Note published on September 8, 2026 at 8:51 PM UTC - Molly White's activity feed

2026-09-08T20:51:29.000Z

made some tiny stamps out of lino scraps to make labels for my jam jars

Your TV is spying on you, and it's worse than you think. - Werd I/O

2026-09-08T16:33:41.000Z

Link: LG TVs caught spying even when offline or on standby, by Dominic Preston in The Verge

This is an enormous abuse of trust:

“LG smart TVs are almost constantly logging and uploading data about owners and their homes, even when offline or on standby mode. […] Packet captures showed the TVs scanning the local area network for nearby hardware like phones or smartwatches, as well as logging location data and details of nearby Wi-Fi networks, and feeding the information back to LG Ad Solutions. Perhaps more concerningly, the TVs were capable of recording microphone audio when in standby; this continued even after the TV was disconnected from the internet, with audio files stored offline and uploaded once a connection was restored.”

Most households invite at least one television into their homes. It’s almost impossible to buy one without smart TV features; because most television shows are streamed over the internet these days, they’re usually online. You could leave the TV offline while connecting it to a separate box like an Apple TV, but it’ll keep nagging you to connect.

The contract should look like this: you pay for a TV and it shows you stuff. The idea that it will scan your local network for devices, determine what content you like to watch, and maybe even listen to you using a built-in microphone is not something that anybody signs up for. Someone somewhere at LG has been so incentivized to make a graph go up and to the right that they have decided that basic ethical tenets like privacy and transparency aren’t worth holding on to.

That’s particularly important in a world where the Department of Homeland Security has created Minority Report-style Predictive Intelligence Targeting Teams who instruct police to pull people over based on profiled data like their financial activity, despite there being no evidence that they have committed a crime. Data from disparate sources is routinely bought by law enforcement and agencies like DHS in order to create these sorts of profiles; a connected TV in your home could easily contribute. Are you watching the wrong kind of content? Automatic Content Recognition could rat you out. Are the devices connected to your home network outside of the norm? Up goes a flag.

So that’s homes. But most offices have TVs installed somewhere, too. Consider that an installed smart TV could easily be snooping on network devices, content, and even video calls conducted over these screens. Some more sophisticated offices will have them set to a less privileged network or insist on them remaining offline; most will dutifully connect them up. The result is a live microphone and content recognition tech installed in newsrooms, universities, non-profits, and businesses around the country.

Manufacturers like LG can sell this data. They will likely argue that it keeps TV prices down – and maybe that’s true. But this reporting comes after LG promised regulators in Texas to stop collecting viewing data without informed consent; there’s a second mic that may continue recording even when the main microphone setting has been turned off. They’ve shown they cannot be trusted. This kind of invisible data gathering should be illegal. Nobody signed up to be spied on; they just want to watch TV.

ActivityPub - Is it worth defending against replay attacks and message/signature time skew? - Terence Eden’s Blog

2026-09-08T11:34:51.000Z

Here's a problem that I've found with ActivityBot - my little ActivityPub server. Sometimes it receives messages which were originally sent months ago. Why does that happen and is it risky to accept and process them?

My tl;dr is that it probably isn't worth worrying about. But I'd love someone to tell me why I'm wrong.

Here's my thinking:

Causes

All ActivityPub messages should have a "published" timestamp in their body. Some will have an "updated" timestamp. That tells you, unsurprisingly, when the message is alleged to have been originally published or updated. That time might be very different to the time you receive the message.

There are, I think, three different reasons why a server might receive a message which has an out-of-date timestamp.

The first is that sometimes servers are just slow. Processing thousands of messages at the same time means that some of those messages take a while to send. ActivityPub is one big chain-mail so it can take several minutes for a message to be sent to all your followers.

Similarly, your server might be slow. If it doesn't acknowledge receipt of a message, the original server will try sending it again. Sometimes that can take a while.

Finally, some servers take a relaxed view of standards. They send an update to an old message but keep the original publication date. Ideally, they'd use an "updated" timestamp but quite often they don't.

For the purposes of checking the legitimacy of the message, you do not need to check when a message says it was published or updated. You might want to check it isn't an obviously bogus date like far in the future or impossibly far in the past - but that's up to you.

It is normal that your server receives messages which appear to have been published at a totally different time from now.

Is that a problem?

Probably not.

As described above, there are various reasons why a message may be delayed in transit - or may appear to come from the distant past.

What we can check is when the message was cryptographically signed by the sending server. This is independent of its published or updated timestamp.

HTTP requests to your server will have a date header which looks like Tue, 01 Sep 2026 15:54:21 GMT - this is in the slightly peculiar and Anglocentric RFC 5322 format.

New style RFC 9421 headers will also have a signature-input header which will contain something like created=1788278061. That uses the slightly obscure UNIX / POSIX time which counts seconds since the "Epoch" of 1st January 1970.

If you convert the UNIX time to something more modern, you should get an identical value to the date header.

But that isn't always the case. For example, the RFC 9421 standard gives this example:

Date: Tue, 20 Apr 2021 02:07:55 GMT
"@signature-params": ("@method" "@authority" "@path" \
  "content-digest" "content-length" "content-type")\
  ;created=1618884473;keyid="test-key-rsa-pss"

Converting 1618884473 to normal time gives Tue, 20 Apr 2021 02:07:53 - a two second difference.

If the date and created values differ significantly - that may indicate that the message is untrustworthy. Or that there was a delay between the signing and the sending.

The spec says:

The Date header field value represents the timestamp of the HTTP message. However, the creation time of the signature itself is encoded in the created signature parameter. These two values can be different, depending on how the signature and the HTTP message are created and serialized. Applications processing signatures for valid time windows should use the created signature parameter for such calculations. An application could also put limits on how much skew there is between the Date field and the created signature parameter, in order to limit the application of a generated signature to different HTTP messages.

7.2.4. Choosing Signature Parameters and Derived Components over HTTP Fields

But, of course, it doesn't tell you how much skew is problematic. It's up to you how much skew you're prepared to accept.

So that's the difference between the sent time and the signed time. The next time to check is your own. As we've discussed, sometimes servers are slow sending things out. Would you accept a request that was signed five minutes ago? Five days ago? Five months ago? What amount of difference is dangerous?

Here's what various services and sages have to say:

Mastodon

The request contains a Date header. Compare it with current date and time within a reasonable time window to prevent replay attacks.

How to make friends and verify requests

What is "reasonable"? The source code suggests one hour.

Grishka

Time in the Date header must differ from the recipient server’s clock by no more than 30 seconds

A bare-minimum ActivityPub server from scratch

Evan Prodromou

static #maxDateDiff = 5 * 60 * 1000 // 5 minutes

activitypub-bot

SWICG

The standards don't give a concrete time window to use for this comparison. In practice, an hour plus a few minutes buffer in either direction may be a good value, to account for both clock skew and differences in time zone/daylight savings time configuration across systems.

How To Verify a Signature

Others

Without naming names, it looks like a bunch of popular servers don't check whether there's a significant difference between the date the request was signed and the date it was received.

Summary

Various documents and implementations recommend anything between 30 seconds to "a bit more than 60 minutes". Or they just ignore any date difference.

What's the right answer? What happens if the signed date is significantly different from the current date?

What are we trying to protect against?

Replay Attacks. Suppose someone is listening to the communications between the sending server and your server. They copy the message that is sent to you. Later they send it again!

At this point, you might be thinking "so what?" and… I'm inclined to agree with you!

What's the worst that could happen if you received the same message multiple times? Two things that I can think of.

Firstly, it might not be the same message. It is possible to send a new message but with old headers. An attacker could make someone post "I hate Taylor Swift" against their will and watch as legions of fans disembowel the victim.

Except, I don't think this is likely. The signature in the header contains a hash of the message being sent. If you are properly validating the signature, a changed message will have a different hash from the one in the original message. You don't need to check timestamps, you just need to check if the hashes match.

Secondly, idempotence. That's a fancy word for "pressing the button multiple times should only result in one action".

What happens if a user appears to send you multiple "like" messages for a single post? You only record one like.

What if they send multiple messages with the same content? Well, each will have a unique ID in the message - so you only post it once.

What if they send multiple anythings? I can't think of any ActivityPub action which would not be idempotent.

About the worst thing I can think of is this:

Alice sends a message to you saying "I want to follow Bob".
Mallory intercepts this message.
You record Alice is now following Bob.
Alice sends a message to you saying "I want to unfollow Bob".
You record the severed relationship.
Mallory replays the original follow message.
You record Alice is now following Bob.

It's also possible the following could happen:

Alice posts a message saying "I love The Beatles".
You record Alice's message and display it on the timeline.
Alice updates her post to say "I love the Rolling Stones".
Mallory intercepts this message.
You record Alice's updated message and display the new version on the timeline.
Alice updates her post yet again to say "I love the Spice Girls".
You record Alice's updated message and display the new version on the timeline.
Mallory replays the original update message.
You now display that Alice loves the Stones rather than Spice Girls.

Perhaps the same can happen with like/unlike, block/unblock, boost/unboost.

But none of that is significantly prevented by checking the date.

Ultimately, it is up to your sever to check the unique ID of each message and refuse to action any repeated messages. You may not want to trust the unique ID which is sent with the message. If that's the case, you can calculate your own - perhaps using a hash of the contents, the signature, or some other process which will generate an ID based on the message.

Putting it all together

Here's what you need to do to prevent replay attacks:

Independently calculate the hash of the message received.
Validate that your calculated hash matches the hash sent in the message's HTTP headers.
- If not, this is a potential replay attack and the message must be ignored.
Verify that the signature received in the message's HTTP headers includes the message hash and is cryptographically valid.
- If not, the signature is invalid and the message must be ignored.
Has the received message's unique ID already been processed?
- If so, refuse to process it again.

I don't see what checking the timestamp of the HTTP signature has to do with anything. Someone who has access to the original messages and their headers could send them milliseconds after the original delivery.

I think it is probably pragmatic to give messages 60ish minutes grace before dropping them. Delays happen, but anything more significant than an hour might indicate a attack. But, equally, might just mean that the Internet is having a slow day.

If you are correctly checking signatures and hashes, I don't think you need to worry about skew between signature date and delivery date.

No! You're wrong and I can prove it!

Please tell me where I have erred! Stick a comment in the box or drop me an email. If I've made a massive or subtle mistake, I'd love to know what.

Wonders of Web Weaving, Episode 18 - James' Coffee Blog

2026-09-08T00:00:00.000Z

The eighteenth episode of Wonders of Web Weaving is out:

In Episode 18, I chat with Ava, the author of blog.avas.space about, among other things, data protection and privacy, consent in the context of privacy, the armchair of great blogging, and more.

I hope you enjoy the episode!

Wonders of Web Weaving also has an RSS feed you can use to follow along from wherever you get your podcasts.

Ava blog.avas.space The eighteenth episode of Wonders of Web Weaving is out Wonders of Web Weaving also has an RSS feed

SBS meeting schedule: Tue 15/Sep moved +3h - Johnny.Decimal

2026-09-07T22:25:07.000Z

We've moved next week's Small Business Zoom session forward 3 hours.

This is the slot we designed to suit Decimals in the Americas, but at 15:00 the scheduled time doesn't suit those on the west coast who are still at work.

This session only has been moved to:

18:00 Mon 14/Sep – Los Angeles (UTC-7)
21:00 Mon 14/Sep – New York (UTC-4)
01:00 Tue 15/Sep – UTC
10:00 Tue 15/Sep – Tokyo (UTC+9)
11:00 Tue 15/Sep – Canberra (UTC+10)
13:00 Tue 15/Sep – Wellington (UTC+12)
View a timezone chart

Your calendar should update

If you're subscribed to the events calendar (Business members only) this slot should have updated in your calendar.

If it hasn't:

Refresh the subscription.
Confirm you're subscribed to the calendar and that you didn't import a point-in-time copy instead.

Feedback welcome

We try to pick times that suit the most people. Let us know if this doesn't suit, and what does. We'll keep experimenting.

2026-09-07 20:39: Do you know what the hardest thing to do on earth is? Quantum physics? No.... - Kev Quirk

2026-09-07T19:39:00.000Z

Do you know what the hardest thing to do on earth is?

Quantum physics? No.
Solving world hunger? Nope.
Getting Trump impeached? Nah.

It's climbing the stairs on leg day! 🦵🏼

Thanks for reading this post via RSS. RSS is ace, and so are you. ❤️

You can reply to this post by email, or leave a comment.

Skiing in Tūroa - The Weblog of fLaMEd

2026-09-07T08:32:09.000Z

What’s going on, Internet? This is a later post. It’s been a minute since I’ve been skiing. We left the kids at home with their aunty and headed south to Ohakune.

Was made aware before the trip that Ohakune’s main water pipe was recently damaged during an earthquake. Repairs were being made but this weekend the township was without water. Restaurants had to close, hotels and motels had to close and cancel reservations.

We wanted to stay at the Powderhorn this trip for two nights, but the Monday night was fully booked so we couldn’t. Ended up working in our favour as they had to cancell all bookings.

We ended up in a rental house that was owned and managed by a local couple. No running water, but we were able to flush the toilets with water from the spa pool and was hands etc with bottled water supplied by the council.

The view of the mountain from the rental house.

Not much was open in town for food but a few of the takeaways were open so we were able to get a decent feed.

Weather wasn’t looking too flash for Monday up the mountain but it held out in the end. Sure visibility was rubbish off and on during the day, it snowed around lunch time, a great time to take a break, but the snow was pretty good up there.

Like I mentioned, it had been a while (three years) since my last time up the mountain, I went up the top of the Movenpick chair lift and had a rough time getting down. The visibility was horrible up there for the first run.

Visibility for the first run.

I made it down to the top of the Park Lane chairlift and spent the morning at the Wintergarden tow rope and it’s gentle slop getting familiar with the skiis again.

The view from the Wintergarden, tow rope on the right.

After lunch I head back up to the top of Park Lane and spent the next couple hours heading down the Park Lane chairlift.

Once I was confident with that run I headed back up to the top of the Movenpick. The first part of the slope was a bit of a challenge but I struggled through and made it back to the top of Parklane to finish the run.

The base of the mountain, with the Movenpick and Parklane chairlifts heading up.

One day up the mountain is not enough. Next trip I want to spend at least three days on the slopes, a couple hours of private lessons would do me well.

Hey, thanks for reading this post in your feed reader! Want to chat? Reply by email or add me on XMPP, or send a webmention. Check out the posts archive on the website.

Standard zero .05 now reserved for 'AI' - Johnny.Decimal

2026-09-07T04:58:04.000Z

Standard zero .05 has until now been reserved for expansion. I am claiming it for use by your AI agent. I'll duplicate the section from that page below.

⚠️ This blog post is frozen in time. If you're reading this later than September 2026, view the latest text on the standard zeros page in case it has been updated.

.05 AI

A place for your AI agent.

Agents work best when you write things down. Your JDex is an amazing communication tool: both you and your agent can read and write anything in it. Best memory ever.

Sometimes it's useful to have a dedicated space that the agent controls. This is a place that it can store persistent information for recall across sessions.

You can also use it to provide per-system instructions to your agent. For example at 00.05 I have a 'style guide' that tells it how I like my frontmatter properties to be organised (alphabetically).

The skills and MCP server both assume they have control over AC.05.

Emoji ✨

The standard emoji is – obviously – ✨

Note published on September 6, 2026 at 5:27 PM UTC - Molly White's activity feed

2026-09-06T17:27:48.000Z

make bad art

Deleted YouTube again - Joel's Log Files

2026-09-06T13:53:52.000Z

For a little while I have been using YouTube way more, and even paid for the Lite subscription model, simply to test it out.

Honestly, it hasn’t been too bad, and I actually really, really enjoy a lot of the videos I’ve gotten through the algorithm.

But of course, YouTube Shorts have caught up with me and continue to be a very annoying problem, wasting seconds, minutes and hours of my time at every moment.

The algorithm does show some interesting things, or funny content I enjoy, but things go downhill pretty quickly with the usual AI-generated slop videos and recycled content.

A few of the saving graces I’ve seen is shorts made from genuinely awesome videos that came out like 5 years ago, so I think it’s an interesting way to bring life to evergreen videos about science and the like.

With Outer Wilds playthroughs and essays running rampat, my feed slowly phased into more space and astronomy themed topics, which has been pretty fun to get into until I realize half the videos are way too long for what they have to say and use genAI graphics for everything.

So whatever, I just deleted YouTube and cancelled my subscription now. I will continue to use it via Fennec Browser and Newpipe, though maybe a full YouTube detox would be a good idea to try.

Yesterday alone I wasted almost 6 hours on the platform, and I think like 4 of them were just Shorts. Even now I just had to have a video on the background while writing this, what is going on?

You know what, I will try it, I will limit my YouTube time to one hour a day for the rest of the month. It’s possible I’ll fail completely, but hey, at least you will know if that happens and you are free to bully me for it. The weeknotes next Monday will also be the last ones where I share YouTube links this month, as I also feel like a part of me watches more videos because I have a need to find stuff worth sharing here. The less excuses I have the better!

Alright, let’s do this.

This is day 30 of #100DaysToOffload

Reply to this post via email | Reply on Fediverse

The purpose of DNS is to spread scams - Terence Eden’s Blog

2026-09-06T11:34:20.000Z

I imagine everyone here has received an unsolicited message telling them that their tax is overdue and that they urgently need to visit Genuine-Tax-Payment-Website.fart or that a parcel is delayed at customs and you can pay a small sum for its release at Almost-The-Right-Acronym.ak

You know it is a scam. Most people just mark as spam and move on with their day. But a significant number of people don't. They hastily visit the site, tap in their credit card details, give it their mother's maiden name, confirm address, upload a nude selfie, and only then realise that they've been had.

The Internet works at pretty close to the speed of light. You can register a .uk domain and a minute later it's accessible from the other side of the planet. Brilliant for users who want to quickly launch a website. Also brilliant for abusers who want to launch a spam campaign.

By the time enough people have reported the scammers' domain as suspicious, it is too late. In the time it takes for a registrar to disable the domain, or for its name to make its way to the Safe Browsing List, a million messages have already been sent and enough people have handed over their details.

We're told that "the purpose of a system is what it does". At the moment, the Domain Name System's purpose seems to be a vector for criminals to run scams on people at a terrifyingly high rate.

How big is this problem?

BIG!

There's a great blog post by Andrew Campling which reports on this startling claim:

The study found that at least 10% of all new gTLD domain names registered during the year had subsequently appeared on security blocklists by the time of analysis. It estimated that, taking account of subsequent blocklisting and associated domains not themselves blocklisted, the share of names registered by malicious actors may be closer to 20%.

DNS Abuse and Criminal Infrastructure: Beyond Definitions and Blocklists (emphasis added)

That links to a presentation by Interisle which contains some rather shocking statistics (albeit with disputed methodology). It looks at generic Top Level Domains (gTLD) - those are things like .com and .fun rather than country code TLDs (ccTLD) like .uk and .de.

It says 85 million new registrations of gTLDs were made in 2025. Of those 8.5 million were added to blocklists by May 2025. It reckons that a 10% abuse rate is the likely floor for these numbers and it's probably closer to 20%. One in five newly registered domains with a gTLD are scams. That's a bloody crisis.

13 TLDs had more than 50% of their registrations blocklisted.

I can understand why .bid and .loan are popular with scammers. But why .mobi?! What did I ever do to you, eh?

Who are the scammers registering these through?

Ah, our old friends at NameCheap. See Why do scammers love NameCheap?

If those five registrars had more effective policies, it might significantly dent the scammers' ability to ply their devious wares. Or they might just move on to other registrars.

As the report points out:

suspension rates for blocklisted domains were 7.4% to 16.3%.

The full report is on the Interisle website.

What can be done?

I don't know.

In the first instance, it might make sense for registrars to do strong Know Your Customer (KYC) checks on anyone buying a domain. But that stops anyone who wants to anonymously register I-Hate-Nintendo.whatever without risking the wrath of Intellectual Property lawyers.

Also, criminals have access to stolen money and stolen cards. They can convince a hapless mule to register a domain on the criminals' behalf.

Registrars could ask for an escrow payment. Pay €9 for the domain name put €900 in escrow. If your domain appears on a blocklist within the year, you forfeit the money. Criminals with stolen funds are unlikely to care but it would probably put off lots of people from getting a new domain.

There are various banned words and phrases depending on the TLD. For example, South Sudan has a list of political words which they don't want associated with their .ss ccTLD.

But if one gTLD bans a word, a different one might not. A scammer doesn't care if the gTLD is .arse or .elbow - they just want the start of the domain to look legitimate.

Some registrars have strings that they don't allow. In fairness to NameCheap, when I tried to register dwp-payments-gov-uk.pizza it told me that domain was banned. It wouldn't let me get any gTLD with that name.

But all it takes is one registrar to be slightly lax and the scammers get through. Increasing the complexity of the rules is also a hell of a burden on smaller registrars.

Besides, it's pretty easy to get a generic enough looking domain and stick the confusing bit on a subdomain. Here are a clutch mentioned in the report:

https://gov.uk-dwpaph.bond/uk/
https://gov.uk-dwpcjh.bond/uk/
https://gov.uk-dwpclc.bond/uk
https://gov.uk-dwpclw.bond/uk
https://gov.uk-dwpclj.bond/uk/

Perhaps there ought to be a delay before a new domain goes live to allow people to object to it? That would give governments, banks, delivery companies, and a dozen more "important" organisations a right to veto any "dodgy" looking domain.

But suppose someone wants to register gov-uk-stole-my-horse.horse to protest the government's cruel policy of stealing horses - is that a legitimate use of a domain? What if the Darwin Pensioner Divas - a group of elderly singers - want to take payments for their new album of goth/punk covers, can the DPD delivery company veto dpd-payments.music?

Do we want a domain name system where powerful companies control exactly which domains we can register? If I have an idea for a domain on a Friday night do I have to wait until Monday before it can be launched? Are those companies realistically able to parse millions of domains per year and have a low false-positive rate?

All of these things are possible - but all of them come with an impact on legitimate users. To be clear, I don't know what the right answer is.

What is ICANN doing about it?

Lots! It has been a few years since I've been to an ICANN meeting, but even back then the topic of abuse was high on the agenda. They appear to be looking at ways to coordinate abuse reports between various entities, along with some other policies which should hopefully work.

There are two salient points from one of the discussions held at the recent meeting

If anybody thinks that in our current age of AI and as we move into different kinds of computing, DNS abuse is going to numerically stay steady and we will have a downward effect on that baseline 2027 number. I'm not sure that that's an accurate assumption. I think it's going to be the other thing, which is […] it's going to be easier to abuse the DNS.

And

Abusers are going to abuse because it's just too lucrative, because no matter what we do, they will find the way to make profit off of that, and will try to circumvent everything that we do. That is not a reason not to do it, though.

Quite!

As I said, I don't know the answer to this. What I do know is, much like Android's app ecosystem being a haven for scammers, DNS is facing a crisis. When trust in a system goes, only chaos follows.

I don't want to live in a world where I have to show my passport and pay thousands of pounds to register a domain which is only available after being vetted by private interests. But I also don't want to live in a world where scammers have effectively no deterrent from abusing millions of people.

The purpose of a system is what it does. I hope DNS's purpose can become less dangerous while still remaining open.