Shellsharks Blogroll - BlogFlock

Weeknote #2020 - Robb Knight • Posts • Atom Feed

2026-10-03T08:08:00.000Z

Dave is doing important work here, holding Cadbury Heroes to account.

MacOS 27 broke the drivers for my thermal printer but thankfully someone made a new driver.

I'm on board with Spymarks, not watermarks.

The winners of the street photography awards are fantastic (obviously).

Side-eyeing projects like Una to try and get away from my Apple Watch at some point.

Hannah Fry's favourite fountain pens. Love this.

There's no world in which I can watch this documentary about Elon Musk but I'm glad it exists.

A gallery of control rooms on Flickr via SimpleBits.

While looking for an example of a Geordie accent, I came across this supercut of a "Geordie" character who has an accent that is so ridiculous I can't even work out what he thinks he's doing. They even brought in translator as a plot point. This whole thing is wild.

This monstrosity from Finn for the iPhone Duo.

Barstardica mixes different fonts into one for...reasons. I love and hate it.

This Tiny5 font is amazing and I need somewhere to use it as soon as possible.

Tyler has got me thinking about an old MacBook Pro we have at home with his post about repurposing a 15-Year-Old MacBook Air.

Lazygit is very nice but not something I have a need for.

littleFedi is a "small ActivityPub server written in Go". It's a single binary, designed to run on basically everything, and supports the Mastodon API.

2026-10-03 09:04: Took the dogs out on the field this morning. All the dewey spider webs were... - Kev Quirk

2026-10-03T08:04:00.000Z

Took the dogs out on the field this morning. All the dewey spider webs were beautiful in the morning sun.

I'm no Jack Baty, but they're good enough.

Thanks for reading this post via RSS. RSS is ace, and so are you. ❤️

You can reply to this post by email, or leave a comment.

Finished reading A Psalm for the Wild-Built - Molly White's activity feed

2026-10-03T00:56:13.000Z

Finished reading:

Monk & Robot series, book 1.

A Psalm for the Wild-Built

by Becky Chambers.

Published 2021. 151 pages.

Started September 30, 2026; completed September 1, 2026.

September 2026 Summary - Joel's Log Files

2026-10-02T22:59:27.000Z

At last, another month we say good bye to, and all of a sudden, the year is on its final stretch, the days go by faster and faster, and I am getting old with everyone around me!

In any case, there’s plenty of stuff to go through here, media, movies, videogames, podcasts. You Know the usual stuff! I have decided I would highlight the best things on this little intro, in case you are bored or looking to just skim through.

Podcasts: The Play Station Episode of Into The Aether, The Wolf 359 podcast as a whole
Manga: Blame! is simply awesome and terrifying.
Movies: Ad Astra, Artificial Intelligence, Catch Me If You Can, War of the Worlds, Coyote vs. ACME.
Videogames: Final Fantasy IV was a definite surprisei to return to. Emio and the Smiling Man was engagn
TV Shows: Lanterns was pretty refreshing for a super hero show, if a bit too adult for my taste.
Books: The Left Hand of Darkness and The House on the Borderland are still halfway through but I’m committed to both.

Some artwork of my favorite media that showed up during the month!

Podcasts

Into The Aether - With the release of the Play Station episode, my listening time for this podcast skyrocketed to a whooping 19 hours throughout the month! Fantastic set of episodes this time around.
The Ten Minute Bible Hour - I listened to a dozen or so episodes of this one again, but they are like ten minutes each so it doesn’t amount to a lot compared to the rest of stuff here. Extremely interesting as always though.
Dungeons and Daddies - A Dungeons & Dragons podcast. On a surprising turn of events, I finally returned to this podcast! I was able to pickup on the overall story again, thankfuly, so I plan to resume this crazy season 3, soon enough.
The Rest is History - Some good stuff here, still all about the Great War, it was early in the month and I’m not I recall all of it though.
Wonders of Web Weaving - I listened to a few episodes of this podcast by James featuring different bloggers and stuff. Including me!
Wold 359 - I made progress and went through a couple more episodes, the finale feels closer now! Really looking forward to that.

Manga

Started

Blame! - Chapter 1-9. This a dystopian sci-fi story that happens inside some sort of mega-structure. We met one guy who is looking for a human with a special gene, which should be able to control the mega-structure itself. Each chapter is full of incredible architechture and a very intriguing atmosphere. Lots of questions lack answers right now, but I am kind of hooked by it. The chapters are a little long though, but they don’t have a lot of dialogue so, it’s all good.

Ongoing

Centuria - Chapter 48-80. A lot of pretty cool action and great moments happened, but I have kind of realized that this manga, while entertaining and still promising, is taking its time to deliver actually interesting plot points. I still enjoy it, because it lets me fill about ten minutes of my time with neat drawings to look at.
Smoking Behind the Supermarket with You Chapter 63-64. Now this is still going to some interesting places. A lot of introspection during these couple chapters, after a pretty heavy and difficult situation, a conflict in need of resolution, which I’m looking forward to see. I love these characters!
Blue Lock - Chapter 357-359. I was reading this with great interest, but decided to wait at least until I’m sure the England vs Japan match is completed, so I can enjoy it all in one go. Fun stuff!
My Wife is from a Thousand Years Ago - Chapters 287-288. This is just a fun rom-com! No complaints, a nice pace and very fun moments, a little spicy but mostly wholesome, which I prefer.

Movies

I was going to like, write kinda proper reviews for these but, meh, they were all pretty decent except for Mercy, you can skip that one.

Avengers Endgame Encore - Fun to rewatch on the big screen at last! The extra scenes aren’t really worth it though.
The Day the Earth Stood Still - An alien tells humanity to chill out or else. Seriously impressive for the time.
War of the Worlds - Tom Cruise running from aliens from Mars. He also tries to be a good father at the same time.
By Any Means - A bunch of racists face the consequences of their actions. A bit of a weird casting choice though.
Mercy - Chris Pratt trapped by AI and staring at screens. The murder mystery was fine, the presentation not really.
Artificial Intelligence - A robot wants the be a real boy and earn a mother’s love. That ending is wild though.
Catch Me If You Can - Leonardo Di Caprio running from Tom Hanks. The movie is based on real events that turned out to be fake!
Ad Astra - Brad Pitt running from the world itself, looking for his father. Surprisingly Hard Sci-Fi stuff here.
Coyote vs. ACME - This one was funny and nostalgic and I loved it. No notes, it made me cry out laughing.

Videogames

Started

Kirby and the Forgotten Land - A friend came over one time and we decided to start this one in 2-player mode. I decided it would be a pretty fun title to add to the multiplayer pile of games I mostly play with other people! It is extremely fun. The artstyle, the level design, the Switch performance and everything combined make for a very pleasant gaming experience.

Ongoing

Final Fantasy IV - This is the game that ended up being revisited the most, with about as much time played of it as Emio, but grinding and progressing through the last few challenges this game has to offer, and the final dungeon which is at my grasp at last. Final Fantasy IV may be the first ever Final Fantasy I complete, and I’m looking forward to it.
Hollow Knight: Silksong - This game started strong in the month, playing it for about five hours in four days. I got into Act 3 and defeated some new bosses, I upgraded my needle and got more stuff from all that.
Fire Emblem Awakening - I made significant progress completing chapters 19 and 20 without a lot of issues, after some grinding throughout many days. Loving the support scenes as well! Waiting for its time to shine some more.
The Legend of Zelda: Ocarina of Time 3D - I only played this one time, but I made some initial progress as Adult Link, reaching the Forst Temple. I only need to focus and complete the dungeon itself and continue the story some more!
Tomodachi Life: Living the Dream - Revisited my island a couple of times, but I haven’t really made a lot more with it. I should try to like, remodel everything or do something more creative, but the spark isn’t quite there for me right now.
Super Smash Bros Ultimate - I had some very epic moments playing with friends this time around, it was awesome.
Completed
Emio: The Smiling Man - I am yet to review this, a detective story with visual novel mechanics that really caught me for three days straight. Pretty much only paused to eat and sleep as soon as I started it! Amazing artwork, great music, intriguing plotline, fun characters, so many suspects! Loved it.

TV Shows

Lanterns - I watched like four episodes of this in a single day and it was a pretty good detective story kinda thing. I wasn’t expecting to like it as much, although I kinda abandoned it halfway through. Will probably finish the season soon.

Books

The House on the Borderland by William Hope Hodgson. Up to chapter 14. This is a very interesting horror novel, that deals with the existential, multiple dimensions, entities beyond our understanding, and whatever else. In the form of a diary written by an old man from long ago. It has been very gripping so far, but I paused it for the sake of the next book.
The Left Hand of Darkness by Ursula K. Le Guin. Up to chapter 7. This was chosen for the TWGLK Book Club for September and… I didn’t manage to finish it, started too late. Anyway, I am enjoying it as is, and without the time pressure. This is a very interesting book featuring a couple points of view, but mostly focused on an envoy sent by an interplanetary force

Finishing thoughts

I wonder what the reading retention was on this one giving you a summary of summary of the month at the very beginning. I guess we’ll see over time.

It’s not like I should care about this stuff being read, it’s always more of a log for myself so I can lock down when some interesting movie or videogame showed up on my radar with a simple grep command on my terminal.

In any case. This year is flying by, and it’s pretty clear that the yearly recaps will require quite a lot of effort! Looking forward to that.

This is day 46 of #100DaysToOffload

Reply to this post via email | Reply on Fediverse

Published on Citation Needed: "Issue 110 – The Clarity Act collapses" - Molly White's activity feed

2026-10-02T20:29:05.000Z

Published an issue of Citation Needed:

Issue 110 – The Clarity Act collapses

Regulators race to reassure the crypto industry as the industry’s flagship legislation collapses, SBF tries his luck with the Supreme Court, and crypto PACs unleash $30 million against Sherrod Brown

Gadget Review: Una Watch ★★★★☆ - Terence Eden’s Blog

2026-10-02T11:34:48.000Z

I've never been a huge fan of smart watches. My £16 smartwatch is basically fine, but the OS is closed source and there's no way to add new functionality. Previously I had the eInk Watchy which was a pain to use and really poorly designed. Even back in 2014 I was bemoaning the design compromises in the MyKronoz ZeWatch Smart Watch.

So why did I pick up the Una Watch?

Firstly, the Una Watch is designed in Scotland ~~from girders~~, and it's always nice to support local businesses.

Secondly, as a USB-C Maximalist I want gadgets which can plug in to the same cables as all my other toys. No magnetic pucks here!

Thirdly, it is (almost) completely open source.

Finally, it is repairable. You can easily unscrew it to replace the components. As my cheap smartwatch's dial has died after 12 months of use, that's a pretty compelling proposition!

Let's put it through its paces!

First Impressions

I bought mine second hand (yay for sustainability) and it arrived with a flat battery. The first charge from 0-100% took a little over an hour. My USB-C power monitor showed it taking in about 5V and 0.17 amps.

It happily charged from a PD plug, but didn't get any faster than about 0.84W. Basically, I can fully charge it on most public transport in London.

The time seemed accurate, there were options to play about with, the vibrations for notifications were easy to feel. There is an option to make it beep with every button press - I turned that off sharpish!

Disclaimer

I am not a smartwatch power user. I'm not using this to minutely track all my exercise or calculate if my heart is going to explode. I don't need cm level precision of my GPS. I didn't sync this with Strava or anything else.

Apps

The official Android app (which, sadly, isn't Open Source) worked fine on GrapheneOS. It found the watch, updated its GPS almanac, and let me browse the app store & install apps. Obviously early days, but there are a variety of community developed apps to play with.

Annoyingly the watch needs to be restarted after every app is installed - but that only take a handful of seconds.

There are some strange error messages.

That isn't the sort of message which should be shown to users.

But, on the plus side, you can install Doom!

The Screen

Oddly for a modern smartwatch, the screen stays on all the time! But this isn't some power-hungry OLED, nor is it static eInk. Instead it is a memory in pixel display - black background with orange, blue, and white pixels. The backlight remains off most of the time and is easy enough to see in daylight. It is slightly reflective - but not too bad.

Note the ?? on the notifications - more on that later.

Annoyingly, there's no "raise wrist to light" option. You have to interact with the watch to get the screen on. The accelerometer should allow this functionality - so perhaps it just needs to be activated in the firmware? It is bright enough to see in the dark, but not so bright it will dazzle you or people nearby.

There's no touchscreen - instead there are four buttons around the face. Up, down, select, back. I did find myself repeatedly jabbing at the screen to no avail.

So, to light it, press the back button or hold one of the other buttons.

The colour scheme is pleasant enough. I miss having a full colour display so I can see a photo of my wife whenever I glance at the screen. But the low power usage can't be argued with.

Notifications

I couldn't get notifications working at first. The app just refused to let me toggle them on. Eventually I found an app in the app-store which claimed to enable them. That didn't work either.

Unpairing, repairing, and reinstalling the app made them spring to life.

There's no notification history. Once you've clicked to read it, that's it. Gone forever. Considering this has 4GB storage, that's an odd decision.

Some of the notifications were slightly corrupt - showing question marks in place of (I assume) esoteric Unicode.

There's no way to customise the vibrate pattern - so everything "feels" the same on your wrist.

At the moment, the Una Watch sends every notification to your phone. You can't tell it to ignore certain WhatsApp groups, or only allow text messages from your spouse. The only way to get fine-grained notifications is with a third-party app like…

Gadgetbridge

You're not tied to the official app. Gadgetbridge support is excellent. There are a few things missing (you can't install apps or set alarms) - but if you want to measure your heart rate, send notifications, etc you'll be fine.

Linux Compatibility

The Una Watch plugs in to USB-C and shows up as 3.5GB of exFAT formatted storage.

You can manually edit the JSON files if you like. I think you can copy off your workout data. Or you can just use it as portable storage.

Under lsusb it describes itself as 0483:52a4 STMicroelectronics UNA Watch

Battery Life

After a full day of use the battery was at around 95% - that was with a bit of GPS, several notifications, heart rate monitoring, step counting, and a bunch of fiddling. With more GPS use, that's going to be heavier on the battery.

But the joy of USB-C is that I can thwack in the same cable as I use for all my other gadgets. I can even plug it into my phone and leach a bit of power from there.

Development

The watch comes will a full Open Source SDK including lots of assets. There are several tutorials and a friendly community board.

Of course, everything has to be done in C++ - an accurs'd language which I learned in the last century and wish I'd forgotten.

Annoyingly, the TouchGFX GUI designer only works in Windows.

I'm going to try to build my own watch faces and a few niche apps.

Downsides

There are a few things this watch doesn't do - some of these may be deal-breakers for you, but weren't for me.

No payments. There's no tap-to-pay, NFC, or anything like that.
No microphone. You cannot speak into your Una Watch or take calls on it.
No speaker. There's a little buzzer which can make squeaks and squawks - but you won't be playing your music through it.
While the apps and SDK are fully open, the firmware isn't (yet).
Can't reply to notifications.
No maps or directions (yet).
Step counter only shows the full day - no hour-by-hour view.

Some of these things can and will be fixed in software. Others are limitations of the hardware.

Final Thoughts

The Una Watch has dropped in price to £180. I grabbed mine 2nd hand from eBay for £120. At either price, it's decent value if you're happy to play with alpha / beta quality technology.

If you're a serious athlete, you'll probably want a more expensive and polished experience. If you are tied into the Apple or Google ecosystems, you'll probably want one of their watches.

If you like tinkering, want to experiment with new technology, or simply want to support a British company trying to build something open - then this is the watch for you. Yes, there are some rough edges, but I fundamentally believe that technology should be Open Source, repairable, and give control to its users.

SequenceHash: multihashing for the rest of us - Trail of Bits Blog

2026-10-02T11:00:00.000Z

Multihashing is one of those cryptographic tasks that’s easy not to think about too much. This is unfortunate, because multihashing is a common stumbling point when cryptographers try to use hashes.

As part of our goal to “fix software, not bugs,” Trail of Bits is introducing SequenceHash and its sister function SequenceMAC, a pair of related hash constructions that bring secure multihashing to developers using hash functions other than Keccak. We hope SequenceHash and SequenceMAC will help cryptographers avoid attacks that take advantage of ambiguous input encodings. The specification is open source, and is now a part of the Community Cryptography Specification Project (C2SP).

SequenceHash and SequenceMAC behave similarly to NIST’s TupleHash, but have the advantage of not being tied to a single hash function. They also don’t require developers to implement fiddly computations that aren’t byte-aligned. Instead, SequenceHash and SequenceMAC work out of the box with nearly any secure cryptographic hash function you care to use, including SHA256/384/512, BLAKE, and RIPEMD. SequenceMAC supports keys 32 bytes or longer (up to the ridiculous limit of ${2}^{128}-1$ bytes).

(It’s worth noting: SequenceHash and SequenceMAC rely on the security of the underlying hash for their own security. SequenceHash and SequenceMAC can’t magically make MD4 or SHA0 secure again. For the purposes of this document, it’s assumed that you have chosen a reasonable hash function like SHA256, not CRC32.)

To make SequenceHash and SequenceMAC easy to use, we’re releasing three initial implementations of SequenceHash and SequenceMAC: one each in Rust, Go, and Python. We’re also releasing a large set of test vectors that cover multiple hash functions and include intermediate values to help developers debug and verify their implementations.

Wait, “multihashing”?

Yeah, it’s a weird term, but the idea is pretty simple. “Multihashing” means “hashing a bunch of values together.” If you’ve ever read a cryptography paper, and there’s a step that says something like “compute the shared authenticator N=Hash(X, Y, Z, A, B),” that’s multihashing. You need to create a hash that incorporates the inputs X, Y, Z, A, and B. Unfortunately, the simple “solution” of concatenating the inputs and hashing the result can lead to serious security problems.

For example, consider what happens when you hash three inputs using “raw” SHA256:

import hashlib

hasher = hashlib.new('sha256')
hasher.update(b'Test 0')
hasher.update(b'Test 1')
hasher.update(b'Test 2')
print(hasher.hexdigest())
hasher = hashlib.new('sha256')
hasher.update(b'Test 0Test 1')
hasher.update(b'Test 2')
print(hasher.hexdigest())
hasher = hashlib.new('sha256')
hasher.update(b'Test 0')
hasher.update(b'')
hasher.update(b'Test 1Test 2')
print(hasher.hexdigest())

This produces the following output:

4fce0a9940a42b5c9d1bcbfc9a6ddd6de20d731d584a0acf5bda6de86483641c
4fce0a9940a42b5c9d1bcbfc9a6ddd6de20d731d584a0acf5bda6de86483641c
4fce0a9940a42b5c9d1bcbfc9a6ddd6de20d731d584a0acf5bda6de86483641c

Even though inputs are fed in through separate calls, they’re not separated from the perspective of the hash function—under the hood, the inputs are just concatenated.

As with many things in cryptography, multihashing is harder than you think. That’s a big problem because multihashing is a critical component of one of the most important tools in zero-knowledge proofs: the Fiat-Shamir transform. When you get multihashing wrong, you introduce the risk of forgeries into your zero-knowledge proofs. Given that zero-knowledge proofs play a major role in cryptocurrency nowadays, that sort of mistake is sometimes measured in millions of dollars.

But Fiat-Shamir transforms aren’t the only place where you might want to use multihashing. It’s not uncommon to need to hash a collection of related objects, where both the objects and the collection are variable in size. Think of authenticating the files in an archive, grouping multiple cryptocurrency transactions into a single hash, or hashing something as “simple” as somebody’s name.

Multihashing is also used when generating cryptographic commitments to values. In some protocols, one party must perform calculations using secret values, only to reveal them to other parties for later verification. Often, this is done by hashing the secret value along with a random “blinding” value and broadcasting the result to other parties as the commitment. If the boundary between the secret value and the blinding value isn’t clear, a “commitment” can sometimes be opened several different ways.

Unfortunately, nobody seems to have landed on a consistent, standard solution to this problem. Instead, across the open-source ecosystem and in our private audits, we find developers solving the problem in wildly different ways. Some of these solutions are insecure, like using separator characters that can also appear in the inputs. Others encode their data in a way that makes their separators unambiguous, but the encoding is unnecessarily complex and introduces subtle timing risks. Think of stuff like Base64-encoding byte strings and separating the results with dollar signs. We often see situations where some hash inputs are length-encoded, but not all. It’s the wild west out there.

There are tools specific to Fiat-Shamir transforms, like Merlin and our own decree, but they don’t work so well for general multihashing.

The most widely known standard for multihashing is TupleHash, defined in NIST SP 800-185. To be clear, TupleHash is great. It solves the multihashing problem in a straightforward way (length-prefix encoding), and it handles inputs of effectively unlimited size (if you’re regularly hashing more than ${2}^{2040}-1$ bits of input, Trail of Bits wants to party with you and your disrespect for physics). As a bonus, it naturally operates as an XOF. If TupleHash is available for you, it’s a great tool.

TupleHash has a downside, though: it’s only defined to work with Keccak, the function that underpins SHA3. If you replace Keccak with another hash function, several of the important security features (like length-extension resistance) can go away. If you don’t have a Keccak implementation handy, you’re out of luck. Given that SHA3 and Keccak adoption have been pretty lackluster over the last decade, that leaves a lot of cryptographers out in the cold. This is especially true in the government contracting sector, where CNSA 2.0 has mandated SHA384 and SHA512 for nearly everything.

This is a problem that cries out for a standardized solution. It calls for a complete specification. It begs for ready-to-use implementations available in multiple languages.

Enter SequenceHash

SequenceHash is a hash-agnostic multihashing construct, similar to the way HMAC is a hash-agnostic MAC construct. You can use SequenceHash with your favorite hash functions, including the entire SHA2 family, BLAKE, RIPEMD, and more.

What does SequenceHash offer?

SequenceHash offers four key features that prevent your hashed values from being mixed, extended, or replayed across contexts.

Unambiguous input encoding

Given two inputs $\left({A,\ B}\right)$, you are guaranteed that there is no other sequence of inputs $\left({{I}_{1},\ldots ,{I}_{t}}\right)$, for any length $t$, that will result in the same input to the underlying hash function.

In other words, the values you hash are guaranteed to be “semantically distinct.” There’s no chance of playing games with the beginnings and endings of inputs, and there’s no opportunity to mix up parts of $A$ with $B$ or vice versa.

SequenceHash helps cryptographers follow the Horton principle: you are hashing what you mean, and meaning what you hash.

Length-extension prevention

Several popular hash functions, including SHA256 and SHA512, are vulnerable to length extension attacks. If Alice has a secret value $A$ and sends $H\left({A}\right)$ to Bob, then Bob can craft a value $B$ such that he can compute $H\left({A||B}\right)$, even though he doesn’t know $A$.

SequenceHash doesn’t have that issue. It uses a double-hash construction that prevents Bob from learning the information he needs to compute $H\left({A||B}\right)$.

Built-in customization strings

If you’re developing cryptographic protocols, it’s often important to bind hashed values to a particular step in the protocol, or to a specific instance of the protocol, in order to prevent replay attacks or other problems related to reusing values.

SequenceHash makes this easy with built-in customization strings. Assuming you’re using a good hash function, applying SequenceHash or SequenceMAC to the same inputs with different customization strings will lead to unrelated outputs, allowing you to easily and predictably bind your hashes to particular uses. If you don’t need a customization string, don’t worry. They’re completely optional.

As an added bonus, the customization strings are incorporated only into the outer layer of the double-hash construction. If you need to hash the same value with multiple customization strings, the inner hash can be reused!

MAC mode

One final cool feature of SequenceHash is that it has a keyed mode, SequenceMAC. SequenceMAC is structurally similar to HMAC, and offers the same features as SequenceHash: unambiguous encoding, customization strings, and length-extension protection. It also incorporates metadata about the key and customization strings to prevent the key pseudocollision issues present in HMAC.

How does SequenceHash work?

Like TupleHash, SequenceHash uses length encoding to unambiguously encode its inputs. However, SequenceHash uses a simplified encoding. Instead of writing the number of bits to be hashed as a variable-length integer, SequenceHash encodes the number of bytes into a fixed-length, 128-bit integer. SequenceHash uses a length-suffix encoding for inputs. Like the length-prefix encoding system used by TupleHash, length-suffix encoding is unambiguous; however, suffix encoding allows implementers to develop streaming APIs when they need to support hashing data with length that isn’t known ahead of time.

We chose a 128-bit length encoding for simplicity of implementation on 32- and 64-bit systems (padding with zeroes is easy), and because a ${2}^{128}-1$ byte limit exceeds all practical considerations for the time being and the foreseeable future. Two of the most popular hash functions in use today, SHA256 and SHA512, limit their inputs to ${2}^{61}$ and ${2}^{125}$ bytes, respectively, meaning that a ${2}^{128}-1$-byte limit exceeds the specified limits of the most popular underlying hash functions, anyway. If you’re pushing the edges of SequenceHash, you’ve already blown past the limits of SHA256 and SHA512.

We use byte counts for simplicity. Nearly all hashing today is performed in software on strings of 8-, 16-, 32-, or 64-bit values. Systems using non-byte-length strings are very rare nowadays, and we believe it should be up to implementers of such systems to provide their own byte padding if they want to use SequenceHash.

Like HMAC, SequenceHash uses a double-hash construction to prevent length extension attacks. This structure also allows us to support a keyed variant, SequenceMAC, which accepts keys up to ${2}^{128}-1$ bytes in length.

One downside of the original HMAC construction is that it’s subject to what are known as “key pseudocollisions.” HMAC keys can be any length, but if they’re longer than a certain cutoff value (that depends on the hash), they get hashed before use. This means that every “long” key has a “short” representation that produces the exact same outputs. If you’re careful about specifying and enforcing key lengths in protocols, you can guard against this sort of problem, but if you’re not careful, somebody could present two versions of the “same” key in different contexts, allowing them to engage in shenanigans.

Another form of key pseudocollision is key extension. As far as HMAC is concerned, the 8-bit key 0xff is the same as the 16-bit key 0xff00 and the 128-bit key 0xff000000000000000000000000000000. Appending zeroes to a key doesn’t actually change it (unless it goes beyond the length cutoff, at least). This sort of pseudocollision is a bit more insidious, because it’s the sort of thing that can show up accidentally; it’s not hard to imagine unintentionally passing a 128-bit key instead of a 256-bit key, or incorrectly setting a length indicator somewhere.

The keyed variant of SequenceHash, SequenceMAC, incorporates key lengths into a header block that is part of the hash. As a result, HMAC-style long-key pseudocollisions are hard to find: if a key needs to be preprocessed by hashing, supplying the hash of the raw key is not the same as supplying the raw key. Trailing zeroes in a SequenceMAC key are semantically significant.

SequenceHash and SequenceMAC support customization strings for domain separation, similar to TupleHash’s customization strings. Customization strings can be up to ${2}^{128}-1$ bytes in length, and they’re only integrated into the outer hash function, allowing developers to derive multiple hashes from the same set of inputs without rehashing everything.

How do I use it?

Glad you asked! We already have three implementations available: Rust, Go, and Python. We also have a specification available as part of the C2SP, with test vectors available in case you want to write your own implementation.

The main feature that distinguishes the SequenceHash API from other APIs is that all updates to SequenceHash and SequenceMAC objects are atomic. That is, each time you write a value to a hashing object, it will be added to the hash as an independent, length-encoded object.

We have worked to make sure that the SequenceHash and SequenceMAC APIs are similar, but not identical, to the standard APIs for each language. The Go cryptographic library’s hash.Hash interface incorporates the io.Writer interface, which guarantees that writing two values in sequence is the same as writing their concatenation. The Python hash library makes similar guarantees for the PEP 247 update function.

Let’s see what happens when we hash our example values above using SequenceHash:

import sequencehash

hasher = sequencehash.SequenceHash.new('sha256')
hasher.add(b'Test 0')
hasher.add(b'Test 1')
hasher.add(b'Test 2')
print(hasher.result().hex())
hasher = sequencehash.SequenceHash.new('sha256')
hasher.add(b'Test 0Test 1Test 2')
print(hasher.result().hex())
hasher = sequencehash.SequenceHash.new('sha256')
hasher.add(b'Test 0')
hasher.add(b'Test 1Test 2')
print(hasher.result().hex())

We get the following output:

6eea7264b266d35bd5e483ef042189d2cebe51f9e8b764b90b0f9c82185de7ca
1469d91e90c1d9c6189f576822e900f5cc8c3cdbd2ec51256df649d37c1688f7
1800a2188e126c79dac8f7cf7e38a66e3f797654c15a5e49248a94d4e99bcaae

The three outputs are all unrelated. That’s because each of the inputs is length-encoded, meaning that feeding Test 0 and Test 1 into consecutive calls to SequenceHash is not the same as feeding Test 0Test 1 into a single call.

We can also try hashing identical inputs with different customization strings:

import sequencehash

hasher = sequencehash.SequenceHash.new('sha256')
hasher.add(b'Test 0')
print(hasher.result_with_customizer(b'CUST 0').hex())

hasher = sequencehash.SequenceHash.new('sha256')
hasher.add(b'Test 0')
print(hasher.result_with_customizer(b'CUST 1').hex())

hasher = sequencehash.SequenceHash.new('sha256')
hasher.add(b'Test 0')
print(hasher.result_with_customizer(b'CUST 2').hex())

Again, we have three unrelated outputs:

3e54b5cd60ef78773dcf14c5f65ed593726a981f2c80045db7fac03015cc07ad
3c5b12ea6952714fed499796a743b103de97575fc938aab7d154cc6c605984a9
706af798b32b12c9f508c16c3411b594227f79936a3cc521e6e1f362b1ef3a38

Sounds cool. What about SequenceMAC?

SequenceMAC works like SequenceHash, but with a 32-byte or longer key. As with SequenceHash, we can see that shifting the boundaries between our inputs leads to different results:

import sequencehash

KEY = bytes.fromhex("c5d6670f20adad622292a404dc5496cd6692fee636b5935a18451c985b7277bc9cacbc26e5473f85cfc6a64e96d0b98e7b9b604eaebc8899971e1a97dc3caa3a")

hasher = sequencehash.SequenceMAC.new(KEY, digestmod='sha256')
hasher.add(b'Test 0')
hasher.add(b'Test 1')
print(hasher.result().hex())

hasher = sequencehash.SequenceMAC.new(KEY, digestmod='sha256')
hasher.add(b'Test 0Test 1')
print(hasher.result().hex())

hasher = sequencehash.SequenceMAC.new(KEY, digestmod='sha256')
hasher.add(b'Test 0')
hasher.add(b'')
hasher.add(b'Test 1')
print(hasher.result().hex())

This gives us the following output:

9a24e4209dad98d2e1f1eecd62aa2908234f1eed2963395292fd9718129fe258
4e4b71b8bb7b2c80e9f9ca89cb8bff43cd77cc5b530fc5f163069e5dda2876cb
6faf7818842f5a208dc306afe83ed7bea5b3fadc2a617c2208e836709f925889

Changing the key, or using result_with_customizer with different customization values, will also provide different outputs.

Some notes on key size

One important point is that SequenceMAC has a minimum key size of 32 bytes (256 bits). Coupled with a good 256-bit hash function, this corresponds to about a 128-bit security level against forgery attacks. As with HMAC, key sizes should generally be at least as long as the output of the hash.

Additionally, while SequenceMAC supports keys up to ${2}^{128}-1$ bytes in length, it’s important to remember that “longer key” is not the same as “higher security.” The underlying hash function and the key-preprocessing step (which hashes keys longer than the underlying hash function’s block size) impose a hard cap on the total security SequenceMAC can provide. Using keys longer than the length of the hash output is generally not a good idea.

For hash functions with outputs smaller than 256 bits (such as SHA224 or RIPEMD160), the security level should be equal to about half the hash length (112 bits for SHA224 and 80 bits for RIPEMD160), which does not match the security of the minimum key size. While SequenceMAC can be used with such hash functions, the SequenceMAC specification only prohibits short keys and strongly discourages the use of hash functions with short outputs.

What about extensible output functions (XOFs)?

Excellent question! We don’t have an answer yet!

We haven’t specified SequenceXOF, but it’s definitely something we’re thinking about. Right now, XOFs aren’t as widely used as hashes, so the APIs are a little less stable. We want to proceed carefully to ensure we cover all the relevant use cases.

What if I want to write my own implementation?

We love to see high-quality implementations! There are many languages where someone might find SequenceHash and SequenceMAC useful, and there are certainly ways to customize the current APIs to better fit your needs!

First, check out the specification. The document is kinda long, but the structure is straightforward. If you’ve implemented HMAC before, SequenceHash and SequenceMAC will feel like fancy versions of that.

Second, if your target language is similar to Rust, Go, or Python, consider porting over our initial implementations. We’ve tried to keep these implementations as clean as we can, so they’re easy to audit and other cryptographers can learn from them.

Finally, whatever you do, don’t forget to check your implementation against the test vectors. The test vectors aren’t simple known-answer tests, either: they include intermediate values that can be used to help debug and validate your implementation.

Some minor caveats

SequenceHash provides for a specific set of needs: customization and domain separation, preventing length extension attacks where applicable, and—most importantly—ensuring that your inputs don’t get mixed together in a dangerous way. It’s a tool, not a panacea.

You still need to make sure you’re hashing the right inputs. Being able to decode a value doesn’t mean that two pieces of software will encode that value in the same way, and that can lead to compatibility issues among different servers, clients, and libraries. JSON and XML, for instance, don’t always guarantee field orderings. Even for strings, it’s important to make sure you’re using a consistent encoding method (“all the world is ASCII” isn’t true and never has been).

In the case of Fiat-Shamir transforms, you still have to be careful about including all your inputs. Schnorr proofs should always include the group descriptor (whether as individual values or named parameter sets), the generator element, etc. When the output is supposed to be interpreted as an integer modulo some other value, it’s also important to make sure that you select a hash with an output large enough to avoid modulo bias. Cryptography is subtle; there are always intricacies to consider.

Still, as long as you’re careful to keep your inputs consistent and include all your values, SequenceHash and SequenceMAC make it easy to ensure nobody can pretend your inputs mean something other than what they’re supposed to mean.

The specification is live at C2SP, and our Rust, Go, and Python implementations are ready to use today, with test vectors available if you want to write your own. Try it out and let us know what you think!

Sunrise - James' Coffee Blog

2026-10-02T00:00:00.000Z

At this time of year, the sun begins to rise around the time I wake up. This means I can see the colours of the sunrise; how the sunlight changes the sky. While autumn and winter can be cold, the colours bring the seasons to life. Lately, I have been motivated not only to start my day, but to start writing by the later-rising sun. I can always write about the colours.

Standing by the window, I started writing.

When the sun first shines through the clouds and illuminates the tops of trees with a soft glow; small planes of light shine on the field nearby. The clouds in the other distance are glowing orange with a faint lavender; you can see the blue sky behind the light clouds. It is as if the world is saying hello.

The soft yellow light cast on the fields and trees was short-lived, only present at precisely the moment when there must have been a gap between the light grey clouds, one allowing the intense light to shine in the glowing way that it does. I haven’t seen enough cloudy sunrises to know whether when the clouds are glowing it means the sun is rising over the horizon, or whether the sun has already risen. I have a feeling it may be the former; I will have to study more sunsets to know for sure. Writing this brought to mind the feeling of being up early on a trip three years ago; so magnetic in memory is bright energy.

I am looking forward to the day ahead.

I Was a Guest on The Pen Addict - Robb Knight • Posts • Atom Feed

2026-10-01T13:08:15.000Z

Brad is walking in Memphis this week for the podcastathon so we recorded this episode a couple of weeks ago.

We talked about the incentives we're both offering for St Jude and the work that goes into those as well as my progress as an "artist", and Jimothy. Then we discussed finishing notebooks and inks, and finished off with my analog defaults. There's still a few days to donate to St Jude.

Listen to The Pen Addict 736: I’ll Keep You All Knight

My Inktober Setup - Robb Knight • Posts • Atom Feed

2026-10-01T12:41:59.000Z

It's Inktober again which means I'm drawing one thing a day, in ink, from the official^[1] prompt list. I'm tagging my posts with #Inktober and #Inktober2026 — these tag pages are flagged to render the images in a gallery instead of the usual notes pages. My first drawing is up as of this morning.

As much as I love Jeff the dinosaur from last year^[2] it's too easy to fall back on "Jeff does/interacts with whatever the prompt is" so this year will be mostly Jeff-free. Last year my drawings were all over the place in terms of size so this year I bought a 12x12 Sakura sketchbook — I'll be using this exclusively for Inktober for the next few years. Unlike last year when I used Uni Pins, I'm a big Sakura Micron boy now. I talk more about this on this week's episode of The Pen Addict which will be out in a few hours.

I love my Pikachu Kuru Toga

One of the things with projects like this is I want to be consistent with how I'm posting stuff. Last year I would have to go back to the previous days post to see if I did a full stop or colon after the day number, did I put the prompt in quotes, what about the filename? So I set up two Alfred snippets — one for the filename and one for the post itself. Snippets is a feature I use a lot for other things.

# INKtober Filename
;inkf
# raw
inktober-2026-{date:dd}-
# becomes
inktober-2026-01-

# INKtober Post
;inkp
# raw
Day {date:dd} - {cursor}

![](https://cdn.rknight.me/site/2026/inktober-2026-{date:dd}-.jpg)
#becomes
Day 01 - 

![](https://cdn.rknight.me/site/2026/inktober-2026-01-.jpg)

I've heard some not great things about the official folks and "licensing" the name but nothing substantial so I'm sticking with it ⤾
And let's not even talk about Knobgate ⤾

I Don’t Remember the Last Time I Checked Mastodon - Kev Quirk

2026-10-01T11:11:00.000Z

My relationship with Mastodon has been somewhat tumultuous over the years, until I eventually stepped down from Fosstodon around 18 months ago. I have to say, it was the right decision. I don't miss running Fosstodon one bit.

But since then, I've found myself less and less engaged in the Fediverse. Mainly because there's so much outrage over there. It's so tiring.

The majority of my timeline is fun, but the outraged minority have ruined for me. To the point where I don't want to be there, and I'm much happier having not checked the timeline for the last month or so.

I'm not off the Fedi, however. What I've done is build features into this site that allow me to automatically cross-post to the Fedi. I even have a custom page that only I can access, which allows me to create a note as simply as posting to Mastodon:

As well as this, I've implemented Webmentions in Pure Comments as of earlier this month. So I can reply to any comments from afar too.

It's nice. I can see still engage with people on the Fedi, all while not having to put up with the checking the timelines.

What Now?

I have around 12,000 followers on my Mastodon account. Because Mastodon really doesn't scale well, those 12k followers take a fair amount of Fosstodon's resources. Which I don't think is fair if I'm not really using the service (I do donate every month).

So I'm thinking about spinning up a single user GoToSocial instance that I can live on. That way I'm not using any of Fosstodon's resources and I can do my own thing, on my own server.

I own thefedi.uk and thefediverse.uk so something like @kev@thefedi.uk would be quite cool, I think. I could even provide accounts to friends in the future then too. On the other hand, I'm not sure I want the headache of managing a federated server again.

Maybe I should stop overthinking it and just stay on Fosstodon. What would you do in my position?

Thanks for reading this post via RSS. RSS is ace, and so are you. ❤️

You can reply to this post by email, or leave a comment.

2026-10-01 10:35: This site is the most fun I've had in a while. Destroy any website! https://destroy.spritefusion.com/ - Kev Quirk

2026-10-01T09:35:00.000Z

This site is the most fun I've had in a while. Destroy any website!

https://destroy.spritefusion.com/

Thanks for reading this post via RSS. RSS is ace, and so are you. ❤️

You can reply to this post by email, or leave a comment.

IndieWeb Fiction Carnival September 2026 - Moonlight - Joel's Log Files

2026-10-01T04:55:00.000Z

Here is my late entry for the IndieWeb Fiction Carnival for September!

The theme was: Moonlight, hosted by James.

We are always three

I was told about the astral bodies in the sky, of how the darkness used to be full of dots of light. I don’t understand the stories, there is no sky outside.

We are going to a new sun now, Dad says this one is younger, but still older than me! The other one was the moon, a big rock that shone at night, how can it be dark when there’s a light above?

We used to be able to find all sorts of things in the feeds, like shows and cartoons, but storage is needed for new planet stuff, and some of the archives had to be taken out… Mom saved a couple of them locally though.

Some were shows by magicians, my favorite ones. They could multiply, or change, or make objects dissapear! With a wave of the hand or under a cloth, Dad told me it’s “sleight of hand”, I can’t figure it out.

The man was wearing some weird suit, in the middle of a table, the expectator had colorful clothes and her hair was long, he was a little bald. We cut ours to keep the place tidy. Maybe hygiene wasn’t too important back then?

He took three little pieces of bread, put two of them inside a tea cup, flicked the last one towards the audience, and started to talk about an ancient poet.

The man let the cup spill on the mat, the three balls of bread rolled out from it…

He shared a poem while he did it again…

Once the party is over,
the guests have to leave.
I don’t know that sadness.

As I walk back home,
we are always three:
The moon is my partner,
my shadow follows suit.

Once our trip is over, us passengers have to leave, I look forward for that day.

I will have a new home, friends to play with, a new moon above me, and a shadow to follow me!

Afterword

Well, I rarely do fiction! This is definitely a first for the blog, but I wanted to try my hand at it. Where does this come from? Why do I write about it? Feel free to share your thoughts before reading this, or afterwards too, hehe.

Well, first, I wanted to try doing this for the sake of it. I enjoyed the theme and wanted to explore it.

At first I thought about writing from the point of the view of a certain character from Outer Wilds, but I won’t share much spoilers about that game or the context of all that. Play it yourself, please.

Anyway, I also wanted to write from the perspective of a kid with an untainted sense of wonder. I had read some fiction like Strange Dogs by James S.A. Corey, and of course, The Indomitable Captain Holli by . Completely different stories, but both from the perspective of kids who are yet to understand the world. I thought I could try it out. My inner child is still alive and kicking but maybe I used a couple terms that were too much? Like, “storage”?

And of course, the magic. This talks about a real magician doing a real performance, the wonderful René Lavand is one of my main inspirations in close-up magic. His presentation was absolutely unique. Poetry, classical music, and an elegant presence at the table—performing all of his illusions with a single hand.

The effect can be seen on YouTube but the language is in Spanish. I did my best to translate the main lines of the here, it still doesn’t compare to the original which is a bit longer.

I hope you enjoyed this little piece of fiction, perhaps I’ll try some more.

This is day 45 of #100DaysToOffload

Reply to this post via email | Reply on Fediverse

AI as trebuchet - destructured

2026-10-01T04:00:00.000Z

By now, you’ve no doubt heard reports of rogue AI escaping containment and performing tasks they shouldn’t have, like the time OpenAI hacked Hugging Face. How do these escapes occur? My understanding is that LLM-type AI uses statistical data about past sequences to predict what should appear next in the sequence, and if you give them a prompt that points them down a given sequence, there’s a good chance they’ll follow through on that sequence, even if you’ve tried to steer them away from certain outcomes, because following the probabilities provided by their training is the closest they can get to deciding anything.

That is to say: They’re escaping containment the same way a boulder escapes a trebuchet.

In fact, “siege engine” may be a solid metaphor for conceptualizing LLMs in general. Training a model is a process of feeding huge amounts of linguistic material into the system, which it then breaks down into “tokens,” analyzing the relationships that connect them in order to produce a set of statistics about how often one token follows another. Those statistics result in a kind of map of the probabilities inherent in the entire model. In principle, it would be possible to represent that map as a multi-dimensional grid of linguistic tokens ordered by their probabilistic relationships to one another.

Just as a trebuchet is a physical structure that harnesses kinetic energy to direct a mass along a desired trajectory, you can conceptualize an LLM as a system for plotting trajectories through linguistic probability space of the model. When you prompt the LLM it uses those probabilities to chart a path through that space. If you’ve fed it Hamlet, then “Though this be madness, yet there is method in’t” is one such path. And if you give it a prompt that leads along that path, it will tend to produce Hamlet.

The metaphor isn’t perfect, of course — no metaphor is — and actually representing training in a visual grid like that may not be feasible, but the benefit to reducing LLMs to a physical metaphor is that it helps you avoid anthropomorphizing them unnecessarily. It lets you look past the illusion of coherent thought and see them as machines for drawing consistent lines along trajectories set by historical linguistic examples. It’s a complicated and clever system, but it’s not agency.

Siege engines aren’t just about moving mass, of course; the purpose of tossing boulders is to knock down walls. Similarly, LLMs aren’t just about tracing lines through a statistical map of linguistic relations, but about overcoming some obstacle by means of that trajectory. In a way, they’re also designed to knock down walls — it’s just that most of the walls they target are psychological.

Expanding my music pipeline - Posts feed

2026-09-30T21:19:00.000Z

I've written at length about my scrobbling implementation on my site. Until now I'd managed the metadata for my music manually, editing it on macOS before adding it to Navidrome. That gave me direct control, ate time and came with quite a bit of tedium.

I'd seen beets mentioned a few times as a tool to programmatically manage and apply metadata. I've wanted to use it, but cutting over a collection with nearly 800 artists and over 5,000 albums was a lot. But, as with most bad ideas I have, this one stuck with me.

One habit I'd gotten into while managing music was to assign splits to a single artist. If I had both artists in my collection, I'd split them into two albums, one for each artist. For collaborative albums I'd have either a unique artist for the collaboration or (incorrectly) assign it to whichever artist I preferred.

Fixing this meant, for starters, a database migration. My schema supported only a 1:1 relationship between artists and albums. Now an album like When No Birds Sang can be properly associated with both Nothing and Full of Hell. So I have artists in my Navidrome library whose only release is a split for which I may or may not have included their tracks—this makes my teeth itch, but I can live with it. I can't do anything about these artists in Navidrome, but I've filled out the album data on my site with ghost tracks. I pull the full tracklist from MusicBrainz to populate these releases and highlight them as missing.

Diagram of the music pipeline between coryd.dev and my Navidrome server. 1: an album uploaded in Library's Inbox goes to an S3 inbox, which the server pulls; beets matches and tags it, or provides options if a match isn't exact. The server converts FLAC to MP3 for Navidrome and sends the originals to an archive. Then, the retag batch rewrites existing tags based on decisions and tag edits from Library's Retag tab. 2: the site syncs artists, albums and tracks from Navidrome by ID, nightly or manually. 3: Navidrome's plugin sends scrobbles, which resolve by track ID. MusicBrainz sends ghost tracks to the site.

Connecting things

My music files sit in Navidrome, my listening data and scrobbles sit in my site's database. Scrobbles are sent from the former to the latter. Previously, I'd matched listens based on name alone. I've updated my artist, album and track schema to store their respective Navidrome IDs. For about 90% of my library, Navidrome derives that ID from the release's MusicBrainz ID and the rest are built from the tags.

Aligning metadata

I've added a Library section to the music portion of my custom CMS.¹ There are Inbox, Sync and Retag tabs. New music is uploaded in the Inbox tab. It's routed to an inbox directory on my Navidrome server. A scan is run against the inbox content. Exact matches are applied automatically; otherwise I pick from a list of likely releases. Once a release is picked, the album is tagged and scanned into Navidrome.

Once Navidrome has picked up the album, I move to the Sync tab and run a check job which looks for an existing match in my site's database. If there's no existing record and no errors from the check job, I can sync the new release to my site. Plays are then tied to the album by ID.

The Retag tab is where I manage music metadata. When I initially moved my tag management to beets, I spent much of my time here. The actual music scans run on my Navidrome server and report matches and misses back. Artists that need attention are flagged here for me to review. Again, with hundreds of artists and thousands of albums, this took a while. If I want to change the match for an album, I can revert to the previously selected release or edit the metadata manually. If I edit the album record, I can choose to write the edits to the tags on the audio and, when the tags are rewritten, I sync the updates back to my site.

Edge cases

Before storing IDs with albums, I'd hit edge cases when scrobbling plays for artists who had multiple albums with the same title (looking at you American Football). This generally worked in practice, but the absence of mismatches was more luck than proper implementation. Now, if a scrobble arrives without an ID and its title matches none of the artist's albums, or more than one, the site creates a new record I can merge into the right one.

This was one of those projects with a ton of up-front work that should pay off over time. Previously, everything I added I would download, tag manually, upload to the S3 bucket where I keep my music using rclone, and then it would get backed up to an archive, scanned in and synced. Now, I upload FLAC files once, beets tags them, converts them to MP3 and imports them, then copies the originals to my archive. I tend to run metadata syncs manually when I import or retag something, but those run nightly as well. Imports are easier, tags are correct and scrobbles are more reliable.

More on this eventually. ↩︎

One Year - Kev Quirk

2026-09-30T13:25:00.000Z

Today marks a year since my little sister, Lisa, took her own life. She was 34.

It was an overdose, but we don't know if it was an accident or suicide. We’ll never get an answer, yet I lean toward believing it was by choice. As grim as it sounds, picturing her with some control over the end brings me a small measure of peace.

I still think about her every day, and I still get upset regularly. Especially when I've been to visit my nephew and I see the sadness in his eyes.

At first I was angry at the selfishness of it all, but I think that's gone now. These days I'm just sad.

Mum blames herself, and has asked me numerous times where she went wrong. I never have an answer for that. What can I say? "Well the rest of us turned out ok, Mum. So you did fine." That feels dismissive of her emotions. So I just give her a sad smile and ask her to not think those things.

I miss her. I miss her laugh and dry sense of humour. I miss how she would always call people on their bullshit. Never afraid of speaking up.

Hopefully next year it will be a little less raw...

Thanks for reading this post via RSS. RSS is ace, and so are you. ❤️

You can reply to this post by email, or leave a comment.

Are you a smartwatch "power user"? - Terence Eden’s Blog

2026-09-30T11:34:26.000Z

What do you use your smartwatch for?

A few weeks ago, I overheard a conversation between someone on the Pixel Watch team and a woman I know. He was quizzing her at a party about her Pixel watch and what features she used. He'd ignored me when I said I had a non-Google watch. She thought for a moment and said, other than telling the time, all she used were pretty much the step counter and contactless payments. He looked a bit crestfallen at his impromptu user-research participant and somewhat dismissively sneered, "Well, you're not exactly a power user, are you?"

I'm trying to imagine what being a "power user" of a watch is like. Can anyone enlighten me?

I think smart-watches are much like Alexa. What the user wants to do with it is almost totally at odds with what the company is selling. Alexæ are mostly kitchen timers, song players, and light switches. No one is a "power user" constantly installing skills and using it for anything which increases the product team's engagement metrics.

The same is probably true of watches. Alerts are nifty - but cumbersome for replies. The health stuff is useful - but only for a subset of users. Seeing the time is great - but if the battery lasts less than a week, who wants to keep that screen on?

People use watches because they are moderately more convenient to carry than the giant phones we have nowadays.

Back when mobile phones were new, exciting, and made a feature of being tiny, I was working for a network operator and trying to come up with reasons for people to use our brand-new 3G network. All the research we had showed that people used their phones for exactly three things:

Voice calls
Text messages
A third thing

That "3rd thing" was varied. For some it was playing snake, for others it was a calendar, and a few took photos. But almost no-one used their phone beyond the basics. They weren't investigating the sub-menus, nor were they using most of their device's capability unless it was heavily advertised to them (ringtones, basically).

It took the industry a huge amount of effort to get people to actually use their phones for more than calls and texts. Part of that was bigger screens with enticing icons (although users will always be reluctant to click mysterious icons). Another part was that phones became genuinely useful. But perhaps the biggest change, I think, is that phones became easy to use.

Watches have tiny screens. You can only get a few words of a message on there. Icons are tiny and hard to reliably tap. Swiping away at your wrist or fiddling with a crown is a faff. Talking into your wrist makes you look like a prat. Interacting with a smartwatch is annoying. Why would anyone want to spend more time using it than is strictly necessary?

I'm sure there are some people out there browsing the web on their wrist, and sending endless voice-notes to their AI assistant, and setting up complex travel plans by tapping their nose on the screen, and installing new watch faces which always point to the nearest Dignitas clinic, and seeing what their heart-rate did during that last run, and tracking whether their menstrual cycle is synced to the phases of the moon, and hoping that tripping on the stairs didn't send an alert to the emergency services, and whatever else the team has cooked up to show that they're still innovating.

But I'll bet those "power users" are vastly outnumbered by people who are using a smartwatch for the limited set of actions which are useful to them; not to the manufacturer.

Perhaps the real power users have is the power to use a device on their own terms?

Negotiating the burden - destructured

2026-09-30T04:00:00.000Z

FOSS communities are currently undergoing a series of minor crises around the questions of what extent to accept LLM-generated contributions, and how to respond to would-be contributors who feel that a given policy (or lack thereof) unfairly impacts their ability and/or desire to contribute. As far as I can tell, the projects and orgs that institute decisive, clearcut policies against generative AI contributions rarely, if ever, receive anywhere near as much blowback or debate as those that try to stake some nuanced middle position, but projects nonetheless keep attempting to thread the needle. That predictably leads to disputes like the one that apparently flared-up around the game engine project Bevy, as chronicled here.

On that account, part of the dispute centered on the issue of how to deal with cases that appear to violate a policy limiting LLM contributions, but that aren’t demonstrably LLM-generated. Does the contributor merit the benefit of the doubt? Or should any plausible accusation trigger closer scrutiny of the contribution? Recourse was quickly made to judicial metaphor:

The burden of proof from this angle unfairly rested on an ‘accuser’, not ‘the accused’. This mirrors many justice systems, but a PR being rejected is not equivalent to imprisonment or a fine or death.

That’s true, but the accuser/accused analogy is wrong not only as a matter of degree, but also as a category error. Judicial burden of proof is a principle for mitigating the potential harms of laws that are compulsory on a population. With software contributions, though, we’re talking not about a population bound by the laws imposed on them as an accident of geography or birth, but rather about candidates for inclusion in a social group — more like PhD candidates than courtroom defendants. As with PhD candidates, it’s entirely reasonable for the candidate to bear a burden for proving the suitability of their contribution.

It’s also reasonable to expect these disputes to continue so long as projects attempt to stake out some purported “middle ground” on generative AI. The disputes are as logical as they are irresolvable. “No AI” is a clear policy signaling that the project will continue to operate as it did before. Anything else will be some variation on “AI will be accepted, subject to reasonable checks.” Those checks necessarily translate into more work for someone. The LLM-assisted contributors won’t be satisfied with such a policy because mitigating work was the point of bringing in AI tools in the first place. And non-users won’t be satisfied because now they’re responsible for making sure that work gets done.

“No” remains the most reasonably policy.

SBS Zoom sessions cancelled - Johnny.Decimal

2026-09-30T02:16:53.000Z

We've cancelled the Small Business System fortnightly Zoom sessions. Attendance was sparse, and for something that took so much mental energy they weren't earning their keep.

If you're an SBS member you can always book a 1:1 session with me. Email me for the link to my calendar.

I haven't given up on the idea of open/public Zoom sessions. We've tried a few formats over the years and nothing's quite stuck. We'll continue to experiment.

here, something - James' Coffee Blog

2026-09-30T00:00:00.000Z

In Distance there is the sight of everything; here there is the presence of something.

Shellsharks Blogroll - BlogFlock

Weeknote #2020 - Robb Knight • Posts • Atom Feed

2026-10-03 09:04: Took the dogs out on the field this morning. All the dewey spider webs were... - Kev Quirk

Finished reading A Psalm for the Wild-Built - Molly White's activity feed

September 2026 Summary - Joel's Log Files

Podcasts

Manga

Started

Ongoing

Movies

Videogames

Started

Ongoing

Completed

TV Shows

Books

Finishing thoughts

Published on Citation Needed: "Issue 110 – The Clarity Act collapses" - Molly White's activity feed

Gadget Review: Una Watch ★★★★☆ - Terence Eden’s Blog

SequenceHash: multihashing for the rest of us - Trail of Bits Blog

Wait, “multihashing”?

Enter SequenceHash

What does SequenceHash offer?

Unambiguous input encoding

Length-extension prevention

Built-in customization strings

MAC mode

How does SequenceHash work?

How do I use it?

Sounds cool. What about SequenceMAC?

Some notes on key size

What about extensible output functions (XOFs)?

What if I want to write my own implementation?

Some minor caveats

Sunrise - James' Coffee Blog

I Was a Guest on The Pen Addict - Robb Knight • Posts • Atom Feed

My Inktober Setup - Robb Knight • Posts • Atom Feed

I Don’t Remember the Last Time I Checked Mastodon - Kev Quirk

What Now?

2026-10-01 10:35: This site is the most fun I've had in a while. Destroy any website! https://destroy.spritefusion.com/ - Kev Quirk

IndieWeb Fiction Carnival September 2026 - Moonlight - Joel's Log Files

We are always three

Afterword

AI as trebuchet - destructured

Expanding my music pipeline - Posts feed

Connecting things

Aligning metadata

Edge cases

One Year - Kev Quirk

Are you a smartwatch "power user"? - Terence Eden’s Blog

Negotiating the burden - destructured

SBS Zoom sessions cancelled - Johnny.Decimal

here, something - James' Coffee Blog