Latest Posts (20 found)

Is anyone still using Emacs?

In a recent discussion at the orange site sparked by the Emacs 31 Is Around the Corner: The Changes I’m Already Daily Driving article, people were asking themselves “Is anyone still using Emacs?” and then providing their own perspective. For me, the answer is a resounding yes… but the interesting part is that I’m not still using Emacs: I’m actually using Emacs again . And instead of burying my answer to the opening question in a long discussion thread, I thought I’d explain my journey with and without Emacs for the last… almost 30 years. At the end, I’ll unveil the specific feature that I feel gives me superpowers and that keeps me hooked. Show your support for this publication by subscribing. It’s free if you want it to be! I got into Linux around 1997 via Caldera OpenLinux 1.1. Before then, I had extensively played with Borland Turbo C++ and Visual Basic as a kid so I was heavily accustomed to those fancy IDEs that we lost . As I got into Linux and found myself in an alien world, I had to buy a couple of introductory books. Yes, books, the printed kind—because that’s how we had to learn new stuff before. Both books talked about Vim and Emacs and presented them as the advanced choices. I found this strange because the IDEs I had used before seemed more complete, but I, being a Windows renegade for some reason, charged ahead. I learned the basics of both editors and went through their tutorials at different times. The two old books I used to learn Linux back in the day, open to show their Vim and Emacs introductions. Since then and until roughly 2015, I flip-flopped between Vim and Emacs. At times I used one, and at times I used the other. I favored Emacs for long-running coding sessions but Vim excelled at my pkgsrc work where I had to edit tens of different files in quick succession. Even though Vim and Emacs worked well for me, I missed something. Language integration was poor so I was tempted by the more modern editors that everyone was touting, and especially so as I moved to macOS. I tried a bunch, like the now-defunct Atom and Brackets , but they all felt brittle and overwhelming: they had too many features, too many settings. And then, VSCode arrived in 2015. As I took it for a test drive, it “felt right” from the get-go. It looked modern, was relatively small, and its plain and simple settings editor—read: just a JSON file because there were no settings panels yet!—made me feel like I was in control. I could understand this modern editor and easily tune it to my needs. Soon after, I started learning Go and then Rust, and VSCode’s integration with their corresponding LSPs made that process so much easier: code auto-completion and real-time error highlighting sped up my learning significantly. I stuck with VSCode for these languages and slowly phased Emacs out. I was sold. During that time period, I was also working on Bazel—a Java project—at Google and the natural choice for it was IntelliJ. I had tried to use Emacs for Java development at some point, but IntelliJ was (and still is) so good that it was the only realistic choice. My usage of VSCode with its Vim plugin continued through my short stint at Microsoft, where I was working on a C++ codebase and had to connect to remote Windows boxes. Most people used RDP to work on the remote machine “directly”, but I couldn’t stand that workflow: I very much preferred running VSCode on my desktop and using SSH to connect to the remote machine, which is something that VSCode does very well. And then… I moved to Snowflake in 2022 where development used to happen inside an ancient Linux VM and where my day-to-day job was to write shell scripts and Bazel build files: neither VSCode nor IntelliJ were going to save me here, and as I mentioned earlier, I hate the feeling of working within the constraints of a “remote” graphical environment. So my instinct was to go back to SSH and connect to the local VM with it. As I did that, I needed an editor for long work sessions, and the old and trusty Emacs was there waiting for me. But this time around, I didn’t have the patience to set it up. You see: I had accumulated hundreds of lines in my file over the years without understanding much about them, and I wanted to throw it all away and start over… but it all felt like too much work. Maybe destiny brought Doom Emacs my way at the right time. Stock Doom Emacs screenshot from the project's website. You see, Doom Emacs is an Emacs “distribution” where someone has gone through the pain (or joy, I won’t judge) of configuring Emacs from the ground up. More specifically, Doom Emacs offers sane defaults, predefined language integrations, and an experience that welcomes ex-Vimers. It doesn’t claim to be an IDE… but it feels like one to me. Once I set it up, I experienced déjà-vu: Emacs felt right just like VSCode did in 2015. All of a sudden, lots of Emacs features became discoverable via interactive popup menus accessible behind space-based shortcuts that don’t destroy your wrists, and coexisting with the same Vim-style key bindings that I had grown so used to. But what’s more: the configuration felt simple and understandable, spread across just three trivial files: to specify global settings like the theme or the fonts to use, to select which Doom-specific modules need to be enabled, and to install non-Doom packages. The defaults for these files are reasonable, with plenty of comments to configure the few details you might want to tune. With this new setup, I have had the best Emacs experience ever. Thanks to the advances in LSPs (for which we have to thank VSCode) and modern features like tree-sitter, Emacs now feels like an IDE: I get proper language integration for most languages I have to deal with. And the absolute killer feature for me is that I get the exact same development environment no matter what machine I need to work on. It doesn’t matter if it is a MacBook or a Linux laptop, or if I’m connecting to a Linux cloud workstation or even my own FreeBSD server: all I need is a shell, tmux, and Emacs, and I am equally productive. This, to me, is really valuable because I tend to work on a variety of machines and muscle memory pays off. If you research Doom Emacs online, you will find people “complaining” that “it does too much”. And that’s true: it does, which is why I find it so useful. But I often wonder if I could cut things down because someday I’d like to learn more about Emacs. This is especially true now that I see many modern third-party modules “graduating” and becoming part of the stock package. For those reasons, I’ve recently been tempted to try the Bedrock or Emacs Solo distributions. However… the activation energy required to make the switch is pretty damn high. And if I decided to go that route, well, I’d still question myself for not truly going all the way to “raw” Emacs. And before closing, a related thought: I can’t quite comprehend how Emacs becomes transformative for people due to its Elisp backing. Sure, I could implement more logic and workflows within Emacs, but I already do “everything” with ease in the shell via scripts—and scripts feel more Unix-y because “Unix is my IDE”. I actually don’t like how Org mode and Magit are “locked” behind Emacs instead of being standalone applications. I’m surely missing something, but I’m not quite sure what it is… So coming back to the question that opened the article: yes, I still use Emacs, and it has become even more important to me than it was in the past due to my need to work on disparate remote machines all the time. Now the questions for you are: do you “still” use it too? What distribution, if any? How does Emacs transform your workflows? Now that you have made it this far, consider subscribing and/or sharing this article in your favorite social platform for further discussion! The two old books I used to learn Linux back in the day, open to show their Vim and Emacs introductions. Since then and until roughly 2015, I flip-flopped between Vim and Emacs. At times I used one, and at times I used the other. I favored Emacs for long-running coding sessions but Vim excelled at my pkgsrc work where I had to edit tens of different files in quick succession. The switch to VSCode and IntelliJ Even though Vim and Emacs worked well for me, I missed something. Language integration was poor so I was tempted by the more modern editors that everyone was touting, and especially so as I moved to macOS. I tried a bunch, like the now-defunct Atom and Brackets , but they all felt brittle and overwhelming: they had too many features, too many settings. And then, VSCode arrived in 2015. As I took it for a test drive, it “felt right” from the get-go. It looked modern, was relatively small, and its plain and simple settings editor—read: just a JSON file because there were no settings panels yet!—made me feel like I was in control. I could understand this modern editor and easily tune it to my needs. Soon after, I started learning Go and then Rust, and VSCode’s integration with their corresponding LSPs made that process so much easier: code auto-completion and real-time error highlighting sped up my learning significantly. I stuck with VSCode for these languages and slowly phased Emacs out. I was sold. During that time period, I was also working on Bazel—a Java project—at Google and the natural choice for it was IntelliJ. I had tried to use Emacs for Java development at some point, but IntelliJ was (and still is) so good that it was the only realistic choice. My usage of VSCode with its Vim plugin continued through my short stint at Microsoft, where I was working on a C++ codebase and had to connect to remote Windows boxes. Most people used RDP to work on the remote machine “directly”, but I couldn’t stand that workflow: I very much preferred running VSCode on my desktop and using SSH to connect to the remote machine, which is something that VSCode does very well. Back to (Doom) Emacs And then… I moved to Snowflake in 2022 where development used to happen inside an ancient Linux VM and where my day-to-day job was to write shell scripts and Bazel build files: neither VSCode nor IntelliJ were going to save me here, and as I mentioned earlier, I hate the feeling of working within the constraints of a “remote” graphical environment. So my instinct was to go back to SSH and connect to the local VM with it. As I did that, I needed an editor for long work sessions, and the old and trusty Emacs was there waiting for me. But this time around, I didn’t have the patience to set it up. You see: I had accumulated hundreds of lines in my file over the years without understanding much about them, and I wanted to throw it all away and start over… but it all felt like too much work. Maybe destiny brought Doom Emacs my way at the right time. Stock Doom Emacs screenshot from the project's website. You see, Doom Emacs is an Emacs “distribution” where someone has gone through the pain (or joy, I won’t judge) of configuring Emacs from the ground up. More specifically, Doom Emacs offers sane defaults, predefined language integrations, and an experience that welcomes ex-Vimers. It doesn’t claim to be an IDE… but it feels like one to me. Once I set it up, I experienced déjà-vu: Emacs felt right just like VSCode did in 2015. All of a sudden, lots of Emacs features became discoverable via interactive popup menus accessible behind space-based shortcuts that don’t destroy your wrists, and coexisting with the same Vim-style key bindings that I had grown so used to. But what’s more: the configuration felt simple and understandable, spread across just three trivial files: to specify global settings like the theme or the fonts to use, to select which Doom-specific modules need to be enabled, and to install non-Doom packages.

0 views

Search Is Broken

I was listening to Late Night Linux 390 during my evening walking with the pooches tonight, and they were talking about (among other things) Kagi search . I've tried Kagi myself, but ultimately cancelled my subscription as I didn't really see the point in paying for it when I could get similar results with DuckDuckGo . This isn't because DDG or Kagi are inherently bad, it's because no matter which service you use, the web has been SEO'd to within an inch of its life, so we're fucked either way. That's why I stopped using Kagi as I didn't see the point in paying $10/month for a service that can't fix the web despite having some interesting options to help filter the noise. What I've started doing instead is to use DDG for simple queries that I can quickly and easily get the answer to. For anything more complex, I go to my LLM of choice (currently Gemini) and I ask the question there. This is because it saves me a tonne of time sifting through all the SEO crap, and I can ask follow up questions too. Win/win. Thanks for reading this post via RSS. RSS is ace, and so are you. ❤️ You can reply to this post by email , or leave a comment .

0 views

Full Page Paralysis

You’ve probably heard the term. It’s meant to convey how difficult it can be to start something. “Blank page paralysis”. But for my money, beginning is easy. Finishing is the hard part. In software, they call it “the last 90%”. In logistics, they call it “the last mile”. It’s that final stretch that’s disproportionately hard. Finishing makes something real and finite, subject to judgment. As I near completion, there’s a little voice in my head that says, “As long as it’s unfinished, there’s nothing wrong with it. It’s still potentially perfect!” I don’t struggle with blank page paralysis. But I am paralyzed in the face of a full page ready for publishing. Reply via: Email · Mastodon · Bluesky

0 views

favorite re:publica 26 talks - part 1

Sadly couldn't attend re:publica 26, but the talks have been recorded and uploaded on YouTube. If you don't know: It's a conference in Germany with workshops and talks that deal with internet topics, specifically digital rights, media culture, online presences like blogs or social media, and our general information society. So I watched many of the uploaded talks by now, and here is part 1 of my favorites! Initially, I wanted to do one post, but it's getting way too much/long, and I'm dragging my feet watching the rest I planned to. Most of these talks are in German, some are in English, but I guess you can also use YT's auto dub feature (which I find horrible, but has become a bit better lately, as far as I can tell from when it was suddenly turned on). Let's start! OpenClaw - Anatomy of the Wave - great talk about AI agents, how to set one up, and interesting use cases. Kinda sold me on at least going through the setup process, especially as one reader once inspired me to give open source local models a try. Interesting tidbits: The idea of letting an employee close to retirement use an agent so it will save all the knowledge that will otherwise be lost or won't be covered in onboarding of a replacement; anti-distill tech, that masks your skills and outputs so that models cannot be trained to replace you; the theory that as more and more people will talk with AI, we will go back to a predominately oral culture, worse grammar and writing (as AI will understand anyway, even with mistakes), and potentially affecting how we talk to each other; the appeal to build your own agent before the big players in the AI space barter over you and your data, and so that you are independent from platform capitalism. On Counter-Power (with Arne Semsrott) - absolutely banger talk, my favorite. I love Arne, I also bought his latest book. Interesting tidbits: A lot of INSA studies about public opinion/voting that show off the AfD's success in Germany are paid for by BILD and NIUS, and the INSA CEO has a past of supporting the AfD and other far-right and conservative groups; the %s of AfD in those polls looks scary, but when compared to the last election and how many groups did vote for a Bürokratieabbau for power and money, but the most vulnerable ( Bürgergeld/Grundsicherung , Immigration), get more and more of it; political and civic participation needs to be fun and enjoyable! Young, blonde, right-wing... & AI-generated is a talk about how many prominent rightwing personalities online (that rightwing politicians even interact with and platform on their account) are AI-generated, especially young, blonde white women. AI makes it easier to produce more polished content; even when we consider it slop, it is polished in a specific way that resembles high quality marketing stuff that AI is trained on. That makes it easier for rightwingers to churn out hard-hitting images and content of their fabricated reality that their audience laps up, and they especially focus on decline porn , which generates attention, money and power through the fantasy that we are close to a complete collapse etc. Ordinary media and their contribution to the comeback of fascism talks about how false neutrality in the biggest reputable/respectable news media has contributed to the rise of fascism. Everything is "debatable" or "controversial", "critics say" what they don't directly want to say, and therefore outsource Machtkritik onto third parties. One great example: NYT wrote "Critics complain that Italy's Government is interfering in the arts" but it actually was, as was explained in the text, so the title should have just said Italy's government is interfering in the arts. This trick gets used like a shield to blame a view on critics instead of standing by what they write. Tagesschau platforms BILD and NIUS like they are respectable platforms just to play a "both sides equally" game, false dichotomies get created for outrage and clicks when there is a more nuanced view they do not offer because it would actually involve journalistic work of contextualizing what politicians say with facts. Trumps unhinged tweets get sanitized, normalized and softened by news by breaking them down into "giving Iran more time to open the Strait" as if it was a respectable position. The Authoritarian Stack with Francesca Bria. She's showing stuff from the Authoritarian Stack and Euro Stack websites, explaining how much tech oligarchs are building and controlling the essential systems of our modern society; social media, office software, chips, internet, raw materials etc. while they are building a post-democratic world. They embed themselves into states and governments through procurement, venture capital, and personnel pipelines; supply chains and dependencies are weaponized, bottlenecks become goldmines (land, power, chips, mines, data centers) and political alignment with Washington becomes a requirement to access advanced compute. Interesting tidbits: Ideology steers the Venture Capital, which funds the companies, which send people off into government positions (State Capture) which leads to Regulation/Deregulation in their favor, and they get Gov Contracts which lets them build Infrastructure. We all pay for it via taxes, because those get invested when government buys their products (esp around immigration control, war, etc.); Marc Andreessen spent more on the election than Soros and Musk; General Matter reactors are the first privately owned uranium enrichment plant in America, Thiel sits on the board, 900 million contract; every year over 2 trillion euros of public EU procurement go to fund our dependency. Digital arms race (with Michael Kolain) covered whether we are in a digital arms race, the issues in it, and how we might get out. Old terms and concepts like disarmament don't work anymore, as these AI systems are dual use; spending in AI is also investing into AI warfare because of this. This means at some point, since systems and countries can no longer be disarmed, there is always the threat of attack, a silent war that never ends, a hyperwar that is unparalleled in speed and scale. Mirjam Walser – Unheard of! AI, animals, and the question of whose interests count is a great presentation on the animal rights aspects of it all. AI is promised to increase animal welfare, but it is a ruse of the big players in animal agriculture to optimize productivity and profitability. The goal is completely autonomous mass killing in giant meat plants, no humans needed. Interesting to note: Anthropic is, so far, the only company whose guidance includes respecting animals and all sentient beings. Trust in the AI Era: How does digital information remain credible? says that we are going through a paradigm shift in which we do not need to ask whether a picture is real, but instead asking ourselves where it comes from, who made it and what got changed. Also, interesting facts around content credentials; some cameras in Samsung and Pixel phones, as well as some Lyca model, cryptographically sign an image during the shot so it is known it was actually physically taken ("real"). Different approaches taken/different orgs around it are C2PA, CAI, CR. There are different approaches to both integrity and identity layers of this confirmation. Manipulation will be a daily thing, but we need visible signs and control so we can choose how to engage with it. High time for sexual media literacy covers digital sexuality (Digisexualität, Mediensexualität) for everyone, but especially teens. It makes clear that it's not only always about porn or porn websites; people also use the internet for sexual education, flirting and sexting with each other (or with bots) over social media platforms and games, exploring sexuality and finding validation from other sexual minorities, finding each other to have sex in real life, seeing thirst traps on the feed, etc. and unfortunately, they also get sexually harassed, groomed, deepfaked, and there is (new term for me!) Sharegewalt ('share violence', non-consensual sharing of nudes to other parties). Nowadays, children come into contact with sexual media at 11 years old on average; analog consensual sexual experiences tend to happen between 14-19, where most people report having their first intercourse at 19. This used to be earlier for past generations. Digital sex becomes a practice range for analog sex nowadays, which makes sense, as digital no's are easier than real life no's, and digital experiences can be paused or stopped easily. The big point is: It is important for teens to be able to find ways to cope with their changing, sexualized bodies, to experience themselves as a sexual being and find out what they like, see their effect on others, test their desires and how it is to generate sexual attention, and find out where they are on the gender binary (or outside of it). It's especially important for queer people, disabled people, abused people, socially anxious people or people who are surveilled a lot at home. We should not think of teens as passive victims to sexual content, but as consumers, and continue improvements in sex education, and expand it to teaching media competence around porn and sexting (how to keep yourself safe, how to draw boundaries, detect cybergrooming, knowing you have legal rights etc.). Classism in Digital Spaces - I really struggled not to cry watching this one because it hits close to home. You're not only confronted with different economic realities offline, but also online, where everyone shares their highlight reel and makes their life look more luxurious. It can quickly feel like you're the only one struggling, or the only one with an upbringing in poverty. As a poor person, you are shamed, and people who are more well-off than you refuse to believe your stories, and then when they feel guilty for earning more, they project that onto you, and shame you for making them feel bad. They act like having money is so hard and a burden that was placed on them, or as if they should not pay more of a collective bill if they also earn more. It is also staggering just how many people do poverty cosplay both online and in real life; their family has been comfortably middle class all their life, yet they somehow co-opt poverty discourse as if it affected them. I get mad when I interact with someone in that way and then later find out their family has multiple houses, for example. People like that don't know how good they have it; despite Germany being one of the richest countries, every fourth child is growing up in poverty by now. So many of my friends struggle to find jobs, and also rely on Bürgergeld/Grundsicherung , and for them it's like being in an abusive relationship. This huge, powerful entity gives you a very limited amount of money while degrading you, insulting you, and making you jump through hoops trying to prove you are not guilty of something , and there is nothing you can do about it. You can't evade it, or can't break out of it, you can't defend yourself. You are forced to endure it until you can find a job, which could be next week or in 5 years. You're living under constant threat of losing everything, and are expected not to be a fucking nervous wreck during it? Next time you read about how a high percentage of people getting benefits isn't looking for a job, remember that this includes minors, people close to retirement who don't get hired due to their age, disabled people, people doing care work for the children and elderly in their family, people who already work a low-income job and get the benefits as supplement, and more. Defeating digital corporations with class action lawsuits - collective legal action like that is new in the EU (since 2020), and this video explains the different kind of options and what they are used for. I will not bore you with legal details, but it was very enlightening for me! Includes real life example of class actions against X, TikTok, Amazon and more. Sorry, not sorry – The Art of (Not) Apologizing in Public - very helpful for me as a person who struggles to understand apologies and what makes a good one, and why social media apologies are the way they are. This may sound odd, but for most of my life so far, I just never understood what was expected of me when I was made to apologize, and what it is for. I often don't regret any behavior I know I am supposed to apologize for, and in many contexts while growing up, just did it because I knew it was the "right" thing to do, without actually feeling remorseful or wrong about what I did (nowadays, I apologize when I feel genuinely remorseful). Apologies by others unfortunately give me absolutely nothing and don't resolve anything for me emotionally (the result of growing up with people who apologized to me doing the thing they apologized for again and again, or abusers not apologizing to me ever, and also me being forced to apologize when I didn't want to, I guess, which made it all feel like a fake performance and scam), so I have a very limited view of what others actually feel about it. I appreciate this deep dive into what an apology is, what it is good for, and why some people apologize while others don't. The Future of Human-Machine Relationships was cool to watch because it's led by an actual researcher summarizing her studies on how humans interact with AI, what it means to them, what influences it, and the range of answers to some of the research questions. She makes clear that AI should be a bridge into the real world, not a wall, and not an escape. Related talk: When AI simulates consciousness , about how pareidolia and the frictionless, sycophantic design of the big GenAI aids the humanization of them. LLMs as they are publicly available right now are a mass social experiment. ... but there are many, many, many, maaaaany more videos and talks that happened, so feel free to check out the rest and see if you find anything you like! Part II hopefully coming soon. Reply via email Published 19 Jun, 2026 OpenClaw - Anatomy of the Wave - great talk about AI agents, how to set one up, and interesting use cases. Kinda sold me on at least going through the setup process, especially as one reader once inspired me to give open source local models a try. Interesting tidbits: The idea of letting an employee close to retirement use an agent so it will save all the knowledge that will otherwise be lost or won't be covered in onboarding of a replacement; anti-distill tech, that masks your skills and outputs so that models cannot be trained to replace you; the theory that as more and more people will talk with AI, we will go back to a predominately oral culture, worse grammar and writing (as AI will understand anyway, even with mistakes), and potentially affecting how we talk to each other; the appeal to build your own agent before the big players in the AI space barter over you and your data, and so that you are independent from platform capitalism. On Counter-Power (with Arne Semsrott) - absolutely banger talk, my favorite. I love Arne, I also bought his latest book. Interesting tidbits: A lot of INSA studies about public opinion/voting that show off the AfD's success in Germany are paid for by BILD and NIUS, and the INSA CEO has a past of supporting the AfD and other far-right and conservative groups; the %s of AfD in those polls looks scary, but when compared to the last election and how many groups did vote for a Bürokratieabbau for power and money, but the most vulnerable ( Bürgergeld/Grundsicherung , Immigration), get more and more of it; political and civic participation needs to be fun and enjoyable! Young, blonde, right-wing... & AI-generated is a talk about how many prominent rightwing personalities online (that rightwing politicians even interact with and platform on their account) are AI-generated, especially young, blonde white women. AI makes it easier to produce more polished content; even when we consider it slop, it is polished in a specific way that resembles high quality marketing stuff that AI is trained on. That makes it easier for rightwingers to churn out hard-hitting images and content of their fabricated reality that their audience laps up, and they especially focus on decline porn , which generates attention, money and power through the fantasy that we are close to a complete collapse etc. Ordinary media and their contribution to the comeback of fascism talks about how false neutrality in the biggest reputable/respectable news media has contributed to the rise of fascism. Everything is "debatable" or "controversial", "critics say" what they don't directly want to say, and therefore outsource Machtkritik onto third parties. One great example: NYT wrote "Critics complain that Italy's Government is interfering in the arts" but it actually was, as was explained in the text, so the title should have just said Italy's government is interfering in the arts. This trick gets used like a shield to blame a view on critics instead of standing by what they write. Tagesschau platforms BILD and NIUS like they are respectable platforms just to play a "both sides equally" game, false dichotomies get created for outrage and clicks when there is a more nuanced view they do not offer because it would actually involve journalistic work of contextualizing what politicians say with facts. Trumps unhinged tweets get sanitized, normalized and softened by news by breaking them down into "giving Iran more time to open the Strait" as if it was a respectable position. The Authoritarian Stack with Francesca Bria. She's showing stuff from the Authoritarian Stack and Euro Stack websites, explaining how much tech oligarchs are building and controlling the essential systems of our modern society; social media, office software, chips, internet, raw materials etc. while they are building a post-democratic world. They embed themselves into states and governments through procurement, venture capital, and personnel pipelines; supply chains and dependencies are weaponized, bottlenecks become goldmines (land, power, chips, mines, data centers) and political alignment with Washington becomes a requirement to access advanced compute. Interesting tidbits: Ideology steers the Venture Capital, which funds the companies, which send people off into government positions (State Capture) which leads to Regulation/Deregulation in their favor, and they get Gov Contracts which lets them build Infrastructure. We all pay for it via taxes, because those get invested when government buys their products (esp around immigration control, war, etc.); Marc Andreessen spent more on the election than Soros and Musk; General Matter reactors are the first privately owned uranium enrichment plant in America, Thiel sits on the board, 900 million contract; every year over 2 trillion euros of public EU procurement go to fund our dependency. Digital arms race (with Michael Kolain) covered whether we are in a digital arms race, the issues in it, and how we might get out. Old terms and concepts like disarmament don't work anymore, as these AI systems are dual use; spending in AI is also investing into AI warfare because of this. This means at some point, since systems and countries can no longer be disarmed, there is always the threat of attack, a silent war that never ends, a hyperwar that is unparalleled in speed and scale. Mirjam Walser – Unheard of! AI, animals, and the question of whose interests count is a great presentation on the animal rights aspects of it all. AI is promised to increase animal welfare, but it is a ruse of the big players in animal agriculture to optimize productivity and profitability. The goal is completely autonomous mass killing in giant meat plants, no humans needed. Interesting to note: Anthropic is, so far, the only company whose guidance includes respecting animals and all sentient beings. Trust in the AI Era: How does digital information remain credible? says that we are going through a paradigm shift in which we do not need to ask whether a picture is real, but instead asking ourselves where it comes from, who made it and what got changed. Also, interesting facts around content credentials; some cameras in Samsung and Pixel phones, as well as some Lyca model, cryptographically sign an image during the shot so it is known it was actually physically taken ("real"). Different approaches taken/different orgs around it are C2PA, CAI, CR. There are different approaches to both integrity and identity layers of this confirmation. Manipulation will be a daily thing, but we need visible signs and control so we can choose how to engage with it. High time for sexual media literacy covers digital sexuality (Digisexualität, Mediensexualität) for everyone, but especially teens. It makes clear that it's not only always about porn or porn websites; people also use the internet for sexual education, flirting and sexting with each other (or with bots) over social media platforms and games, exploring sexuality and finding validation from other sexual minorities, finding each other to have sex in real life, seeing thirst traps on the feed, etc. and unfortunately, they also get sexually harassed, groomed, deepfaked, and there is (new term for me!) Sharegewalt ('share violence', non-consensual sharing of nudes to other parties). Nowadays, children come into contact with sexual media at 11 years old on average; analog consensual sexual experiences tend to happen between 14-19, where most people report having their first intercourse at 19. This used to be earlier for past generations. Digital sex becomes a practice range for analog sex nowadays, which makes sense, as digital no's are easier than real life no's, and digital experiences can be paused or stopped easily. The big point is: It is important for teens to be able to find ways to cope with their changing, sexualized bodies, to experience themselves as a sexual being and find out what they like, see their effect on others, test their desires and how it is to generate sexual attention, and find out where they are on the gender binary (or outside of it). It's especially important for queer people, disabled people, abused people, socially anxious people or people who are surveilled a lot at home. We should not think of teens as passive victims to sexual content, but as consumers, and continue improvements in sex education, and expand it to teaching media competence around porn and sexting (how to keep yourself safe, how to draw boundaries, detect cybergrooming, knowing you have legal rights etc.). Classism in Digital Spaces - I really struggled not to cry watching this one because it hits close to home. You're not only confronted with different economic realities offline, but also online, where everyone shares their highlight reel and makes their life look more luxurious. It can quickly feel like you're the only one struggling, or the only one with an upbringing in poverty. As a poor person, you are shamed, and people who are more well-off than you refuse to believe your stories, and then when they feel guilty for earning more, they project that onto you, and shame you for making them feel bad. They act like having money is so hard and a burden that was placed on them, or as if they should not pay more of a collective bill if they also earn more. It is also staggering just how many people do poverty cosplay both online and in real life; their family has been comfortably middle class all their life, yet they somehow co-opt poverty discourse as if it affected them. I get mad when I interact with someone in that way and then later find out their family has multiple houses, for example. People like that don't know how good they have it; despite Germany being one of the richest countries, every fourth child is growing up in poverty by now. So many of my friends struggle to find jobs, and also rely on Bürgergeld/Grundsicherung , and for them it's like being in an abusive relationship. This huge, powerful entity gives you a very limited amount of money while degrading you, insulting you, and making you jump through hoops trying to prove you are not guilty of something , and there is nothing you can do about it. You can't evade it, or can't break out of it, you can't defend yourself. You are forced to endure it until you can find a job, which could be next week or in 5 years. You're living under constant threat of losing everything, and are expected not to be a fucking nervous wreck during it? Next time you read about how a high percentage of people getting benefits isn't looking for a job, remember that this includes minors, people close to retirement who don't get hired due to their age, disabled people, people doing care work for the children and elderly in their family, people who already work a low-income job and get the benefits as supplement, and more. Defeating digital corporations with class action lawsuits - collective legal action like that is new in the EU (since 2020), and this video explains the different kind of options and what they are used for. I will not bore you with legal details, but it was very enlightening for me! Includes real life example of class actions against X, TikTok, Amazon and more. Sorry, not sorry – The Art of (Not) Apologizing in Public - very helpful for me as a person who struggles to understand apologies and what makes a good one, and why social media apologies are the way they are. This may sound odd, but for most of my life so far, I just never understood what was expected of me when I was made to apologize, and what it is for. I often don't regret any behavior I know I am supposed to apologize for, and in many contexts while growing up, just did it because I knew it was the "right" thing to do, without actually feeling remorseful or wrong about what I did (nowadays, I apologize when I feel genuinely remorseful). Apologies by others unfortunately give me absolutely nothing and don't resolve anything for me emotionally (the result of growing up with people who apologized to me doing the thing they apologized for again and again, or abusers not apologizing to me ever, and also me being forced to apologize when I didn't want to, I guess, which made it all feel like a fake performance and scam), so I have a very limited view of what others actually feel about it. I appreciate this deep dive into what an apology is, what it is good for, and why some people apologize while others don't. The Future of Human-Machine Relationships was cool to watch because it's led by an actual researcher summarizing her studies on how humans interact with AI, what it means to them, what influences it, and the range of answers to some of the research questions. She makes clear that AI should be a bridge into the real world, not a wall, and not an escape. Related talk: When AI simulates consciousness , about how pareidolia and the frictionless, sycophantic design of the big GenAI aids the humanization of them. LLMs as they are publicly available right now are a mass social experiment.

0 views
Unsung Yesterday

“Don’t entangle emulators in infringement events that are visible from space.”

A funny and occasionally spicy 15-minute video by Nerrel from October 2024 about some of the nuances and legal fights surrounding Nintendo’s fight with community-made Nintendo emulators: = 2x) and (width >= 700px)" srcset="https://unsung.aresluna.org/_media/dont-entangle-emulators-in-infringement-events-that-are-visible-from-space/yt1-play.2096w.avif" type="image/avif"> = 3x) or (width >= 700px)" srcset="https://unsung.aresluna.org/_media/dont-entangle-emulators-in-infringement-events-that-are-visible-from-space/yt1-play.1600w.avif" type="image/avif"> The video paints Nintendo in the harsh light, highlighting their double standards and willingness to throw their corporate legal weight around just to squash the challenges before they go to court, despite court precedents ruling against them. The video also talks about software preservation – this is the part that feels very important to me – and I also learned things about piracy, DCMA, and modern video game encryption. Just to highlight the versatile value of emulation, in another corner of the emulation universe, I found this fascinating project: a web page called Yes we scan , made by George MacKerron, that promises scanning directly from the browser – for example if you have an old scanner unsupported by your modern OS. And… it actually works! It combines WebUSB with an interesting technique: Your web browser emulates a whole PC running Linux with open-source scanning software (SANE). It connects that to your scanner via WebUSB. If you are interested, the details page has more… well, details . MacKerron also wrote Printervertion that allows you to print directly from web, too, even if your operating system abandoned your vintage printer. The way I understand this, both efforts basically invite an alternative operating system that might be more supportive to take a stab at scanning or printing, and do it in a friendly and sleek way through emulation. It’s kind of incredible this is even possible. #emulation #games #hacks #hardware #youtube

0 views
Unsung Yesterday

“It’s rare that printing nothing at all is the best default behavior.”

Aanand Prasad, Ben Firshman, Carl Tashian, and Eva Parish put together Command Line Interface Guidelines for people who write command-line tools. I like that it harkens and links back to other writing, and is also pragmatic: shares good parameter-parsing libraries, commonly used options, and so on. Here are some good principles that caught my attention: Display output on success, but keep it brief. Traditionally, when nothing is wrong, UNIX commands display no output to the user. This makes sense when they’re being used in scripts, but can make commands appear to be hanging or broken when used by humans. For example, will not print anything, even if it takes a long time. It’s rare that printing nothing at all is the best default behavior, but it’s usually best to err on the side of less. By default, don’t output information that’s only understandable by the creators of the software. If a piece of output serves only to help you (the developer) understand what your software is doing, it almost certainly shouldn’t be displayed to normal users by default—only in verbose mode. Catch errors and rewrite them for humans. If you’re expecting an error to happen, catch it and rewrite the error message to be useful. Think of it like a conversation, where the user has done something wrong and the program is guiding them in the right direction. Example: “Can’t write to file.txt. You might need to make it writable by running ‘chmod +w file.txt’.” Signal-to-noise ratio is crucial. The more irrelevant output you produce, the longer it’s going to take the user to figure out what they did wrong. If your program produces multiple errors of the same type, consider grouping them under a single explanatory header instead of printing many similar-looking lines. Consider where the user will look first. Put the most important information at the end of the output. The eye will be drawn to red text, so use it intentionally and sparingly. Make it recoverable. If the program fails for some transient reason (e.g. the internet connection went down), you should be able to hit <up> and <enter> and it should pick up from where it left off. There’s a lot more inside . (The document is undated, but I believe the effort started in 2020. It seems to still be updated via GitHub , where you can also send in your suggestions.) #command line

0 views
Stratechery Yesterday

2026.25: The Stuff of Myth(os)

Welcome back to This Week in Stratechery! As a reminder, each week, every Friday, we’re sending out this overview of content in the Stratechery bundle; highlighted links are free for everyone . Additionally, you have complete control over what we send to you. If you don’t want to receive This Week in Stratechery emails (there is no podcast), please uncheck the box in your delivery settings . On that note, here were a few of our favorites this week. This week’s Stratechery video is on The iPhone’s Last Stand . Anthropic Again. Well, Fable was fun well it lasted: last Friday the Trump administration slapped export controls on the model, limiting access to U.S. citizens, leaving Anthropic no choice in the short term but to make the model unavailable. We still don’t entirely know what happened, although Occam’s Razor suggests that people still don’t really understand how AI works . Ultimately, however, the power and problem of Anthropic is the same: the company’s safety superpower is that every action it takes looks, from the outside, to be self-serving, even as the company becomes ever more convinced its motivations are pure. — Ben Thompson E-Commerce in the Age of AI. The semi-regular e-commerce summits between Ben and Michael Morton are generally an auto-rec for me, and this week’s Stratechery Interview was no exception . Morton covers the sector for Moffett Nathanson, and the conventional wisdom about the future of that space in the AI era seems to shift every six months. This week, Morton and Ben talked Shopify and its durability, OpenAI getting its butt kicked with the ChatGPT checkout experiment, milkmen in the 1960s, and a bit of Uber and Waymo at the end. Come for an information dense update on a variety of fronts, and stay for a good vibe throughout. — AS The Finals Were a Perfect 10.  The Knicks are NBA Champions for the first time in 53 years, the NBA just had its highest-ratings for an NBA Finals in 28 years, and from start to finish, the show was fantastic for casual and hardcore fans alike. We had a great time reliving all of it on this week’s Greatest of All Talk , and on Sharp Text this week , I wrote about Wemby alienating fans on and off the court, an accounting of everything I got wrong about this Knicks team, and a refreshing reminder that as maddening as pro basketball can be, certain NBA formulas will work until the end of time.  — AS Anthropic’s Safety Superpower — Anthropic’s belief in its own commitment to safety gives the company license to aggressively favor its business and even challenge the U.S. government. Fox Buys Roku, The Problem With Fox’s Smart Strategy, Streaming That Works — The market hates Fox’s acquisition of Roku, but the company is trading extraction from rights holders for leverage as a renter. The State of Fable, The Jailbreak Problem, SpaceX Acquires Cursor — The administration is very likely wrong about Fable, but that is ultimately Anthropic’s responsibility. An Interview with Michael Morton About E-Commerce in the Age of AI — An interview with Michael Morton about e-commerce and AI, including the challenges of unfalsifiable bear cases, distribution versus referal models, grocery, and autonomous vehicles. Aura and the Lack Thereof — Looking back at the NBA Finals where Victor Wembanyama became a villain, the Knicks became legends, and the NBA mattered again. Anthropic’s PR Prices and Specs Sri Lanka’s Organic Fertilizer Debacle The “Miracle” Rice The Knicks Are NBA Champions, The Most Enjoyable Title Winners Since 2010, Wemby Crashes Back to Earth The Anthropic Saga Continues, Fox and the Future of Streaming, Q&A on ChatGPT, Agentic Shopping, Autonomous Driving

0 views
Unsung Yesterday

Paste And Match Style is not the answer

Every once in a while, I stumble upon a long thread in a random corner of the internet where someone discovers Paste And Match Style, and everyone erupts in applause. “Yeah, it’s a life saver.” “I use it all the time.”“I can’t believe this isn’t the default!” Then, inevitably someone chimes in: “Oh yeah? I can show you how to make it the default.” And they explain how to wire ⌘V to use Paste And Match Style. And I always get worried seeing that. I believe this is the core problem people are bothered by before discovering PAMS – when you copy and paste from another doc, you inherit its style/​visual appearance: And Paste And Match Style, well, does what it promises: This feels nice. So, what’s the problem? The problem is that PAMS is drunk with power and flattens everything on its way: That includes: None of these are “style.” This is actual information that should not be removed. If you wire PAMS as your main ⌘V shortcut, or even if you use it occasionally, you might remove valuable data from text you’re moving around, without even noticing. (And if you do notice, the frustrating irony is that recreating the information lost in transit – for example, re-linking things one by one – is often more work than fixing the style would be.) If you are designing an app that handles rich text, here’s what I have seen others do: = 2x) and (width >= 700px)" srcset="https://unsung.aresluna.org/_media/paste-and-match-style-is-not-the-answer/7.2096w.avif" type="image/avif"> = 3x) or (width >= 700px)" srcset="https://unsung.aresluna.org/_media/paste-and-match-style-is-not-the-answer/7.1600w.avif" type="image/avif"> = 2x) and (width >= 700px)" srcset="https://unsung.aresluna.org/_media/paste-and-match-style-is-not-the-answer/8.2096w.avif" type="image/avif"> = 3x) or (width >= 700px)" srcset="https://unsung.aresluna.org/_media/paste-and-match-style-is-not-the-answer/8.1600w.avif" type="image/avif"> Have some contextual rules – for example Figma does things differently depending on whether you paste into a new text box (preserve style), or a text box that’s already filled (match formatting). (If you’re seeing some other apps doing something interesting, please let me know!) Doing the right thing won’t be easy. Books have been written about the illusion of the difference between “stylistic” and “semantic.” People use bolding for either. Others treat headlines as visual style, right aligning means something different in English than it does in Arabic, you might still have to normalize indentations, and so on. But I believe it’s necessary to put in the effort to make regular Paste work as well as humanly possible, rather than relying on people to know about the far-from-perfect ticking time bomb that is PAMS. #flow #text editing emphasis by italics or bolding bulleted and numbered lists strike-through text Do not have styles to begin with. If you use Notion, Dropbox Paper, Medium, or anything that relies on Markdown, they give you no way to customize fonts, colors, letter spacing, and so on, so regular superliteral Paste has a limited blast radius and works well: Have a very strong center of gravity toward the default style. Apple Notes does this well. Use Notes for years, paste into it from all over the world, and you might never realize it allows you to change fonts and colors. Its default Paste removes style, but it doesn’t remove any valuable information like links or bullet points. Notes also introduces a shortcutless Paste And Retain Style as a third option after a “semantic” paste (which keeps data and removes style) and PAMS (which removes everything), for those who really want to paste extremely literally: Word has Paste And Match Formatting that seems to be what Notes does by default, but it’s not the default: Help users understand the options they have more. For example, Word offers a little post-paste menu. I don’t personally love (it doesn’t have a preview + it doesn’t remember my preference + the options are scary), but it uses better-than-default language like Keep Text Only, and it protects people from the harrowing backrooms of its own Paste Special: Have some contextual rules – for example Figma does things differently depending on whether you paste into a new text box (preserve style), or a text box that’s already filled (match formatting).

0 views

Raise the ambition threshold

“Perfection is finally attained not when there is no longer anything to add, but when there is no longer anything to take away.” — Antoine de Saint-Exupéry AI gives us an unprecedented ability to add. The danger is that we begin to mistake accumulation for value. Every new system and feature adds obligations: it must be operated, secured, monitored, documented, integrated, upgraded and eventually replaced or retired. Hackers love a juicy target, even if it’s that half-forgotten service that people are unsure whether it’s safe to turn off or not. If we respond to “cheaper” software creation by producing far more software, we may accumulate obligations faster than we acquire the capacity to discharge them. Under the weight of the proliferation of software, the organization starts to sacrifice its ability to build what it will need next to react effectively to changing market conditions and opportunities. This is the dynamic described by catabolic collapse . Catabolic collapse is a theory of societal decline in which a civilization accumulates more infrastructure than it can afford to maintain. Eventually, an increasing share of its available energy and resources is consumed merely preserving what already exists. Maintenance crowds out renewal. The society begins consuming its own capital simply to continue functioning. Think of debt payments taking up ever larger amounts of the national budget, the transport budget overwhelmed by the costs of fixing too many crumbling roads and bridges. If we accept that every organization, even with AI, has a finite capacity to maintain software, then it follows that we should select carefully the software projects we commit to. I can finally work on that feature that didn’t get funded time after time. I’m going to use AI to build it in two days rather than the estimated two weeks. This is a case of lowering the value threshold and it’s a sloppy way to introduce one of the most transformational technologies in human history. You might get lucky this time, it might end up worthwhile, but then you equally might just be adding that extra bell or whistle, meanwhile your competitor is building a revolutionary new product that will blow you out of the water. AI should raise the ambition threshold for software rather than lower the value threshold. Unless you’re in a small, agile start-up, building a highly strategic product still requires a lot of cross-organizational work. Software engineers, researchers, product managers, market research and customer feedback, the list goes on. But forget all that, let’s reward our engineers (generally focused more on technology than business value) for using huge numbers of tokens to build stuff without careful evaluation of the actual ROI of the work. It’s cool that Johnny finally rewrote that backend system in Rust, or rewrote the build system, or finally implemented that feature few customers actually are willing to pay for. But what was added may have done more for increasing the maintenance costs (and reducing the ability to react to future needs) than actually creating value. Prototyping and demos are another slippery slope. Prototyping is an ideal case for AI with its ability to accelerate work. However, if the prototype represents a system that falls into the category of “previously too low-value to justify,” then the prototype is part of the same problem. It seems that in the initial euphoria at the turn of the year at seeing the new power at our fingertips, some conflated faster for cheaper, more for better. The lesson is that we should continue to apply sensible constraints to what we build. Just because we can build it doesn’t mean that we should.  The danger of using AI injudiciously is greater in large organizations, where the average worker is farther away from the customer and the business value. The more disconnected you are from the success and failure of the organization, the easier it is for tokenmaxxing to help you spend time and money on producing a lot of lower value work. Add the slopification of work and some organizations might actually see a net-negative impact. Indiscriminate token usage in the large enterprise is already showing signs of faltering as CTOs question the value of their AI usage mandates. Business is a perpetual contest for advantage. Companies that spend their new AI capabilities trimming costs and burning down backlogs may soon be leapfrogged by competitors using them to attempt what was previously too difficult, risky or ambitious. So if you find that you are finally clearing all those nice-to-haves in the product backlog, ask yourself if your team is being ambitious enough.

0 views
David Bushell Yesterday

Life is too short for lowercase ASCII

CSS is hard and it should be hard. For good reason: CSS isn’t just a complex language, it’s one of the most advanced graphics, layout, and typesetting languages available in computing. The deskilling of web dev is harming the product but, more importantly, it’s damaging our health – this is why burnout happens - Baldur Bjarnason Hard isn’t a negative label. You know what else is hard? Applying silicone sealant to waterproof bathroom fixtures. It’s hard enough that such expertise are worthy of a profession. Regardless, I decide it should be easy. I made a proper mess and my hands are now hydrophobic. Seriously, any tips applying this gunk? CSS is deceptively hard as a whole despite many of the constitute parts being simple. CSS syntax is simple (mostly). CSS properties and values are simple ( to lookup ). What is hard is deciding how to organise styles. What we like to call: CSS methodology. Every developer has their own preferred methodology. Over the years we’ve seen many notable examples published — SMACSS , OOCSS , BEM , ITCSS , CUBE — to name a few. These methodologies have several things in common: The CSS spec does not dictate methodology. You are left to bring order to chaos. The correct methodology is the one that you and your team can adhere to. Caveat: the only wrong CSS methodology is “CSS-in-JS” — fight me. Historically, I’ve used a basic BEM-like naming convention. I prefer flat specificity and a logical order to match the design hierarchy. I think component-first and avoid getting too DRY because I can’t control who is going try their hand at styling later. Modern CSS is moving too fast to settle on one methodology. Custom properties allow design tokens to be part of the system. and rules add a new depth to encapsulation. Cascade layers and the unassuming pseudo-class have all but nullified specificity wars. As CSS gets more complex, I dare say CSS is actually getting easier (for a professional). Strict methodological conventions become less important when the laws they impose can be safeguarded by the code itself. That frees us to explore more adventurous and less rigorous styles. Safe in the knowledge that any mess is more readily contained. CSS technical debt is a cheaper commodity. Some kind of CSS methodology is still necessary but breaking the rules is not the headache it used to be. Gnarly selectors are not the bane of my existence anymore. Now this is the point where you’re expecting me to announce my brand new CSS methodology with a trendy domain and a ten part TikTok series. Maybe a few practical code examples to backup my bold claims? You’re going to be very disappointed. That is not this post. I just think it’s neat to capitalise component class names like they’re proper nouns. Isn’t that fun? I find it adds clarity to a component’s scope. I even add an HTML comment after the closing tag so that source-spelunkers don’t get lost. I do plan to write a more groundbreaking thesis on CSS one day. The world is not ready for my radical ideas yet and I’ve got a bathroom to finish redecorating. Interesting tidbit from the original CSS level 1 specification (emphasis mine). CSS gives so much power to the CLASS attribute, that in many cases it doesn’t even matter what HTML element the class is set on -- you can make any element emulate almost any other. Relying on this power is not recommended, since it removes the level of structure that has a universal meaning (HTML elements). A structure based on CLASS is only useful within a restricted domain, where the meaning of a class has been mutually agreed upon. 1.4 Class as selector - Cascading Style Sheets, level 1 considered harmful! Thanks for reading! Follow me on Mastodon and Bluesky . Subscribe to my Blog and Notes or Combined feeds. Naming conventions Modular composition Cascade management Controlled specificity

0 views

Passing of the torch

If you are subscribed to People and Blogs, you might have noticed that today’s newsletter arrived from a different address. That’s because the always lovely Zach has officially become the new custodian of this series. The peopleandblogs.com domain name has been transferred, the mailing list has been migrated (from Buttondown to Buttondown), and the RSS feed has been redirected. As I wrote in a previous post , I’m gonna publish three more interviews here on the site before officially saying goodbye to the series on July 10th. But contrary to what I wrote months ago, I decided that I’m not gonna keep the interviews archived here on the blog, and instead I’ll redirect them all to their new location. Keeping them here would be obviously good for me, it’s extra traffic that comes to the site, but I don’t care about traffic, and I much prefer to send people towards Zach’s site and help the series grow that way. I’m very happy that the series will continue on, and I’m excited to see where Zach will take it. As I said to him, this is his series now, he can and should do whatever he wants with it, and I look forward to seeing it evolve over the next months and years. Thank you for keeping RSS alive. You're awesome. Email me :: Sign my guestbook :: Support for 1$/month :: See my generous supporters :: Subscribe to People and Blogs

0 views
Kev Quirk Yesterday

📝 2026-06-19 12:25: Little chicks are starting to venture out from under mum. 🐥

Little chicks are starting to venture out from under mum. 🐥 Thanks for reading this post via RSS. RSS is ace, and so are you. ❤️ You can reply to this post by email , or leave a comment .

0 views
Kev Quirk Yesterday

Proud Dad Moment

Yesterday was sports day at my kids' school, and usually it consists of us standing in a field, being baked by the sun, waiting for our kids to come on and do their couple races each. All in all, I'm only ever interested in a couple minutes of the 2.5 hours we stand there. Usually my oldest doesn't try that hard as he struggles with resilience. So if he's not clearly winning, he won't push, he'll give up. And our younger son was always a little too young and therefore uncoordinated, and usually at the back. This year was different. Our youngest tried really hard and was rapid ! He ended up winning 2 of his races and coming second in another. Great result. But the stand out was our oldest son. At the end of the day, they give out all the awards and our son won the prized sportsperson of the year award. Not the day …the year . The headteacher talked in great depth about how he is always helpful to the younger kids, how he's always a good sportsman, even if he loses, and how he's happy to share his knowledge to help others be better. This would make most parents proud, right? But for us, even more so. Our kids are adopted, and thanks to a significant amount of early neglect, our oldest has always found it impossible to share and help others. He always put himself first. That's not because he's selfish. He's actually a very kind, loving boy. It's because in those early years he had to survive and in order for him to survive it was literally him versus his siblings. What a horrendous situation to be in. Anyway, to hear that he's not only been a good sport throughout the year, but also that he's sharing and working with his teammates filled his mum and I with joy and made us so proud. My wife shed a little tear - she thinks I didn't notice, but I did. Me being the clown that I am, I shouted "WELL DONE SAUSAGE!" at the top of my voice so the whole school could hear. Everyone knows I call them the sausages so this made sure every single person on that playground saw him have his moment. What a legend. ❤️ Thanks for reading this post via RSS. RSS is ace, and so are you. ❤️ You can reply to this post by email , or leave a comment .

0 views
DHH Yesterday

European Delusions & Danish Drones

Europe is finally waking up from many decades of naive pacifism. While the continent is loath to give America credit, this is largely where it's due, as Trump has pulled back on blanket security guarantees. Well, that and a major war on its doorstep going on four years now. That's the thing about delusions. Their upkeep seems free until reality intrudes. And that reality has finally gate-crashed the European continent with all the tact and timing of a drunken sailor. So now what? "Buy, buy, buy" was what the Danish prime minister declared last year, as she committed another 50 billion kroner to buy weaponry in that year and this. But buy what and from whom? Sadly, there aren't many top European weapon and equipment makers ready, as the continent's defense industry has been starved of investment for thirty years.  As late as 2018, nearly two-thirds of European investors excluded companies involved in conventional weapons production due to ESG considerations, per Eurosif. And this has been going on since the early 1990s. As always, the best time to plant a tree was twenty years ago. The second-best time is now. And this also applies to the tech industry because the next war will depend on it more than ever. Like drones. They've become the main vector in the war in Ukraine. Fiber-optic cables have covered the battlefield like a spiderweb, and many of the recent advances on the Ukrainian side have been attributed to their superior drone operations. We need drones in Europe. Lots of them. In all shapes and sizes. Made by European companies, built on open-source platforms, and with local supply chains. And that's exactly what the Danish startup Upteko has been working on for nearly a decade, and is now ready to scale up. So I invested in Upteko. It's outside my normal, boring invest-in-what-you-know strategy of putting money in Danish SaaS startups, but also not that far away. The future of drones is as much in software as in propulsion. And I know something about that. But really, it wasn't so much about knowledge as it was motivation. And nobody has brought more of a motivating example to the tech-meets-defense question than Palmer Luckey. His Anduril company is infusing modern weapon-making with the zest and innovation of a Valley startup. It's sorely needed, and deeply inspiring. Europe needs its own Andurils. Not because it can't also continue to buy systems from the Americans, but because a good ally is self-sufficient, equally inventive, and armed to the teeth with a diverse fleet of awesome, native weapons.

0 views

Edoardo Baldi

This week on the People and Blogs series we have an interview with Edoardo Baldi, whose blog can be found at edoardob.blog . Tired of RSS? Read this in your browser or sign up for the newsletter . People and Blogs is supported by the "One a Month" club members. If you enjoy P&B, consider becoming one for as little as 1 dollar a month. Hello! I’m Edoardo, in my thirties, born near Milan (Italy) and raised in the Alps of the same region, to escape the boredom of too flat a horizon. I studied physics, first in Milan, then abroad in Switzerland, where I spent a little over four years on a PhD that convinced me academic research wasn’t for me – or so I thought, since I didn’t stray too far. In the following years I became a “research software engineer”, meaning a software developer who works closely with research. It took me a while to realize that, despite the many benefits, that work had become a routine I was taking too much for granted. Or better: I had lost sight of why I was staying there; why I kept choosing that configuration for my life. Now I’m trying to figure out if teaching the two subjects I’m most passionate about – math and physics – is what I want to do in the next chapter of my career. I can never get enough of hiking in the mountains, especially over multiple days – as long as my body agrees. And sharing an experience with other people who love the same thing is my ideal vacation. Books, writing – I don’t know how many experiments with novels and short stories I’ve done over the years – and puzzles of all kinds (including programming challenges, even though I’m a particularly slow coder) are some of the activities that can easily fill my free time. Having always loved tinkering with computers, I think I started writing random things online quite early. If I remember correctly, it was on LiveJournal or MySpace, prehistoric stuff now. I discovered WordPress during high school, following a guy from my same school who wrote ironic essays on philosophy topics. I tried to emulate that model, but I didn’t get very far as it wasn’t my thing. Years later, with some friends fond of cinema, again on WordPress, I started a collective blog where we wrote our opinions on the movies we watched, often together. The name of the blog – Sweet Sue and Her Society Syncopators – was a tribute to a classic 50s American comedy. (I’ll let you work that one out.) During my PhD, I collaborated on and managed the university cinema club’s blog. At the time, however, I also started publishing my very personal ideas on books and movies on another blog, whose name or domain I honestly don’t even remember now. I think I tried to recover something from that blog via the Wayback Machine, with no success. Fast-forward several years, I realized why none of those blogs had survived: I was writing on commission – I loved the perk of press screenings, but writing something afterwards was non-negotiable. Or I was performing for some imagined audience by covering whatever was trending, not what I actually cared about. I could say that my personal blog was born when I decided that my online space would be only a public personal journal: the only rule was to write about what interested me the most, in the way that felt most natural. This is still the reason behind my current blog. How long is it going to survive? I don’t know. It did well, so far, with ups and downs. Beyond my hiking recaps, almost everything I write starts from curiosity – a science-based question (“if I ate an apple a day for a year, how many kg of peel could I accumulate?”), something I want to understand well enough to explain, a brain teaser that sometimes keeps me awake. Since it’s often something I don’t know, a research phase almost always follows – and I admit that, sometimes, it derails my intention to write. I keep a dedicated note for each idea, where I track its evolution. When I feel like I’ve reached a conclusion of sorts, I then sketch out a structure and use it as a guide for the first draft. Curiously, all my notes are in English, but the first draft of anything I write is always in Italian. Then I translate into English, and very often rewrite some parts that don’t flow very well in the other language. And yes, I often use Claude for a final proofread: I’ve given it strict instructions on what it can and can’t touch, and how. The content is always mine, and I’m careful to keep it that way: I don’t want to end up with a voice I no longer recognize as my own. As for the tools, my personal notes live in an Obsidian vault – because they must be plain text files – and I write all my drafts almost exclusively in iA Writer. It’s been my first choice for many writing projects, at least in their early stages. One feature I particularly love is its support for authorship , without violating the plain text pact. When I sit down to write the first draft, I have only one need: to be alone in a fairly quiet environment. Honestly, I’ve never tried writing in a public place, like a café – and the few times I did write on a train, it was surely due to a deadline I couldn’t avoid. As far as I’m concerned, it’s more the act of moving through space that stimulates what I might call creative thinking – which I take to mean authentic rather than original , as in “totally new”. And I’m also convinced that the environment influences my creativity, but I couldn’t say how or why. Often I’ve only realized much later that I had visited an environment from which I returned with ideas I considered creative – whether these didn’t go very far is another, unresolved story. I think I’ve tried dozens of frameworks to create a blog, starting with the large family of static-site generators. After several attempts, intrigued by some input from Manu, I gave Kirby a chance and discovered that it met all my needs. One above all: my blog’s content must be in plain text, as I don’t want to deal with any kind of problem taking it with me, wherever it might be in the future. So, for the moment: Kirby CMS, hosted on a fairly basic server managed by Hetzner. The domain is registered on Porkbun, and the DNS is managed by Cloudflare. I’ve also written a dozen custom plugins to tweak many aspects of my website because, for me, tinkering with the mechanics of a personal blog is part of the joy of having one. I just can’t resist – and I keep telling myself “tinker less, write more”. I would probably study web design and web technologies properly from the start – I mostly stumbled into this stuff through my day job. I say this to avoid having to settle for some preconfigured service that isn’t right for me. I would love to have a domain like , but the problem isn’t availability so much as the popularity of my name. And, honestly, I’m not ready to pay $200 a year for a personal website. The maintenance costs for my blog are quite low: 4€ and something a month for the server, plus the annual cost of the domain – about 20€. Kirby CMS requires a one-time license (100€, renewed every four years), and this is the only expense I periodically re-evaluate: the moment it no longer aligns with my needs, I will have no problem planning a migration elsewhere. In fact, I’ve already done it several times as a stress test , but for now I don’t feel the need to. My website generates no revenue, nor have I ever tried to make it do so. Personally, I have nothing against monetising a personal website, provided it’s done honestly. If I were to do it, I probably wouldn’t rely on platforms like Substack – only because I like building things myself. Even today I financially support some blogs because I believe in the work of the people behind them – or to give a friend a small nudge to keep going. A good part of the blogs I follow, or like to return to from time to time, I discovered thanks to “People & Blogs” – or through “Ye Olde Blogroll” . I think it’s unlikely that anyone reading this page doesn’t know either of them; but if that’s the case, I invite you to take a look, exploring even the older, less obvious stuff. I want to mention a friend’s project, halfway between a personal blog and a photography portfolio, that I had the pleasure of contributing to . I’m very fond of it: partly for my friendship with the author, and partly because it circles a theme that has quietly followed me for years: the sense of belonging to a place, or to multiple places; the idea, the concept, the experience of what we call home . The project is “Stay Stay Stay” by Elettra Pistoni: if you’re not into reading about this topic, her pictures are well worth a look. I also think she would more than gladly welcome the opportunity for this interview, but I’ll leave the decision to those in charge. I’ve lost count of how many newsletters or feeds I’ve subscribed to over the years, and it doesn’t really matter. I’ve reached the point where the list of online content I follow consistently has no more than ten items. Among these, two blogs and a newsletter (in Italian) that I return to quite regularly, even to reread older things: I’ll take this as a cue to share a bit of what’s going through my head – two thoughts and a side project that will maybe see the light someday. Finally, a heartfelt thanks to Manu for offering me the opportunity to share a bit of myself with this community! Now that you're done reading the interview, go check the blog and subscribe to the RSS feed . If you're looking for more content, go read one of the previous 146 interviews . People and Blogs is possible because kind people support it. “Useful Fictions” by Cate Hall Julia Evans ’s blog, a trove for tech enthusiasts The newsletter “It’s Friday I’m (not) in love” , partly inspired by “Modern Love”, the New York Times’ well-known column. Whenever I feel like telling someone “I don’t have time”, I stop and remind myself that it’s almost never true. In fact, never. It’s just my fear of making a commitment, or a lack of courage to admit what I really care about. I try never to hide behind this excuse with the people I really care about, because they don’t deserve it. I’ve also written a short post about it . This could be one of my guiding tenets , because I haven’t been able to refute it yet: “Actions, not words, reveal our real values” . It’s not mine , and I often struggle to accept it myself. But I’m convinced that if we actually lived by it, we would have far more genuine and satisfying relationships with other people – in whatever sense you want to take that. Being a hiker obsessed with traveling light, I started working on an app (web only to begin with) that lets me keep track of my gear and which items I decide to bring on each trip. Dozens of these tools already exist, but this is my vision of what I’d want such an app to do. I called it “Baseweight”, and I hope to have an alpha version out in the near future. If someone is curious, the app’s future home will be at baseweight.my . And if you’d like to share your thoughts on it, don’t hesitate to reach out ! Opinions and suggestions are especially welcome at this early stage.

0 views
Andy Bell Yesterday

The logical destination of LLMs

Graze , the company that do really good stuff around AT protocol user controlled algorithms, have announced that they’re trying to “Billionaire proof inference” by creating an AI cooperative called co/core . It’s quite an interesting idea, where users share their own personal spare compute, from devices like an old MacBook, with a network of other users doing the same thing. The idea is that LLM tasks are run on each other’s machines and everyone appears to mutually benefit. The logical endpoint to this technology is that it’ll be these small, niche networks and local specialised models, used by technology enthusiasts. Add it to the pile of other “game changers” that are now predominantly used by niche groups. The economics don’t add up for the rest and that’s even while paying users/companies are still being hugely subsidised . When the real costs hit, the ROI just simply isn’t there. I’m genuinely glad to see stuff like this co/core initiative happening — it’s actually quite refreshing. I do worry about security, but it’s an experiment, just like the AT protocol was , so I expect that stuff to be earnestly ironed out by decent people. Do I personally have any interest in it though? Nah, because the stink of the tech oligarchy, environmental harms, psychological harms and being told every fuckin’ day that LLMs are the “future” will very likely never pass for me, so I can’t ever seeing me being interested in using this technology in any meaningful way. I do appreciate that people genuinely enjoy using this technology, though, so at least there is some more accessible movement away from the sweaty tech oligarchy and their infinite losses machine.

0 views
annie's blog Yesterday

Do not bargain to be loved

A gentler world begins in the way you touch your heart. Be soft with the light inside you. Caress your body with this breath. God is nothing else but the place where the sun comes up in your chest. You are the glimmering destination. You are the golden honey daubed on the bread of the ordinary. Whatever is perfect, whatever is heavenly, begins here. — Fred LaMotte Do not bargain to be loved. Do not negotiate. When love is withheld as a punishment, as a manipulation, as a means to move you in a certain direction: Do the worst and most difficult thing and quit asking for it. Withdraw your hand, put it in your pocket. Clamp your mouth shut, let your silence swell, do not ask for explanations. It's already been explained. Love is not contractual. Love does not have terms you must fulfill before you get to have it. Love exists and is made apparent in all situations where it is present. If it is not apparent — if you cannot feel it, hear it, and see it in action — it is not present. This seems like a harsh rule but it is the only rule of love. Love is not confusing. Love is clear. Love is simple. Love is obvious. Big as the sky, sturdy as a mountain. Brave and honest, tender and unrelenting. You don't have to poke around in dark corners asking, Is it here? Is it here? You don't have to dig for love until your fingers bleed. You don't have take apart some sharp-edged thing to get at the gooey love-filled center. Love doesn't hide. Love appears and stays. Love is present. When you're loved, you know it. You feel it. It opens you up. It blesses you with spaciousness and closeness, with freedom and safety, equal measures. You don't have to choose one and lose the other. Love does not offer you a half. Love is the whole. Do not bargain to be loved. Here are some things that are not love: Compliments Love may express itself in those ways. Love may give you affection, attention, all of the above. Wonderful. Love can bring you these things, but it does not hold a monopoly. Agreement can come from avoidance of conflict. Attention can come from jealousy. Affection can come from loneliness. Compliments can come from a need to please. Gifts can come from guilt. Love is not transactional. Love is not a handful of coins in your pocket, spend one here, spend one there, save some up for a rainy day. Love does not run out. Love is self-created, self-fulfilling, endless supply. Love is active generosity. Love is splendid, exorbitant kindness. Love cannot be measured or doled out in small bits, cut into smaller slices. When someone tries to love you this way, here is the explanation (take a deep breath): What they offer you is not love. They offer you something , to be sure. But it is not love. If love is what you want, don't bargain for what is not love. Some people want to love but don't know how. Or they want to get love, but don't know how to give it. You don't teach them by accepting not-love and pretending it is love. You can show them by knowing what love is and being it, best as you can: Being clear, being simple, being obvious. Not accepting half-truths or hiding. Not equating affection with love, apologies with love, attention with love. Not being pulled into transactions. Not being backed into a corner. Not making yourself smaller. Not agreeing when you don't agree. Not tolerating what you shouldn't tolerate. Clear, simple, obvious. Big and sturdy. Brave and honest, tender and unrelenting. Even when saying goodbye. Compliments

0 views
Marc Brooker Yesterday

Meet Alice. Alice is impatient.

What do you mean? Meet Alice. Alice uses your web service. Alice, like most humans, measures her time in seconds and minutes. Alice says your service is slow. You tell Alice that the mean request to your service completes in 100ms, but Alice says that her mean wait time is 1s. You’re both right. Meet Alex. Alex uses your web service. Alex, like most humans, measures his time in seconds and minutes. Alex says that when you have outages, they last a long time and he gets really annoyed. You tell Alex that your MTTR is less than 1 minute. Alex says that he sees the mean outage lasting 1 hour. Again, you’re both right. What’s going on? What’s going on is that you’re measuring time in requests, or in outages, and Alex and Alice are measuring time in seconds and minutes. When you have a long request or a long outage, Alex and Alice count that as a long time, with a heavy weight. But you only count that as one. More technically, what’s going on here is the inspection paradox . Alex and Alice don’t experience your latency distribution $f(t)$, they experience a t-weighted version of it. If you have a MTTR or mean request time of $\mathbb{E}[X]$, Alex and Alice experience $\mathbb{E}_a[X] = \frac{\mathbb{E}[X^2]}{\mathbb{E}[X]} = \mathbb{E}[X] + \frac{\mathrm{Var}(X)}{\mathbb{E}[X]}$. Most of the time they’re waiting, they’re waiting for things that take a long time. This is (roughly) how humans experience time. Let’s play with this with a little simulation. Plug in your median latency (or recovery time), and 99th percentile latency (and recovery time), we’ll fit a Gamma distribution to it, and then plot both what your service metrics see and what your customers see. Median: ms    p99: ms What your service sees (mean): – ms . What your customers experience (mean): – ms . For example, put in 30 as the mean (let’s ignore the milliseconds and pretend these are minutes for now) for a 30 minute Median TTR (i.e. in half of your postmortems you see a recovery time of $\leq 30$ minutes), and 600 in as the p99 (one in every 100 events, recovery takes 10 hours). Your MTTR is 81 minutes. Your customers experience a mean time to recovery of nearly 5 hours! There are many arguments for why tail latency (and long recovery times) are so important to understand (e.g. multiple samples ), but this is the one that I think is the least widely understood. For service times, timeout-and-retry can hide this latency some of the time (as long as the running request doesn’t hold locks or other exclusive resources). But, for recovery time, no such hiding is possible. The heaviness if the tail matters a great deal. This is also one of the reasons I don’t like trimmed measurements (like trimmed means) as a way of thinking about service latency or recovery time. They throw out some really critical context about the shape of the right tail that dominates the customer experience (the other reason is related to Little’s Law and capacity usage, which I’ve written about before ).

0 views

Datasette Apps: Host custom HTML applications inside Datasette

Today we launched a new plugin for Datasette, datasette-apps , with this launch announcement post on the Datasette project blog. That post has the what , but I'm going to expand on that a little bit here to provide the why . Datasette Apps are self-contained HTML+JavaScript applications that run in a tightly constrained sandbox hosted on your Datasette application. They can use JavaScript to run read-only SQL queries against data in Datasette, and can run write queries too if you configure them with some stored queries . Here's a very simple example and a more complex custom timeline example - the latter looks like this: Apps are allowed to run JavaScript and render HTML and CSS. They are limited in terms of access - the they run in prevents them from accessing cookies or localStorage and they also have an injected CSP header (thanks to this research ) which prevents them from making HTTP requests to outside hosts, preventing a malicious or buggy app from exfiltrating private data. Datasette Apps started out as my attempt at building a Claude Artifacts mechanism for Datasette Agent , but I quickly realised that the sandboxed pattern is interesting for way more than just adding custom apps to the interface surface and promoted it to its own top-level concept within the Datasette ecosystem. They're also a fun way to turn my multi-year experiment in vibe-coded HTML tools into a core feature of my main project! You can try out Datasette Apps by signing in with GitHub to the agent.datasette.io demo instance. Since the very first release, Datasette has offered a flexible backend for creating custom HTML apps via its JSON API. One of my earliest Datasette projects was an internal search engine for documentation when I worked at Eventbrite - it worked by importing documents from different systems into SQLite on a cron and then serving them through a Datasette instance with a custom HTML+JavaScript search interface that directly queried the Datasette API. I had client-side JavaScript constructing SQL queries, which originally was intended as an engineering joke but turned out to be a really productive way of iterating on the app! That project, combined with my experience building my HTML tools collection and my experiments with Claude Artifacts , has convinced me that adding a Datasette-style backend to a self-contained HTML frontend is an astonishingly powerful combination. Imagine how much more useful Claude Artifacts could be if they had access to a persistent relational database. That's what I'm building with Datasette Apps! Here are a few of the ideas and patterns I've figured out building this which I think have staying power. This is the magic combination that makes Datasette Apps feasible in the first place. I need to run untrusted HTML and JavaScript on a highly sensitive domain - an authenticated Datasette instance can contain all sorts of private data. The attribute lets me run that untrusted code in a way that cannot interact with the parent application - it can't read the DOM, or access cookies, or steal secrets from . It can however use and friends to load content (or exfiltrate data) from other domains. But... it turns out if you start an HTML page with a header you can set additional policies that lock down access to other domains. I was worried that malicious JavaScript would be able to update or remove that header but it turns out that doesn't work - once set, the CSP policy is immutable for the content of that frame. Having locked down those iframes to the point that they couldn't do anything interesting at all, the challenge was to open them back again such that they could run an allow-list of operations, starting with read-only SQL queries against specified databases. I built the first version of this with , which allows a child iframe to send messages to the parent window. I created a simple protocol for requesting that the parent run a SQL query - the parent could then verify it was against an allow-listed database before executing it. One of the LLM tools, I think it was GPT-5.5, suggested that on its own can be exploited if the iframe somehow loads additional code from an untrusted domain. I don't think that applies to Datasette Apps, but I also believe in defense in depth, so I had GPT-5.5 help me port to a MessageChannel() based transport instead. has the advantage that if a page navigates to somewhere else the channel closes automatically, removing any chance of executing commands sent from an untrusted external page. If you navigate to the timeline demo and search for the string you'll pull in some search results that embed images from the domain. This domain is not in the CSP allow-list, so it trips an error. Those errors are captured and transmitted back to the parent frame, where they can be displayed in a useful error log. This is meant to make hacking on apps more productive by surfacing otherwise-invisible problems. I built an experiment demonstrating that you can even turn this into a one-click-to-allow mechanism for building the CSP allow-list based on what breaks, but I haven't integrated that idea into just yet. SQL queries are also visibly logged - scroll to the bottom of the timeline page to see that in action. I want apps to be able to conditionally write to the database, but this is an even more dangerous proposition than SQL reads! My solution involves Datasette's stored queries feature, rebranded from "canned queries" and given a major upgrade in the recent Datasette 1.0a31 - work that was directly inspired by Datasette Apps. Users can create a stored write query that performs an insert or update, then allow-list that specific query for an app to use. Usage from code inside an app looks like this: I'm only just beginning to explore the possibilities this unlocks myself, but my goal is to support full read-write applications built safely as Datasette Apps. The Datasette Apps plugin has no dependency on LLMs at all, but these self-contained apps are the perfect shape to be written by a modern LLM. The create app form includes a copyable prompt at the end. This prompt has everything a model needs to know to build a new app, including the schema of any selected databases. This means you can click "copy", paste it into ChatGPT or Claude or Gemini, tell it what you need, and there's a good chance the model will spit out the code necessary to build the app. If you have Datasette Agent installed your AI assistant will also gain tools to both create new apps and edit existing ones, Claude Artifacts style. Datasette Apps started life back in April as datasette-agent-artifacts , a plugin I have since renamed to keeping only its editing tools . I built that as one of the first plugins for Datasette Agent , to help get the plugin hooks into the right shape. That first prototype was mainly built using Claude Opus 4.6 in Claude Code. When I switched track to Datasette Apps I started with a plan constructed using Codex Desktop and GPT-5.5 xhigh, based on extensive dialog and feeding in both and other prototypes I had built. Most of the work that followed stuck with Codex, but in the few short days that we had access to Claude Fable 5 I had it run a security evaluation of the product (an ability that would get it banned by the US government shortly afterwards) and it found a very real problem. I was allowing users to allow-list CSP hosts for their apps, but Fable pointed out the following attack: That's clearly unacceptable. I fixed it by restricting the ability to allow-list any domain to a new permission, which is intended just for trusted staff. Site administrators can also configure Datasette with a list of , which regular users can then select. This means you can do things like allow and your users will be able to build apps that load extra JavaScript libraries from the cdnjs CDN. I've reviewed Datasette Apps extremely closely, especially the security-adjacent parts of it. The critical sandbox and CSP configuration are based on multiple AI-assisted prototypes and tests. I'm really pleased with this initial release. Datasette is growing beyond its origins as an application for serving read-only data into a much richer ecosystem of tools for doing useful things with that data once it has been collected. Datasette's roots are in data journalism. I've always been interested in the question of what comes next after a journalist gets their hands on a giant dump of data about the world. Datasette supports exploring and publishing it. Datasette Agent adds interrogating it with AI assistance. Now Datasette Apps expands that to building custom interfaces and visualizations to help unlock the stories that are hidden within. You are only seeing the long-form articles from my blog. Subscribe to /atom/everything/ to get all of my posts, or take a look at my other subscription options . A less privileged user with permission creates an app that queries SQLite for all available tables and selects and exfiltrates all of the data to a host they had allow-listed via CSP. They then trick an administrator user with access to private data into visiting their app. ... and the app can now run queries as that user and steal their private data!

0 views
Heather Burns Yesterday

Going bla bla bla about wtf

I had a natter with David Meyer about the past fortnight in UK tech policy drama. We did this deliberately as a casual chat, as opposed to a techlaw deep dive, so don’t expect anything too heavy. (I had in fact planned to switch off my brain this summer like normal policy wonks do. So […]

0 views