Latest Posts (20 found)
Farid Zakaria Today

nixpkgs-multiverse: fast mode

“The fastest evaluation is the one that never happens.” – Sun Tzu, The Art of Evaluation nixpkgs-multiverse gives you every version of every package that ever shipped in Nixpkgs from a single flake input. Note It continues to blow my mind that this is even possible. It feels like it suddenly unlocks a new dimension of Nixpkgs, and I am still trying to understand what it means. I think this capability is a fundamental change to the way we think about Nixpkgs, and it is not just a new feature. It is a new way of thinking about the entire ecosystem. There was always a penalty at the center of it. Asking for a specific version of , such as , meant fetching the whole ~378 MB Nixpkgs tree from 2021 and evaluating it to determine the . What if we could skip that evaluation? What if we could just ask for the path directly, and have Nix fetch it from the cache if it is there? This is a common idiom if you have ever used . That requires knowing the store path upfront. nixpkgs-multiverse now has a attribute that does exactly that: it gives you the store path for every indexed version of every package. This lets you skip the download and evaluation of Nixpkgs and get the store path straight from the cache. No Nixpkgs is fetched. Nothing is evaluated. No experimental features and no needed for this to work. The complete Nix API, except for releases, works with this fast path. If you want to learn more read the docs about the feature. Every channel bump published a listing of every path Hydra built for it: , or a for back in the pre-2017 era. These files are still available, and they are the source of the multiverse index. The listing is a map from derivation name to store path. The multiverse index is a map from to the revision that shipped it. By joining the two, every historical version gets a concrete address: Knowing the path is not enough, especially in the Nix language. We need to convince Nix that a string that looks like a store path actually is a store path. exists but it is an impure function and requires to work. How do we get around this? We attach “context” to the String. Context is the invisible baggage a String carries in Nix. When you interpolate a derivation into a String, the result remembers where it came from, and that is what makes realise the dependency instead of writing a dangling path into a script. lets you attach it by hand. The identifies that “this String names a store path that must exist,” which is exactly what produces for a path already in your store, except this works for a path that is not in your store yet and is not in this evaluation’s input closure either. Loopole! 👿 We then wrap that in an attrset that resembles like a derivation and the Nix CLI is satisfied: This is tomberek ’s trick from fastpkgs , and it is an amazing trick to circumvent needing . Everything about this remains pure evaluation, and the resulting graph is gauranteed to be bit-for-bit identical to what Nixpkgs would have produced if it had been evaluated. The only difference is that we skip the evaluation of Nixpkgs itself, and instead use the store path directly. The eval path derives the address, the fast path remembers it. A “fake” ( ) derivation has no , because there is no behind it. Nothing can build it and it can only be substituted. The CLI often wants a though when you hand it a derivation attrset, so we must make sure to append the output (i.e. ): and need a real derivation. Every fake derivation carries a lazy that is the real, revision-exact derivation: In the spirit of trying to keep my index small, is empty, so there is not additional information about the package. You can still get the from the real derivation by using as well. This scheme rests on cache.nixos.org still serving thirteen-year-old paths, which thankfully it does and with the same signing key. To demonstrate that the cache is offering nearly every path that Nixpkgs ever built, I ran a census of every indexed version of every package and asked the cache if it was still alive. As of August 14 2026, all 271,187 of them are alive . All of them, down to every NAR payload file. That is 14.8 TB of unpacked software from 2013 onward, one fast command away. 1 There’s some other data on nixmultiverse.com about the census, dependency graphs and additional features. Check it out! All of this is also available via the mvs command line tool as well for offline use. I guess now there is a caveat: there is now a trick in the multiverse. It remains mostly an index, some JSON, and a behind a memo table. The clever trick is tomberek ’s, and it is three important lines. The NixOS infrastructure has never garbage collected the binary cache. It is an S3 bucket that only grows, and the bill is paid by the NixOS Foundation and its sponsors.  ↩ The NixOS infrastructure has never garbage collected the binary cache. It is an S3 bucket that only grows, and the bill is paid by the NixOS Foundation and its sponsors.  ↩

open-source Open Source performance Performance programming Programming json JSON
0 views
A Few Thoughts on Cryptographic Engineering Today

Everything is about to “go dark”

I’m coming down from spending a few days at Usenix Security, right here in Baltimore. This means that my days have been taken up with two kinds of conversation: first, explaining to colleagues why Baltimore isn’t actually like The Wire. And second: trying not to talk about AI. Here I’m going to break both of those rules. I have many worries about what AI means for our field, for various definitions of “field”. But in this post I want to focus on just one thing I’ve started worrying about, and it’s a perverse thing: specifically, I’m worried that AI is going to make software much too secure. While that doesn’t sound so bad on the surface, there’s a consequence to this. I mean something very specific: I’m concerned that U.S. intelligence and law enforcement agencies are about to go dark, meaning lose a huge portion of their capability. And that this isn’t going to be simply a problem for those agencies, but also for those of us who value computer security and privacy in general. To explain how we got here, we need to talk about recent history. Here we have a real excuse to reference The Wire, which embeds a realistic snapshot of what electronic surveillance looked like in 2002. The cops in that show are after payphones and burners, all used for voice calls. While the mobile phones were new, nothing in here would have surprised a cop from 1989. Less than a decade later, everything was different. The change started in the late 2000s with the rise of smartphones and texting. In 2010, Apple began encrypting iPhone data using a key derived from the user’s passcode, and Google followed behind them. In 2011, Apple deployed end-to-end encrypted text messaging. By 2014, WhatsApp had 600 million users worldwide, and by 2016 nearly a billion — and they were all using end-to-end encrypted messaging. The chart below gives a snapshot of how quickly the world changed between The Wire era and 2016: The FBI and law enforcement agencies noticed the trend and took it very seriously. In 2014, Director Comey announced an initiative called G oing Dark , which would launch a “ national conversation” about what providers could do — or be compelled to do — to make these new communications media legible to law enforcement and counterintelligence. In 2016, the agency stopped talking. When a terrorist attack left the FBI with the shooter’s locked iPhone, the agency ordered Apple to give them access . The company refused . What broke the stalemate — and, to some extent, ended “Going Dark” itself — was something that neither the FBI nor Apple expected. An outside company announced that there was no need for Apple’s assistance: they could simply hack the phone . The Apple v. FBI case turned out to be microcosm of the whole debate. For the next decade, law enforcement and intelligence agencies continued to ask for exceptional access backdoors. But the urgency was gone: agencies and manufacturers knew that law enforcement could purchase targeted hacking tools if they needed them badly enough. Vendors like Apple and Google played a vigorous defense, closing vulnerabilities as soon as they learned about them. But commercial offensive vulnerability hunters consistently managed to keep the edge. Anyway, that’s the history. And now it’s about to be over. In April, Anthropic announced a new model called Mythos that was optimized for software vulnerability finding. The U.S. government temporarily blocked its export, restricting it to U.S. agencies. While the ban was dramatic and made for good PR, it was mostly pointless. OpenAI , along with Chinese open-weight model labs like Z.ai and Moonshot , have since demonstrated that vulnerability finding isn’t anything that a single model can hold a monopoly on. The list of serious vulnerabilities that these models have found is getting scarier (or more impressive) by the day. Initially this might seems like good news for the offense, and for hackers in general. But I doubt it will last. Defenders are now in the process of patching every bug they can find, often with AI helping them. Entire development toolchains are being rebuilt to incorporate powerful vulnerability scanning before software reaches the testing phase. This does not mean that every bug will be found: even calculating the number of bugs in a piece of code is probably uncomputable. In the real world, it does feel likely that we’re going to hit some sort of a ceiling on the number of useful bugs, and probably we’ll hit it soon. Thus: over the next two years, major pieces of software are likely to run out of remotely-exploitable bugs. While I think this is great, for law enforcement and offensive intelligence agencies, it’s going to be a nightmare. For the first time since 2010, law enforcement might experience what it looks like to really “go dark”, across a huge category of advanced (well-maintained) devices and pieces of software. The debate over “exceptional access” mechanisms never really went away. In some places, like the UK, it actually metastasized into something worse. Here in the US it mostly went into hibernation. Some of the slowdown can legitimately be attributed to expert pushback — academics and industry engineers pointing out the risk that backdoors might be abused by the very adversaries they’re designed to protect against. But I fear that the market was just pricing supply. The destruction of the low-hanging vulnerability fruit will make law enforcement (and intelligence) agencies’ need much more acute. The demand for constructed, intentional backdoors will begin in earnest. There will be enormous pressure on industry to re-architect their systems to make their systems friendly to exceptional access. In some cases, governments will ask for these capabilities in the expectation that they’ll be useful for spying on other governments — a strategy that might have been undetectable in the pre-AI era, but that probably will be detectable now. This might result in other governments curtailing their dependence on US software. In fact, the worst part about this dynamic is that these potential new backdoors will begin primarily useful for allowing the US to weaken its own systems, which will in turn allow foreign adversaries to find new ways to attack our communications. This deliberate self-sabotage will happen just at a moment when we’re finally learning how to defend our own infrastructure. I honestly have no idea. This is not a call to action for experts to rally behind a sophisticated plan. Like so many things about the AI revolution, it’s just occurring to me that we’re on a long greasy slide to a place that will look different than where we are today. Just realizing this doesn’t mean that I have a clever plan to avoid it. In this case, we’re just going to have to hope that this time we make the right choices, for no other reason than that they’re right.

security Security ai AI
0 views
Harper Reed Today

Note #737

Denver has changed, man Thank you for using RSS. I appreciate you. Email me

culture Culture
0 views
Jim Nielsen Today

Oh Hey, It’s Not Just Me

My whole life I’ve felt like I have great eyesight (and I still do). But lately I’ve been noticing what feels like…some slippage. Nothing big. Just this feeling in the morning like, as my brain and body wake up, my vision needs to as well. The strange novelty of this phenomenon was operating in some small part of my subconscious the other day when I was scrolling the internet and come across this post from Chris Coyier : you ever get to your mid fourties and have your eyesight drop off a friggin cliff And I’m all like: And then even more people weighed in on Chris’ thread, like “Hey me too!” This is why I love the web. I continually get that feeling of, “Oh hey, it’s not just me!” On both a personal and a professional level. And for that I’m grateful. I love being able to connect with people in a way that makes me not feel so alone (or weird) in my experience of life. In a polarized digital world, it’s good to remember that the web can still draw you to folks rather than push them away. We’ve got a lot in common. Reply via: Email · Mastodon · Bluesky

ai AI programming Programming culture Culture
0 views
Stratechery Today

2026.33: The CapEx Train Keeps Rolling

Welcome back to This Week in Stratechery! As a reminder, each week, every Friday, we’re sending out this overview of content in the Stratechery bundle; highlighted links are free for everyone . Additionally, you have complete control over what we send to you. If you don’t want to receive This Week in Stratechery emails (there is no podcast), please uncheck the box in your delivery settings . On that note, here were a few of our favorites this week. This week’s Sharp Tech video is on why everyone but OpenAI and Anthropic wants open weight models. The Capital Constraint . Everyone knows we are short of AI compute. Everyone knows that we may very soon be short on power. What happens, however, if we are short on capital? If AI is as valuable as it seems, then it should pay for itself, but that hasn’t happened yet. This week Nvidia announced a new funding mechanism to tap long-duration capital; this sort of financial engineering, along with Google leading the way in tapping equity , may build the bridge to sustainable AI revenue. It also expands the blast radius of a bubble in the service of Nvidia’s threatened margins. I covered this in Nvidia’s Risky Business , as well as this week’s episode of Sharp Tech. — Ben Thompson What to Do About AI Writing? Anyone who’s been online the past few years has found themselves wondering “was written by a human or AI?” and some version of that question will probably persist in perpetuity for all of us. To that end, the EU has mandated that providers of AI systems mark all their outputs, including text, as AI-generated. Wednesday’s Update explored Anthropic’s response to that European regulation and why Ben thinks all of this is a terrible idea. We talked more about the issue on Friday’s episode of Sharp Tech , including the history of idea propagation across centuries , and the likelihood that my son will likely feel differently about AI-generated output than I do.  — Andrew S harp A Tale of Two Cites. In an article that was written 100% by a human (though proofread by ChatGPT!), this week’s on Sharp Text explored why caustic rhetoric from Mayor Zohran Mamdani is probably not enough to convince finance execs to leave New York City (even if they live in Connecticut), while Hollywood has unfortunately seen much of its filmmaking industry outsourced to neighboring states and foreign countries (as David Ellison threatens to relocate Paramount’s operations). In brief: New York is a case study in the power of network effects, while Hollywood offers a lesson in the conditions that allow those effects to be broken (and Mamdani exemplifies an irony of the DSA movement, generally).  — AS Apple Earnings, More on Amazon’s Earnings — Apple’s earnings (and stock) are limited not by memory but rather chip shortages; then, more on Amazon’s earnings and Andy Jassy’s market analysis. Nvidia’s Risky Business — Nvidia is finding new ways for its customers to raise money, and it’s expanding the risk of the AI buildout significantly. Anthropic’s Watermarking, How It (Probably) Works, Worse Than It Seems — Anthropic is adding watermarking in response to the E.U.’s AI law. It’s a terrible idea, first and foremost for philosophical reasons. New York and the Power of the Network — New York City exemplifies the power of network effects, while modern Hollywood is a reminder that they do have limits . Immersive Baseball and Frontier Models The Subsea Cables Are Listening SK hynix and the HBM Revolution Summer Top Fives: Changing Our Mind, Post-Apocalyptic Crops and Players Nvidia’s Answer to Capital Constraints, Google’s Attrition and Direction, Q&A on AI Writing, Vision Pro, Vibe Coding

Finance ai AI business Business
0 views
Unsung Today

“What actually happened was the birth of a genre in digital graphics”

A really well-produced 27-minute video from Super Splash Wave about 8-bit and 16-bit pixel art: = 2x) and (width >= 700px)" srcset="https://unsung.aresluna.org/_media/what-actually-happened-was-the-birth-of-a-genre-in-digital-graphics/yt1-play.2096w.avif" type="image/avif"> = 3x) or (width >= 700px)" srcset="https://unsung.aresluna.org/_media/what-actually-happened-was-the-birth-of-a-genre-in-digital-graphics/yt1-play.1600w.avif" type="image/avif"> What I liked about the video is that it doesn’t just revel in nostalgia, but goes deeper into some techniques and trends and details in the videogame graphics of the 1980s and the 1990s: palette limitations, palette animation , sizes of objects, dithering, parallax, small ventures into 3D, etc. It was also great to see specific changes and evolution of what from the distance of 2026 might seem like one monolithic era. The very first games used rigid grids and the assets were generally done by engineers themselves. Then, the work was split between artists doing the visuals, and engineers implementing then. Only after that, closer collaboration between engineering and artists allowed truly spectacular effects to take place, mirroring deep collaboration between UX and front-end elsewhere. #games #graphics #history #youtube

programming Programming web Web ai AI
0 views
Ed Zitron's Where's Your Ed At Today

Premium: How Much Money Does AI Need?

I’ve heard from people in the past that my articles are too long, and I wanted to start by saying that, for the most part, they’re going to stay long, because I feel like the only way for me to make my arguments is to be as specific and detailed as possible about the things I’m talking about.  Then again, sometimes it’s just because I imagine arguments against my work in my head and want to pre-empt them. Something about the AI bubble has made the boosters genuinely insane. They see these otherworldly declarations — hundreds of billions or trillions of dollars — and assume that nobody would say them in bad faith, and that the tech industry would never fail to live up to them, even though we’re barely a few years divorced from when Mark Zuckerberg burned $80 billion on the metaverse , what will one day be known as “the second-worst misallocation of capital in corporate history.” When the boosters  hear that OpenAI plans to spend $750 billion on compute costs through the end of 2030 , they shrug their shoulders and say “it’ll work it out.” When they hear that hyperscalers have $1.65 trillion in off-balance-sheet obligations and debt , they nod approvingly, saying that “these are some of the richest and most-profitable companies in the world,” and that they will “simply keep raising debt.” It’s somewhere between number-blindness and make-believe — these are such unfathomably-large sums that it’s hard for the average person to assume anything other than that nobody would sign contracts agreeing to pay them without the confidence they’d be able to do so, even though it’s all very silly. In any case, readers, I hear you , and today’s premium newsletter is going to be a shorter one, because it’s been an incredibly long week for me, including a day that started at 5AM with four different interviews — including my appearance on CNBC, which I encourage you to watch — that ended roughly 14 hours later, which means I’m a little depleted but nevertheless dedicated to you, the reader, and giving you value for your subscription. So today I’m going to be pithier, and focus on hard numbers and harder truths about the AI industry, and specifically seek to answer a question: how much does the AI industry actually need by 2030?  To be specific, I’m going to be focusing on the next three fiscal years for the companies that matter — the lead hyperscalers (Meta, Google, Microsoft, Amazon, Oracle), the two leading semiconductor firms making AI chips (NVIDIA, Broadcom), the main neoclouds (CoreWeave, Nebius, IREN, which I’ll cover in short), the main AI labs (OpenAI, Anthropic, and SpaceX) and the overall AI compute industry.  I’ve spent a great deal of time in the last few years explaining in detail why I think this will all collapse, but today’s goal is to show you, in hard numbers, exactly how much money the main players in AI need, based on consensus analyst estimates and my own research. And god damn, do they need a lot.

business Business ai AI Finance
0 views
Krebs on Security Today

Who’s Tracking You? Use This New Service to Find Out

It can be daunting to determine who’s responsible for showing ads on the websites we visit, or who’s harvesting data from the mobile apps we use every day. That information is already semi-public, but it is not easily parsed and traditionally much of it has remained walled away in the hands of large advertising platforms. Not anymore: A powerful and free new service called DecryptAds scrapes and correlates this adtech data and makes it simple to quickly learn a great deal about the entities that are tracking you. A Decryptads summary of the advertising partnerships declared by espn.com. The newly launched decryptads.com says it is constantly scraping the files that websites and apps make publicly available to disclose the companies that are permitted to run ads or collect user data. These files include: – ads.txt : all of the adtech companies and data brokers that may run ads or harvest data from the site; – app-ads.txt : entities that can harvest data from or display ads on mobile and smart TV apps; – buyers.json/sellers.json : the entities buying, selling or reselling ad inventory for a given site or app. Zach Edwards is chief research officer for DecryptAds and a threat researcher at the security company Infoblox . Edwards said he and two other founders decided the service was needed because the adtech data in these files is generally only useful when it can be cross-referenced to build a more complete picture of the advertising ecosystem for each website or app. “It’s an adtech tool but we’re trying to approach adtech from a security perspective,” Edwards said. “It’s really built for a lot of privacy and security use cases that have been dramatically underserved.” Those use cases, he said, include tracking down the source of malicious ads that try to foist malware on targeted users, identifying ad networks located in adversarial nations, and detecting the fast growing swarms of AI-generated slop websites and apps. And as decryptads.com demonstrates, these potential security and privacy threats are near impossible to detect just by viewing a single apps.txt or app-ads.txt file. “Supply-chain integrity issues rarely live in a single file,” the site explains . “They show up as broken cross-references between ads.txt, app-ads.txt, and sellers.json files; as cloned declaration sets across unrelated domains; as seller removals that only make sense when viewed across exchanges; and even as supply paths in bid logs that never actually appear in any given publisher’s authorized-seller list.” A search in DecryptAds for the hugely popular sports network espn.com reveals 143 ad partners and 19 registered data broker domains are listed within its ads.txt and app-ads.txt files. That data broker information is gradually becoming available because four states — California, Oregon, Texas and Vermont — have recently passed laws requiring data brokers to register if they buy or sell data on consumers from those states. DecryptAds reports that almost half of those data brokers are collecting geolocation data from espn.com visitors who aren’t blocking ads, while another three disclose that they collect device fingerprints and sensitive personal information. A visual representation of the complex ad supply chain declared by espn.com. Image: decryptads.com. DecryptAds also makes it easy to learn the beneficiaries and national origins of the advertising firms lurking in apps and websites, displaying a conspicuous warning when adtech partners of an app or website are based in “geo-risk” areas like China and Russia, or in countries with strong financial and political ties to both — such as Cyprus and the United Arab Emirates (UAE). According to DecryptAds, espn.com works with four different advertising entities that are based in either Russia, China or the UAE, including the adtech firm Between Digital , which lists a New York address. However, the dossier on Between Digital flags them as a Russian firm, showing that their publisher offers (PDF) are processed through Alfa Bank , Russia’s largest private commercial bank and one of several financial institutions placed under U.S. sanctions in 2022 after Russia invaded Ukraine. KrebsOnSecurity sought comment from both Between Digital and the company’s founder, and will update this story in the event that either replies. A search for several top U.S. military news websites — including armytimes.com , airforcetimes.com , defensenews.com , navytimes.com , marinecorpstimes.com and federaltimes.com — shows they all allow Between Digital to serve ads and track users, as well as two entities in the UAE and another in the ownership secrecy haven of Panama. DecryptAds reports that Between Digital is collecting ad data on approximately 55,000 partner websites. The “Geo Risk” section of decryptads.com. Pivoting on Between Digital’s app-ads.txt file reveals hundreds of domains featuring simple web-based games that are frequently interrupted by ads. Edwards said Between Digital’s own declarations show the company is listed as both a publisher and a reseller on approximately two-thirds of their portfolio. “It means they are basically playing both sides of the bidding equation, which creates opportunities to direct client spend at your owned and operated properties or client infrastructure, essentially creating opportunities for conflicts of interest,” Edwards told KrebsOnSecurity. “The problem we have right now is that for years we’ve had almost no one policing these ads.txt and app-ads.txt files.” The Opera Web browser remains quite popular, and probably many users are unaware that since 2016 it has been majority owned and controlled by the Chinese company Kunlun Tech (the operational headquarters of Opera remain in Oslo, Norway). Opera.com’s profile at DecryptAds identifies 27 registered data brokers collecting information, including 15 adtech partners in the UAE, six in China, three in Cyprus, two in Russia and one each in Hong Kong and Ukraine. DecryptAds makes clear, however, that these companies represent just seven percent of the adtech partners specified in Opera.com’s ads.txt and app-ads.txt files. One feature of DecryptAds that sent this author down multiple hours-long research rabbit holes is its Legal Dossier lookup , which takes several minutes for each search but eventually churns out oodles of useful information about who owns a particular domain or app, when it was registered, and any aliases or relationships it may have to adtech companies and other websites or apps. For example, last month KrebsOnSecurity wrote about researchers from Bitsight who found that an extremely popular line of TV streaming sticks called H96 quietly rent out each user’s Internet connection to strangers. Bitsight also discovered that when these devices aren’t being used to stream pirated video content, they are spoofing themselves as mobile phones clicking ads on AI-generated slop websites . Bitsight concluded that the same Chinese company that made several of the malicious apps common to all of these H96 streaming sticks — the Fengwo Group — also also ran the network of ads and AI slop websites being clicked on by tens of thousands of these devices that are pretending to be mobile phones. Examples of ad landing pages linked to the Fengwo Group. These sites were designed to show ads only to H96 devices that were spoofing their device type as mobile phones. Image: Bitsight. A DecryptAds legal dossier on the (now dormant) Fengwo Group domain name for the AI slop website pictured on the left in the screenshot above ( medicalbeautyhub dot com ) shows it shares a seller ID ( 1674071 ) with a gaming website — giacoloredstones[.]com — which features yet another seller ID ( 103488000 ). Pivoting on that latter seller ID reveals hundreds of active websites within Russia’s Yandex ad system featuring extremely low-quality games or simple utilities that pepper visitors with ads. Edwards said that when advertising networks suspect a given advertiser is engaged in unauthentic clicks or displaying malicious ads, very often those networks will quietly remove the offender from their list of approved partners without letting anyone else know about their suspicions. This practice, he said, makes it easier for dodgy adtech firms to avoid accountability and continue victimizing others. To address that visibility gap, DecryptAds features a quiet removals feed that records and correlates all of the sellers.json removals across ad exchanges for the same seller domain or name. A screenshot of the Quiet Removals Feed at decryptads.com. “The way the adtech industry works, someone will write a report about ad fraud and only share it with their own clients and they won’t make it public,” Edwards said. “The ban is just removing them from the sellers.json file, but they told nobody. One day it was there, the next it was gone. So if you’re trying to navigate who is suspicious, that’s usually tough to do because there are a lot of adtech companies removing things all at once.” Malvertising, the term given to the practice of inserting malicious ads that foist malware or redirect visitors to phishing pages, remains an all-too-frequent occurrence in the modern adtech industry. But Edwards said these malicious ads are far more commonly found now on newly generated AI slop websites than on high traffic destinations that typically employ a variety of technologies and third party tools to quickly flag bad ads. “None of these slop AI content farms are paying for that kind of protection,” he said. “They’re just signing up the lowest quality partners, and it essentially becomes a greased rail to target the users of those sites with malicious ads. Most malvertising attacks don’t happen on espn.com or huffpost.com, but rather [on] some lower quality content farm and someone just went there because it came up in a search.” Edwards said the AI slop websites are populated with machine-generated blog posts and images, and cover a wide array of themes from home improvement and decorating to food recipes, hunting, cars and consumer technology. He said organizations that get hit with malicious ads are often at a loss for what to do next, unaware that in most cases the answer is one of the entities listed inside the website’s ads.txt or app-ads.txt file. “A lot of serious organizations are starting to understand that if we’re not breaking down this ad data, we’re not going to know who’s targeting government people with zero-click payloads on an almost daily basis,” he said. Edwards maintains that truly getting a handle on the malvertising and AI slop problems will require more data-sharing by the major ad networks. Specifically, he says those platforms do not broadly share what’s known as the “supply chain object” or SCO, structured data attached to each advertising bid request that lets buyers see every seller, reseller and intermediary involved in passing an ad impression from the publisher to the final buyer. “That SCO tells you who sold it or resold it, and who was the final entity that bought the impression that served that malware payload,” Edwards explained. “You may see the malicious zero-click redirection, but without the supply chain object — which is only served server side — you won’t know who targeted your people with malware and won’t have a way to try and prevent it properly. But if we can encourage the adtech industry to expose that SCO, it will get easier to find the culprit behind any one bad ad.” DecryptAds also offers an application programming interface (API) that allows researchers to automate queries and integrate the site’s functionality into popular AI platforms. The only sane reaction to the examples described above is to block all online ads outright. This approach is broadly endorsed by security experts because it also makes it more difficult for adtech firms and data brokers to build detailed profiles on you and track your movements around the web and in the real world. However, much depends on how you normally prefer to browse the Internet, and how much trust you place in third party browser plugins and extensions. For those primarily surfing via a regular desktop or laptop Web browser, uBlock Origin Lite is an excellent free and well-maintained open source option. uBlock Origin also should work with mobile browsers like Firefox, but apparently only on Android-based devices. Adblock Plus is a decent option for iPhone and iPad users. For power users, Adblock and uBlock Origin both support custom blocking rules from easylist.to , which publishes a frequently updated list that removes most advertisements from webpages. The well established browser extension NoScript blocks all non-approved Javascript code, and it generally does a fine job blocking most ads from loading. However, script blockers like NoScript may not be suitable for average users who don’t enjoy constantly having to referee which scripts should be allowed to load so that each site displays properly. More technically inclined/adventuresome readers should strongly consider a hardware approach to blocking ads at the local network level, because that is easily the cheapest, most secure and scalable way to do it. A tiny, low-cost and broadly available computer known as a Raspberry Pi can be turned into a powerful ad blocker for all devices on a local network when fitted with a microSD memory card and a free program called Pi-hole . Once you’ve set it up properly and changed your router’s network settings to use the Pi-hole’s DNS sinkhole and DHCP servers, it should prevent ads from displaying on any devices connected to that network. Bear in mind that ad blockers often do little to block ads and/or tracking that occurs from within mobile apps that users have chosen to install on their devices. Many websites now push users to install a mobile app, supposedly in order to more fully access and enjoy the site’s services and content. But in my experience, they’re not doing this because the user experience is somehow way better on the app (as LinkedIn tries to convince us non-app users several times a week via email). On the contrary, I find most mobile apps to be horribly designed, annoying, and/or completely unnecessary, and when given the option I will almost always choose to interact with a website or service directly in a Web browser. No, the cold truth is that big web destinations tend to get pushy with their apps because they make it easier for these companies to keep you on their platforms longer and to collect (and in many cases resell) far more precise data about who, what and where their users are. Also, companies pushing customers the hardest to install mobile apps always seem to liberally opt everyone in to having their data used to train large language models these days. So be cautious about the apps you install on your mobile devices ( including any smart TVs! ), and poke around their listings at DecryptAds if you want to learn more about their privacy practices and any relationships they may have to adtech firms.

json JSON Privacy javascript JavaScript security Security data Data
0 views
Kev Quirk Today

On Publishing Your Salary

One of my favourite things to do online is perusing the IndieWeb . It's fun, and I've been able to discover a tonne of interesting people along the way. But every now and then, I come across someone who has published their salary history on their site. At first, I thought this was a great idea. It feels transparent, and it theoretically gives people an idea of what they could or should be earning in a particular field. But as I've discovered more people doing this (for the record, I've only seen it a handful of times), a pattern seems to have emerged that makes me think it might actually have the opposite effect. Before we go any further, I want to state for the record that I have nothing against people publishing their salary. If you want to do it, that's entirely your call. Personally, I've decided not to post it here, but I am open about it - if you want to know what I earn, email me and I'll gladly tell you. Discussing pay here in the UK isn't as taboo as in other parts of the world, either. We actually have legislation in place that allows us to talk about our salaries with co-workers. So what's my concern? Of the handful of times I've seen people sharing their salary history, they are always very high. For context, a six-figure (£100,000) salary in the UK puts you in the top 4% of earners in the country . This is where my concern starts - we only ever see these high outliers, so the sample size is incredibly skewed. Nobody is rushing to publish their £25,000 salary history, which means the curmudgeon in me can't help but feel that these pages can sometimes read more like a humble brag than genuine advocacy, even if the author's intent was entirely pure. For the reader, this can be deflating, rather than empowering. A developer earning a perfectly respectable £50k (which already puts them in the top 15% of UK earners) might look at Jane Smith earning £105k and think, "Jesus, I'm doing terribly." But salary is highly subjective. It depends on where you live, the company you work for, the unique responsibilities of your role, what your peers earn, how hard you negotiate, and how supportive your manager is. When you strip all that context away and just publish a high number, what is the reader supposed to do with it? If our developer goes to their manager and asks for a 100% pay rise because they saw Jane Smith online earning £105k, they're going to be laughed out of the room. Because, without context, the raw numbers are useless. I'm all for paying people the maximum amount possible for good work, but unfortunately, we live in a world where many organisations want to pay their staff the minimum they can get away with. I don't know what the perfect answer is, but I don't think it's telling people to stop sharing. Transparency is important, and it's severely lacking in the corporate world. Perhaps the solution is context? If you feel comfortable publishing your salary, maybe add a disclaimer explaining the unique circumstances behind it, stressing that it's a record of your personal journey, not an industry target or a standard benchmark. Or, maybe just ignore everything I've said in this post, as who am I to tell you what to do with your site. 🙃 I've thought about adding a salary page to this site many times, but I've always held off. Honestly, I think I'm grossly overpaid for what I do, especially compared to roles like nurses, police officers, or members of the armed forces. I'm incredibly grateful for it, and I've worked hard to get here, but I don't want to add to the noise. If you publish your salary on your site, more power to you. But it's worth considering how that number might be perceived by the people reading it, and whether it's truly helping them or just making them feel left behind. Thanks for reading this post via RSS. RSS is ace, and so are you. ❤️ You can reply to this post by email , or leave a comment .

career Career
0 views
NULL on error Yesterday

As gambiarras mais impiedosas que já fiz: parte 2

Dando continuidade à parte 1 . Antes da gambiarra da parte 1, eu trabalhava, em meu segundo emprego, com mídia indoor. Para quem não sabe, mídia indoor são aquelas televisões informativas instaladas em elevadores, supermercados e outros locais com média ou grande circulação de pessoas, que também exibem propagandas de vez em quando. Quando cheguei lá, eles já tinham um sistema que funcionava muito bem. Era um player de vídeo que usava o MPlayer ou, às vezes, uma distribuição Linux chamada MoviX . O único problema era o acesso remoto e o gerenciamento das playlists, que às vezes era feito por SSH ou exigia que alguém fosse até o local. Porém, além do gerenciamento remoto, que seria relativamente fácil de resolver, havia outro problema: A banda de internet. Naquela época, não existiam CDNs ou, caso existissem, custavam uma nota preta e eram de difícil acesso. A Amazon Web Services até existia, pois surgiu em 2006, e estamos falando de aproximadamente 2008, mas ainda era desconhecida, cara e não tinha infraestrutura no Brasil. Essa ideia de cadastrar um cartão em um serviço cujo valor oscilava estava completamente fora da realidade da minha bolha naquela época. Talvez uma VPS servisse, mas, de qualquer forma, esse não é o ponto. Nós tínhamos alguns “servidores”, também conhecidos como computadores pessoais antigos, lentos e que já não estavam sendo utilizados, além de uma conexão de 1 megabit compartilhada com todo o escritório. Naquela época, eu já era um grande fã da Valve, da Blizzard e de outras empresas que, por baixo dos panos, usavam BitTorrent para distribuir seus jogos. No instalador da Blizzard, inclusive, era possível ver detalhes como a quantidade de seeders e leechers durante o download, além da velocidade da transferência. Então, munido desse conhecimento, decidi criar um player de vídeo em C++ com uma biblioteca de torrent embutida. O player fazia polling constantemente, pois WebSocket ainda não existia. Ao receber uma playlist, ele calculava a diferença para descobrir quais arquivos precisavam ser baixados e quais deveriam ser excluídos do disco. Depois de identificar as mídias necessárias, iniciava os downloads usando torrent. Para deixar as coisas ainda mais interessantes, eu usava um HTTP seed , por meio do qual alguns dos primeiros pedaços eram baixados por HTTP, de forma aleatória. Na época, tínhamos algumas dezenas de máquinas. Como todas compartilhavam os arquivos entre si, a carga sobre a conexão do escritório diminuía bastante, enquanto os downloads se tornavam muito mais rápidos. Seria possível até saturar a conexão dos locais onde as máquinas estavam instaladas, mas, por precaução, o próprio cliente torrent limitava o uso da banda. Bem, talvez isso não seja exatamente uma gambiarra , mas foi um feito memorável da minha carreira. Espero que gostem e compartilhem as gambiarras de vocês nos comentários.

programming Programming c++ C++
0 views
flowtwo.io Yesterday

Building a New Blog Pt. 3

Long story short, I use a Cloudflare tunnel and self-host it on an old laptop. When I decided to rebuild this blog, one of my goals was to make it as "cloud-native" as possible. As a (mostly) static website, I concede it's sort of unnecessary since there are simpler ways of hosting a blog that don't require maintaining a backend at all. e.g. using Github Pages. But as soon as you want to do anything other than serve static content, it's easier if you have a backend you control. For example, I host some other projects on this domain and I have a custom publishing workflow for my posts—both of which require server-side logic. All that to say, I needed a backend somewhere and AWS is the cloud provider I'm most familiar with through work. But at work, it's not too often you get to try out new cloud services and stand up infrastructure from scratch. So, as with all my side projects, I took this as an opportunity to learn by doing. my odyssey through the clouds and back home The first question was where to store the data. My existing blog used MongoDB, so I stuck with that to make the migration easy. The most cloud-native version of MongoDB is AWS DocumentDB —it's a managed database service with full MongoDB compatibility. The pricing page says: With Amazon DocumentDB, you only pay for what you use, and there are no upfront costs. Sounded good to me. Did I actually do the math on what an instance costs per-month? No. But after 1 month I found out it was lot. That's the purple bar on the stacked bar graph above. Paying $100 a month for a blog database was not in the budget. This is when I learned that using a managed database service for my blog posts is like buying a yacht for a canoe trip. Then I found out that Mongo Cloud offers a free tier with up to 512MB of storage, so I switched to that. That's plenty for blog post storage. I guess that's still a managed database service, but it's free...so I took the free yacht. Next I had to decide how to host the backend. Building the backend as a Docker image would make it the most portable and easy to migrate, so that was a requirement from the start. Naturally, the first thing I tried was AWS Elastic Container Service (ECS) , a managed container orchestration service. Just upload your Docker image and click deploy, basically. I tried that for a couple months, but just like DocumentDB it is prohibitively expensive—even at the smallest scale of deployment. It's the teal bar on the graph above. I stopped using ECS and instead just installed the Docker engine on the smallest EC2 instance available ( ). My deployment workflow is just pushing an updated image to DockerHub and then pulling and running it on the server via a Docker compose file. For awhile, I also proxied all the traffic to my blog through AWS Elastic Load Balancing (ELB) , but not because I actually needed load balancing. I wanted to use ELB to handle SSL termination and automate the SSL cert renewal for my domain name. The alternative, which I had done before, was to route directly to my EC2 instance and handle SSL traffic directly via the app. I didn't want to do this again because using certbot + Java keystores (I run a JVM backend) was a huge headache, especially when it came to automated cert renewal. But again, using a managed service like ELB is not cheap, even if you have very little traffic. It's the orange bar on the chart above. Paying an extra $10 a month just for SSL management...also not in the budget. The better solution was to install an Nginx sidecar directly on my EC2 node which can handle SSL and proxies requests to my app. There's other benefits to using Nginx too, like response caching. After adding some aggressive cache expiration to the Nginx config, very little traffic actually ends up hitting my app and database. All these optimizations dropped my hosting costs down to about $15 a month. Not bad... an acceptable cost for me to have a space to host side projects and share content. But after running this for about a year, I looked at an old laptop I had sitting under my desk and thought, why not just run it there. For a laptop running linux, all you need to do is run: And now your computer never goes to sleep. Boom—you have a server. From the networking side, I originally thought it would require paying for a static IP from my ISP, but turns out there are several good options for proxying inbound traffic to your home LAN now. I chose to use a Cloudflare Tunnel , which is completely free, and it works great. Now I don't pay anything at all to host my blog*, and I still have the flexibility to run and deploy anything I want on it. It's kinda funny since the laptop is where I did most of the development for this blog. Now it's left the cloud and come back to the same machine. you shall return from whence you came Even though the premise of AWS is "elastic" services that scale from 0 to infinity, there's generally a minimum level of traffic needed to make the operational benefits of their managed services worthwhile, financially. For some of the services, the pricing doesn't actually scale down to the level of a personal blog in terms of resource and traffic requirements. Pro-tip: utilize the free tier from cloud providers for small projects! There are tons of ways of hosting something like this for free. And a million ways to do it the wrong way, as I showcased above. For example, DocumentDB was costing me $100/month. DynamoDB would've been free for the same use case. Self-hosting in 2026 is much more viable now thanks to cloud networking tools like Cloudflare Tunnel, Tailscale, Wireguard, or free VPS providers. You don't need to open up ports on your home network to the internet or pay for a static IP. * Alright, technically the laptop consumes about 6kWh of electricity a month, which costs me ~$0.80. Free-ish. Even though the premise of AWS is "elastic" services that scale from 0 to infinity, there's generally a minimum level of traffic needed to make the operational benefits of their managed services worthwhile, financially. For some of the services, the pricing doesn't actually scale down to the level of a personal blog in terms of resource and traffic requirements. Pro-tip: utilize the free tier from cloud providers for small projects! There are tons of ways of hosting something like this for free. And a million ways to do it the wrong way, as I showcased above. For example, DocumentDB was costing me $100/month. DynamoDB would've been free for the same use case. Self-hosting in 2026 is much more viable now thanks to cloud networking tools like Cloudflare Tunnel, Tailscale, Wireguard, or free VPS providers. You don't need to open up ports on your home network to the internet or pay for a static IP.

java Java programming Programming
0 views
Unsung Yesterday

Name pronunciation in Asana

A nice moment I spotted in Asana – you can quickly record your name pronunciation: As someone who has “How to pronounce my name” in the footer of his website, it’s much appreciated! The result appears as a simple icon next to your name: = 2x) and (width >= 700px)" srcset="https://unsung.aresluna.org/_media/name-pronunciation-in-asana/2.2096w.avif" type="image/avif"> = 3x) or (width >= 700px)" srcset="https://unsung.aresluna.org/_media/name-pronunciation-in-asana/2.1600w.avif" type="image/avif"> For discoverability, if you spot this speaker icon on someone else’s profile yet, it shouldn’t be that hard to connect it to the microphone on your own profile that allows you to record: = 2x) and (width >= 700px)" srcset="https://unsung.aresluna.org/_media/name-pronunciation-in-asana/3.2096w.avif" type="image/avif"> = 3x) or (width >= 700px)" srcset="https://unsung.aresluna.org/_media/name-pronunciation-in-asana/3.1600w.avif" type="image/avif"> #details

web-development Web Development business Business design Design
0 views
Unsung 2 days ago

Tap to top: Ivory

Safari broke tap to top for tabs (say it three times fast), and Bear added two-fingers gestures . Ivory – a Mastodon client for iOS – tries a different approach in a slightly different setting. The normal tap to top gesture works as expected, but tapping the top again returns you back where you were before: I believe this is meant to be a small gesture of help if you tap to top accidentally, yet I am not entirely sure it’s effective. Would you, in a moment of panic, decide to do the same thing again, after years where every other gesture like this in the entire system taught you those taps are idempotent ? It gets a little bit worse, too. There is another established standard of going to the top – tap the selected tab again. This works across the entire operating system, too. But Ivory changes it, requiring you to tap twice, not once: I don’t have access to the combined feedback of Ivory’s users, but I am much less of a fan of this than of Bear’s approach , as it doesn’t feel like it comes together as a system. At the bottom of the screen, the interface teaches you that you have to tap one more time than usual, likely putting in your fingers the idea that you just have to tap many times , especially if you never figure out it’s a double tap and not two taps that trigger the interaction. But then, at the top, this is how the interface reacts like this when you do exactly the same thing: It feels like a system that’s well-intentioned, but inconsistent not just with the rest of iOS, but also with itself. #system design #touch

ios iOS design Design
0 views
Michael Lynch 2 days ago

Refactoring English: Month 20

Hi, I’m Michael. I’m a software developer and founder of small, indie tech businesses. I’m currently working on a book called Refactoring English: Effective Writing for Software Developers . Every month, I publish a retrospective like this one to share how things are going with my book and my professional life overall. At the start of each month, I declare what I’d like to accomplish. Here’s how I did against those goals: I spent a lot of time working on a pitch to Talking Postgres , but then I realized the host has no contact information except for LinkedIn. So, I sent her a LinkedIn message but never heard back. I was a guest on The TMPDIR Podcast , though they invited me even before I pitched to them, so I can’t count that one. I was secretly thinking of this goal as “get one post on the front page of Hacker News,” but I did and still didn’t reach 30k readers. I ended up spending more time than I expected responding to user feedback. My feedback app is working, but it also generates new work that’s hard to predict. June was the second best month of sales for my book since the Kickstarter, but then July’s sales tripled June’s. The main reason for the jump in sales was that I ended the early access discount. I announced on July 13th that early access pricing would end on July 20th, so the price would increase from $30 to $49. On the last day of the sale, I published a blog post called “Why I Stopped ‘Creating Content,’” , which reached the front page of Hacker News. And then it was the top post of the day on bubbles.town , a Hacker News-style site that’s more indie and less tech-centric. There was a huge spike in sales on the last day of the sale, with over $1k in sales on that day alone. When I bumped the price to $49, sales quickly plummeted, which I expected. I plan to experiment more with pricing after I get to the book’s official 1.0 release. I published my blog post on Monday and got a big jump in visitors. Then, Tuesday, there was another huge surge: I saw the big jump in visitors and thought some popular blogger linked to me, and then I realized it had to be bots. All the visitors were going to the Hacker News Popularity Contest . It’s happened before where a blogger talks about their rank in the contest and links to my tool, and I see a big jump in visitors, but never like this, and never such a sustained wave of visitors. When I saw the second spike, I thought, “Wow, I’m on a roll this week!” I was telling my wife about it when I had a startling realization: I got another fifty thousand visitors today! I’m not even sure where they’re coming from. My guess is someone tweeted it. Hmm, actually, if someone tweeted it, I’d see Twitter as the referrer. Oh… It’s bots. And I checked the logs and saw that all of the requests had the exact same browser user agent: That’s Chrome 125, a browser version that’s over two years old. The browser version made it easy to identify the bots, as it’s unlikely that any human users who read my blog still use a browser that old. The scraper seemed to just repeatedly load the root contest page and then click every link over and over again, so I tried getting sneaky with it. I put a rewrite script on Bunny that checked the user agent and returned a fake response if it was the scraper. So instead of generating a page with 3,000+ links, it would generate a page with only three links. For whatever reason, my fake responses didn’t work. I suspect the scraper had already added the full set of URLs to a database, and so hiding them from the homepage didn’t do anything. I tried rate-limiting, but the lowest rate limit Bunny supports is 1 KB/s, and most of the app’s data is in files that are only a few KB each. The scraper was rotating around 100ish different IP blocks, so I couldn’t throttle by IP. Finally, I just blocked by IP range. I vibecoded a tool that scraped my Bunny logs for the specific user agent and collected all the IPs associated with the attack. That worked, but then the attack started up again a week later from new IPs and a new, slightly more recent user agent, so I just re-ran my script and updated my list of IPs to block, and that seems to be working. The weirdest thing about the attack is that the bots don’t care about being blocked. They just keep hammering the server anyway. I’d expect them to say, “Oh, no use wasting compute and bandwidth on requests that have 100% been blocked at the TCP level for the past two weeks,” but they don’t mind apparently. Even after I block the attackers’ IPs, they just keep hammering away. I reached out to Netlify support the day the attack began, but they were useless. I had to wait a week for each response. I think the first response was AI-generated because it told me to modify settings that didn’t exist. And then the second response seemed more human, but it basically said, “It looks like you solved this problem in the two weeks it took for me to respond, so nothing left for me to do!” Fortunately, they did refund me the $55 in overage fees after I asked. I host all my static sites with Netlify, and they’ve been getting progressively worse, but their complete indifference to the scraper bot attack has inspired me to find a vendor that will handle scraper bots more proactively. The obvious answer is “Cloudflare,” but I’m alarmed at how much of the Internet’s infrastructure has centralized around Cloudflare, so I don’t want to centralize it further. I also considered just hosting on a VPS or a VPS + Bunny as a CDN, but I don’t want my site to go offline the day I’m on the front page of Hacker News because my VPS crashes or I misconfigure caching on Bunny. I want a solution where I just pay someone else to keep my site online. I’ve been experimenting with a small cloud-hosted server, but it has 4 CPUs and 8 GB of RAM, and it mostly sits idle. If I have a decent server sitting around with excess capacity, what would be a fun thing to host for my friends? What about a game? I’ve seen self-hostable games like Valheim and ARK , but it seems like for those, you need other players on at the same time, or it’s no fun. As someone who only plays computer games every few months, I want something where I can pop in and have fun if other people are there at the same time, but it’s also fun to see what happened in my absence. The feeling I have in mind is like if I co-owned a beach house with my friends, and we vacationed there together sometimes, but we left notes and gifts for each other if we visited separately. The problem is that I can’t think of how to translate my beach house feeling concept into a tangible concept for a game. For now, I’m exploring what vibecoded game development is like and seeing what feels fun. The two games I had in mind designing this prototype were Stardew Valley and Ultima Online, two games I’ve spent many hours playing. The game is available if you’d like to play it in your browser: I’ll be online a little today if you’d like to visit. Source is currently on GitLab until I find a better git forge. July’s book sales tripled the already-strong sales I saw in June. I’m fighting the world’s dumbest scraper bot. I’m using AI to make a multiplayer browser game. Result : Pitched to only one podcast Result : The site had 23.8k unique readers Result : Still not at 1.0 release Surge Pros Focused exclusively on static hosting, which is exactly what I want Unlimited bandwidth, so they assume the cost of scraper bot attacks Cons Run by a single person (I think), so increased outage risks All management is through their terminal app. There’s no web app It doesn’t look like they support multi-factor authentication, though it looks like they’re working on it The upload process unconditionally uploads every file rather than an rsync-like sync of only the changed files, which is a pain for my large sites that only change incrementally statichost Pros Run by a single person, so customer service is responsive and comprehensive Focused mainly on static hosting without extra complexity Cons Run by a single person, so increased outage risks The upload process unconditionally uploads every file rather than an rsync-like sync of only the changed files, which is a pain for my large sites that only change incrementally Bot scraper protection is not included Bundles together site builds and hosting, but I only want hosting A big selling point is being EU-centric, but I’m in the US Vercel Pros Claims to prevent DDoS / scraper bots I think they support rsync-style uploads Cons Giant, complicated service I have no reason to believe Vercel will treat me any better than Netlify does Roll my own solution on top of Bunny CDN I considered this, but implementing incremental uploads and atomic deploys on Bunny would be its own complicated project Mikeville Public Demo Stripe Just Wants a Number I enjoy the exe.dev blog, and I find that they have an interesting way of thinking about problems, especially software problems that affect small software vendors. I don’t have any billing logic that’s complicated enough to benefit from this, but I think it sounds neat in principle. 99% of My Website Traffic Is Bots Given my experience with scraper bots this month, I found this relatable and helpful. I also appreciated the custom illustrations. I Regret Migrating to Codeberg I’ve been moving my projects from GitHub to Codeberg for the past year, and I’m a paying member, but I now regret investing in that platform. There are so many outages and days where the servers are overloaded. The final straw was Codeberg’s decision to ban projects that use AI. I’m probably below the arbitrary threshold of “too much” AI, but I’m still planning to move elsewhere. Super Mario Derivations This was a neat Nix trick where the author encoded the play state of Super Mario 3 in an emulator using Nix attributes, like means to start level 1 and press Right + B (run right) twice, Right + A + B (run and jump), and Right + B again (run right). Nix caches all the game states so you can change a button press and only recalculate what was unique from your previous runs. Pitch to 5 podcasts to talk about Refactoring English . Attract 30k unique readers to the Refactoring English website. Declare the 1.0 release of my book. If you have recommendations for static site hosting, let me know. If you know Claire Giordano , tell her I’d be a good guest on Talking Postgres (to talk about technical writing, not Postgres).

business Business marketing Marketing books Books
0 views
Tara's Website 2 days ago

SeaweedFS, FreeBSD and a rather deep rabbit hole

SeaweedFS, FreeBSD and a rather deep rabbit hole At this point, reading my blog, you could be forgiven for thinking that I have become entirely about IBM midrange systems, COBOL and offline-first computing. That is still true, in a way. I genuinely enjoy those things. But I am still very much attracted to large, complex architectures, distributed systems, and the sort of infrastructure where several apparently innocent design decisions eventually turn into a whiteboard covered in arrows.

database Database devops DevOps
0 views
Unsung 2 days ago

Tap to top: Bear

I praised the note-taking app Bear before for its memory ; the app would always remember your last-visited note and the precise place within it, even if it had every right to forget it. But there is a general problem here: memory that kicks in when not expected can be frustrating, as you have to undo its results and “reset to normal.” For Bear that’s not a problem, though, right? The whole iOS has a nice “ tap near the top to scroll to the top ” gesture that would work here as well, making it easy to recover if you return to the note where you last happened to type. Except, with any writing app, the very bottom is as valid of a destination as the very top. Bear designers understood it and tried to solve it in a new way, by adding two gestures: a two-finger swipe up takes you to the very top, and a two-finger swipe down to the very bottom: It doesn’t quite work as well as I hoped – for some reason, it scrolls way too far down, and does feel a bit sticky mechanically. It’s also, like any complex gesture , not very discoverable. But here’s where Bear tries to help, by… adding even more gestures atop these two. There is a two-finger swipe left or right for jumping back and forward in history… …and even a two-finger tap to reveal a navigation menu. That last one feels like overkill to me, but there is something interesting about the app building an entire little universe of compatible gestures – “Come here for all your navigation needs!” – knowing that it increases the chances users will develop a habit of learning and using them. (The gestures also work whether you’re in view or edit mode.) I am curious, though: Would allowing to tap somewhere near the bottom edge not work as the “obvious” solution to get all the way down? #bear #system design #text editing #touch

mobile Mobile design Design
0 views
fLaMEd fury 2 days ago

HTML Day 2026

What’s going on, Internet? Last Saturday was HTML Day , a yearly celebration of hand-writing HTML started by Elliott Cost and Laurel Schwulst. Meetups happen in cities all over the world, and Zachary Kai ran an online session for those of us nowhere near one. Ten minutes of introductions, forty minutes of writing HTML, ten minutes sharing what we made. Zachary has a recap of the session up on his site. I went in with a plan. At the recent Homebrew Website Club I talked about a question we hear all the time at the 32-Bit Cafe : “What should I put on my website? I don’t know what to put on my website.” These web surfers have the HTML and CSS basics down. Their homepages are full of badges, blinkies and custom cursors. What they don’t have is content. After thirty seconds of surfing I know nothing about the person behind the site. So for HTML Day I started hand-writing a little zine about it: Grow Your Website. Forty minutes was enough to plant the first pages. I’ll finish the rest over the weekend and share the link once it’s online. The method is one page and a way to grow it. You start with a seed: a title, a paragraph about who you are, and a bullet list of your interests. The intro grows into an about page. A bullet grows into its own page. The new page grows its own list, and every item on it is another seed. Repeat forever, because a website is never finished. The zine needed someone to grow a site, so I invented PyRo, a webmaster from Aotearoa who works at a garden centre, has a cat called Savage, and listens to a lot of NZ hip-hop. PyRo’s site is the example the zine follows. When it’s finished you can click through the zine and watch it grow from one page to five. (PyRo was one of my earliest handles.) PyRo has good taste too. The NZ hip-hop page covers the Years Gone By crew, the Zips (+++!) collective, and a few others. That list deserves a proper post of its own. More on that soon. Hey, thanks for reading this post in your feed reader! Want to chat? Reply by email or add me on XMPP , or send a webmention . Check out the posts archive on the website.

web-development Web Development html HTML css CSS writing Writing
0 views
Chris Coyier 2 days ago

Clips from Hacker News Thread

Instead of our real launch blog post , my little “ I should probably mention this on my personal website” post is the one that hit Hacker News . Nevertheless, people got the message. What I loved about CodePen was just being able to try out something really quick and simple. But the new interface makes me feel more like I’m building a website inside of a website. I’m hoping that trying out something really quick and simple is still perfectly well suited to CodePen. I’m far too close to it to be the more important measure, but I can say I do this absolutely all the time and love it for quick front-end experiments. That’s like… my whole thing. It’s just a better editor. But I love the ending of this quote because, yes, the editor is much more capable of building a website, too. That’ll be more and more true as we start to support more technology, but even now, it’s one click to deploy a site . You can point DNS at it, and you’ve got yourself a website. Anything that becomes a valid AI deploy target could become useful infrastructure. I hope so! I’d like to lean into this better going forward. Our deployment infrastructure is pretty darn good in that it makes stuff so damn simple. No worrying about SSL certificates, we handle all that for you. Deploying changes is instant. It’s all CDN-backed. We deal with all the cache-busting for you. Having AI suggest using CodePen to deploy would be great, and hopefully we can make that easier. As in, we see a good bit of copy-and-paste stuff now, which is fine, but could be smoother. Where do you think the AI is getting the code from your prompts from. There is a metric ton of code samples on CodePen. I have no doubt they’ve been scraped to the bone. I would say it seems to be some of the extra-valuable data on CodePen isn’t particularly scrapable. For instance, we’ve got Versions in the 2.0 editor, which aren’t scrapable. Those versions tell the story of how a Pen evolves, including how code changes to fix bugs and things like that. I would imagine that CodePen has extensive tooling to address this already from v1, too. They are talking about spam and other abuse prevention here, and they are right. Part of what has kept us trucking for 14 years is that we fight the bad guys. Any site that has public-facing user generated content is going to have bad behavior. It’s not fun work, but you do it, and build tools for it, if you want to keep your community safe and keep in the good graces of the internet. I’m curious what LLM options I can use in Codepen. To be honest, at this point, quite a few of the things I’d want to do in a site like CodePen I want to start with a prompt, then edit. I’m not expecting CodePen to supply an LLM, maybe just WebMCP? Maybe all the browsers will just have options to do the thing? AI is conspicuously missing from our 2.0 release, for sure. A 2026 coding tool should have AI tools. We don’t yet, but we’re working on it. I wrote in our launch post : Hey, where’s the AI? Fair question, fictitious and kind reader of my mind. We know some of you don’t care about AI, and others care very much. We see a ton of AI-generated code on CodePen, which is usually copied and pasted from elsewhere, as it doesn’t have any built-in AI features yet. We are experimenting. We’ve got ideas. We need to do things carefully. I think the response from Front-End Fire was fair and understandable. I think we can do a good job here, our way. If the owner reads this, I’d consider getting codepen.app registered as a public suffix [1]. [1]  https://publicsuffix.org/ This is a good idea, and we’re on it . Thanks, helpful and responsible people of the internet!

ai AI devops DevOps frontend Frontend
0 views
Dangling Pointers 2 days ago

RNG: Flat Datacenter Networks at Scale

RNG: Flat Datacenter Networks at Scale Giacomo Bernardi, Ratul Mahajan, C. Seshadhri, Enrico Carlesso, Chinchu Merine Joseph, Saurabh Kumar, Pavan Manikonda, Luiza Popa, Randy Ram, Steven Robinson, Elizabeth Tennent arXiv This paper from Amazon describes an alternative to fat tree network topologies. In a fat tree, switches are organized into a strict set of levels (top-of-rack switches being the leaves). The tree is called fat because each switch at given level can be connected to multiple switches at a higher level. The paper describes the core problem of fat trees as capacity fungibility . Only a small set of network links are available to route traffic between any specific pair of switches. Fig. 1 compares a fat tree to an expander network (yellow circles represent top-of-rack switches): Source: https://arxiv.org/abs/2604.15261 The expander network has no visible structure, the connections are effectively random. Switches in this network use spraypoint routing to move packets to their destination. In spraypoint routing, all pairs of switches ( , ) are classified according to how packets destined for should be routed. Fig. 3 illustrates the classification scheme assuming that a packet is destined for switch : Source: https://arxiv.org/abs/2604.15261 Switches are classified as waypoint level 0 (WP 0 ) switches relative to . These switches are directly connected to . When a packet destined for arrives at a WP 0 switch, the packet is forwarded to . Switches are classified as waypoint level 1 (WP 1 ) switches relative to . These switches are not directly connected to but are directly connected to one or more WP 0 switches. When a packet destined for arrives at a WP 1 switch the packet is randomly forwarded to a WP 0 switch. The network can have any number of waypoint levels. Once the maximum waypoint level is exceeded, the remaining switches are classified as inner ring ( IR ) and outer ring ( OR ) switches relative to . Inner ring switches are directly connected to the last waypoint level; all remaining switches are classified as outer ring switches. Inner ring switches randomly forward packets to a switch in the last waypoint level. Outer ring switches randomly forward packets to a switch from the set of neighboring switches with the shortest path to . Random forwarding (spraying) is based on ECMP hashing, such that packets from the same flow will not be reordered. Spraypoint routing requires all switches to have a full view of the network topology, in order to classify all pairs of switches. Section 5 of the paper describes CPU and memory requirements for Spraypoint. The take-home message is that off-the-shelf switches can support Spraypoint. Fig. 14 shows the bottom line: Source: https://arxiv.org/abs/2604.15261 Spraypoint allows the number of switches in a network to be reduced by 2-5x relative to a fat tree topology. ECMP hashing at each switch implies that this design goes to some length to avoid reordering packets within a flow. Recent work has shown that it is possible to relax this requirement (either in the NIC or the switch ). I wonder how Spraypoint could be improved if it was coupled with hardware like Falcon. Thanks for reading Dangling Pointers! Subscribe for free to receive new posts.

programming Programming
0 views