Adding Support for BlueSky to IndieLogin.com
Today I just launched support for BlueSky as a new authentication option in IndieLogin.com! ⌘ Read more

Welcome to our new babies Ade 🖤and Persefone 🤍 ⌘ Read more

HTB AD Track: Sauna Walkthrough

Image

Hello Everyone!! Here’s my writeup for the machine Sauna.

Continue reading on InfoSec Write-ups » ⌘ Read more

Honest Government Ad | Visit New Zealand! ⌘ Read more

Getting Hands-On with Kerbrute: Practical AD Enumeration & Attack Tactics ⌘ Read more

My open letter, to the European Commission digital markets act team:

Hello,

I am joining other developers, concerned about Googles new plan, to approve every app and effectively destroy most of the competing 3rd party stores this way. The biggest one of these alternative stores, most known for their focus on user and developer privacy, already states, this would make it impossible for them to operate: https://f-droid.org/cs/2025/09/29/google-developer-registration-decree.html
Even communities like the XDA forum, where new developers are often introduced to the world of Android development, would likely be strongly impacted, as making, publishing and installing Android apps is made less accessible.

I am not just writing on their behalf, I run a small website myself (https://thecanine.ueuo.com/), that both provides legal modifications, for some android apps - for example adding an amoled dark theme, to the most popular XMPP chat client for Android, or increasing one of Androids keyboard apps height. This all comes after Googles previous changes to the Android operating system, that prevent users from installing old apps (old to Google, can mean only a couple of months, without an update - https://developer.android.com/google/play/requirements/target-sdk and the target version gets increased every year). I rely on apps developed by a single developer, even for things like making the pixel art presented on my website and sideloading as a way to make these apps work, before developers can catch up to Google’s new requirements - if Google is allowed to slowly kill these options, us digital artists will soon lose the tools we need to create digital art.

Adding Stride Scheduling to xv6
Comments ⌘ Read more

@lyse@lyse.isobeef.org Yeah, those are my bad.

A couple of weeks ago, I added CORS support, which is the source of the OPTIONS call. What I didn’t do was store the result so it stops trying to make further attempts. I’ll get that in tomorrow.

As for the “If-Modified-Since” header, the server-based component of TwtStrm should be sending that (along with its user-agent tag and my user info). I wasn’t sure if that could be sent with CORS requests, so I’ll need to look into that a bit more.

Thanks, I appreciate the feedback!

@prologic@twtxt.net considering other alternatives we have seeing (of which I have lost track already), yes. Why don’t you guys (client makers) take a step at a time and, for now, increase the hash length to deal with the collisions. Then location-based addressing can be added… or not, you know. 😅

Raspberry Pi Updates Keyboard PC with New 500+ Model
Raspberry Pi 500+ is the newest all-in-one personal computer in the Raspberry Pi family. It combines the Raspberry Pi 5 platform with a mechanical keyboard, upgraded memory, and integrated storage. The design builds on the earlier Raspberry Pi 400 and 500 models while adding higher specifications and new input features. The Raspberry Pi 500+ is […] ⌘ Read more

@bender@twtxt.net Thanks for asking!

So, I’ve been working on 2 main twtxt-related projects.

The first is small Node / express application that serves up a twtxt file while allowing its owner to add twts to it (or edit it outright), and I’ve been testing it on my site since the night I made that post. It’s still very much an MVP, and I’ve been intermittently adding features, improving security, and streamlining the code, with an eye to release it after I get an MVP done of project #2 (the reader).

But that’s where I’ve been struggling. The idea seems simple enough - another Node / express app (this one with a Vite-powered front-end) that reads a public twtxt file, parses the “follow” list, grabs (and parses) those twtxt files, and then creates a river of twts out of the result. The pieces work fine in seclusion (and with dummy data), but I keep running into weird issues when reading real-live twtxt files, so some twts come through, while others get lost in the ether. I’ll figure it out eventually, but for now, I’ve been spending far more time than I anticipated just trying to get it to work end-to-end.

On top of it, the 2 projects wound up turning into 4 (so far), as I’ve been spinning out little libraries to use across both apps (like https://jsr.io/@itsericwoodward/fluent-dom-esm, and a forthcoming twtxt helper library).

In the end, I’m hoping to have project 1 (the editor) into beta by the end of October, and project 2 (the reader) into beta sometime after that, but we’ll see.

I hope this has satisfied your curiosity, but if you’d like to know more, please reach out!

@movq@www.uninformativ.de better than in the US. Our lasts only 10 years, and you need to go through the vision test, and, of course, pay). Recently they added a little gold star denoting “real ID” compliance, and we had to pay $10 to get the old one replaced—out of the regular renew “schedule”.

In here it is all about control, and money.

@kat@yarn.girlonthemoon.xyz, see this one, regarding “Anubis” (which I believe you use, right?): https://github.com/eternal-flame-AD/pow-buster

Adding too this. The configuration example at the repository reads:

{
	"nick": "Example",
	"description": "alice's twtxt instance!",
	"host": "twtxt.example.com",
	"admin": "alice"
}

Would it make more sense changing nick to instance_name or similar? Usually nick is reserved for users, like here, quark. Right? Also, is host the same FQDN to be used while proxying traffic to the application? That is, using the above configuration, it’s Caddy configuration would be:

twtxt.example.com {
	encode
	reverse_proxy :31212
}

Is that correct?

XMPP Interop Testing: Lots More Options
Since the last update, we’ve added a lot more options on how to run your tests. We’ve added a slew of new CI systems, this time focussing on freedom-respecting, open source CI systems for your open source projects.

Recent additions include Jenkins, Drone, Harness and Woodpecker.

This brings our total number of CI systems in which you can run XMPP interop tests up to a whopping ELEVEN, plus anywhere else you can run containers!

Whether you’re building … ⌘ Read more

Honest Government Ad | Global Sumud Flotilla ⌘ Read more

good afternoon yarnverse i have done nothing productive so far. except edit my fandom site a little bit (i added tag pages!). does that count lol

Since Google announced their intentions to heavily limit sideloading on Android, starting end of 2026, I’ve been looking for potential solutions, for this policy change, that threatens the majority of projects I maintain, in some way. Google already killed my browser project years ago, but I have no other choice, than to fight this, any way I can.

The best choice to deal with this, will probably be the Android Debug Bridge, which can be used not only to install apps unrestricted, but also to uninstall, or remove, almost any unnecessary part of the OS. Shizuku, combined with Canta Debloater, is the winning combination for now.

I’ve already removed most Google apps from my device: the annoying AI assistant, the stupid Google app adding the annoying articles, left of your homes screen, Google One, Gboard, Safety app… it’s amazing, no distracting Google slopware, like in the good old Android 2 days! And I absolutely intend to keep it this way, from now on, no new Google apps or services on my devices, unless Google can give me a good enough reason, to allow them there and whenever the app that verifies signatures, to block installing apps not approved by Google, I’ll just remove it from my device and advocate others do so too.

added opengraph to my blog :D https://bubblegum.girlonthemoon.xyz/articles/underground-soundcloud-remixes

Honest Government Ad | Visit Norway! ⌘ Read more

Ni Hao; bīng qílín!
I’m just dropping in, to emphasize my love for ice cream and the Chinese crawler bots, allocating their time and resources, towards scraping my humble website.

To show my gratitude, I’ve even added a random little dog generator to https://thecanine.ueuo.com/sparkle.html so that everyone can pick up their own custom dogFT, on their journey through my site.

We use all the Microsoft programs at work - Teams and Outlook especially.

After all kinds of technical problems with Teams, that sometimes go unresolved for over a year, Microsoft shifted their priorities away from fixing things and towards adding an annoying AI Copilot button, that just takes up space and all it does, is loads the website in Teams, so I disabled it. Soon they just add it back, but in a different row of icons, therefore it’s now a different button, you have to disable (I think they added yet another one, to the Teams, on my work phone and I had to disabled that too). Not too long after, the desktop one just enabled itself, because of “an error” and I can disable it, but doing so activates a popup, that begs you to turn it back on, every once in a while. You can’t disable the popup and can only click “Yes” or “Not now” on it. I still keep it disabled, out of principle, but yesterday I noticed yet another Copilot button, this time in the top right corner of my Outlook and this one cannot be disabled, on the business version of Outlook and even on the personal one, it’s only possible to do it through hidden privacy settings, by prohibiting the program from connecting to Microsoft servers, for extra “features”.

There’s people complaining about it online, so it’s clear nobody really wants it, but at this point Microsofts position is that you will have at least one useless AI button on your screen, at any given time, and you will be happy. And yes, their AI sucks and if I absolutely have to use AI for something, there’s already 2 better options, we have access to, at work.

Joanne Robertson + Oliver Coates – Always Were
Joanne Robertson is accompanied once again by the great Oliver Coates on “ Always Were”, the haunting second single from Robertson’s beautiful new album Blurrr, coming next month on AD 93… [Continue reading…](https:/ … ⌘ Read more

@prologic@twtxt.net AHA the .* entry did the trick! i originally had these rules in there, they were added by default except for the youtube rules:

imgur\.com
giphy\.com
imgs\.xkcd\.com
reactiongifs\.com
githubusercontent\.com
youtube\.com
yt.\be

also oooh the missing feature sounds very handy!

37C3 and New Year’s Eve 2023
Another one from the vaults. The 37C3 conference took place in
December, 2023. This report was mostly written in January, 2024.
Mostly finished it at night in my cottage between 28 and 29th
December, then edited and added some stuff in July, 2025. So… Only
1.5 years late?

It was a little ironic, and a little sad, that I was finishing the
37C3 report during 38C3. I didn’t manage to get any tickets for me and
#3 for 38C3 and had to make do with watching the stream.

The links to the talks go to [C … ⌘ Read more

@lyse@lyse.isobeef.org “Advanced”, well, probably more “mature”. There aren’t a ton of crazy features and that icon thing is the largest code addition in the last 10 years. %)

Speaking of OS/2 … I just realized that Windows 3.x didn’t have icons, either. If I’m not mistaken, this only got added in Windows 95. In other words, OS/2 had this feature before Windows did, because at least OS/2 2.1 from 1993 had icons. Who would have thunk.

(Now I kind of want to know which system really introduced this feature.)

Joanne Robertson + Oliver Coates – Gown
Joanne Robertson collaborates with her friend the great Oliver Coates on the haunting lead single from her stunning new album Blurrr -- one of the best of the year – coming in September on AD 93… [Continue reading…](https://www.gorillavsbear.net/jo … ⌘ Read more

@aelaraji@aelaraji.com And I read the following funny response to that:

Bluesky: Users verify their age by adding a payment method or uploading a photo ID.

Mastodon: Users verify their age by posting pictures of the vintage computer equipment in their homes.

https://beige.party/@maxleibman/114848276288629121

😏

Another example:

$ setpriv \
    --landlock-access fs \
    --landlock-rule path-beneath:execute,read-file:/bin/ls-static \
    --landlock-rule path-beneath:read-dir:/tmp \
    /bin/ls-static /tmp/tmp/xorg.atom

The first argument --landlock-access fs says that nothing is allowed.

--landlock-rule path-beneath:execute,read-file:/bin/ls-static says that reading and executing that file is allowed. It’s a statically linked ls program (not GNU ls).

--landlock-rule path-beneath:read-dir:/tmp says that reading the /tmp directory and everything below it is allowed.

The output of the ls-static program is this line:

─rw─r──r────x 3000 200 07-12 09:19 22'491 │ /tmp/tmp/xorg.atom

It was able to read the directory, see the file, do stat() on it and everything, the little x indicates that getting xattrs also worked.

3000 and 200 are user name and group name – they are shown as numeric, because the program does not have access to /etc/passwd and /etc/group.

Adding --landlock-rule path-beneath:read-file:/etc/passwd, for example, allows resolving users and yields this:

─rw─r──r────x cathy 200 07-12 09:19 22'491 │ /tmp/tmp/xorg.atom

@prologic@twtxt.net Yeah, this really could use a proper definition or a “manifest”. 😅 Many of these ideas are not very wide spread. And I haven’t come across similar projects in all these years.

Let’s take the farbfeld image format as an example again. I think this captures the “spirit” quite well, because this isn’t even about code.

This is the entire farbfeld spec:

farbfeld is a lossless image format which is easy to parse, pipe and compress. It has the following format:

╔════════╤═════════════════════════════════════════════════════════╗
║ Bytes  │ Description                                             ║
╠════════╪═════════════════════════════════════════════════════════╣
║ 8      │ "farbfeld" magic value                                  ║
╟────────┼─────────────────────────────────────────────────────────╢
║ 4      │ 32-Bit BE unsigned integer (width)                      ║
╟────────┼─────────────────────────────────────────────────────────╢
║ 4      │ 32-Bit BE unsigned integer (height)                     ║
╟────────┼─────────────────────────────────────────────────────────╢
║ [2222] │ 4x16-Bit BE unsigned integers [RGBA] / pixel, row-major ║
╚════════╧═════════════════════════════════════════════════════════╝

The RGB-data should be sRGB for best interoperability and not alpha-premultiplied.

(Now, I don’t know if your screen reader can work with this. Let me know if it doesn’t.)

I think these are some of the properties worth mentioning:

• The spec is extremely short. You can read this in under a minute and fully understand it. That alone is gold.
  
• There are no “knobs”: It’s just a single version, it’s not like there’s also an 8-bit color depth version and one for 16-bit and one for extra large images and one that supports layers and so on. This makes it much easier to implement a fully compliant program.
  
• Despite being so simple, it’s useful. I’ve used it in various programs, like my window manager, my status bars, some toy programs like “tuxeyes” (an Xeyes variant), or Advent of Code.
  
• The format does not include compression because it doesn’t need to. Just use something like bzip2 to get file sizes similar to PNG.
  
• It doesn’t cover every use case under the sun, but it does cover the most important ones (imho). They have discussed using something other than RGBA and decided it’s not worth the trouble.
  
• They refrained from adding extra baggage like metadata. It would have needlessly complicated things.

The lid is on and the first saw brackets are done. Let’s see how impractical they are. I might have to add heavy chamfers to better guide them in.

I added 07 to 11: https://lyse.isobeef.org/tmp/hobelbankschubladen/

Saw this on Mastodon:

https://racingbunny.com/@mookie/114718466149264471

18 rules of Software Engineering

1. You will regret complexity when on-call
   
2. Stop falling in love with your own code
   
3. Everything is a trade-off. There’s no “best” 3. Every line of code you write is a liability 4. Document your decisions and designs
   
4. Everyone hates code they didn’t write
   
5. Don’t use unnecessary dependencies
   
6. Coding standards prevent arguments
   
7. Write meaningful commit messages
   
8. Don’t ever stop learning new things
   
9. Code reviews spread knowledge
   
10. Always build for maintainability
    
11. Ask for help when you’re stuck
    
12. Fix root causes, not symptoms
    
13. Software is never completed
    
14. Estimates are not promises
    
15. Ship early, iterate often
    
16. Keep. It. Simple.
    

Solid list, even though 14 is up for debate in my opinion: Software can be completed. You have a use case / problem, you solve that problem, done. Your software is completed now. There might still be bugs and they should be fixed – but this doesn’t “add” to the program. Don’t use “software is never done” as an excuse to keep adding and adding stuff to your code.

@prologic@twtxt.net will do. No worries, not a show stopper. I will suggest that the muted numbered list not be sorted, but latest muted first. That way we have a better idea. Maybe adding timestamps to those too? Just a thought.

Of Pointlessware and CEOs
Had a moment, to check up on some of the companies, I stopped following, get to The Browser Company and see their newest product - it’s just Chrome, with an AI chat window pop-up and that’s it. Something Canary Chrome, come with already.
I see Theo from T3.gg, making fun of it on YouTube and promoting “his” product - an AI chat app, where you can choose from multiple models, by all the popular AI companies. Something I already have a worse version of, at work and I don’t even use it.
There’s also an interview, about the future of virtual keyboards, surely this is at least actually a real thing and not more pointless horse shit. I check the website of the keyboard SDK, and it’s around 20 identical apps, that just copy the same keyboard SDK/api and slap chatgpt features on top - in the App Store, these are surrounded by chatgpt clones, that just feed the users prompts, into the real thing and put ads, next to the answers.

OIDC: Integrate Kubernetes authentication with Azure AD via OIDC (Part IV)

Image

You want to authenticate Kubernetes users by integrating it with Azure AD using OIDC. This setup involves configuring the following … ⌘ Read more

Honest Government Ads | News, Bloopers & Behind the Scenes ⌘ Read more

PEP 794: Import Name Metadata
This PEP proposes extending the core metadata specification for Python packaging to include a new, repeatable field named Import-Name to record the import names that a project owns once installed. A new key named import-names will be added to the [project] table in pyproject.toml. This also leads to the introduction of core metadata version 2.5. ⌘ Read more

@movq@www.uninformativ.de oh, you bet someone is adding them. Being as we are a small community, I could almost guess who added what. 😅

@lyse@lyse.isobeef.org oh it wouldn’t be very long, maybe that’d make for a fun blog post! i just used the same tool that the nerd font people use to add glyphs, but for a “custom glyph set” i just added. the whole noto font LMAO

The Hidden Admin Backdoor in Reddit Ads

Image

An Invisibility Cloak for Attackers: How One Admin Created a Stealth Account That Even the Owner Couldn’t See or Remove

[Continue reading on InfoSec Write-ups »](https://infosecwriteups.com/the-hidden-admin-backdoor-in-reddit-ads … ⌘ Read more

To follow up what I said minutes ago, they don’t even want you to think of the initial idea, they want you to be a mindless organism, the AI algorithm analyses and tells what you should make, down to the script, so that you get the highest number of people possible to click it and see some AI generated advertisement, blended seemly into what’s no lonher even your work.
https://arstechnica.com/gadgets/2025/05/netflix-will-show-generative-ai-ads-midway-through-streams-in-2026/
https://youtu.be/dGA6sVaGveU

@prologic@twtxt.net @movq@www.uninformativ.de I don’t even think the premise of this makes much sense. If an artist is convinced they cannot compete, with the “AI” learning models, we already have today, they must have some self esteem issues, strange opinion on what the purpose of art is, or just be someone mindlessly redrawing already established things and not be all that good at it.

It might be connected to some typically non-artists assumption, that the more time and effort the artwork took to accomplish, the more artistic it is - this can be further twisted in these peoples minds, into the “more pointless detail = more artistic art” meme. AI often ads pointless and illogical details everywhere, “so it’s obviously better, than the human artist, who drew the original”.

Some people just enjoy having the picture they wanted or having the status of an artist to brag about and don’t actually enjoy the artistic process of discovery and small decisions, made while drawing, that shape the outcome into something, only you could have created.

Adding Mastodon Comments to your Blog
Comments ⌘ Read more

Buying a TV these days, means trying to avoid endless enshitification:
-Spyware and adware
-Shitty AI upscaling/ frame interpolation
-HW that breaks after 2 - 3 years
-One off OS, dead on arrival
-Android OS, that starts lagging after the third update
-8 buttons worth of ads, on your remote

You probably have to make some kind of a compromise. I thought that was buying from some other brand like Hyundai, but that one also felt into some of those categories and just broke, after less than 3 years of use. At this point I’ll probably go back to LG and hope their HW is still reliable and the rest manageable… It has AI bullshit and knowing LG, probably some spyware you have to try your best to get rid of, can buy a remote with “only” 2 ads on it, some web-based OS shared between all their TVs, that usually gets 4 - 5 years worth of updates and works decently enough afterwards.

At this point, I’ll probably settle for anything that doesn’t literally fall apart, not even 3 years in, like the Hyundai did.

I’m thinking about adding one more white guy podcaster into the world (me)

I’m also thinking of adding eye-off icon next to every Twt that, when clicked, hides that feed (tooltip: “Hide this feed”). This would work with the filters as a “temporary additive filter” to restrict/control the current view.

“AI” automated PR reviews mostly useless junk
The team that makes Cockpit, the popular server dashboard software, decided to see if they could improve their PR review processes by adding “AI” into the mix. They decided to test both sourcey.ai and GitHub Copilot PR reviews, and their conclusions are damning. About half of the AI reviews were noise, a quarter bikeshedding. The rest consisted of about 50% useful little hints and 50% outright wrong comments. Last week we reviewed all our exp … ⌘ Read more

Announcing Linkerd 2.18: Battlescars, lessons learned, and preliminary Windows support
We’re happy to announce the release of Linkerd 2.18. The theme of this release is battlescars: we’ve  added features and updated functionality to reduce operational pain in response to real life, hard-won lessons we’ve learned with… ⌘ Read more

Pascal’s Law
⌘ Read more

Pascal’s Law
⌘ Read more