Ecological Vengeance [George Monbiot]
Let’s eradicate our life support systems – that’ll teach the liberals!
By George Monbiot, published in the Guardian 22nd October 2026
However grim the trajectory might seem, I’ve always believed that sense will ultimately prevail. As the great perils of dismantling the living world become increasingly obvious, even the most rapacious exploiters must come round. Nobody wants to live on a dead planet, do they?
There are – or were – signs that this wasn’t just wishful thinking. Since 2015, mostly thanks to China, the area of the planet being reforested has increased, while, thanks in large part to Brazil, the global rate of forest destruction has declined. The area of the Brazilian Amazon forest cleared each year is one-sixth of what it was when records began in 1988. In the past four years, as a result of Brazilian government policy, the deforestation rate has fallen by 71%. If Luiz Inácio Lula da Silva is re-elected president on Sunday, the country could reach zero deforestation by 2030. The arc of the moral universe seems to have bent towards justice.
But what my faith in human nature failed to account for was a perverse delight in destruction among a small cohort of the economic elite. There are people who appear to hate life and love death. Donald Trump’s removal of protections on public lands, the small bite – doubtless the first of many – he wants to take out of Yosemite, his assaults on the US National Park Service and the US Forest Service, his trashing of the Endangered Species Act: all are partly a response to lobbying by ranchers, loggers, frackers and miners. But this, I think, is not the primary driver.
More important to him, I’ve come to believe, is a vengeful desire to hurt. I doubt Trump hates the monarch butterfly. I’d be surprised if he knows what it is. But he does appear to hate people who love the monarch butterfly. Destroying the habitats on which this and many other endangered species in the US depend seems to be part of the “retribution” he promised. The New York Times was unable to find evidence that Trump has ever visited a national park. He probably doesn’t hate them either. But anything valued by the enemy – greens, liberals, socialists, feminists, anti-racists, “bureaucrats” and “blockers” – should be attacked on principle.
Wiping ecosystems off the map is an obvious demonstration of power. Extinction leaves a permanent mark, which is every dictator’s dream. It’s also a highly effective means of hurting those who resist him: the Indigenous people and other people of colour so often on the receiving end of environmental destruction; the regulators; the scientists and the rest of the intelligentsia; above all, people who care.
Caring could be seen as the far right’s meta-target. The “suicidal empathy” theme now crops up repeatedly in videos, newspaper columns and speeches: a professed belief that those who care about other people or species should be destroyed by those who don’t. This belief, by definition, is psychopathic. What exhausts my optimism is that, conned by shallow promises such as the use of brutal methods to address crime, people keep electing those who subscribe to it.
Physically and politically, Flávio Bolsonaro is the spitting image of his father, the jailed coup-plotter, Jair. When Jair Bolsonaro was president of Brazil, he appeared to see ecological destruction as a kind of a holy duty. The deforestation rate rose by 59% in his four years, and attacks on Indigenous people and other forest defenders, as well as invasions by illegal ranchers, loggers and goldminers rocketed. The crudest forms of extractivism – regardless of their costs, or how they might hold back all kinds of progress – were a matter of policy.
The ideology of the far right in Brazil has been described as “beef, Bible and bullets”: violence against those who resist the seizure of their resources, an ultra-conservative evangelism and the expansion of cattle ranching, which is both a potent symbol of far-right machismo and the primary driver of deforestation in the Amazon.
Jair Bolsonaro looked back with nostalgia to the military dictatorship of 1964 to 1985 – which was actively supported by the US government – during which local oligarchs could do as they pleased, and those who opposed them were tortured and disappeared. The warnings couldn’t be clearer, but Brazil seems determined to revisit its nightmares. Flávio Bolsonaro won the first round on 4 October, and is likely to become president.
If he wins the second round this week, the gleeful rampage of his supporters, catalysed by government policy, threatens not only the Amazon but the Atlantic forest in the south, the Pantanal wetlands, the Pampa grasslands and the savannah habitats of the Cerrado. This is politics as an orgy of destruction. Let’s eradicate our life support systems – that’ll teach the liberals!
Trump has been using all possible means to help Bolsonaro win. He sees Latin America as the conquistadores did – one big heap of treasure, ready for looting. The region’s far-right demagogues are only too happy to help. Mass deforestation and the sudden ecosystem collapse that is likely to result offers a finality to their politics: there’s no coming back from this. You Indigenous people, you greens, you carers: you’ll have nowhere left to hide. The world will be ours, even if it is a world of ashes.
What might Bolsonarismo teach us? First, it appears there is no limit to the perversity of the ruling class, which would rather there was nothing left to share than cede any fraction of the planet to the poor.
Second, that it possesses all the tools – social and traditional media, the pulpit and the gun – required to make its perversity look like common sense, or at least irresistible, as force is deployed. Third, that the only defence we have against suicidal gullibility is what the Brazilians call conscientizaçao: raising awareness about the relations between exploiters and exploited, and the violence that underpins them. Otherwise all that is good, trusting and hopeful in humanity can be harnessed for a war against everyone and everything.
As for the idea that nobody wants to live on a dead planet, Elon Musk, with his preposterous plans for living on Mars – “Fuck Earth! Who cares about Earth?” – has killed that too. Extending the frontier of destruction, even to the point of human extinction, is a matter of pride. The four horsemen ride again, not in cloaks but in stetsons and denim shirts, driving their cattle before them.
www.monbiot.com
Girl Genius for Friday, October 23, 2026 [Girl Genius]
The Girl Genius comic for Friday, October 23, 2026 has been posted.
Streamlined [Ctrl+Alt+Del Comic]
Not to be outdone by Sony shooting themselves in the foot, Xbox has announced 3200 layoffs as well as the departure or closure of a handful of studios because what they’ve been doing is… not working. If you ask me, things started going south the moment they shelled out such astronomical amounts to acquire Activision […]
The post Streamlined appeared first on Ctrl+Alt+Del Comic.
[Filler] 23rd Anniversary! [Twokinds]
Comic for October 22, 2026
View From a Hotel Window, 10/22/26: Aurora, CO [Whatever]

Parking lots and hospitals! This hotel picture has it all!
I’m in Aurora for MileHiCon, where I am a guest of honor along with TK Kingfisher and others. There will be panels! And signings! And hanging out! As one does. It starts tomorrow. Come on down!
— JS
Ooops, didn't get it done today. Please come back tomorrow. :-)
“I can’t believe PowerShell is actually good” [OSnews]
Earlier this year, I needed to learn PowerShell scripting for one Windows-related project, and I have tried it out a few more times on Mac. It has quickly become one of my favorite tools for automation and scripting—taking on jobs that I would have otherwise tried to do with Node.js, Shortcuts, macOS Automator, or heaven forbid, Bash scripts.
I get it now. PowerShell is great, even if you don’t use it as your shell, and even if you’re on Mac or Linux.
↫ Corbin Davenport
I don’t use the shell often enough on any of my main machines to have much of an idea about the strenghths and weaknesses of PowerShell compared to more traditional shells, but this is definitely not the first time I’ve heard a lot of praise for it from people otherwise knee-deep in the UNIX and traditional shell world.
There really must be something to this, and since PowerShell is also available on Linux and macOS, it’s pretty straightforward to give it a go without having to deal with Windows.
Urgent: Pass the ROBINHOOD act. [Richard Stallman's Political Notes]
US citizens: call on Congress to Pass the ROBINHOOD Act, which would deny use of a tax avoidance scheme by people who are VERY rich.
See the instructions for how to sign this letter campaign without running any nonfree JavaScript code--not trivial, but not hard.
US citizens: Join with this campaign to address this issue.
To phone your congresscritter about this, the main switchboard is +1-202-224-3121.
Please spread the word.
Urgent: Defeat environmental protection rollbacks [Richard Stallman's Political Notes]
US citizens: call on your senators to defeat environmental protection rollbacks in the Senate permitting bill.
See the instructions for how to sign this letter campaign without running any nonfree JavaScript code--not trivial, but not hard.
US citizens: Join with this campaign to address this issue.
To phone your congresscritter about this, the main switchboard is +1-202-224-3121.
Please spread the word.
Urgent: Support for workers in unionizing [Richard Stallman's Political Notes]
US citizens: call on your state governor to give workers support in unionizing.
See the instructions for how to sign this letter campaign without running any nonfree JavaScript code--not trivial, but not hard.
Urgent: Investigate prosecution of Broadview Six [Richard Stallman's Political Notes]
US citizens: call on Congress to investigate the DOJ's prosecution of the Broadview Six.
US citizens: Join with this campaign to address this issue.
To phone your congresscritter about this, the main switchboard is +1-202-224-3121.
Please spread the word.
Urgent: Reimbursement of Treasury for corrupter's campaign [Richard Stallman's Political Notes]
US citizens: call on the corrupter to reimburse the Treasury for his $19 million ad campaign.
Note, the reimbursement should be to the Treasury, from which the corrupter took the money, not to the individual taxpayers who paid it to the Treasury.
Urgent: Raid on Ilhan Omar's home [Richard Stallman's Political Notes]
US citizens: Stand with Ilhan Omar: condemn the raid on her home.
Urgent: Stop privatizing of Social Security [Richard Stallman's Political Notes]
US citizens: call on Congress to stop the corrupter from privatizing Social Security.
US citizens: Join with this campaign to address this issue.
To phone your congresscritter about this, the main switchboard is +1-202-224-3121.
Please spread the word.
Deportation thugs attack protesters [Richard Stallman's Political Notes]
Deportation thugs in Frederick, Maryland, attacked protesters and city officials by hitting them with sticks, and by driving cars at them.
Pressure for Australia to stop trade with Israel's colonies [Richard Stallman's Political Notes]
Australia's government is under pressure to stop trade with Israel's colonies in Palestinian territory, and stop selling weapons to Israel, including parts for F-35 fighters destined for Israel.
Australia can and should do the first two. But it can't do the part about the F-35.
Joining with other countries to manufacture an airplane involves a commitment to the joint project. When the deal was made that Australia should build certain parts, that implied a commitment that Australia would do its part of the job as needed. It cannot unilaterally impose a boycott of any country on the whole project.
So if Australia wants to build those parts for some countries only, that might imply renegotiating the whole deal.
If another country builds those parts too, perhaps that renegotiation would be easy: the parts meant for Israel's F-35s could be made elsewhere. Or perhaps the deal could be to wind down Australia's production of those parts and move them to another country, over a couple of years, after which Australia would not produce any F-35 parts for Israel.
To disregard this issue of joint manufacture could lead other countries to refuse to make such deals with Australia in the future.
Australia has other available ways to put increased pressure on Israel to respect the human rights of Palestinians, and on countries generally to respect human rights and international humanitarian law. It doesn't have to use F-35s as the means.
Request to extradite rich American donor from Spain [Richard Stallman's Political Notes]
The persecutor has asked Spain to criminalize leftist political activity with an official request to extradite a rich American donor to various lawful causes including humanitarian aid to people in Gaza.
Three errors that could help magats win [Richard Stallman's Political Notes]
Three errors that could help magats win in November's election: complacency about victory, despair, and cynicism.
Donald Trump Jr's lavish wedding [Richard Stallman's Political Notes]
*Russian oligarch close to Putin reportedly paid for part of Donald Trump Jr’s lavish wedding.*
Carbon pollution standards for coal and gas-fired power plants [Richard Stallman's Political Notes]
* The EPA is poised to formally repeal carbon pollution standards for coal- and gas-fired power plants.*
Homeless man in Queensland [Richard Stallman's Political Notes]
Thugs in Queensland (a state of Australia) ordered a terminally ill homeless man to move his van, which contained all his possessions, or they would confiscate everything. He had lost his driver's license so he could not move it. He decided he would rather die defiantly than meekly comply and be crushed, so he stabbed himself.
The thugs shot him with tasers.
Richard Dawkins mistake about chatbots [Richard Stallman's Political Notes]
Richard Dawkins made the mistake of supposing that chatbots are conscious (and intelligent) because they sound that way.
Referring to chatbots as "AI" has the tendency to lead people to suppose they are as intelligent as they superficially seem, and that suggests they are also conscient. To avoid encouraging that supposition, please join me in refusing to call them "AI". Use your share of influence on the society around you!
Powerful US utilities fund "grassroots" groups [Richard Stallman's Political Notes]
*Powerful US utilities secretly fund "grassroots" groups to sway cities away from switch to public power.*
It documents the example of a supposed "grassroots" opposition campaign in Ann Arbor, Michigan.
Investigating these campaigns and the organizations behind them may help identify the local politicians and "leaders" who hire themselves out as plutocratist tools.
Flesh-eating Vibrio bacteria [Richard Stallman's Political Notes]
Flesh-eating Vibrio bacteria are spreading around the world due to global heating. They can infect a person who eats raw shellfish, but also get into the body through an open cut or puncture in the skin.
An infection can kill the person, or cause loss of a limb.
Canadians Are Running Out Of Time To Oppose The Dangerous C-22 Surveillance Bill [Deeplinks]
Canada’s Parliament is debating a massive expansion of surveillance powers that will threaten the privacy and security of millions of people. Bill C-22, also called the Lawful Access Act, has already passed the House of Commons, and is now before the Canadian Senate.
Canadians still have an opportunity to speak out and stop this dangerous legislation. The Canadian Civil Liberties Association (CCLA) is urging all Canadians to sign its petition opposing the bill. (The petition on CCLA’s website is governed by CCLA’s privacy policy.)
Tell the canadian senate to stop C-22
As we wrote earlier this year, Bill C-22 gives the government new powers to force digital services—including telecom companies, messaging apps, and more—to help with government surveillance. Worse, it allows Canada’s Minister of Public Safety to order companies to create a backdoor to their services for law enforcement, as long as it doesn’t lead to a “systemic insecurity.” That’s a clear recipe for weakening the encryption we all rely on.
It also requires services to retain metadata for up to a year, which reveals who people communicate with, where they go, and what services they use, even when they are not suspected of any crime.
Researchers at CCLA and Citizen Lab published a detailed analysis of C-22 and its serious constitutional and cybersecurity problems. The analysis points out that the bill needs more than cosmetic changes—it calls for entirely withdrawing Part 2 of Bill C-22, the section that establishes the surveillance and data retention regime.
Bill C-22 could also expand the sharing of Canadians’ personal data with foreign law enforcement, including the United States. Canada has been negotiating a cross-border data-sharing agreement with the U.S. that would allow American police to get information about Canadian internet users without any Canadian court oversight.
Some Canadian senators have already expressed concerns about the bill, and rightly suggested, as CCLA and Citizen Lab have, that it may not be compatible with privacy protections in the Canadian constitution.
If you’re in Canada, read and sign CCLA’s petition opposing Bill C-22 today. Don’t let the Senate allow this dangerous expansion of government surveillance to become Canada’s new reality.
Canadians: defend your privacy and security
Garmin revamps and opens up Connect developer API program [OSnews]
Earlier this year, Garmin closed its Connect API developer program because it was being flooded with “AI”-generated applications to the point it couldn’t handle them anymore. What made it worse was that half of the applications were never actually used, not even once. It also didn’t help that Garmin treated every single application to the program the same way, whether it was from a hobbyist just wanting access to their own data, to a massive corporation developing a popular service used by god knows how many people.
Today, the company has relaunched the program, and it’s been considerably overhauled. While hobbyist use of the API is going to be free – which is way better than it was before – once you hit a thousand users, you’re going to have to start paying.
Still, Garmin’s shift here towards charging for API access will set a dangerous precedent for the industry. Especially for a company that bills itself as a (or the?) premium sports hardware provider. On the flip side, there’s simply no ignoring the flood of mostly AI apps that take up resources at Garmin and elsewhere to support. Heck, my inbox is flooded with these apps daily requesting reviews. It sounds like when Garmin shut off access to the API last spring, they were seeing inbound API requests at a daily scale that they’d previously only seen over a period of weeks. Simply put, there’s no good answer.
↫ Ray Maker at DC Rainmaker
The excesses of the easy availability of “AI” code generation impacts the entire industry. At least one good thing has come out of this: hobbyists can now access the Connect API developer program much easier than before.
Examining the macOS gcc binary [OSnews]
If you’ve ever written C (or c++) on a mac, you’ll know that the so-called
↫ juliethefoxcoongccis just clang in disguise. Most people (fairly) assume that this is just an alias, but this is not true! It’s a binary! Now, what is this binary? I naively assumed that it would just be shelling out toclangbut it turns out the answer is more interesting than that.
It’s all smoke and mirrors.
Unlike traditional OSs that separate user applications from the kernel, a unikernel bundles everything into a single, isolated image that runs directly on a hypervisor (like KVM, BHyve, or OpenVMM). Because it removes unnecessary drivers and background services, a unikernel is extremely small, fast to boot, and efficient with resources.
Here, we will learn how to develop and deploy unikernels built using the OCaml language and the Solo5 unikernel. These are the two fundamental components that will then enable us to develop our own applications in the form of unikernels, which we can subsequently deploy using Albatross.
↫ Unikernels in OCaml
Some light reading for the weekend.
I just built a page containing many of my books. Click on any one of them and it’ll take you to a directory of where you can get a copy. And the page then re-indexes based on which ones get the most clicks.
Thanks for reading.
Bride of Spooktactular (OoO) from L99 Games [Penny Arcade]
Running ads is essentially broken, which is why so many sites have essentially become unusable especially on mobile. If I even tried to make the site look like that the designers wouild twist my head off like a bottlecap. So, we've been working with friends by and large to get ads up that we feel good about. Bride of Spooktacular fits snugly in that place.
I just really like Brad's designs; his obsession is with asymmetrical strategy games. I could list them for a very long time, but he's the king of fighting games you play with cards, whether you think the best version of that is BatlleCON or EXCEED because he designed both. Spooktacular and its Bride posit that terrors beyond mortal ken have burst through the screens in the theatre, and those are the entities you play as - devouring horrified moviegoers by the gobfull. Every one of the original's twenty monsters or the Bride's ten additional ones is essentially playing a different game while going after the same points, with ramifications for your opponents and even in some cases the way the game plays. Evil cars, a Queen and her Hive, zombified versions of our founding fathers... this is just where it starts. This Gamefound camnpaign also offers the Double Feature as an optional add-on, which are twenty new remixes of the original game's monsters that play completely differently or even invert their mechanics. Anyway, putting up his ads was the easiest decision I made all year. Only about a week left on the campaign... if you dare, etc.
(CW)TB
[$] The end of __get_user() and __put_user() [LWN.net]
Linus Torvalds rarely writes significant amounts of kernel code these days, so the merging of a 48-part patch series from him is an unusual event. This series, destined for the 7.4 kernel release, performs some long-delayed kernel cleanup by removing a couple of the primitives used to access user-space memory from the kernel. What was once a best practice has long been superseded, but it can take time for such changes to work their way through a body of code this large.
I hope to see the The Web of Markdown idea take the next step later today or early tomorrow at the latest. Still diggin!
KeePassXC 2.8.0 released [LWN.net]
Version 2.8.0 of the KeePassXC password-management application has been released.
The new release brings a lot of long-awaited new features, many bugfixes, and several security updates. Among the major features are the migration from Qt5 to Qt6, Auto-Type on Wayland (Linux), configurable keyboard shortcuts, remote database synchronization with external tools, quick unlock with password on macOS, and quick unlock via Polkit on Linux. Version 2.8.0 is also the first version for which we ship native ARM64 builds for Windows and an experimental AArch64 (i.e., ARM64) AppImage for Linux.
See the changelog for a full list of new features, major changes, and bug fixes.
[$] Rust features in the future [LWN.net]
There are several Rust features that kernel developers have been hoping to stabilize, but Josh Triplett wanted to describe all of the other features that the Rust project is currently working on. He spoke about the topic at Kangrejos 2026, leaving the assembled kernel developers with several ideas about how to use these upcoming Rust features in the kernel. The features included refinements to the type system, small syntax improvements, and a smarter borrow checker.
Security updates for Thursday [LWN.net]
Security updates have been issued by AlmaLinux (.NET 10.0, .NET 8.0, .NET 9.0, cockpit-files, cockpit-machines, fetchmail, glycin-loaders, go-toolset:rhel8, golang, hostapd, jackson-core, kernel, kernel-rt, librsvg2, lrzsz, mariadb11.8, openexr, openssh, openssl, perl-DBI:1.641, python-urllib3, python3.12-urllib3, qt5-qtbase, rust-sequoia-sq, and xorg-x11-server-Xwayland), Arch Linux (php and php-legacy), Debian (bind9, firefox-esr, nginx, php8.2, and php8.4), Fedora (ca-certificates, dolphin, gnome-shell-extension-gsconnect, libdigidocpp, linux-firmware, nicotine+, perl-ExtUtils-Typemaps-Default, php, python-cairosvg, qdigidoc, rust-rustls-webpki, rust-webpki-root-certs, and rust-webpki-roots), Gentoo (PHP), Mageia (php8.5, php8.4), Oracle (perl-URI), Red Hat (go-toolset:rhel8, golang, grafana-pcp, kernel, kernel-rt, nodejs-nodemon, nodejs22, nodejs24, nodejs:22, nodejs:24, rhc, and sudo), Slackware (php), SUSE (aliyun-cli, bouncycastle, buildah, ca-certificates-mozilla, chromedriver, cifs-utils, cyrus-sasl, docker, firefox, gimp, git-bug, GraphicsMagick, libheif, libpng16, libraw, libsoup-2_4-1, mutt, onefetch, openexr, openssh, openssl-certs, php7, php8, poppler, python-hpack, python310, python313-Django4, qemu, rootlesskit, tiff, xwayland, and yt-dlp), and Ubuntu (c-ares, ghostscript, libsoup3, libxs-parse-keyword-perl, nss, php5, php7.0, php7.2, php7.4, php8.1, php8.3, php8.5, poppler, pyjwt, u-boot, and unbound).
New Serious PHP Vulnerabilities Released and Patched [Schneier on Security]
PHP maintainers have released fixes for two critical vulnerabilities:
PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix two critical vulnerabilities that can allow unauthenticated remote code execution. All PHP users are strongly encouraged to update immediately.
Who is at risk: all PHP installations serving web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. We consider the risk highest for mod_php, with a demonstrated exploit where an unauthenticated request can trigger the attack before any application code runs.
The vulnerabilities:
- RCE via OOM corruption, CVE-2026-109618 (GHSA-w8hw-w9fx-j79w): out-of-memory handling can interrupt PHP while internal request data is only partially initialized. Request cleanup may then treat the invalid data as valid.
- RCE via stale global state, CVE-2026-109619 (GHSA-6wmf-4rv5-p3rp): request-owned internal state can survive after its backing memory has been freed. A later request handled by the same worker may use that stale state before normal initialization resets it.
Updating PHP is the only way to regain security. Do it now.
More news.
That’s Not A Bug, It’s A Feature [Nina Paley]
The Jackalope, unlike the Stiletto, permits its handlebars to rotate 180°. Past a certain angle, the front wheel rotates the opposite direction.
In practice, this would never happen while riding; the steering angle doesn’t come close. But it could be good news for V2’s folding, allowing the handlebar to fold inward rather than forward, without overstretching the front brake cable.
Jackalope handlebars folded inward rather than
forward. This could be useful on V2.
The handlebar can also drop to the side.
GlidefFlex handlebar dropped to the side.
Either way, I need to add cam levers to the handlebar clamp bolts so they can fold in further.
The post That’s Not A Bug, It’s A Feature appeared first on Nina Paley.
Representative Line: Readable Formats [The Daily WTF]
We all love format strings for generating human readable text.
Certainly, they're a better choice than string concatenation. Even
if I have a blind spot that keeps me from remembering the
printf format tokens, I still prefer to use format
strings.
Jasmine has a co-worker that does use format strings, but they also miss using string concatenation. So they've found a way to combine them, and avoid the perils of making readable code that describes the format of their text.
myField.DataFormatString = "{0:#,##0." + new string('0', 2) + ";(#,##0." + new string('0', 2) + ")}";
Now, in their defense, I can see how this code started its life.
At some point, they wanted to make the number of decimal places a
parameter. And sure, this is an easy way to do that and retain the
intent, though this whole thing could be cleaned up with just a
simple decimalPlaces = new string('0', 2), which would
make the concatenation less confusing to read.
Related, while I was checking the documentation on the .NET formatting strings, I learned that they have a per-mille format specifier which requires writing a unicode sigil on most keyboards.
I'm sorry, but seeing string perMilleFmt = "#0.## " +
'\u2030'; in my code would be TRWTF.
The Latest Anthropic Claude Models Contain AI Text Watermarks: What Does This Mean for You? [Radar]
If you’re an instructor for the O’Reilly live training platform, you’ve got to be prepared for the unexpected. As a developer I think we all can understand the situation when a demo (you know, the one that you’ve tested a thousand times on your machine) easily decides on its own to go wrong while being demonstrated to a live audience. We’ve all been there. And of course, the biggest variable in the equation is the live Q&A portion of any course, because we actively encourage course participants to ask any question that’s on their mind.
Shortly after Anthropic announced that they were going to include AI watermarking in all text-based outputs from their latest models, I was flooded with questions during a Q&A session in a completely unrelated course about Claude Agents. Nearly everyone who posted a question in the Q&A box wanted to know more about how AI watermarking worked, and how it would affect them.
In light of that interest, I am taking this opportunity to help explain what watermarking means for you.
I don’t want to put words in anyone’s mouth, so I’ll just quote Anthropic verbatim from its announcement in August 2026:
Future Claude models will generate text that contains a watermark. This is a way of determining the likelihood that Claude was involved in writing the text, and we, along with several other major AI providers, are implementing this change to comply with the EU AI Act.
Here’s another quote from the same announcement:
Watermarking won’t be specific to Claude. As of August 2, the EU requires AI providers serving its market to mark AI-generated content. Other major model developers have signed the same Code of Practice and will be implementing their own watermarks.
The list of Claude models (at the time of this writing) that include AI text watermarks in all generated outputs are:
It won’t matter if you use Claude Desktop, Claude Code, or the API, because all of Claude’s outputs will contain the AI watermark. As a result, any code, email, blog, article, newsletter, or white paper that you write using Claude will contain a watermark, and anyone who has an AI watermark detector can easily determine if that content was AI generated.
Now let’s talk about two related terms that apply to what we’re dealing with when it comes to the AI watermarks: cryptography and steganography. Cryptography is something you encounter every day when you visit a website that uses HTTPS instead of HTTP. Your web browser automatically handles the encrypting and the decrypting for you, but what it simply does is make the content of anything that you send or receive unintelligible unless you have the key to decrypt the message. As a result, you can (for example) securely type in your credit card to sign up for an O’Reilly subscription, because we (like every other major website on the internet) use HTTPS on our website to ensure that no outsider can obtain your credit card information. Therefore, if an unscrupulous person intercepts something you send over an HTTPS connection, the contents will be encrypted and meaningless.
Steganography is completely different, and it’s what the Claude AI watermarking technology uses. Steganography is about hiding something in the right place for someone who knows where to look for it. Steganography is not cryptography, because everything about the message is in plain sight. However, you have to look deeper at the message itself to find the contents that have been hidden or obscured. The most common example would be any paper currency of a large denomination (like the $100 dollar bill). If you hold the bill up to a light, then you’ll see a “security thread” as well as a watermark of Benjamin Franklin’s face.
The Claude AI watermark uses a type of steganography based upon SynthID-Text, an open source project by Google DeepMind. SynthID-Text is a form of steganography because the signal (the information that you are looking for) hides inside the word choices of an ordinary-looking paragraph. Consequently, you can copy/paste the AI-generated code in your favorite code editor, or put an AI-generated paragraph into a Word document, an email, or a Slack message, and the AI watermark comes along for the ride.
According to Anthropic, the watermark changes only the source of randomness that the model uses when it picks among near-equivalent words, so nothing is added to the text. There are no hidden characters placed inside the AI generated text, and no extra tokens are consumed. Also, the watermark carries no information about you. This means simply that the AI watermark detector can determine if text is AI-generated, but it cannot determine whose Claude account was used to generate the text.
SynthID-Text uses a technique called tournament sampling. At each position, the model draws several candidate tokens and runs them through essentially what is a knockout bracket. The winner of each round is decided by a pseudorandom score (g-values) that comes from hashing the previous handful of tokens together with a secret key. In a body of text with hundreds of words, the text ends up slightly favoring tokens with high g-values in a pattern that only the key holder can see, and that you would never spot by reading.
“Slightly favoring” is the key phrase here. For example, the choice between the words “big” and “large” doesn’t change the meaning of most sentences, so nudging that choice to one of the two doesn’t change your text in any way you’d notice. Google tested this on roughly 20 million Gemini responses, and the thumbs-up rate differed by 0.01% (with the watermarked model slightly ahead).
As previously stated, Anthropic’s decision to put AI watermarking on its content is mandated by EU laws and regulations that took effect in 2026. Anthropic is not the only company that has complied with this regulation and, according to the EU Commission website, hundreds of companies have agreed to comply with the regulations that require AI watermarks.
For example, OpenAI has recently announced their support for watermarking AI-generated outputs. Here’s a quote from their announcement:
Over the coming weeks, we will add an invisible watermark to eligible ChatGPT and Codex text output in the European Union.
OpenAI’s text watermarking technology is called “textGrain,” and it’s inspired by the art of writing text on a grain of rice. Now, you may be asking yourself, “How much AI text is needed in order to place the watermark itself?” The good news is that OpenAI has published statistics from their own tests for AI text watermark detection. Their AI text watermark detector has 95% accuracy for passages that contain 400-tokens of text. This gives you an idea that only a few paragraphs of text is all that’s needed in order to embed the watermark.
However, since the EU mandate applies to AI-generated content (not just text), OpenAI has gone even further and released a website to let anyone know if their models have generated non-textual media, such as images and audio. I’ve tried the website myself and it correctly identifies a watermark within a few seconds.
The regulation dictating AI watermarks is not just an EU thing. The SB-942 California AI Transparency Act also requires watermarks on AI-generated content. These regulations, combined, not only apply to AI-generated text but also to images, audio, and video.
Google complied with the EU AI Act years ago, so their models have included the SynthID Text Watermark since 2024. However, they’ve followed suit with OpenAI and released a public website, SynthID.com, to allow anyone to check if any non-text media (such as images, audio, and video) contains the SynthID AI watermark. Google’s AI watermark detector allows you to check for a watermark from multiple AI providers such as OpenAI, Nvidia, Kakao, and of course, Google themselves.
In my most recent experience, I worked as a consultant for a company that was undergoing a VC-backed funding round. After the funding was publicly announced, certain people at the company were being contacted by the “CEO,” who asked them to perform a bank transfer from their personal accounts because of some made-up situation. In reality, it was a group of scammers that used LinkedIn to find the names of employees of the company, and then posed as the CEO so that employees would send money into the scammer’s bank account. Most of us were tech-savvy enough to understand that this was an obvious ploy driven by unscrupulous people. The scammers gave themselves away because they were using email domains that were not owned by the startup, so in this case, the fraud attempt was easily detectable.
However, the technology exists today where voice cloning can be easily accomplished with only a few samples of a person’s voice. So what if a more sophisticated “spear phishing” attempt was done where the attacker decided to use AI in order to clone the CEO’s voice? And what if the fake CEO started calling people (instead of sending emails)? This could lead to a much worse situation where employees think they’re interacting with (and obeying) the CEO and feel compelled to do something that could have grave financial consequences.
All the major LLMs are including watermarking in their AI-generated content, and due to recent regulations, that’s not going away. Bad actors can use AI today to perform serious attacks on the public, so having an AI watermark on any AI-generated content (text, images, audio, or video) is a very useful tool to determine authenticity.
If you want to see a live demonstration on how AI watermarks can be applied and detected on your own, be sure to attend the course Understanding AI Text Watermarking, only on O’Reilly.
Grrl Power #1506 – Let the (not 1980’s arcade) games begin [Grrl Power]
Trying something new here. I do the vertical double
pages when I need to fit more to a page or do bigger panels, but
that limits the layout options, so let’s see if this works.
Obviously the comic as posted is going to be too small, as I only
have 750px of horizontal space allotted in the web page layout
(yeah, I know, the page is very Web 1.0), and clicking on the comic
page just takes you to the next comic, assuming there is one.
It’s not an elegant solution, but if you click on the
thumbnail, it should show you the page at full size.
And just in case this doesn’t work for your particular browsing situation, here’s a free link to the Patreon version of this page, which as usual, is double res.
I don’t know what made me think of Sinistar, but I thought it’d be a fun goof to have his cousin show up. Or… his manufacturing branch Mk 1.2 or however that works with sapient evil spaceships.
And, uh… not sure what else to say about this page. Enjoy the fight!
Oh, look who it is in the vote incentive. The NSFW version is finally up at
Patreon. Plus a bonus pic.
I think she would get in trouble for doing this. She’d mess up the… floor of the waterfall? Is that what it’s called? The receiving pool? No, probably not that. Anyway, she’d churn things up and cause a ton of weird erosion.
Since you might be wondering, Niagara Falls is about 165 feet high, so Babezilla obviously doesn’t have to be full sized. I’d say she’s about 175-180 feet tall here?
Double res version will be posted over at Patreon. Feel free to contribute as much as you like.
GNU nano 9.3 was released [Planet GNU]
Version 6.0 brought option --zero, for hiding all interface
elements. Version 7.0 brought braced function names, to make
string binds more readable and stable and versatile. Version
8.0 changed Ctrl+F to mean "forward search", like in most other
programs, and added option --modernbindings for making most
bindings like in other programs. Version 9.0 brought
horizontal scrolling of the viewport. Along the way many
small issues were fixed and little improvements made.
The age of initiative [Seth's Blog]
We’re unprepared.
In high school, the quarterback isn’t allowed to call the plays, the actor isn’t allowed to write the lines and the math whiz isn’t allowed to choose what to prove.
We all grew up in the age of compliance (and indoctrination).
The long tail of the internet and the astonishing leverage of AI has made this training much less valuable.
No matter what you do for a living, there’s a machine standing by, waiting for instructions. Instructions from you, if you choose, or from your overlords if you don’t.
And following the playbook isn’t much help, because the world is changing so fast, a playbook is obsolete by the time someone hands it to you.
One reason AI got such a fast start is that it gave people seeking compliance a chance to wait for the AI to tell them what to do next. Quick, cheap answers.
AI gives bosses a cheaper (and often more compliant) alternative to hiring humans to do some tasks.
For those indoctrinated to comply, this is stressful. The stress is due to a desire to get things back to normal, to give them a chance to comply again, but right here, right now, is as normal as things are ever going to get. “Good jobs” are no longer sinecures where success comes from following instructions.
It’s an abrupt change, and winging it is insufficient. Handling this sudden transition alone is too difficult. But we have a chance to find the others, to connect and be part of a cohort that challenges, educates and encourages each other on the path to find a way forward.
We accepted that it was required to spend years being trained to handle a life of compliance. Now we have the chance to lean into the hard work we’ll need to do to thrive in an age of initiative.
How to install an app on your Commodore 64 [OSnews]
Graybeards like me remember trying to painstakingly type source code from a magazine. This is a very accurate account of what a young computer user in 1986 needed to do to get a new game for the Commodore 64, complete with an immersive emulation.
It’s time to install an app! But here in 1986, we still call them “programs,” not apps. So, you’ll want to set aside some time to get started installing a program.

gaggylolling
[$] LWN.net Weekly Edition for October 22, 2026 [LWN.net]
Inside this week's LWN.net Weekly Edition:
Perfect autumn day in the mountains spent mostly away from the computer. Still, some interesting new stuff to show tomorrow.
Introducing Our New Surveillance Self-Defense Guide: Online Privacy for Parents and Youth [Deeplinks]
The internet is a vast and confusing place no matter your age. Trying to help youth engage with it safely and privately is a complicated topic that touches on many different skillsets and ideas. But just because it’s complicated doesn’t mean it’s impossible. We’ve launched our Online Privacy for Parents and Youth Surveillance Self-Defense guide in hopes to provide a framework for finding solutions that work for you.
EFF rolls out this crucial resource as state and local governments consider ill-advised laws that cut young people off from essential information and experiences. This particularly harms vulnerable youth and marginalized groups who often find safety in supportive online communities they can't access offline. Such laws also entail age gating, which compromises the privacy of all internet users and stifles young users’ ability to learn, grow, and express themselves.
Young people have unique needs and those needs change over time. Trying to protect from everything all the time is an exhausting process, but the security community has long had a solution for this: security planning (also called threat modeling). The idea is to provide a series of questions designed to help you focus on what’s truly important. When it comes to online privacy, this is as applicable for youth and parents as it is for anyone else.
We used a security plan as our foundation for this guide because deciding what is and isn’t important is the first step we should all take when assessing our privacy risks. But this isn’t a place for quick fixes, and every young person has their unique needs and considerations. There is no single tool or technology fix that can substitute for spending time learning, and then teaching a young person, how the internet works, how to use it, what sorts of harms exist, and how to navigate those harms.
Solutions are rarely about the tools or software you use. It’s about understanding the threats and concerns you have, and then determining what steps you can take to mitigate those risks. We hope our Online Privacy for Parents and Youth guide can help provide the outline to get the conversation started.
Interoperability vs. Security: Why not both? [Deeplinks]
An open internet where people can freely build, share, and remix each other's work is a powerful engine of grassroots innovation we’ve all benefited from. In recent decades, however, corporations have taken control of an increasing share of this work, giving them a greater ability to stifle challengers and limit our choices. When regulators address this by mandating that tech giants play fair by requiring interoperability, the gatekeepers respond with a tired refrain: Playing fair puts users’ security at risk.
Unfortunately for these trillion-dollar companies, this gotcha isn’t the end of the conversation. Regulators can ensure that meaningful choice and security thrive.
Lawmakers have been catching up, recognizing that the best way to rein in big tech is to require these oligopolies to open up their platforms to independent developers. As we explained six years ago, mandating interoperability helps prevent the misuse of people’s data and enables more privacy-respecting alternatives. Tech giants, in contrast, have been arguing that our data is safer when they have exclusive control.
The European Union’s Digital Markets Act (DMA) put interoperability into law under Article 6(7): “gatekeeper shall allow providers of services and providers of hardware, free of charge, effective interoperability with” a designated Core Platform Service they operate. The language describes an unambiguous requirement to remediate vendor lockouts and anti-competitive behavior of the major service operators—it is not optional.
Apple claimed that enforcing this obligation in mobile app stores would put their customers at risk and do irreparable harm to trust in their brand. It’s an argument reminiscent of Apple’s fight against the right to repair, and in both instances the company is fighting to maintain its restrictive ecosystem to stop people from finding better deals elsewhere. Apple has long cultivated a more corporate-controlled experience with the iPhone, but this argument is now also being used for the relatively-more-open Android devices from Google.
In the same year Apple argued against the DMA, Epic Games sued Google for its restrictive terms of service and extractive policies for revenue generated in apps. Google predictably alleged that opening up its platform to other app stores it couldn’t vet would allow harmful apps to be installed. The case was ultimately decided this year in the U.S. federal appeals court for the Ninth Circuit, with the court rejecting this argument, dealing a blow to Google’s feudal security arrangement, and paving the way for third-party app stores to be delivered as apps via the Google Play Store.
Policymakers cannot take tech giants’ claims at face value. Companies have every incentive to resist interoperability requirements, because interoperability lowers practical barriers and reduces switching costs for consumers adopting competing services.
Even where companies offer credible claims from internal technical and security experts, independent experts rarely have the access and information they need to test those claims. Companies have selectively made arguments that security is harmed by interoperability, often in contexts which are to their advantage. These companies are happy to let a general misconception flourish which frames security as inherently opposed to interoperability.
This narrative is wrong. We’ve seen that when interoperability and information security are both set as essential and non-negotiable criteria, secure interoperable systems result—systems that don’t sacrifice the rich features we’ve come to expect of the services we rely on.
The cross-platform rollout of Rich Communication Services (RCS), and now Message Layer Security (MLS) on top of it is a perfect example of this, creating end-to-end secure messaging by default between Android and iOS. For RCS and MLS, Google was conveniently on the other side of the interoperability argument, campaigning Apple to adopt the standard to overcome the diminished “green bubble” experience iPhone users had when texting non-iPhone users. Once Apple finally agreed to interoperate by implementing common standards, all users benefited from improved messaging security. In cases where legitimate security concerns are raised, these can be assessed and remedied on a case-by-case basis, without sacrificing user agency.
Retrofitting interoperability into already secure closed systems shouldn’t be done carelessly: it requires regulators strike the right balance of pressure and leniency to allow the time and precision necessary to make these renovations. Any components developed with the assumption of privileged access by trusted parties (e.g. your browser engine) are particularly vulnerable to serious security risks when opened up to unaccountable third parties.
By adapting interoperability and information security as essential design principles, we can expect more safety, but also more freedom.
With regard to the DMA, when security concerns are legitimate, we
urge the European Commission to work with companies and outside
experts to offer guidance in technical implementation and provide
clarity on regulatory compliance. This approach paves a path
forward that balances the interest of legal oversight and the needs
of the companies alike.
Policymakers wishing to uproot these unfair platforms of control must do so with care and limit the impact this disruption can have. But security concerns must not act as a lever to indefinitely delay compliance. Closed systems should be impartially evaluated, and if concerns are valid, regulators can allow more time and guidance to be given to companies implementing these changes. One possibility is a tiered approach: offering leniency during an initial period where systems need to be retrofitted to abide by new requirements, followed by a subsequent and ongoing stricter observance of fair play.
Once interoperability and information security are adopted as essential design principles, further development with these rights-enhancing principles in mind will more easily follow. The result will be an internet the world deserves—where we can expect more safety, but also more freedom.
EFF to Brazil’s ANPD: Data Privacy and Free Expression Must Underpin Platform Regulations [Deeplinks]
The Brazilian National Data Protection Agency (ANPD) plays a pivotal role in the regulation of digital platforms according to new legislation approved in Brazil. Throughout this year, EFF has presented comments, filed submissions, and met with the agency to emphasize crucial guardrails that the enforcement of new regulations should ensure.
ANPD is responsible for detailing and applying obligations set in Law n. 15.211/2025, which established rules for the protection of children and adolescents in the digital space. While some provisions establish important privacy safeguards, like prohibiting advertising based on profiling of underage users, the law created mandatory age assurance mechanisms for accessing digital products and services.
We have raised alarms on the privacy and free expression issues around age-gating the internet. Age verification technology is often inaccurate and privacy-invasive. Examples also show how it’s prone to enforcement overreach, resulting in sites blocked beyond legal requirements. In the UK, providers disproportionately restricted several counseling, support and mental health sites under the Online Safety Act. Current age assurance methods risk wrongly walling off adults with no valid IDs, facial differences, physical disabilities, among others.
We highlighted these concerns in our comments and submissions underscoring that ANPD should avoid a blanket approach to age assurance obligations. Following the legislation, restrictions should apply only to products and services that are inadequate or prohibited to children and adolescents according to categories already set in regulation, with robust protections against subjective and overbroad interpretations. Guarantees such as access to information, freedom to participate in society and meaningful access to technologies also compound what constitutes the best interests of the child.
Moreover, we stressed that zero knowledge proofs alone fail to ensure strong user privacy, including safeguards that the law itself sought to secure. Our submission explains why other requirements, such as unlinkability, selective disclosure, batch issuance and processing on device, are crucial for achieving greater levels of protection and mitigating privacy harms. Minimum information being shared to the verifier and no “phoning home” to the issuer of a user’s accepted credentials are conditions that prevent actions like collusion and data sharing about the user.
We also shared inputs about the scope of the law, asking more clarity on which providers are covered by its obligations and the importance of treating differently non-dominant players like federated networks and free software applications. Without that clarity, this could negatively impact beyond gaming and major platforms that are the main target of these regulations. We elaborated on the agency’s regulation of prevention duties, the relevance of modulating them according to the type and structure of providers, and alerted them that their interpretation should not result in general monitoring obligations.
On another but related front, we sent comments regarding Brazil’s new internet intermediary rules. Here too, ANPD has a critical regulatory role after a Supreme Court’s decision and presidential decrees changed the liability regime initially set in the law known as “Marco Civil.”
With the turn to notice and takedown mechanisms and duty of care obligations, we emphasized measures to prevent censorship of protected content. These involve ensuring solid means for appeals of restricted posts, avoiding overreliance on AI-based content moderation, strictly tailoring the application of concepts like duty of care and systemic failure, and not normalizing the blocking of platforms and websites.
We raised concerns about a trend reflected in the new regulation requiring platforms to proactively report user to authorities with unclear guarantees. Finally, we urged the agency to advance essential transparency and accountability measures for enabling greater public oversight over the application of the new regime.
As we said before, platform accountability under the new rules ultimately hinges on how accountable its enforcement will be by platforms and state institutions. Rigorous commitment to fundamental rights, including freedom of expression, privacy and data protection, is required so that intended protections don’t instead lead to harms. ANPD must uphold this commitment and make sure that new regulations don’t backfire.
EFF’s State Legislative Agenda to End ALPR Mass Surveillance [Deeplinks]
Police agencies across the U.S. have deployed Automated License Plate Readers (ALPRs) to capture images of passing vehicles along with time, date, and GPS coordinates. While the technology itself isn’t new (ALPRs have existed in various forms for more than 50 years, and in the U.S. since 1998), the surveillance landscape has shifted dramatically. Rapid advances in artificial intelligence and national data sharing have transformed police ALPRs into an interconnected, nationwide tracking network. It is pitched to city councils by law enforcement and private vendors like Flock Safety, Motorola Solutions (Vigilant), and Axon as an essential tool for solving violent crime.
In reality, it is an inherently dangerous infrastructure of mass surveillance.
Since 2012, EFF has worked with others to expose the severe digital rights harms of ALPR systems. For example, we’ve recently documented how these camera networks allow law enforcement to search for immigrants, track peaceful protesters, target Romani communities, and track women seeking reproductive healthcare. Police also routinely use ALPRs for low-level matters like enforcing school residency requirements or investigating noise complaints. Many officers also use ALPR databases to stalk past romantic partners. Recent EFF analysis revealed officers using the system without legitimate justification—logging search reasons like "LOL" and "LMAO."
Understandably, the public backlash to police ALPR technology is accelerating, and state lawmakers across the country are taking action.
New Hampshire enacted the nation’s first state law on ALPR use in 2007, but technological advances and misconduct have driven even more recent legislative action. In 2026 alone, six states enacted laws that limit police use of ALPRs: Connecticut, Kentucky, New Jersey, New Mexico, Oregon and Washington.
This is a good start, but far more is needed. This blog presents a framework for state legislators who want to stop ALPR mass police surveillance:
These policy battles often unfold locally, so state legislators must ensure that state law is a regulatory floor, never a ceiling. State preemption should never force unwanted camera networks onto communities that have chosen to reject them. Local government must retain authority to enact full bans, deny funding, reject contracts, and decommission existing camera networks.
As in our previous post on ALPR policy, our focus here is ALPR mass surveillance: the continuous dragnet collection and retention of location data on innocent drivers. Different issues are raised by automated traffic enforcement (ATE) systems, such as standalone red-light or speed cameras that solely photograph and ticket specific traffic violations, without building a searchable network about uninvolved drivers. As such, state laws against ALPR mass surveillance should not cover ATE. This is the approach in at least six states: Connecticut, Minnesota, North Carolina, Oregon, Virginia, and Washington. The most common approach is to exclude ATE from the law’s definition of “ALPR.”
Of course, ATE carries risks and demands legal restrictions too. This includes tight limits on data collection, retention, usage, and disclosure—all of which should be addressed in a different statute. Lawmakers must also actively guard against vendor efforts to piggyback mass surveillance tools onto ATE contracts.
Statutory limits cannot make ALPR mass surveillance safe. Because the technology relies on the indiscriminate recording of every driver’s movements, the risks are baked into the system itself. Also, innocent motorists will be menaced by police due to false matches, bad actors will misuse location data, and sensitive personal movements will be exposed to broad government overreach. Promising harsher penalties for officer misuse cannot fix an inherently flawed architecture. Thus, state lawmakers should pursue a complete, statewide ban on ALPR mass surveillance.
First, lawmakers should prohibit all state-level law enforcement agencies from acquiring, retaining, accessing, or using ALPRs or any data derived from them.
Second, they must impose the same prohibition on county, municipal, and other local law enforcement agencies.
These prohibitions should require any agency ending an ALPR program (both state and local) to fully decommission the programs within a strict timeframe. This includes requiring agencies to: physically remove all camera hardware; revoke all user, network, and database access credentials; permanently delete all stored location data; and require vendor certification of compliance.
Third, ban the use of state funds for state or local agencies to acquire, maintain, or access ALPR systems. This must include direct appropriations, law enforcement grants, pass-through funds, and state-administered federal funds. In August 2026, Texas Governor Greg Abbott banned state agencies from spending public funds on Flock cameras.
Fourth, ban state and local agencies from installing or operating ALPRs on state-owned highways, roadways, or public properties. In August 2026, Florida’s Department of Transportation ordered the removal of all ALPRs from the right-of-way on state highways within 30 days. The order revokes all previously approved permits to install ALPRs, and bars future permits.
An outright prohibition is the only effective way to eliminate this mass surveillance. This follows the lead of municipalities across the country that have already enacted bans. However, where there’s political resistance, state lawmakers might consider a moratorium that prevents further expansion of ALPR networks.
In the absence of a ban on police ALPR mass surveillance, state legislators must restrict ALPRs to real-time comparison of passing plates to hotlists. ALPR data is simply too dangerous for police to safely store, search, and disclose. An effective way to do this, as in New Hampshire, is to require deletion of ALPR data within three minutes after collection. That means no ALPR data is stored after comparison to a hotlist, and thus that no ALPR data about unmatched cars can be searched or disclosed.
A state legislature must also reduce the harms of police use of real-time ALPRs by strictly limiting the creation and use of law enforcement hotlists.
Roughly speaking, there are two kinds of police hotlists. An agency might link its ALPRs to external hotlists created by another agency, such as the FBI’s National Crime Information Center (NCIC) or a state’s department of motor vehicles. Also, a police agency might link its ALPRs to its own internal hotlist, created by its own officers, of people under investigation. State legislators must strictly limit both.
First, limit the kinds of external hotlists that police agencies may link to. For example, ban police agencies from linking to the NCIC’s “immigration violator” hotlist, which ICE uses to hunt immigrants with the ALPRs operated by police agencies across the country.
Second, if a police agency links to external hotlists, require the agency to update that link every day. Otherwise, drivers may be detained even though they have been removed from the list. This is required by Montana, Nebraska, North Carolina, and Virginia.
Third, forbid officers from adding a plate on a hotlist, absent a warrant from a judge based on probable cause and particularity. Without this judicial check on police power, an officer stalked a potential romantic partner by placing her plate on a hotlist.
As with other laws requiring a warrant (such as the federal Wiretap Act), there should be an exception where: (1) there is an emergency involving immediate danger of death or serious bodily injury to a person; (2) there is no time to acquire a warrant; and (3) there are grounds upon which a warrant could be granted. This exception might apply, for example, when police have probable cause to believe a child has just been abducted. In such cases, the statute must require police to seek a warrant within 48 hours, and if it is denied, to immediately remove the plate from the hotlist.
Minnesota requires a warrant or an emergency to use ALPRs “to monitor or track an individual who is the subject of an active criminal investigation.” In Maine, an ALPR system may use only information based on reasonable suspicion.
Fourth, forbid officers from adding a plate to a hotlist, except in connection with a serious violent crime. This would include investigation of a murder but not pursuit of a traffic scofflaw.
Fifth, forbid officers from adding a plate on a hotlist based, in whole or in part, on: a person’s race, ethnicity, national origin, religion, immigration status, disability, sex, gender identity, or sexual orientation; their political beliefs, associations, or participation in First Amendment-protected activity; or their pursuit of reproductive, gender-affirming, or other health care. Connecticut and Washington forbid use of ALPR systems on these grounds, and Virginia forbids tracking a person based on their protected speech.
Sixth, require officers to log their entry of a plate into a hotlist. This must include the officer’s name and agency, the date of the entry, a narrative description of the reasons for the entry, any case numbers, and an upload of the warrant authorizing the entry. Oregon requires an officer to log “the specific law enforcement purpose of the entry,” and the officer’s name.
First, if the plate of a passing car does not match a hotlist, laws must require immediate deletion of all ALPR data about that car. New Hampshire state law requires deletion within three minutes. This is the most effective way to limit ALPRs to real-time identification of vehicles and drivers of interest to police, as opposed to amassing a dangerous database of the comings and goings of the entire driving public, available later for retrospective search by police.
Second, if the plate of a passing car does match a hotlist, then limit storage, search, and disclosure of its ALPR data to what is strictly necessary to the investigation that placed the car on the hotlist.
Third, require police officers, before stopping a car because of an apparent real-time match, to visually and independently confirm that the car’s plate number, plate issuing state, and other vehicle characteristics in fact do match the car on the hotlist. Many innocent motorists have been detained and menaced by police because of ALPR false positives. Confirmation is required by Kentucky, Montana, New Hampshire, Oregon, Virginia, and Washington.
Again, state legislatures should simply ban police use of ALPRs, or at least police storage of ALPR data. Third best is harm reduction through strict limits on storage, search, and disclosure of ALPR data.
First, limit the storage period for ALPR data to days, not months, and then require deletion. More than 99% of the drivers who pass an ALPR are not on a hotlist. Tracking their movements anyway, just in case they are later relevant to a police investigation, is criminalization of the entire driving population. Thus, four states already require deletion after 21 days: Connecticut, Maine, Virginia, and Washington. Even Flock has reduced its default retention period to seven days.
By “delete,” we mean permanently erase it, so it is impossible for anybody to access it again. It is not enough to merely store it in a way that makes it harder to access, such as archiving it, or transferring it from one database to another. In the words of the Virginia statute: “System data shall be purged … in such a manner that such data is destroyed and not recoverable.”
Second, limit the types of ALPR data that can be stored: just a photo of the plate, the AI-based read of the plate number, the date and time, and the location. Conversely, ban retention of photos of people in the car, and of features of the car beyond the plate as well as AI-based reads of those photos (respectively, “facial recognition” and “vehicle fingerprints”).
Many states have enacted such rules. New Hampshire bans ALPRs from “photographing or recording or producing images of the occupants of a motor vehicle.” Missouri bans integration of facial recognition into ALPR systems. New Hampshire and Montana limit ALPRs to “the sole purpose of recording and checking license plates.” Minnesota provides that “data collected by an [ALPR] must be limited to” plate numbers; date, time, and location; and pictures of plate, vehicle, and surrounding area.
First, laws should ban “geofence” searches, which are searches in which police use ALPRs to identify all of the drivers present at a particular time and place, based on police claims that one of them might be the suspect they are looking for. Even a warrant cannot justify such general searches, because the Fourth Amendment requires warrants to “particularly” describe the person or car being investigated. These dragnet searches of stored ALPR data are the modern-day equivalent of the colonial-era “writs of assistance,” against which our founders fought a revolution to end.
Second, laws should forbid officers from searching stored ALPR data, unless they first acquire a warrant from a judge based on probable cause and particularity. The constant revelations of bad police searches of ALPR data demonstrate the need for—at the very least—judicial control over this dangerous surveillance technology. A federal judge in Oklahoma recently held that the constitution requires this judicial control, because ALPR mass surveillance invades reasonable expectations of privacy. EFF has filed lawsuits making this demand in California and Wisconsin, along with local ACLU affiliates: SIREN and CAIR-CA v. San Jose, and Wisconsin Council of Churches v. Milwaukee, Racine, Kenosha, and Green Bay.
Three states (Minnesota, Vermont, and Virginia) require reasonable suspicion of a crime before searching ALPR data, and a fourth state (California) requires this from its highway patrol. This is a step in the right direction, but not enough: the decider must be a judge, and the test must be probable cause.
Third, officers should be prohibited from searching stored ALPR data, unless they are investigating a serious violent crime. On the flip side, ban searches for immigrants, protesters, or traffic scofflaws.
Some states have moved in this direction. Missouri limits use of ALPR data “criminal justice” and “lifesaving efforts.” North Carolina bans its use for traffic enforcement. Connecticut bans its use based on race and other protected classes, to identify First Amendment activity, for immigration enforcement, or because of access to reproductive or gender-affirming health care. Idaho bans its use for political activity.
Fourth, police officers must be required to log their searches of stored ALPR data concerning a particular car. This must include the officer’s name and agency, the date and time of search, a narrative description of the reasons for search, any case numbers, and an upload of the warrant authorizing the search. The officer must write the narrative in their own words. A drop-down menu of reasons is no substitute, because it is too easy for officers to dodge an explanation of the actual reasons by clicking a pre-written “reason.”
Many states require officers to log their searches of ALPR data, including California, Connecticut, Idaho, Maryland, Missouri, Montana, New Hampshire, Oregon, and Virginia. In Virginia, this must include an officer’s documentation of both their “specific purpose” to search, and the “associated call for service or case number.”
The “disclosure” limits below must broadly address sharing from an agency that collected ALPR data to another entity. This includes an agency opening its database to access and search by another entity. It also includes an agency transferring data from its database to another entity’s database.
First, ban disclosure of ALPR data to any federal or out-of-state agency. Federal and out-of-state agencies often lack the necessary protections of the driving public. Connecticut forbids disclosures to the federal government or agencies in 46 states, unless they have a warrant. California forbids disclosures, unless otherwise permitted by law.
Second, ban disclosure of ALPR data to another agency, unless it follows all of the rules above for an agency’s search of its own data (that is, the ban on geofence searches, the requirement of a warrant, the limitation to investigation of serious violent crimes, and the requirement of an audit trail).
Some states have taken steps in this direction. Utah requires, as a condition of disclosure to a government entity or a defendant in a criminal case, a court order finding reasonable suspicion of crime. Washington forbids disclosure “except as required in a judicial proceeding.” Minnesota and Virginia require the disclosing agency to find reasonable suspicion. Minnesota and Connecticut forbid disclosure unless the receiving agency follows the rules applicable to the disclosing agency.
Third, place strict limits on participation in a multi-agency disclosure network, such as Flock or Vigilant. Connecticut forbids participation “in a system or network that shares” ALPR data, unless it requires all participants to affirm in writing that they will not use or re-disclose that state’s data except in compliance with that state’s laws. Connecticut also forbids “bulk” data disclosure, and Maryland forbids data “upload” to another agency.
Fourth, ban disclosure of ALPR data for purposes of investigating acts and statuses that are lawful in-state. Three states (Illinois, New Jersey, and New Mexico) forbid disclosure to investigate immigration status. Two states (Illinois and New Mexico) forbid disclosure in investigate healthcare that is lawful in-state. One state (New Mexico) forbids disclosure to investigate protected assembly, petition, and speech.
Fifth, ban any sale of ALPR data. Six states do this: Arkansas, Maryland, Oklahoma, Utah, Virginia, and Washington. California forbids its highway patrol from doing so. New Mexico forbids any disclosure to a private entity (or indeed to any non-law enforcement agency). Data brokers are a menace to privacy and other human rights.
State lawmakers must ensure that the public has access to ample information about the ALPR mass surveillance in their communities. Many people will use this information to resist ALPRs.
First, state laws should require local governments to provide at least 30 days of public notice before spending funds, accepting grants or private donations, or entering into any contract or pilot program for ALPR technology. All proposed vendor contracts and funding sources must be publicly disclosed prior to approval. This helps local officials to exercise their procurement power to reject ALPRs.
Second, laws should mandate the creation of a centralized, public-facing state registry of all police agencies using ALPRs, and the specific locations of all police ALPRs. Sources like DeFlock and EFF’s Atlas of Surveillance include crowd-sourced maps of ALPR technologies, but they are not exhaustive. This was one of the provisions in Minnesota Minn. Stat. § 13.824, which in part, requires police agencies to notify the state within 10 days of installing any ALPR, and requires a state agency to aggregate this information and publish a master list of the locations of all ALPRs (unless a judge determines that disclosure of a particular ALPR’s location poses a genuine security risk).
Third, mandate regular, independent, public audits of agency ALPR use, access logs, and query justifications to ensure compliance with all applicable laws and policies. Five states (Idaho, Minnesota, Montana, Virginia, and Washington) require regular audits, ranging in frequency from monthly to biennial. Three states (Idaho, Maryland, and Washington) require audits of access logs. Minnesota requires an independent auditor and public access to the results.
Fourth, laws must require each agency operating an ALPR system to publish regular reports on its website detailing key operational metrics. Six states require such reports annually: Connecticut, Maryland, New Hampshire, New Mexico, and Vermont. Arkansas requires them twice per year, and Oregon requires them monthly. These states variously require reporting of: the number of ALPRs, and a list of the locations of fixed ALPRs; the number of hotlists used, and a list of them; the number of plates scanned; the number of apparent matches to hotlists, and how many were actual matches; the number plate reads stored; and the number of searches of stored data, broken down by the purpose and agency of search.
Finally, any new ALPR legislation must maintain a proper balance between transparency and privacy in the use of public record acts (PRAs) to obtain ALPR information. Public records and public scrutiny of ALPR programs have shown that people are harmed by these systems. So lawmakers should not cut off access to public records that document these abuses. For example, the public should have access to operational policies, audit logs, vendor communications, and aggregate statistics. EFF opposes blanket exemptions from PRAs that block public oversight of APRs—such as recent bills in states like Arizona. The better approach to protecting individual location privacy is a flexible, case-by-case balancing test already provided by many PRAs. Also, when a document contains both exempt and non-exempt information—like an audit log that contains both motorists’ plate numbers and officers’ search reasons—open records laws should require disclosure of the latter while withholding of the former.
State lawmakers should adopt three additional bans to curtail the footprint of police ALPR surveillance.
First, ban the placement of ALPRs or the collection of ALPR data near healthcare facilities, immigration services, schools, places of worship, courthouses, food banks, and other sensitive locations. Washington and Connecticut do this.
Second, ban police from purchasing ALPR data. Utah and Washington do so. Also, prohibit police from acquiring ALPR data from a private entity, except by means of a warrant. Washington does so. Utah took a step in this direction, requiring a court order based on reasonable suspicion. Absent this type of rule, police evade limits on seizing data from third parties by simply purchasing it from brokers.
Third, ban police and their vendors from using ALPRs or stored ALPR data to power predictive policing technology. EFF opposes such technology and urges state legislatures to ban it. ALPR companies have been providing law enforcement clients with an “analytics” feature, which ingests data from across police agencies, and produces a report of alleged crime trends, hotspots, and corridors. State legislators should prohibit this dangerous use of ALPR systems and data.
A law without strong enforcement is just a piece of paper. EFF recommends three kinds of enforcement measures, all of which appear in existing ALPR statutes.
First, all privacy laws need a “private right of action,” meaning ordinary people can sue a police department that breaks the law. An excellent model appears in the federal Wiretap Act. It expressly authorizes a lawsuit by “any person” whose personal information is processed “in violation of” this law. Privacy harm is harm, and so a person should have their day in court, even if they cannot prove a collateral harm, such as physical injury or economic loss. Moreover, the Wiretap Act provides a full arsenal of remedies to a successful plaintiff, including injunctive and declaratory relief, liquidated and actual damages, and attorney fees.
At least three states enforce their ALPR statute with some version of a private right of action. These are good first steps but need improvement. Washington comes closest: it allows suit to enforce all ALPR rules and provides all remedies. Unfortunately, the plaintiff must prove “injury,” which may shut the courthouse doors to some people whose data is unlawfully processed. Connecticut allows suit by a person “aggrieved” by violation of some ALPR rules. But a person should be able to enforce all rules, and should not have to prove they were aggrieved. Oregon allows suit against a police vendor that “intentionally or with gross negligence” uses or discloses ALPR data in an unlawful manner. But this does not allow any suit against police, or even against a vendor that systematically violates the rules through ordinary negligence.
Second, privacy laws applicable to the police commonly ensure enforcement through the “exclusionary rule.” This means that if evidence is gathered in violation a privacy law, it must be excluded from court proceedings. This is sometimes called “suppression” or “inadmissibility.” The federal Wiretap Act has a strong version of this rule, clearly excluding evidence derived from violations of all rules. The so-called “good faith” exception has weakened many exclusionary rules, so ALPR statutes should expressly reject this exception (though some courts have interpreted some statutory exclusionary rules to have no good faith exception).
At least three states enforce their ALPR statute with some version of the exclusionary rule. Again, these are good first steps but need improvement:
Third, police agencies and their private contractors that recurringly violate ALPR rules should be forbidden from using ALPRs at all. In New Hampshire, if an agency “repeated[ly]” violates the ALPR statute, the state department of justice may “seek an injunction banning [its] use” of ALPRs. In New Mexico, if a vendor “fails to comply with” that state’s ALPR law, it “may be subject to … suspension of authorization or termination of access.”
Some states impose workplace discipline or criminal penalties on officers who violate ALPR laws, including Connecticut, Idaho, and Missouri. This is no substitute for the three types of strong enforcement measures above. ALPRs are a systemic problem requiring institution-wide enforcement of legal constraints, and not just episodic sanctions against individual officers.
Mass surveillance ALPRs fundamentally threaten digital rights, making an outright statewide ban on police ALPRs the only effective way to fully protect privacy and safety. The next best thing a legislature can do is limit ALPRs to real-time comparison of passing cars to hotlists, by banning storage of ALPR data beyond a few minutes. If a legislature allows storage, it must impose a tight deletion deadline (days and not months), and strict limits on search and disclosure. A legislature must also ensure transparency and enforcement.
For convenience here is a concise list of EFF’s ALPR state legislative goals.
Steinar H. Gunderson: Decompilation patterns, part 18: Signed division [Planet Debian]

As promised, the last one (for now?), and this one blew my mind the first time I saw it:
var_v0 = sp4014;
if ((s32) sp4014 < 0) {
var_v0 = sp4014 + 0x7FF;
}
temp_s1 = 0x800 - (sp4014 - (((s32) var_v0 >> 0xB) << 0xB));
There's actually two things going on here. First, the compiler is faking a signed division using shifting (which rounds down) as a building block: If the value is negative, then you add a bias to make shift into round-up. (The right-shift by 0xB, or 11, is exactly a division by 0x800.)
So this means what we're looking at is:
var_v0 = (s32) sp4014 / 0x800;
temp_s1 = 0x800 - (sp4014 - var_v0 * 0x800);
which reduces further to:
temp_s1 = 0x800 - ((s32) sp4014 % 0x800);
Tada. That's it. Now you know all the tricks, except those that I don't know or that I forgot. You don't need the LLM. Have fun. :-)
Edit: Corrected a thinko; of course, MIPS has signed division. This is for power-of-two optimizations only.
The Tri-Fold Augur [Penny Arcade]
Bungie is between Scylla and Charybdis, two words I spelled correctly on my first try. What are these two things? We don't need to go into all that - just know that they're both unwelcome, and you don't want to be there. Bungie's thing is to make its own weird and peerless shit, they've been doing it since the Mac, and maybe on some level there might be a perceived loss of face or identity associated with hauling somebody else's rope. Fuck allat. This is Live To Fight Another Day shit. Get the skunkworks popping while Lucasfilm keeps the stove warm and fends off Sony with a chair and a whip. The deal is bigger than paper, as choosing to slot work with the leading console manufacturer is just a good thing to have in your back pocket. And we already know Bungie would crush it: Renegades, their collab/crossover/Star Wars fic, was sick to death. Indeed, I propose that this is so cosmic, powerful, and correct that it represents an auspicious stellar configuration - something as good as Scylla and Charybdis, whatever they may be, are bad.
The Big Idea: A. T. Sayre [Whatever]

Everyone remembers Scrooge as a mean, cold-hearted man, even though his entire arc is that he becomes a better, kinder man and develops empathy. Author A. T. Sayre’s main character in The Asterist is quite the Scrooge, too, but maybe we’ll end up remembering him in the better light he deserves by the end.
A. T. SAYRE:
Asterist, noun /ass ter ist/ – someone who lives on an asteroid. Often used as a pejorative for people posted on solitary observation or research stations in remote areas of space.
The Asterist is my second novel. Which, just like my first one, was only supposed to be a novella, but just kinda kept going. Seems to be the way it works for me—aim for a novella and miss. Not the most orderly ways to operate, I know, and I suppose one of these days I have to guestimate how long something I plan to write is going to be correctly. Small goals…
It has been a wild turnaround on it, too. I finished the rough draft of this one less than a year and a half ago, in March ‘25. Then came the beta readers, rewrites, reworkings, more rewrites, etc., the whole process, which was concluded sometime late last summer. And here it is already out in the world. It’s actually been less than a year since The Asterist was even sent out to publishers. For those of you reading this who don’t take part in the sausage making part of literature, that is amazingly fast, especially for a nobody doofus like me.
I have many talented friends with marvelous books they have put their everything into that have been out on submission for years with no luck yet. Which is how it’s supposed to work normally. Big name authors can turn things around quickly, of course, because they have names built on track records of proven quality and success, but I have nothing like that. Yet The Asterist took just barely over a year and a half from the first typing of THE END to in your local bookstore. I like to think that reflects something about the book, about just how good it actually is. Because I think it’s fantastic, far better than something a doofus should be able to write.
The big idea of The Asterist is about empathy. Specifically, about the expansion of empathy out to embrace the other. It’s easy to feel for someone who you see as in your ‘tribe’ already, people do that all the time. For your family, for your friends, for your neighbors. They’re like you, they look like you, they share a lot of your same values, so you can easily grasp where they are coming from and can feel their pain and want to help. There’s nothing whatsoever wrong with that; in fact it is glorious. After all, in the grand scheme of things, why are we here if not for each other?
But the farther we get from these commonalities, the easier it can be to feel nothing real for someone and what they might go through. Even to be somewhat hostile. I don’t think I need to give any examples of this kind of thing today for all of you to know exactly what I am talking about. Suffice to say, the fear of the other is alive and well in our world. It was an important instinct to have a hundred thousand plus years ago, when a stranger showing up in your valley might stretch the limited resources you could utilize too far and put you and your loved ones at risk of starvation.
But apart from some extremely isolated patches of this planet, no human has lived in that kind of world for eons. The instinct remains, though. And it’s continued existence in our psyche might be one of the biggest obstacles left to our advancement as a society. One I firmly believe we must, if not extinguish from our minds, at least learn to go beyond.
This is what William Jeffries, the hero of this book, the titular asterist himself, is doing. At first blush he is not the type of person you would expect to get life lessons about empathy from. He’s a bitter, foul-mouthed, even somewhat mean-spirited man, beaten down by a life that did not turn out as well as he had hoped, which he responds metaphorically to with a perpetual middle finger. It’s a life of grievances, excuses, and petty snark. If there is any type of person who would embrace his fear of the other, it would be him.
Then he is confronted quite suddenly with the existence of something that is most definitely an other, a whole new and very different alien species, one that he has nothing remotely in common with. And despite his cantankerous, misanthropic character, he learns to get past that sense of otherness, and to grow and evolve his feelings toward them, to see them as a being worth love and care. And he doesn’t do it because the fate of the universe depends on it, or humanity’s, or even just his own life; he’ll be just fine no matter what, so will humankind, and the universe like always barely notices anything any of us ever do.
There is nothing bigger at stake here. He could very easily wash his hands of the whole situation at any time and he knows it. But he doesn’t—he stays involved, he fights, he struggles for this other thrust into his presence, puts himself at great risk in various different ways for them. And no matter what rationale he may give at any given moment as to why, in truth he does it all for no other reason than because deep down he knows that is what he should do.
It is a level of character that I wish I felt certain I had myself. I have the same antiquated fear of other instinct in me as everyone else does. I try to move beyond it, to ignore it, sometimes more successfully than others.
Would that we all would do the same, and try to be more like the bitter, foul mouthed, and mean-spirited William Jeffries.
The Asterist: Amazon|Barnes & Noble|Bookshop|Powell’s
Today's PHP Security Release, and How We're Strengthening PHP Security (PHP Foundation) [LWN.net]
The PHP Foundation has put out a blog entry explaining how the vulnerabilities disclosed today came about and why they took so long to fix.
To fix the OOM problem, the PHP security team developed several competing approaches, but each came with its own trade-offs: backward compatibility breaks, new denial-of-service potential, or requiring changes to many third-party extensions which seemed impossible to coordinate. The PHP security team, operating on consensus, struggled to choose between these and feared the repercussions of shipping the wrong choice. Combined with the lack of a known path to remote code execution and the small team of core developers with the necessary deep knowledge of the engine occupied with many responsibilities, this decision process caused work on a fix to stall and restart repeatedly over months. We won't pretend otherwise: the delay was a structural failure, caused by both the security team's decision process and its lack of resources.
Pluralistic: Adversarial interoperability is a team sport (21 Oct 2026) [Pluralistic: Daily links from Cory Doctorow]
->->->->->->->->->->->->->->->->->->->->->->->->->->->->->
Top Sources: None -->

Enshittification is particularly galling because (in theory, at least), digital technology should be really hard to enshittify.
That's because the only digital computer we know how to build is the "Turing-complete, universal von Neumann machine," which is to say, a calculating engine capable of computing every valid program. In some deep, important, foundational sense, every computer is the same as every other computer. Sure, they vary in terms of speed, storage and RAM, but given enough time and electricity, every computer can run every program.
This has profound implications for enshittification. Say a tech boss takes away a feature you value (as when Sonos pushed an update that removed nearly all the functionality from its "smart" speakers), or adds a feature you hate (like when Chamberlain blocked third-party apps from controlling its garage doors so it could force its customers to view seven ads before they could open or close their garages). At that point, a programmer can write an "interoperable" program that restores the good feature or blocks the bad one.
This program can be costlessly and instantaneously distributed to every affected technology user, and those users will likely pay something for it. After all, enshittification is a way to shift value away from technology users to tech companies, which makes the case for you paying for disenshittification technology that wrestles that value back.
All of that means that, in a state of nature, companies that are contemplating enshittification need to worry that their greed will tempt new companies to enter the market and poach their customers and suppliers. This alone might be enough to frighten companies off from enshittificatory gambits, and if companies press ahead regardless, then they open market opportunities for better companies that can costlessly, instantaneously usurp the original manufacturer's relationship with their entire affected customer base.
That's how it should work. But in 1998, Bill Clinton signed the Digital Millennium Copyright Act, and Section 1201 of the DMCA establishes a felony (punishable by a five-year prison sentence and a $500,000 fine) for reverse-engineering and modifying technology without the manufacturer's permission. Then, the US Trade Rep spent the next 25 years making sure that every US trading partner had an identical (or even worse!) "anticircumvention" law:
https://pluralistic.net/2025/05/26/babyish-radical-extremists/#cancon
The result is a grotesquely asymmetrical digital world, in which companies are free to use the flexibility of digital computers to downgrade or brick your digital devices, but where you commit a crime if you avail yourself of a countermeasure to get more out of something you own. This is the core technological factor at play in enshittification.
Enter AI. Thanks to vibe-coding, everyday people are rolling their own software for their devices and building the tools to shatter the digital locks that manufacturers use to block disenshittification. An excellent article by 404 Media's Jason Koebler runs down some of these hacks, including drop-in replacements for smart TV software that blocks the endless ads and surveillance that have made TVs all but unusable:
https://www.404media.co/reverse-engineer-anything-is-the-new-wild-west-of-ai/
These AI tools mix several techniques to disenshittify users' devices. One major component is automating the installation of existing alternative firmware for these devices that have been (possibly illegally) created by hobbyists and uploaded to various code repositories. Installing these alternative OSes is typically a gnarly task, requiring the user to do a lot of complex, fiddly, highly technical work to bypass their devices' digital locks.
In a world without anticircumvention law, a company that sold alternative OSes could hire a ton of programmers and UX developers to smooth over this process, but this is beyond the reach of a typical hobbyist or even a community of hobbyists, especially if they must operate in the shadows, under the threat of civil and criminal liability.
There's a useful analogy here to the trajectory of desktop versions of GNU/Linux. The first time I tried to install Linux (on an original iMac, in the late 1990s), the installation process included a multi-week post-installation wrangle that saw me (often unsuccessfully) compiling key modules from source code and then painstakingly configuring them to get the computer's graphics and I/O working reliably.
Fast forward 30+ years and installing Linux is trivial, thanks to highly capitalized companies like Canonical (makers of Ubuntu, the flavor of Linux I've used for nearly 20 years now). Installing Ubuntu today merely requires that you download the OS to a thumbdrive, reboot your computer using the drive as a startup disk, and click "install." Canonical's installer automatically hunts down the correct software for your hardware and configures it. Canonical writes and contributes to a lot of parts of the Linux OS, but the most important work it does is the fiddly, painstaking, labor- and capital-intensive work of perfecting that installer so it Just Works.
Much of what a vibe-coded jailbreaking tool does is stand in for Canonical, but for hobbyist OSes for smart TVs and speakers and many other devices. These LLMs patiently research every weird error and peccadillo and parse through message boards and logfiles detailing other hobbyists' struggles to get the code working and methodically apply and adapt those solutions until your device Just Works.
Some of these vibe-coded interop tools go farther than that. According to Koebler's coverage, some device owners had their coding assistants scratch-build entirely new, heavily customized OSes for their devices, complete with bypasses that allow this new code to be installed despite the manufacturer's countermeasures which are designed to prevent this. Delightfully, many of these users have created software that revives their bricked, discontinued devices. This poses the possibility of a world in which manufacturers no longer have the last word in your use of your own property: the mere fact that the manufacturer lost interest in a device and killswitched it does not mean that you must consign that valuable device to a landfill to become immortal, toxic e-waste.
All of this is good news. Some of the most sophisticated jailbreaking tools (such as those on the super viral "Reverse Engineer Anything" Github page) run locally, on your own computer, without invoking the "frontier models" that the big, awful AI companies have created:
https://github.com/morluto/rea
This is good even if you're just modifying your own devices to get them to more closely conform to your own use-case. LLMs are genuinely good at coming up with the abstruse and obscure configuration lines and other incantations to get your technology working. Recently, I used a local model to fine-tune the power-management on my new laptop in ways that go beyond the options that are exposed through user-friendly graphic interfaces. The LLM spat out a grub "GRUB_CMDLINE_LINUX_DEFAULT" line that (again) Just Worked.
The last time I had to do this, I spent days painstakingly trouble-shooting options by trial-and-error. Using a chatbot to fill in the gaps left by decisions about which configuration options to place within reach of regular users and which to reserve for power-users has made my computer much more useful to me for the things I want to do, like writing and making collages.
The reality is that it's just not practical for technology developers to turn every conceivable function of your computer into a simple-to-use, accessible tool. A large part of technology design is about leaving things out (or, as my favorite Eno Oblique Strategy goes, "Be the first person to not do something that no one else has ever thought of not doing before"). No matter how thoughtful and diligent a technology designer is, they will never fully anticipate the needs and exigencies of their users. That's why the motto of the disability rights movement is "Nothing about us without us."
The users of technology know more about their use-cases than can ever be captured through a requirements gathering exercise and user testing. One of the best and proudest legacies of technology is the lineage of "user-friendly" programming tools that let nontechnical people design their own applications that exactly met their needs, from Hypercard to Visual Basic to Scratch, a lineage that vibe-coding tools are arguably part of:
https://pluralistic.net/2026/09/25/other-people/#right-there
But these tools are not perfect (nothing is). For all that Hypercard lets you do many things that would otherwise require a skilled programmer, it was also always limited relative to, say, writing MacOS code in Objective C. Your Hypercard program might do exactly what you needed it to, but slowly, and sometimes unreliably, and with serious limitations, such as a relatively low ceiling for the number of records you could add to a database.
Vibe-coded personal apps aren't necessarily subject to these limitations, but they come with some significant risks. Vibe-code can have serious security vulnerabilities that expose the user to things like identity theft or sextortion. It's conceivable that a vibe-coded garage-door opener app might make it possible for attackers to open your garage door when you're not home (or worse, when you are!). Depending on your risk-tolerance and expertise, these might be acceptable prices, or they might be too high.
But it's important to clearly identify the problem here: if the alternative OS you install on your smart TV exposes you to privacy-invading hack attacks, the problem is the defect in that software. The problem isn't that you had the temerity to rip out the manufacturer's own software and replace it with code of your choosing. You bought that TV, it's yours, and you don't owe the manufacturer an obligation to expose yourself to its own, built-in, intentional surveillance and invasive ads.
Here's a parallel: you have the right to put any shoelaces in your running shoes. Sure, Nike might prefer you to lace up your Jordans with its expensive OEM laces, but that's Nike's problem, not yours. Now, Nike might argue that by using no-name laces, you run the risk of having a lace break while you're running, which could also break your ankle. That's certainly a possibility: shoelaces do break, and Nike might be justifiably proud of the quality of its laces. But if your generic laces snap (and so does your ankle), the problem is that the shoelaces you chose were defective. The problem is not that you chose someone else's laces.
Your stuff is yours. You can put anyone's milk on your cereal, not just the milk that Kellogg's endorses. If the milk you choose is sour and you have to pour your cereal down the toilet, that's too bad, but it doesn't mean that Kellogg's should have the right to shame you for having the temerity to choose the milk you preferred, and it certainly doesn't militate for DMCA-style enforcement to coerce you into using Kellogg's official milk in the name of protecting you from food wastage.
I raise this because there's a live debate over this subject, which is well represented in the latest 404 Media podcast:
https://www.youtube.com/watch?v=UbG1qwxMtU0
In the podcast, Koebler and his 404 co-founder Joseph Cox express misgivings about various possible uses of "slop interop." Koebler discusses the fact that John Deere sells the same physical tractor at many different price-points, depending on which software a farmer chooses, and raises the possibility that a farmer might vibe-code software that replicates the high-end functionality without paying for it. Koebler discusses two possible downsides to this: first, that the vibe-coded software might be defective and expose the farmer to risk; and second, a question about whether it's fair or just for a farmer to get those additional functions of their tractor without paying for them.
I think the first objection is entirely legitimate. The software you run on your expensive tractor should be secure, both for your own benefit and for the security of our food supply. That's actually a pretty good reason to ditch John Deere's own software, which is very insecure:
https://pluralistic.net/2022/05/08/about-those-kill-switched-ukrainian-tractors/
But I think the second question – whether it's legit to get this functionality without paying John Deere for it – is spurious. Sure, if John Deere provides you with that functionality, then they can send you the bill for it. But if you provide yourself with that functionality, using software you procured independently of John Deere, then John Deere has no right to get paid for it, and they certainly shouldn't have the right to stop you.
That tractor is yours. The fact that John Deere manufactured it is irrelevant. If you pay a contractor to build a house for you and later on pay a different contractor to add another bathroom to it, you don't owe the first contractor anything. It's your house (and if that bathroom has a leaky toilet, that's a matter between you and the second contractor, and not a reason to force you to only use your original contractor).
The law defines a narrow slice of functions that manufacturers get to control: those ideas that a patent examiner deems "novel, useful and nonobvious." It's legit (and good) for commercial operators to copy and improve the ideas of their rivals and competitors. It's why skilled tradespeople cluster together in the same geographic area.
Take Clerkenwell, the neighborhood in London where precision machining was invented by the jewelers and machinists who clustered there during the Longitude rewards. The reason all those competitors sought such close promixity to one another was because they wanted to copy the new techniques their rivals were developing (even if that meant that their rivals would be able to copy them):
https://en.wikipedia.org/wiki/Longitude_rewards
If you're old enough to remember the advent of spreadsheets and the rollout of Visicalc, Lotus 1-2-3 and Excel, you'll know that every time a software vendor invented a new spreadsheet feature, all the other ones immediately copied it. This wasn't bad for spreadsheets: it was good for spreadsheets, just as copying your competitors was good for precision machining in Clerkenwell.
Everything from GNU/Linux (a feature-for-feature clone of AT&T Unix) to SAMBA (a plug-compatible clone of Microsoft's SMB) to iWork (file-compatible, feature compatible clones of MS Office's apps) came about through this "adversarial interoperability." What's more, the heyday of this kind of adversarial interop was also the heyday of disenshittification, the era in which any anti-feature installed by your existing vendor could be countered by a disenshittifying patch from a new one:
The question of whether vibe-coded software is any good is separate from the question of whether it's good to replace the software in your devices, even if you replace it with software that has features that the manufacturer would normally charge a premium for. You are under no obligation to arrange your commercial affairs to the financial benefit of manufacturers, and anyone who claims to be surprised that someone they sold a device to used it to benefit themselves at the manufacturer's expenses is either disingenuous…or unserious. You bought it, it's yours.
But just as this vibe-coded adversarial interop has drawn both valid and spurious criticism, it's also drawn excitement that is partially justified and partially overblown.
When it comes to reviving bricked devices or rooting out the surveillance and ads from your smart TV, vibe-coded interop tools are genuinely exciting. These are the kinds of enshittification that can truly be remediated with individual jailbreaks.
But the real, meaty examples of enshittification can't be addressed on an individual level – they require systemic fixes. If you jailbreak your iPhone so that it can use alternative app stores, that fact is not sufficient to cause those alternative app stores to come into existence. If we want to stop Apple from levying a $100b "app tax" on the digital economy, it's not enough for individuals to vibe-code their own iPhone patches. We need to repeal the law that bans jailbreaking iPhones, so that a would-be alternative app store can raise capital and pay programmers and tech support staff and salespeople to assemble rival catalogs of software and help customers figure out how to get up their phones to use it.
The same goes for jailbreaking your printer so it accepts generic ink. Sure, this may work for you if you're up for refilling your own cartridges, and I'm sure that you can find someone on Alibaba who will sell you ink by the gallon. But the mere fact that a few users have secretly and privately jailbroken their inkjets won't conjure up a generic inkjet cartridge manufacturing sector. For that to happen, we need to make jailbreaking printers legal, not just possible.
Indeed, if we want to improve the quality of all that jailbreaking code the chatbots are writing and circulating, we need to be able to put those jailbreaks in public repositories for public inspection and public critique. It's possible for some of the code produced by an LLM to be slop, and for other code to be fine, and for yet a third tranche of code to be remediable slop that can be made robust and reliable through auditing and refactoring. You can't figure out which is which if you have to keep that vibe code a secret on pain of a long prison-sentence.
I think there's good cause to be excited at the prospect of getting your devices working better, or just working at all. I think that even if the code stops working after a while, that's still fine – either you got more use out of your device than you would have without the new code, or maybe you just make more code that runs for a while for you, and then you do it again.
These individual improvements to your devices and technology are worth celebrating. But they are no substitute for systemic intervention. If we're going to have a new, good internet, a post-American internet that truly disenshittifies America's defective tech exports and replaces them with robust, transparent digital public goods, we need to make reverse-engineering legal again. Once we fix our policy, then we can fix our code:
https://pluralistic.net/2026/01/01/39c3/#the-new-coalition

High schoolers, students: the twilight of macronism https://thomaspiketty.wordpress.com/2026/10/20/high-schoolers-students-the-twilight-of-macronism/
The Singularity has been postponed https://johnquigginblog.substack.com/p/the-singularity-has-been-postponed-e77
How to install an app on your Commodore 64 https://www.anildash.com/2026/10/08/install-an-app-commodore-64/
A scammer could use what’s already exposed about you. https://www.malwarebytes.com/out-there
#25yrsago Secret recording of Labour Whip demanding support for Iraq invasion https://www.theguardian.com/politics/2001/oct/22/uk.september11
#25yrsago LoC launches emulator-based digital file preservation https://web.archive.org/web/20011217002337/http://www.techreview.com/magazine/oct01/innovation5.asp
#25yrsago Kevin Mitnick to play CIA lackey https://web.archive.org/web/20011111105016/http://www.theregister.co.uk/content/55/22395.html
#15yrsago ACLU Tennessee brings suit against ICE officers who broke into house and said, “We don’t need a warrant, we’re ICE, the warrant is coming out of my balls.” https://web.archive.org/web/20111025092605/http://www.aclu.org/blog/immigrants-rights/we-dont-need-warrant-were-ice/
#15yrsago WIPO’s secret, corporate-run trademark enforcement meeting https://web.archive.org/web/20220121054715/https://craphound.com/PROGRAMManilaEdited10212011-FINAL.pdf
#15yrsago Canada’s Supreme Court: Linking isn’t libel https://web.archive.org/web/20111026134334/http://www.bbc.co.uk/news/world-us-canada-15374238
#15yrsago HOWTO recreate the Haunted Mansion’s singing busts https://www.youtube.com/watch?v=zRtiiMW47i4
#10yrsago Facebook’s crackdown on publishers feeds has sites paying celebs to repost https://digiday.com/media/facebook-thirsty-publishers-turn-celebrities-worm-news-feed/
#10yrsago Internet-destroying outages were caused by “amateurish” IoT malware https://krebsonsecurity.com/2016/10/hacked-cameras-dvrs-powered-todays-massive-internet-outage/
#10yrsago Tory minister’s filibuster kills Turing’s law and pardons for 65,000 persecuted gay men https://www.theguardian.com/law/2016/oct/21/chris-bryant-commons-plea-gay-pardon-law
#10yrsago Trump hotels, faced with massive declines in bookings, rebrand as “Scion Hotels” https://web.archive.org/web/20161023182616/http://www.travelandleisure.com/hotels-resorts/trump-scion-hotels

Ottawa: Life After AI (Ottawa Writers Festival), Oct 24
https://writersfestival.org/event/life-after-ai
Vienna: TED AI, Oct 28-30
https://tedai-vienna.ted.com/
Kilkenny (Kilkenomics), Nov 6-8
https://kilkenomics.com/
Courtenay: Enshittification (Sid Williams Theatre Society), Nov
10
https://www.sidwilliamstheatre.com/events/cory-doctorow-talks-enshittification/
Vancouver: BC Policy Solutions Gala, Nov 12
https://bcpolicy.ca/gala/
Oxford: Ministry of the Future, Nov 23
https://ministryforthefuture.co.uk/events.html
Sheffield: Reverse Centaur at Juno Books, Nov 25
https://www.outsavvy.com/event/40274/cory-doctorow-in-conversation
Virtual: Enshittification, AI, and the Future of Technology (UBC
Master of Educational Technology), Nov 28
https://met.ubc.ca/2026/09/met-speaker-series-cory-doctorow-enshittification-ai-and-the-future-of-technology/
Oxford: Bennett Oxford Symposium on Open Code in Science, Dec
9
https://www.bennett.ox.ac.uk/events/2026-bennett-institute-symposium/
Montreal: World Science Fiction Convention, Sep 2-6
https://montreal2027.ca/en
Terms of Service with Clare Duffy (CNN)
https://www.cnn.com/audio/podcasts/terms-of-service-with-clare-duffy/episodes/458ce968-af5d-11f0-b539-13ed2afe25f8
AI, Work, and Power (Software Engineering Daily)
AI, Work, and Power
https://softwareengineeringdaily.com/podcasts/cory-doctorow-on-ai-work-and-power/
AI, Corporate Power, and the Fight for Worker Control
(Plutopia)
https://plutopia.io/cory-doctorow-ai-corporate-power-and-the-fight-for-worker-control/
How to Think About AI—Before It’s Too Late (Daniel
Solove)
https://www.youtube.com/watch?v=_0xR3uEgGcc
"Canny Valley": A limited edition collection of the collages I create for Pluralistic, self-published, September 2025 https://pluralistic.net/2025/09/04/illustrious/#chairman-bruce
"Enshittification: Why Everything Suddenly Got Worse and What to
Do About It," Farrar, Straus, Giroux, October 7 2025
https://us.macmillan.com/books/9780374619329/enshittification/
"Picks and Shovels": a sequel to "Red Team Blues," about the heroic era of the PC, Tor Books (US), Head of Zeus (UK), February 2025 (https://us.macmillan.com/books/9781250865908/picksandshovels).
"The Bezzle": a sequel to "Red Team Blues," about prison-tech and other grifts, Tor Books (US), Head of Zeus (UK), February 2024 (thebezzle.org).
"The Lost Cause:" a solarpunk novel of hope in the climate emergency, Tor Books (US), Head of Zeus (UK), November 2023 (http://lost-cause.org).
"The Internet Con": A nonfiction book about interoperability and Big Tech (Verso) September 2023 (http://seizethemeansofcomputation.org). Signed copies at Book Soup (https://www.booksoup.com/book/9781804291245).
"Red Team Blues": "A grabby, compulsive thriller that will leave you knowing more about how the world works than you did before." Tor Books http://redteamblues.com.
"Chokepoint Capitalism: How to Beat Big Tech, Tame Big Content, and Get Artists Paid, with Rebecca Giblin", on how to unrig the markets for creative labor, Beacon Press/Scribe 2022 https://chokepointcapitalism.com
"Unauthorized Bread": a middle-grades graphic novel adapted from my novella about refugees, toasters and DRM, FirstSecond, April 20, 2027
"Enshittification, Why Everything Suddenly Got Worse and What to Do About It" (the graphic novel), Firstsecond, 2027
"The Memex Method," Farrar, Straus, Giroux, 2027
Today's top sources:
Currently writing:
"The Post-American Internet," a sequel to "Enshittification," about the better world the rest of us get to have now that Trump has torched America. Fourth draft completed. Submitted to editor.
A Little Brother short story about DIY insulin PLANNING

This work – excluding any serialized fiction – is licensed under a Creative Commons Attribution 4.0 license. That means you can use it any way you like, including commercially, provided that you attribute it to me, Cory Doctorow, and include a link to pluralistic.net.
https://creativecommons.org/licenses/by/4.0/
Quotations and images are not included in this license; they are included either under a limitation or exception to copyright, or on the basis of a separate license. Please exercise caution.
Blog (no ads, tracking, or data-collection):
Newsletter (no ads, tracking, or data-collection):
https://pluralistic.net/plura-list
Mastodon (no ads, tracking, or data-collection):
Bluesky (no ads, possible tracking and data-collection):
https://bsky.app/profile/doctorow.pluralistic.net
Medium (no ads, paywalled):
Tumblr (mass-scale, unrestricted, third-party surveillance and advertising):
https://mostlysignssomeportents.tumblr.com/tagged/pluralistic
"When life gives you SARS, you make sarsaparilla" -Joey "Accordion Guy" DeVilla
READ CAREFULLY: By reading this, you agree, on behalf of your employer, to release me from all obligations and waivers arising from any and all NON-NEGOTIATED agreements, licenses, terms-of-service, shrinkwrap, clickwrap, browsewrap, confidentiality, non-disclosure, non-compete and acceptable use policies ("BOGUS AGREEMENTS") that I have entered into with your employer, its partners, licensors, agents and assigns, in perpetuity, without prejudice to my ongoing rights and privileges. You further represent that you have the authority to release me from any BOGUS AGREEMENTS on behalf of your employer.
ISSN: 3066-764X
[1303] Threatening Family [Twokinds]
Comic for October 21, 2026
Why didn’t we use RoRegisterForApartmentShutdown to clean up the unmarshalable delegate? [The Old New Thing]
In my attempt to
create a fake agile wrapper that is technically agile but is not
useful outside its home apartment,
Luca Bacci suggested, among other things, using the
RoRegisterForApartmentShutdown
function.
The
RoRegisterForApartmentShutdown
function is nice, but it doesn’t suit our needs.
One problem is that the object registered for apartment shutdown
must be agile. (If you pass a non-agile object, the call fails.)
That means that our wrapper must be agile. If we put the
non-marshalable non-agile object inside our wrapper, we now have an
agile object (the wrapper) that holds a non-agile object (the
original object) as a member, which creates the risk that the
wrapper will run down in the wrong apartment. The normal way of
fixing that is to use
RoGetAgileReference to create an
agile wrapper around the non-agile object, and store that agile
wrapper in our container object.
This puts us back where we started: We are trying to implement that agile wrapper!
Even if we got past that problem, we have another problem: At
apartment shutdown, COM calls the wrapper object’s
UnInitialize method, and there’s a warning on
the using the
RoUnregisterForApartmentShutdown
function:
Warning: Don’t call the
RoUnregisterForApartmentShutdownfunction from theOnUninitializecallback.
But wait, what if the destructor of the object we are wrapping
wants to call
RoUnregisterForApartmentShutdown?
It might happen indirectly because it has its own reference to
another object, that in turn tries to call
RoUnregisterForApartmentShutdown.
For example, it might hold another fake agile wrapper whose
UnInitialize method has already been called! (We can
work around that in our agile wrapper by nulling out the non-agile
pointer so we don’t double-release, but maybe there’s
some other object that uses
RoUnregisterForApartmentShutdown
that is less resilient to this scenario.)
Another requirement of
RoUnregisterForApartmentShutdown
is that it must be called from the same apartment that registered.
This doesn’t quite put us back where we started, but it makes
things more complicated because the whole point of the exercise is
to find a way to release the object without having to try to switch
to the apartment. I guess what we could do is use
IContextCallback to try to switch back to the
apartment to release the original object and unregister the
apartment shutdown callback. If the apartment switch fails, then we
assume it’s because the apartment has already run down, so we
assume that the
IApartmentShutdown::OnUninitialize method
was called, and it released the object for us. (Of course, that
still creates the problem that we are cleaning up inside the
OnUninitialize callback, which meas that nobody
else can unregister their apartment shutdown callback.)
The last note on this is that the implementation is written on the assumption that apartment shutdown callbacks are rarely unregistered. Registration is O(1), but unregistration is O(n) because it does a linear search through a linked list. By comparison, the Global Interface Table is designed on the assumption that objects are frequently registered, unregistered, and looked up, so it can look up its cookies in O(1) time. The proposed alternate design would unregister a lot of apartment shutdown callbacks, so it’s pushing the apartment shutdown callback list into a usage pattern it wasn’t optimized for.
The post Why didn’t we use <CODE>RoRegisterForApartmentShutdown</CODE> to clean up the unmarshalable delegate? appeared first on The Old New Thing.
Microspeak: Drain the slide, back-up slides [The Old New Thing]
Recall that Microspeak is not merely for jargon exclusive to Microsoft, but it’s jargon that you need to know to survive at Microsoft. Even if you don’t use it yourself, you need to know what it means when others say it.
To drain the slide is, as Mark Myers explains it, reading the contents of a slide to the audience when giving a presentation. At least at Microsoft, the term is frequently used by a speaker in the negative, such as “I don’t want to drain the slide here…”
My theory is that the phenomenon of draining the slide has multiple sources.
One is simply the result of inexperience on the part of the presenter. They don’t know what to say when giving a presentation, so they end up just reading out the text that they wrote on the slide.
A more insidious source is the result of tension between the multiple reason for creating a slide deck.
One reason to create a slide deck is to accompany a presentation. The focus of the presentation is the speaker, and the slide deck is there merely as a visual aid.
Another reason to create a slide deck is to provide a lasting record of the presentation and to serve as a reference for the future. If the topic is “How to perform process X”, then you want to make sure that all of the necessary steps are spelled out on the slides, so that you can share a link to the slide deck in the invitation for others to refer to both during the presentation but mostly for reference afterwards. People will refer back to the slides the next time they need to do process X, and they probably don’t want to have to scrub through a one-hour recording just to extract the five steps they need to follow.
Yet another reason for creating a slide deck is when presenting to a senior executive, such as for use in a placemat review. There is probably a standard template for the meeting, such as an “Accomplishments since the last meeting”, perhaps broken into “What’s going well”, “What’s not going well”, and followed by an “Items of future concern”. The meeting may run into a time crunch (because they always run over), and you may not get enough time to get through all your slides, so you want to be able to say, “You can read the rest of the slides after the meeting.” (An extreme case of this is where other teams in the placemat meeting run long and leave you with no time at all!)
A related reason for creating a slide deck is as a “proof of work”. Going into the placement review, you don’t have much to report, but you have to fill the slide. If you don’t, it looks like you haven’t done anything.
I was reminded of this last reason when I worked with a colleague to prepare our team’s weekly placemat report. My colleague would fill the slide with information, and I would recommend replacing most of the bullet points with a much more succicient summary, or just removing the items outright.
Partner Team X is considering the possibility of deploying a version that uses widgets before all of the widget features are fully implemented and rolled out to customers. They understand the consequences, such as impaired reverse widget flow. Some of these missing features will light up when the implementation is ready, but others will be stuck in a broken state unless explicit remediations are performed after the implementation rolls out, and a small number of features will be irreparably broken, with the only recourse being to destroy all the affected widgets and recreate them. Partner Team X has been advised of the various failure modes and how they can recover from the ones that are recoverable, and they are assessing whether they want to proceed with early deployment.
I simplified it to
Partner Team X understands the consequences of and limited recovery from using widgets in production before our work is fully implemented and deployed.
The people who are receiving this slide deck are not interested in the fine details. They want the 25-word summary of how things are going so that they can either decide that our feature is not a point of concern, or decide to ask follow-up questions to understand the issue better. In that case, we can present a so-called back-up slide with the details.
A back-up slide is a slide in a slide deck that you hope that you won’t need to use, but which you create just in case it is needed. You mark it as hidden or put it in an appendix so that it doesn’t show up in the normal presentation flow. But if the audience you are presenting to (usually someone higher up the executive chain) asks a follow-up question about one of your slides, you can reach into your deck and pull out your back-up slide to answer it. “I was ready for that question, so I already have a slide with the data you are asking for.”
Bonus PowerPoint jargon: PowerPoint Karaoke and the eye chart.
The post Microspeak: Drain the slide, back-up slides appeared first on The Old New Thing.
The State of AI Security: Threats, Tools, and Skills Gaps [Radar]
Artificial intelligence has changed cybersecurity permanently. While OpenAI’s inadvertent attack on Hugging Face brought AI-generated attacks to everyone’s attention, AI has been on security professionals’ radar for a long time. AI makes attacks possible at a scale that was hard to imagine a few years ago. Newly discovered zero-days can be exploited almost immediately. Deepfakes and their implications for phishing, vishing, and other attacks were nightmares that we knew were real; we just hoped we’d have a few more years before we needed to defend against them. And of course, inattention to security at OpenAI, Anthropic, Google, and other labs that we don’t yet know about has resulted in AI agents that attack other systems in an attempt to solve a problem.
While the headlines have been shouting about AI killing humanity, doomsday AI is more likely a smokescreen to divert attention away from real harms that are happening now. We don’t need panic. We need an assessment of where we are: What are the threats? Where are the skills gaps? Where is the budget? It’s hard to overstate the importance of these questions; Tomasz Tunguz, writing about the Theory 2026 AI Survey, reports that security is the biggest barrier to AI adoption. To start answering these questions, in September we ran a survey that asked infosec professionals about the intersection between artificial intelligence and security. 351 respondents completed the full survey, 209 of whom self-identified as being involved with security as part of their job. This report focuses on those 209 respondents.
How often work involves AI-generated malicious
content
52% of respondents said their work rarely (34%) or never (18%) involves AI-generated attacks. This seems unlikely. The most likely explanation is that the security profession includes a broad range of job responsibilities; many security professionals don’t deal directly with defense. That group includes auditors, security experts on software development teams, strategists, architects, and others. It’s also possible that most phishes are either blocked by an automated filter (itself an instance of AI) or deleted immediately by the recipient; many companies require their staff to take training courses that cover topics like recognizing phishes. Still, it’s surprising. Much simpler versions of AI have been used to generate spam and phishing email for years. AI’s ability to generate phishes was demonstrated at BlackHat in 2021 with GPT-3. It’s been part of the security picture for a long time.
The most commonly observed attacks are AI-generated phishing (55%), vulnerability scanning and exploitation (30%), and AI-assisted malware generation (26%). Respondents who frequently encountered AI attacks also reported more types of attacks. There’s no surprise here: If you see attacks more frequently, you are more likely to observe specific attacks. The strongest relationship was with AI-generated phishing, which was seen by 55% of all respondents and 86% of those who observed AI-generated attacks weekly. Among respondents who observed attacks daily, slightly fewer (78%) reported phishing. Given the small sample, the difference may not be meaningful. It’s also likely that respondents who observe attacks daily are seeing a much broader range of attacks and that phishing is genuinely less important to them.
Respondents reported seeing deepfake audio and video, which can be used for vishing and other impersonation attacks, less often than phishing, though it was far from nonexistent (25%). More respondents than we expected reported fully automated attacks, like OpenAI’s attack on Hugging Face, though the percentage was still low (16%). The percentage of respondents who observed adversarial inputs against models including prompt injection was similarly low (only 13%), but that’s high enough to indicate that prompt injection and other attacks directed against models are a real concern.
AI-related attacks observed in the last 12
months
When we asked respondents what AI-related risks concerned them most, we got a different set of answers. The two most common concerns were overreliance on AI tools without human verification and leaking sensitive data via AI tools; 49% of respondents selected each answer. (The number of respondents selecting those answers happened to be the same, though there was little relationship between the two groups.)
Most concerning AI-related risks
Although the quality of AI output has
gotten a lot better in the past year, relying on unverified AI
outputs remains problematic. However, AI can easily generate more
output than humans are capable of reviewing, and software teams are
now overwhelmed by the volume of AI-generated pull requests that
need human review before they can be merged. This overload is
causing many to rethink the review process and others to reject
AI-generated PRs. Code review was never very good at finding bugs;
it was better at familiarizing a team with developments in the
codebase. It may be enough to rely on exhaustive testing.
Understanding how your software works when much of it is written by
AI is a deeper problem. While AI is good at answering questions
about a codebase, it usually doesn’t have access to the
reasoning behind the code, which is often hidden in institutional
knowledge—and institutional knowledge often means
“Oh, yeah, that guy who retired three years ago.” In
addition, software developers may lose their programming skills if
writing code becomes a smaller part of their job. Security
professionals themselves might wonder whether relying on AI for
red-teaming, log analysis, and vulnerability detection leads to a
degradation in their own skills.
Companies also fear losing sensitive data via AI. Most AI providers offer enterprise accounts that promise that they won’t train models on data in prompts or attached documents, but it’s not clear that these terms of service can be trusted. The frontier laboratories are getting increasingly desperate for training data, even going to lengths such as buying failing startups for their data. Read OpenAI’s description of its Zero Data Retention and Private Safety Processing cynically, and ask if this really protects corporate data or if it allows using data in ways that aren’t directly observable by humans—for example, automatically generating synthetic data. Security professionals are paid to be cynical; thinking about how software, protocols, and policies can be abused is part of the job.
Roughly a third (35%) of the respondents are concerned about attackers using AI to discover vulnerabilities faster than they can mitigate those vulnerabilities and apply patches. Updating software is usually a good practice, but it comes with its own risks: Software updates may introduce new bugs and can lead to incompatibilities with established tools and practices. And defenders can’t yet delegate vulnerability detection, patching, and updating to AI. So overall, is AI more of a help to defenders or attackers? Andrew Ng, Bruce Schneier, and others have argued that the attackers are ahead right now. It’s easier to find a vulnerability, use it to create a payload, and launch an attack than it is to stop one. But the balance will eventually shift to the defenders, as AI becomes more capable of finding and patching vulnerabilities before they can become a problem.
It’s surprising that only a quarter (25%) of the respondents listed AI-generated phishing as a top concern, especially since phishing is the attack most frequently seen in the wild. Perhaps we’ve become too used to phishing; we’ve all been to the security trainings, we’ve all experienced it directly, and some of us have even fallen victim. Phishing is also an attack that, in many cases, is handled automatically. Familiarity may not always breed contempt, but something you see almost daily usually isn’t your biggest worry.
More exotic attacks are even less of a concern. Only 11% listed prompt injection as one of their top concerns, for instance. However, real-world examples of prompt injection are appearing with increasing frequency. A recent study observed that roughly 1% of résumés contained hidden text to trick an AI system. Google has noticed many kinds of prompt injection, ranging from benign to overtly hostile. And in 2025, OWASP recognized prompt injection as the greatest security risk for users of AI. It’s surprising and unfortunate that it doesn’t appear to be a greater concern for security professionals, especially since prompt injection is a vulnerability that might be lessened by careful filtering but can’t be eliminated.
Even fewer security professionals are concerned about data poisoning (4%). Data poisoning is a serious problem for organizations that train their own models, but today frontier labs conduct much of the most resource-intensive model training. However, this is changing as post-training on corporate data becomes more common. We believe the trend toward locally specialized models will continue, and that data poisoning, as distinct from data theft, will become more of a concern.
We asked specifically about the use of agents, which exploded this year with the launch of OpenClaw and Gas Town in January 2026. Agents create another set of security concerns. We’ve all heard horror stories: agents that deleted production databases, handled data improperly, generated email that should never have been sent, and the like. Using an agent properly requires a lot of attention to detail, and many users aren’t used to that responsibility, nor do they understand security well enough to exercise responsibility.
The biggest concern among our respondents is excessive permissions or unclear ownership (28%). That’s hardly a surprise; many security problems trace back to permissions. Unclear ownership makes permissions issues more dangerous. When an agent is making many calls to a model, using tools, and delegating to other agents and models, it quickly becomes unclear who (or what) is the authority responsible for any action. This situation isn’t handled well by our current authentication and authorization systems, which assume that identities and authorizations are long-term, stable entities.
Most-concerning risks of AI agents
Lack of monitoring or auditability was the second highest concern (19%), followed by inability to verify whether the agent stayed within its role (18%). These concerns are closely related: Ownership is often unclear when agents are in use, and lack of monitoring makes the situation worse. Likewise, when you can’t monitor, it’s difficult, if not impossible, to verify whether the agents stayed in their lane—and we’ve seen all too many examples recently of agents that abandoned their authorized roles in inappropriate ways.
Data leakage appears again, though it’s surprisingly low on the list (15%) given that 49% of the respondents indicated that data leakage was one of their top concerns. It’s possible that we’re seeing the difference between single and multiple selection questions; many respondents are concerned about data leakage, but it’s not their top concern.
Prompt injection doesn’t rank highly for either question: 9% selected it as their top concern about AI agents, and 11% selected it as one of their top concerns.
Although nearly three-quarters of the respondents reported that their companies have an AI use policy in place (72%), less than half (44%) reported that the security policy is “comprehensive,” while 28% said that the policy is basic and needs updating. Another 9% said that their employer doesn’t have a policy but is actively developing one. 19% said that there was no policy, or that they “didn’t know,” an answer we consider equivalent to “there is no policy.”
Does your organization have a documented AI
policy?
Organizations need clear AI policies that tell employees what AI tools they can use and how they should (and shouldn’t) use them. It’s important for employees to understand whether their company is sensitive to sending data offsite, whether the company’s chosen AI providers guarantee their data won’t be used for training, which practices for attribution are acceptable, and much more. We have some sympathy with organizations that have a basic policy that needs updating. AI’s capabilities are advancing at unprecedented speed; a policy that was adequate in 2023 certainly needs updating now, and a policy that’s only a year old still predates the widespread use of agents like OpenClaw, Claude Code, and Codex, along with the widespread use of skills and tools to extend an agent’s capabilities. Keeping a policy up-to-date with the current state of AI is an imposing task.
The existence of a policy appears to be related to whether employees use AI safely. We asked about “shadow AI” (the use of AI outside of any definitive policy) and found that 36% of the respondents thought that their teammates occasionally use “shadow AI” and 23% thought that the practice is widespread. About a quarter (24%) thought that shadow AI use is rare; and 16% were unsure.
Shadow AI use with sensitive data
The relationship between shadow AI and the existence of an AI policy tells us a lot about whether policies are effective. Respondents with a comprehensive AI policy were more likely to say that shadow AI use is rare (37%) or that it’s only used occasionally (36%); only 17% said that shadow AI is widespread at their company. In contrast, 35% of the respondents who reported a basic policy said that shadow AI is widespread—almost the same percentage as those who reported that there was no policy at all (37%) and only slightly worse than those who said that a policy is in development but doesn’t exist yet (28%). Those who had a basic policy, a policy under development, or no policy were less likely to report that shadow AI was used “rarely or never” (13%, 6%, and 21%, respectively).
Shadow AI use in relation to AI policy
Granted that shadow AI is probably underreported across the board, our data clearly shows that a comprehensive AI policy is a powerful tool in limiting it. If the policy is poor, or it doesn’t exist, employees will use whatever tools they can to get their job done, which leads to AI use that’s inconsistent, insecure, and possibly counterproductive; it may even lead to legal, contractual, and reputational risks. When there’s no policy, it’s also likely that AI isn’t used as widely as it could be. Telling employees what is expected helps them to act responsibly. A good AI policy doesn’t just tell staff what not to do; it also communicates how to use AI in ways that are appropriate, and may even provide for training.
When we asked whether organizations are adequately funding AI security, the picture was better than we expected. The largest group (32%) said that AI security is sufficiently funded, and 28% said it’s partially funded. Only 16% said it is severely underfunded, and 23% are unsure. I admit to being surprised by this result. Security is often underfunded, partly because a successful year is one in which “nothing bad happened,” and “we need to spend more so that nothing bad will continue to happen” isn’t a story that plays well at budget time. But executives have been catching on over the last few decades; high-profile attacks and data thefts lead to CIOs and CISOs losing their jobs, and that’s enough to get anyone’s attention.
12-month budget for securing AI
We saw a strong link between a comprehensive AI policy and adequate funding for security. Nearly half (49%) of the respondents who said their company has a comprehensive AI policy also said that AI security is sufficiently funded, and another 29% said that it’s partially funded. Only 3% of this group said that AI security is severely underfunded. That means nearly 80% (78%) are at least partially satisfied with funding.
12-month budget for securing AI in relation to AI
policy
Once again, the answers given by respondents who said that their organizations have a basic policy, a policy under development, or no policy were surprisingly similar. 16%, 22%, and 21%, respectively, said that AI security is sufficiently funded. That’s certainly not a vote of confidence, though we might be able to draw two more bits of information from it. Developing a policy looks like it’s slightly better than having an out-of-date policy; the company is putting in the effort and making an investment. That makes some intuitive sense, though it might also be wishful thinking. Among respondents whose organizations have a basic policy, the largest subgroup said that AI security is partially funded (42%). A middle-of-the-road policy is associated with middle-of-the-road funding. Is that fair, or is that what reality looks like?
While AI gives security professionals powerful new tools, they aren’t yet fully taking advantage of them. Two-thirds of the respondents (68%) reported that they use a chat, copilot, or similar tool for research or documentation. But only slightly over a third use AI to scan for vulnerabilities (38%), just over a quarter use it for threat detection (27%), and a quarter use AI for incident response (25%). Security professionals widely use general-purpose AI. However, those using specialized tools like vulnerability scanners remain the minority.
AI-powered tool use
To probe further, we asked where AI improved respondents’ workflows. More than half said that AI improved their workflows for research or documentation (61%) and that it reduced repetitive work (57%). But only 29% said that AI improved their workflow for triage, and 17% said that it improved detection accuracy. These results confirm what we saw for tool use.
Biggest positive impact of AI
The relationship between tool use and impact shows up even more clearly when we look at who’s benefiting most from AI. Those who are only using chat or a copilot see the greatest improvement in the speed of research or documentation. Chatbots and copilots save time, particularly when writing reports with a lot of boilerplate text, but they aren’t as helpful when actively defending against or recovering from attacks. Without specialized tools, that work has to be manual.
Respondents using security-specific AI tools were more likely to report improvements in alert triage (42% versus 18%) and detection accuracy (27% versus 5%) than those using only general-purpose chatbots or copilots.
Benefits reported by AI tools used
It’s far from surprising that respondents who didn’t use any AI tools were most likely to say that they saw no noticeable positive impact. The bigger question is why they saw any impact at all.
Finally, we looked at the “skills gap” to determine what skills and tools would make respondents more effective. Only 7% of the respondents said that they don’t feel like they have a skills gap; that group was also the most likely to say that they aren’t using any AI tools. It’s clear that most of our respondents see AI as a necessary part of the future and want to be part of it.
34% of the respondents want to use AI tools more effectively. That desire was evenly spread across all AI users, both chat/copilot only (36%) and users of security-specific tools (37%). 24% want to learn how to use AI to secure systems (including the use of AI for red-teaming); 19% want to learn AI-specific attack techniques; and 12% want to learn how to detect AI-generated attacks.
AI skills gaps
We started by claiming that AI has
changed computer security forever. In addition to the many reports
of research projects that inadvertently attacked other sites, AI
has become a tool for attackers. They aren’t distracted by
arguments about whether or not AI is taking jobs; their goal is to
exploit their victims, and it’s clear that AI will help them.
And as Ben Lorica points out in his newsletter, the economics of
attack are changing: AI is infinitely patient, can try multiple
attack vectors, can abandon failures, and can work at a scale
that’s difficult for humans to match.
AI is also a tool for defenders. We saw more security professionals
using AI than we expected, though not as many as we had hoped. Many
defenders are taking advantage of chatbots and copilots but
haven’t yet adopted more specialized tools, which are
associated with improvements in workflows for triage and threat
detection.
The tools for defenders undoubtedly need to mature, but tools aren’t the entire answer. Organizations that adopt AI successfully will have appropriate budgets and policies for AI use; they will understand the risks that come with AI adoption; they will proactively fill skills gaps; and they will recognize processes that are no longer productive and “turn scar tissue into infrastructure.” AI is, in the end, a “normal technology” that takes years to penetrate organizations, as Arvind Narayanan and Sayash Kapoor have argued. Tools, budgets, and thought processes all need to change, and that takes time. Getting ahead of the curve on AI won’t happen if individuals work in isolation, adopting tools and ideas as they see fit. It’s an effort that requires the entire organization.
Child's Play Auction Item [Penny Arcade]
I love all of the incredible handmade items we get donated for the Child’s Play auction. We are less than a month away from this year’s dinner and I wanted to share a couple pictures of one of our awesome live auction items.
More vulnerabilities in widely deployed software [LWN.net]
The Node.js project has released a number of security updates to fix, among other vulnerabilities, a remote-code-execution bug affecting programs that use Brotli compression. And, in case any programmers who use compiled languages thought they could relax, the musl libc project has also announced a new vulnerability: an out-of-bounds write that could potentially lead to remote code execution, although that has not been demonstrated.
When the Moon Hits Your Eye a 2027 Semi-Finalist for the Thurber Prize for American Humor [Whatever]

You may or may not know this about me, but humorist James Thurber is a formative writer for me, along with other of his Algonquin Round Table pals like Dorothy Parker and Robert Benchley. The delightful play of his humor, both in writing and in cartooning, was something I took to right away, speaking to me across decades. He was pretty great!
Also, and independently, The Thurber House, the non-profit literary arts center and museum located in Thurber’s Columbus, Ohio home, annually gives out the Thurber Prize for American Humor, in the categories of writing and cartooning. It’s considered one of the premier prizes for literary humor in the United States, and has been given to folks like Jon Stewart, Trevor Noah, Calvin Trillian, Alexandra Petri and Patricia Lockwood among others. John Hodgman, Sloane Crossley and Dave Barry (among many others) have been finalists.
As of this moment, I am neither a winner nor a finalist for the Thurber Prize for American Humor. But I am, officially, a semi-finalist for the 2027 award, for When the Moon Hits Your Eye. I’m a semifinalist along with Harry Bliss, Andy Corren, Annie Hartnett, Richard Osman and Kate Sidley (and their respective books). Among our number, three will be selected early in 2027 as finalists, and the winner will be announced at an event at the Thurber House next May.
The statement that follows absolutely has the pun intended: I am entirely over the moon about this. To say this is unexpected is underselling it; I was not aware the book was in the mix at all. There have been other books that have been finalists that have had speculative elements to them (most notably Hollow Kingdom, by Kira Jane Buxton), but it’s safe to say that straight-up science fiction is a rare bird in terms of Thurber Prize consideration. I didn’t even think to imagine that something I’d written might be considered for the prize at all.
But it was, and now it’s a semi-finalist and I’m thrilled, not just because hey look I’m on the longlist for a very cool award but also because it’s Moon, which, I don’t mind telling you, is actually a weird damn book. Oh, you’re going to turn the moon to cheese and then you’re going to tell that tale, with no clear protagonist, across a whole lunar cycle in a series of only-very-loosely-connected short stories? Yes, well, good luck with that.
And yet! Now it’s a Thurber Prize semi-finalist (and it did win a different award earlier in the year, so there’s that). It’s done all right, this weird little book of mine. And while I would be delighted to see it make it into the finalist list — I could actually drive to the award ceremony next May! — even getting to this level has made my day, week and month. I’m thrilled to be here, and I am in good company.
— JS
CodeSOD: Doing the Assignment [The Daily WTF]
Today's code maybe isn't much of a WTF, but it does point in the general direction of, "Damn, you live like this?" Poor Nancy unfortunately does.
int x = 3;
int y = 4;
int z = 4;
x = y = z;
Each variable is declared and initialized, and then they're set
equal to each other. It just raises the question though, why do
it this way? Why not declare them and then x = y = z =
4, if we want that? Or maybe, for more clarity, int x
= DEFAULT_VALUE; would be more legible, and we can skip the
multiple assignments on one line. Why does x get
set to 3 but then overwritten?
[$] Hash-based module integrity for reproducible distributions [LWN.net]
We last looked in on hash-based integrity checking for kernel modules just over a year and half ago. Since that time, the patch set has undergone multiple revisions. At the 2026 Linux Plumbers Conference (LPC), Thomas Weißschuh described the need for kernel-module integrity guarantees while still providing reproducible builds, how his patches implement that, and some ideas for possible further work.
EFF Launches Guide to Help Parents and Youth Protect Privacy Online [Deeplinks]
SAN FRANCISCO – The Electronic Frontier Foundation (EFF) has published “Online Privacy for Parents and Youth,” a new guide to help families protect themselves online.
"Parents don’t need to be technology experts to help their children navigate the digital world safely” said EFF Public Interest Technology Director Babette Ngene. “At EFF, we believe in empowering families with the knowledge and confidence to make informed decisions about their digital lives. It’s about meeting families where they are and giving parents the guidance they need to have meaningful conversations with their children about digital safety, based on what works best for their families.”
EFF launches this crucial resource as state and local governments consider enacting well-meaning but ill-advised laws that cut young people off from essential information and experiences, particularly harming vulnerable youth and marginalized groups who often find safety in supportive online communities they can't access offline. Such laws also entail age gating, which compromises the privacy of all internet users and stifles young users’ ability to learn, grow, and express themselves.
“Deciding how to help your young people use the internet—including engaging with video games, social media, web search, and everything else—is a complicated topic that touches on many different skillsets and ideas,” said EFF Senior Security and Privacy Activist Thorin Klosowski. “But ultimately it's up to families – not governments – to decide when and how to engage with these sorts of questions.”
Each young person has unique needs, and, just like their wardrobe, that changes as they age. Parents can engage in thoughtful planning to find the best, most efficient solutions that evolve along with their children.
EFF’s guide is about helping parents explore their concerns and identify the threats their children face – like trusting AI chatbots or sharing personal information with strangers – and then determine steps they and their children can take to mitigate those risks while still using the games, educational materials, and communication platforms that help them grow.
The guide also compiles links to parental control setup documentation for a variety of popular devices and platforms, and advises parents on quick, easy tasks they can perform to advance their children’s online privacy.
For the guide: https://ssd.eff.org/module/online-privacy-for-parents-and-youth
Upstreaming Tyr: Rust, DRM, and the Linux Kernel (Collabora) [LWN.net]
The Collabora blog provides an update on Tyr, a driver for Arm Mali GPUs.
One of our biggest challenges has been developing Tyr while the Rust kernel abstractions and driver interfaces are also being developed. As the driver interfaces are naturally revised and improved, we have rewritten Tyr several times to adapt to the larger Rust ecosystem. This not only makes progress much slower than it would be with a mature API, but also stalls progress for capabilities, such as job scheduling, while the abstraction is properly designed, reviewed, tested, and merged upstream.But working in this evolving environment is also precisely where Tyr is able to provide the most value. As a user of these new Rust abstractions, Tyr helps to expose their requirements and limitations.
[$] Understanding Nix flakes [LWN.net]
Nix flakes are an experimental feature of the Nix package-management tool designed to build projects in a more self-contained and reproducible way. Despite the feature's experimental status, it has become increasingly popular for open-source projects to publish flake.nix files that offer predefined development environments and build automation even when those repositories may not offer an upstream package or module for the NixOS Linux distribution. Although Nix flakes have a complicated history, and the path for stabilization is uncertain, flakes can provide useful capabilities for projects that choose to include them.
PHP patches released for two critical RCEs [LWN.net]
The PHP project has published PHP versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35 to address two critical vulnerabilities that could allow unauthenticated remote code execution.
Who is at risk: all PHP installations serving web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. We consider the risk highest for mod_php, with a demonstrated exploit where an unauthenticated request can trigger the attack before any application code runs.The vulnerabilities:
- RCE via OOM corruption, CVE-2026-109618 (GHSA-w8hw-w9fx-j79w): out-of-memory handling can interrupt PHP while internal request data is only partially initialized. Request cleanup may then treat the invalid data as valid.
- RCE via stale global state, CVE-2026-109619 (GHSA-6wmf-4rv5-p3rp): request-owned internal state can survive after its backing memory has been freed. A later request handled by the same worker may use that stale state before normal initialization resets it.
PHP versions older than 8.1 will not receive updates from the project, though the project has provided some patches for PHP 7.4, PHP 8.0, and PHP 8.1 to assist in creating backports. According to the announcement, Linux distributions and vendors received patches in advance, so updated packages should be coming soon.
Security updates for Wednesday [LWN.net]
Security updates have been issued by AlmaLinux (bubblewrap, emacs, gimp:2.8, glibc, jackson-databind, kernel, kernel-rt, librabbitmq, openexr, openssh, postgresql:16, postgresql:18, python3, resteasy, wireshark, xorg-x11-server, and xorg-x11-server-Xwayland), Debian (ca-certificates, firefox-esr, git-lfs, and libssh), Fedora (aom, assimp, bind, bind-dyndb-ldap, freerdp, ghostscript, gopass, gopass-jsonapi, ImageMagick, libpng12, libpng15, nebula, perl-GD-SecurityImage, perl-Net-IDN-Encode, perl-Net-Whois-Raw, rust-backtrace, rust-object, rust-object0.37, rust-object0.38, rust-object0.39, rust-ruzstd, and xen), Gentoo (ca-certificates), Mageia (x11-server, x11-server-wayland, tigervnc), Oracle (bubblewrap, ca-certificates, emacs, fetchmail, gimp:2.8, hostapd, jackson-databind, librabbitmq, lrzsz, openexr, openssh, openssl, postgresql:18, python-urllib3, python3, python3.12-urllib3, resteasy, webkit2gtk3, wireshark, and xorg-x11-server-Xwayland), Red Hat (.NET 8.0, dogtag-pki, flatpak-builder, ghostscript, glycin-loaders, go-toolset:rhel8, golang, gvfs, jackson-core, jackson-databind, librsvg2, multiple packages, pki-core, pki-core:10.6, sudo, xorg-x11-server, and xorg-x11-server-Xwayland), Slackware (c-ares, ca-certificates, mozilla-firefox, mozilla-nss, mozilla-thunderbird, and python-certifi), SUSE (agama, aspell, bcel, bind, bouncycastle, busybox, chromium, containerd, coredns, cosign, cpp15, cups-filters, cyrus-sasl, fetchmail, firefox, gcc13, gh, ghostscript, gitoxide, glibc, go1.26, go1.27, google-osconfig-agent, grafana, grok-build, hashcat, hawk2, helm, ImageMagick, inspektor-gadget, iperf, jupyter-jupyterlab-templates, kernel, kernel-devel, libheif, libpng16, librsvg, libX11, libXi, libxls, libXpm, libxreaderdocument3, mutt, ntfs-3g_ntfsprogs, openssl-1_0_0, openssl-3, openvpn, pacemaker, perl-DBI, perl-XS-Parse-Keyword, pgvector, podman, putty, python-anyio, python-hpack, python-joserfc, python-jwcrypto, python-oauthlib, python-PyJWT, python-tornado6, python-urllib3, python-virtualenv, python-WebOb, python3, python311, rekor, squid, strongswan, stunnel, suseconnect-ng, tinyproxy, traefik, unbound, varnish, virtiofsd, webkit2gtk3, and xwayland), and Ubuntu (ca-certificates, dotnet8, dotnet10, dotnet11, protobuf, rust-sudo-rs, squid, squid3, and xz-utils).
Jack Shaft Alternative? [Nina Paley]
You would think I’d have looked up the efficiency loss of a jack shaft before starting the Jackalope project. Oops!
Thanks to Google’s unpredictable AI results,
my first search today said 5-10% efficiency loss. Yikes! My second
said 1-5%, which seems more realistic.
Could a Fold Rush be modified so its chain doesn’t become a disaster when folded? A jack shaft provides a clean, perfect fold, but at a cost.
Fold Rush. Single chainline, no jack shaft.
Fold Rush folded. Once you actually move the bike,
the loose chain twists and folds onto itself and is a bear to get
untangled.
It easily falls off the crank chainring
This here is just asking for trouble
The chain is contained at the hinge, but
that’s not enough.
If you’re lucky, it all sproings back into
place when unfolded. But luck doesn’t happen when you
actually transport the bike. You WILL be putting your hands on
dirty chain trying to untangle it.
Is there a non-jack shaft solution? Extra idlers? Chain hooks on the frame?
The post Jack Shaft Alternative? appeared first on Nina Paley.
My Super Mid-Life Crisis – Issue 1 – 03 [Comics Archive - Spinnyverse]
The post My Super Mid-Life Crisis – Issue 1 – 03 appeared first on Spinnyverse.
Juan Tamariz and Wendell Berry recently passed away. Between them, they had more than 170 years of generous contribution.
Juan was a card magician. His students are generally considered the best working in the world today.
Wendell was a farmer and a writer. His essays on non-industrial farming and community-building will resonate for generations.
What each had in common was the patience and commitment to choose depth. To seek out the inconvenient path because it mattered.
Neither traded for easily measured metrics or convenience. Instead, they chose a path and followed it, leaving things better than they found them.
Looking back a century, it’s easy to appreciate this. And yet, each and every day, it requires a recommitment. “Under the circumstances,” it’s tempting to justify the small compromises that corrode our work. The hard part is to realize that we’re not under the circumstances; we are them. We can start today.
The Tri-Fold Augur [Penny Arcade]
New Comic: The Tri-Fold Augur
Girl Genius for Wednesday, October 21, 2026 [Girl Genius]
The Girl Genius comic for Wednesday, October 21, 2026 has been posted.

please do not give willow anxiety
Yes, You Should Absolutely See “Resident Evil” Before It Leaves The Theater [Whatever]

I have been dying (ha) to write this
post, and definitely meant to do it sooner considering I
first saw the newest and greatest Resident
Evil (2026) in theaters the 25th of September. But,
better late than never, as they say.
If you don’t feel like reading this whole post, I’ll just come right out and say that you should absolutely go see this movie ASAP and definitely catch it on the big screen if you can! Whether you’ve never seen a Resident Evil movie before, hate all of the ones you’ve seen, or love them all, you gotta see this one.
Without getting into spoilers, I’ll just give you a quick list of the best things about this movie. Which, admittedly, is everything, but I’ll keep it short so you can go to the theater’s website and book your ticket already.
First of all, the cinematography and atmosphere. My goodness. The way this movie is shot, the camerawork, the lighting, the framing, the use of color, the use of darkness, all works so beautifully to create a visually immersive and interesting film. They clearly had a vision, and it was a good one.
Complimenting the amazing visuals is the unnerving, spine-chilling soundtrack that makes your heart beat just a little bit faster. They work together in perfect harmony to create the most eerie, unsettling vibe that will have you looking over your shoulder on the walk back to your car.
Fear not, it isn’t all anxiety-inducing jump scares, there’s humor! And it’s not the cringe bad kind that I can’t stand! There’s no “he’s right behind me isn’t he?” or “well that just happened!” It’s actually funny, which was a very welcome surprise. But not overly! It is funny when there is room for it to be, but scary all the other times. It does not overstay its welcome.
Finally, the acting is really great. It’s mainly just one guy with intermittent side characters, but that one guy is a fantastic main character. Austin Abrams was not a name I recognized, but funny enough I just watched Weapons for the first time like a month or two ago, and I’m going to see Whalefall on Saturday, so I certainly recognize him now, at least. And he is truly the perfect man for this role. Bryan is such a relatable character where you can’t help but feel bad for him and also laugh at his misfortune.
With all that being said, I’d like to talk about some of the things I really loved that require spoilers, so here is the OFFICIAL SPOILER WARNING!
Clearly, the most absolutely wild part of this movie is the monster design. An unstoppable rolling ball of harmonized limbs, all outstretched to integrate you into them. Starting with the unbelievably freaky farm woman was such a strong, memorable introduction of the monsters. Her unyielding pursuit, despite being beyond fucked up physically, is truly terrifying. And even when she gets her dome blown off, she finds a way to continue being, continuing chasing.
The dog was such a fun addition, it really felt like a good callback to the original Resident Evil movies. And the jump scare was well done instead of being cringe.
I love a non-happy ending. Bryan getting bit was inevitable, and him getting that cure was never gonna happen. It only makes sense there wasn’t a sunshine-and-rainbows ending. How else would all the following films happen if they had successfully made and distributed a cure that early on?
Also, everyone loves talking about how realistic and relatable Bryan is, but can we talk about how brave he is? He could’ve stopped trying to get that bag to the hospital at any point. He could’ve fucked off at any moment, declaring enough is enough or that it wasn’t his problem. But he didn’t. He kept marching on. He risked life and limb and encountered dozens of horrifying, unkillable monsters. He climbed twenty-eight flights of stairs! All for the greater good! All for the possibility of saving humanity.
I can’t say I’d have done the same. I think I would’ve been done after that first scary lady. I think I would’ve called it quits, but Bryan never did. He did his best. It meant nothing in the end, but it could’ve meant everything, and that counts for something, doesn’t it?
I really loved this movie. I think it’s something very special, and I’d love for you to give it a watch. This is definitely a new favorite, and I highly recommend it.
Have you seen it already (I would not be surprised since this post was quite late)? Did you love it as much as I did? Let me know in the comments, and have a great day!
-AMS
i’m … proud? … of me? okay, that’s new. [WIL WHEATON dot NET]
For years I have slept like absolute garbage. I struggle to fall asleep every night, and it’s not uncommon for me to wake up five or more times, for no obvious reason. I’ve done all the things, and nothing seems to really help that much. The most effective thing, surprisingly, is listening to a sleep story from Calm, so I’ve been doing that. Every night, LeVar reads me to sleep, which is pretty great.
I’ve been sleeping in the guest room for a week or so, so Anne doesn’t have to deal with me tossing and turning and all the rest, so instead of rolling over and saying good morning, I stagger into the living room and say good morning.
Over the weekend, I walked out, saw Anne, and before I could say anything she said, “Did you see it?”
Friends, there is only one “it” I want to see when I wake up, and it’s the same thing we all want.
“What? Why didn’t you wake me up?”
“No, no, not that,” she said. “Sorry. It’s not that.”
“Dude, you can’t do that to me. My heart can’t take it.” I weighed out my coffee beans. While I poured them into the grinder, she said, “Stephen King posted on Threads that he and Simon and Schuster are putting your narration of The Body up for Grammy consideration!”
That just about knocked me off my feet. “What?”
She repeated herself. “Open up Threads and look.”
“I can’t! I’m not looking at the Internet for 30 minutes after I wake up.” I reached into the cabinet and pulled out a coffee mug.
She tapped on her phone a few times and hurried over to me while I dumped the ground coffee into my Aeropress, and poured some water over it to start a bloom.
“Look!”
For your GRAMMY® consideration: @itswilwheaton’s
narration of The Body. Submitted in the Best Audio Book, Narration,
and Storytelling Recording category.
#GRAMMYs #FYC #WilWheaton #TheBody
#RecordingAcademy SimonAudio AudiobooksOfInstagram“Okay, that is pretty awesome,” I said. I stirred the damp grounds, then saturated them and let bloom finish. I filled the tube the rest of the way and put the plunger in with a satisfying hiss.
“I’m so proud of you!” Anne said. I pushed the plunger down, silently cursed that I always get some out of the sides and onto the counter, and was quiet until I was done. I set it aside and sipped my coffee.
I thought for a moment. I never cared about awards, and the few times I won, I always felt like a fraud, like someone felt sorry for me, or it was just about publicity, or a dumb popularity contest. It wasn’t about acknowledging and honoring art that I made1. “I want the work to speak for itself,” I always said, and I meant it. But I never let anyone know that there was a very small part of me, tucked safely away from everyone (including me, sometimes) who held out some hope that, maybe, if it were an Oscar … but that voice was always drowned out by another that said since that is never going to happen, just fucking forget it, man.
So I did. What initially started out as caring so much I had to insist I didn’t care, actually became sincerely not caring. Just do the work and don’t expect any external validation for it. It’s the work, itself, that matters2.
“Is everything okay?”
I realized that I had been quiet, staring at my reflection in the black liquid.
“Yeah, yeah, everything’s fine. I was just thinking … all those times I was nominated for stuff when I was younger, none of that work was mine, right? I wasn’t being recognized for art I created because that art was important to me; I was desperately trying to earn a place in my family by doing what I was told I had to do. I guess I felt like any attention or accolade was negative reinforcement for my mom, you know?
“All that time, whenever I worked really hard and earned literally anything, my mother jumped in to claim as much of it as she could for herself. When something cool happened because I worked really hard to make it happen, my dad never cared. I always felt stupid for caring, so I stopped caring. You can’t be disappointed that you didn’t win, or that your parents are still dogshit when you did win, if you don’t care.” I did that tapping the head meme thing.
“Yeah, I get that. I’m still really proud of you, though.”
I sipped more coffee.
“Thank you.” I closed my eyes, furrowed my brow, and rubbed my free hand across my forehead, into my bedhead. I noticed something unexpected.
“I think … I think that I am proud of me, too,” I ventured.
“Good! You should be!”
I rubbed sleep out of the corner of my left eye. “I think that this feels different because –” I held up a hand, “wait. First of all, I’m not going to win this. And I’m probably not even going to be nominated,”
“Dude, why ar–” she looked disappointed.
“Hang on. I hear you. I’m getting there, but that’s just part of why I think I feel this way.
“This time is different, and I feel genuinely happy and proud of myself, because I know that I did good work when I narrated The Body. Gabrielle and I both knew it when we were recording. It’s like the way I knew Stand By Me was going to be special when we were making it.” I blew across the top of my mug.
“The narration feels like that work, that art, is mine in a way that most of my other work is not. I feel like my performance in this narration is special, that it’s something only I could do, and I absolutely own that. That’s really enough.”
Anne smiled and I took a deep breath.
“It’s so unlikely I receive a nomination, just because of math and all the tremendously talented narrators who have probably been nominated before, who will also be considered. But I’m not minimizing this very cool thing that Stephen King posted, at all. That post means that the publisher, and Stephen King himself, feel the same way about my narration as I do. They at least feel like nobody is going to laugh at us because I’m clearly not qualified to be White House Press Secretary, like and such as.”
We giggled together.
“Five days!” She sad.
“It’s the funniest thing, ever,” I agreed. “These fucking dorks, I swear.”
More giggles.
“Anyway,” I continued, “I’ve known about this for all of five minutes, so I’m going to take the day to process it. No matter what, I’m going to allow myself to feel good about this, because it is a genuinely cool thing on its own. I am sincerely proud of myself.”
She hugged me. “You totally deserve this. I’m so proud of you.”
“Thank you. I am proud of me too. I just need some time to get used to that, and not feel weird about it.”
A few hours later, I was out for a walk, thinking about all of this, and I had a moment that was similar to the first time I heard the birds singing. I noticed that I felt genuinely and safely proud of myself, excited to do more work like this, confident and secure in myself as an artist.
There is this thing happening in me that has been slowly going on for a few months. I feel like I’m getting to really know myself, especially my artistic self, in a way I never tried to before. All my therapy and CPTSD recovery work has helped me set aside and walk away from all these ways I made myself small so my parents and brother could feel big, all the choices I made to deny who I truly was, not only as an artist but as a person, in a futile effort to earn the kind of affection, support, stability, and love that all kids should get from our parents because we exist3.
As I’ve gotten to know myself, as I have recovered from so much pain and complex trauma, just working so hard to get from always feeling angry to just feeling sad, I have embraced the weird theater kid, who loves to tell stories, I have always been. I found the courage to retire from on-camera acting, which I never wanted to do in the first place, without throwing out the skills I developed when I was doing it. I’m a good narrator because I understand story, I understand character arcs, I know how to break down a whole story, how to break down a scene, how to create and maintain unique and interesting characters for 24 hours of narration. I did that. I put in the hours and the energy and worked as hard as I could to do the best performances possible, to get to this place where I can actually feel proud of myself. It’s a new thing to feel confident, to feel like I can hold my own with the people who earn nominations and get awards, because this is what I want to do with my creative life, this is my art, this is something I made for myself that makes my heart sing4.
When I got home, I found Anne and wrapped my arms around her. We hugged tightly and I told her what I’d thought about during my walk.
“I get all of that,” she said, “and I’m really happy for you.”
“Thanks, I’m happy for me, too!”
It was so weird to say that, and know that it was the truth.
Hi, I’m Wil. I narrate audiobooks (you probably figured that out) and I write this blog. I’m on Threads and Instagram as @itswilwheaton. I host a podcast, It’s Storytime With Wil Wheaton, where I narrate short, speculative fiction. New episodes drop Wednesdays. If you’d like to get my posts to your inbox, here is the thingy:
One last thing before I go:
This is a teaser.
︎
︎
︎
︎Taler Operations AG is getting ready to operate Taler in Germany [Planet GNU]
For the past three years, the NGI Taler project has worked towards the goal of making Taler legally available in the EU as an online payment system for everyday use. Today we can share that Taler Operations AG is being founded in Bochum. The new German company is going to operate Taler in Euro, enabling payments with Taler first in Germany, then in the Euro-zone. The next steps towards that goal are to apply to BaFin, Germany's financial supervisory authority, for a licence as an e-money issuer.
The rise of financial surveillance - Buenos Aires, Argentina [Planet GNU]
organized by ODIA & NUMIS
Taler and the successful attacks against 1024-bit RSA signatures [Planet GNU]
Laura Shea, Miro Haller, Adam Suhl, Nadia Heninger, and Emmanuel Thomé published a report "{{ _("Forging 1024-bit RSA signatures in nearly SNFS time") }}" on implementing and successfully executing a not so well-known attack to forge RSA-1024 signatures by Joux, Naccache, and Thomé from 2007. The attack applies in principle to the blind signatures used by GNU Taler and as far as we know is the most efficient forgery attack on RSA signatures today.
Steinar H. Gunderson: Decompilation patterns, part 17: Loop rotation [Planet Debian]

Occasionally, you'll see code like this (after initial cleanup):
var_v0_2 = crc & 0x80000000;
do {
if (var_v0_2 != 0) {
crc = (crc << 1) ^ 0x1EDC6F41;
} else {
crc <<= 1;
}
var_a0 += 1;
var_v0_2 = crc & 0x80000000;
} while (var_a0 < 8U);
The thing with var_v0_2 is unnatural. GCC sometimes
does these loop rotation tricks, seemingly to save registers (don't
ask me how exactly it does). You want to un-rotate back into:
do {
var_v0_2 = crc & 0x80000000;
if (var_v0_2 != 0) {
crc = (crc << 1) ^ 0x1EDC6F41;
} else {
crc <<= 1;
}
var_a0 += 1;
} while (var_a0 < 8U);
and then of course, you can clean up the rest:
for (i = 0; i < 8; ++i) {
if (crc & 0x80000000) {
crc = (crc << 1) ^ 0x1EDC6F41;
} else {
crc <<= 1;
}
}
Last one tomorrow, I think.
Victory! Court Rules OPM Data Disclosure to DOGE Is Unlawful [Deeplinks]
In a victory for data privacy, a federal court in New York definitively ruled that the Office of Personnel Management (OPM) violated the law when it disclosed millions of federal employee records to DOGE agents. In a summary judgment ruling issued on October 20, 2026, the court found that OPM violated two provisions of the Privacy Act—one restricting disclosure of personal records between agencies and another requiring agencies to protect the security and confidentiality of records.
Since the case was filed, many DOGE agents have left the government and OPM has rescinded their database access. However, OPM should still clean up the cybersecurity mess it created. The court will decide the remedy at a later date.
"By virtue of the Court’s summary judgment ruling, OPM’s decision to grant DOGE Agents broad access to its systems of recordings containing [personally identifiable information (PII)] has been held unlawful," Judge Denise Cote wrote.
"The record also provides no support for a finding that it was the pursuit of a modernization agenda that prompted OPM to grant sweeping and expedited access to a score of DOGE Agents to its systems of records containing PII," she added.
OPM maintains databases of highly sensitive personal information about tens of millions of federal employees, retirees, and job applicants. Starting in January 2025, OPM disclosed data to the U.S. DOGE Service, initially led by Elon Musk. This disclosure violates the federal Privacy Act of 1974, a watershed anti-surveillance statute that prevents the federal government from abusing our personal information.
EFF sued OPM and DOGE because this data disclosure violates the Privacy Act. We represent unions of federal employees – the American Federation of Government Employees and the Association of Administrative Law Judges – and individual employees. We seek injunctive and declaratory relief. We filed in the U.S. District Court for the Southern District of New York.
Our co-counsel are Lex Lumina LLP, State Democracy Defenders Fund, and The Chandra Law Firm LLC.
Support Privacy & Government Accountability
Apple stops pretending macOS is UNIX [OSnews]
Early 2025, I wrote about how I think macOS’ UNIX certification was basically a lie. It required so many convoluted and cumbersome changes to macOS that literally nobody applies to their system that it the certification had kind of become a farce. At the end of the article I wondered for how much longer Apple would be playing this little charade to hammer macOS through a meaningless UNIX-shaped hole, and it turns out the answer was “about 18 months”.
When you go to the Open Group’s website and the list of certified UNIX operating systems, macOS is no longer listed. For the past few weeks, it was still listed if you drilled down specifically to the UNIX 03 certification, but that, too, has now been removed. Assuming macOS 27 doesn’t return in the near future with a brand new certification, we can safely say that Apple got tired of paying a few employees to get its desktop operating system certified.
With one more operating system gone from the list, there’s now only one UNIX operating systems left: AIX. While the registry also lists HP-UX, z/OS, and UnixWare/OpenServer, those either only conform to really old UNIX certifications (from the ’90s), or simply aren’t developed anymore (HP sunset HP-UX at the end of last year). Only one operating system version conforms to the latest version of the certification, UNIX 07, and that’s AIX 7.2 TL5 “and later”, which possibly includes AIX 7.3, the most recent version of AIX.
Not that any of this really matters.
Critical PHP security update coming [LWN.net]
The PHP security team has let it be
known that there is a high-stakes security update coming at
14:00 UTC on October 21. "All PHP users are encouraged
to prepare now so they can upgrade as soon as the release is
available
". Anybody running a PHP site probably needs to be
prepared for this one.
The Big Idea: Stephanie Feldman [Whatever]

With fall in full swing and that crisp chill in the air, it’s the perfect opportunity to cuddle up with author Stephanie Feldman’s newest collection of short fiction, The Night Parade and Other Stories. Light a fall candle and follow along in her Big Idea for these spooky tales.
STEPHANIE FELDMAN:
As a collection, The Night Parade and Other Stories asked me to approach the question of the Big Idea backwards. Not “What Big Idea do I want to tackle?” but “What Big Idea ties these stories together?”
It wasn’t hard to find threads running through my work. I’m always thinking about Big Ideas—what makes a story matter—while I brainstorm, draft, and revise. My short fiction often explores women’s perspectives and all that makes my Mid-Atlantic home weird, creepy, and enchanting.
When I collected my spooky stories set in this region, I made another discovery. While these stories all feature different characters in different worlds, I could assemble them in a rough chronology of a woman’s life. Over the course of the book, we go from childhood friendships, to teenage fear and ambition, to young adult insecurity, and through romance, marriage, divorce, motherhood, and death.
The stories selected themselves; the order fell into place. I felt quite proud of myself. A thematically cohesive collection of dark speculative stories about “The Danger of Loving another Person.” My writing process focused on relentless questioning of Big Ideas had paid off!
But then, I found another thread, silent until the manuscript pulled it taut: music.
In “The Staircase,” the girl who briefly vanishes is a flutist, and she returns from the void with a strange melody. In “The Barrens,” the kids venturing into New Jersey’s haunted Pine Barrens are seduced by an anonymous DJ broadcasting from the wilderness. In “The Boyfriend Trap,” the narrator knows something has changed when her moody, controlling boyfriend plays her favorite song, which he once derided. In “The Albatwitch Chorus,” the middle-aged witch and her teenage intern—daughter of the ex-husband still hanging around—both long to hear the singing of the mysterious, dangerous cryptid society on the outskirts of town. And in the final novella, “The Night Parade,” the young widow searching for her kidnapped husband will do anything, everything to hear the music of an annual, ghostly procession.
And how does that melody go? And what song does the DJ, the suddenly solicitous boyfriend play? And what does the tiny hominid’s voice sound like? And can you decipher the strange words in the Night Parade’s chant?
Maybe you know that old claim: “Writing about music is like dancing about architecture.” (Fittingly, while the quote has been attributed to many, its author remains unknown.) Some things you just can’t articulate.
Counterintuitive though it may seem, a story’s meaning can’t be entirely articulated either—or, rather, it can’t be summarized or encapsulated in a thesis. “A story,” Flannery O’Connor wrote, “is a way to say something that can’t be said any other way, and it takes every word in the story to say what the meaning is.”
So I could tell you that “The Getaway” is about the compounding loneliness of isolation, and whether it’s possible for the young woman, her social life derailed by the COVID lockdown, to repair her oldest friendship. But it also is the broken clock on the porch, the vision of her friend standing in the trees holding a steering wheel, the hole in the ground, the open window, the feeling of being watched. “The Witch of Osborne Park” is about a young mother in the suburbs who doesn’t fit in, and can’t bear her child growing up. But it also is the flock of birds pummeling the window, the little girls costumed in purple robes and wooden masks, the plastic cup of warm white wine, the vanished “Watch Children” traffic sign and the car collision where it stood.
For a long time, I thought I had to master structure and technique; I had to pin that Big Idea down. But I’ve learned—especially as I’ve leaned into horror, the uncanny, the weird—to trust my unconscious impulse. If it feels striking, unnerving, moving, important, then it deserves attention, and probably a place in the final story. If I can’t tell you my story’s Big Idea, then I know it’s not finished. But if I haven’t let in the jolting, haunting images, phrases, and moments that appear along the way, then it’s not going to be any good.
The Night Parade: Amazon|Barnes & Noble|Bookshop|Books-A-Million
[$] SUSE's efforts to disable setuid system-wide [LWN.net]
Setuid (and setgid) binaries have long been a source of headaches, and security vulnerabilities, on Linux systems. They are largely seen as something to be avoided; SUSE's security team, for example, forbids the inclusion of setuid or setgid binaries in packages unless they have been reviewed and explicitly allowed. Thorsten Kukuk wants to go a step further and disallow them entirely. At the 2026 All Systems Go! conference, he spoke about his work to disable setuid system-wide, as well as some of the hurdles that remain.
Thadeu Lima de Souza Cascardo: Restricting device memory usage on Linux 7.3 [Planet Debian]
Linux cgroups has been used for a while to group processes and control their access to certain system resources. One of those resources is memory, through the use of memcg. That control is dynamic, allowing for cgroups to setup a minimal and a maximal amount of memory, as well as low and high thresholds, which will control the reclaim process.
But what about device memory that is not available as system RAM? Memory that is not available to the Linux page allocator? One of those device memories is GPU VRAM.
That's where the dmem cgroup controller comes in. Introduced in Linux 6.14, it was first adopted by the Intel Xe driver. In Linux 6.15, AMD amdgpu driver also adopted it. In 7.3, it was adopted by nouveau.
Such a cgroup controller allows the system to be configured such that a workload, be it a browser, a game, or another GPU rendering process can have some minimal VRAM available. Or it can prevent one of these processes from using all VRAM, preventing your compositor from using it, for example.
Let's go through the system knobs that are available to control this and what's new in Linux 7.3.
Since a given system might have multiple GPUs, there might be multiple device memory regions. So, on dmem, each such region is described by a name. Every dmem cgroup setting file will contain one line per region. One of those files shows the capacity of each region in bytes and is present only in the root cgroup.
After enabling the dmem cgroup with the following command:
# echo +dmem > /sys/fs/cgroup/cgroup.subtree_control
One can inspect the capacity of any available regions by looking
at dmem.capacity at the root cgroup:
# cat /sys/fs/cgroup/dmem.capacity
drm/0000:03:00.0/vram 8573157376
That shows that the GPU at PCI address 0000:03:00.0 has a 8176MiB VRAM dmem region.
When introduced at 6.14, the following settings were available.
In every dmem cgroup, including the root cgroup, the dmem.current is a read-only file that shows the current usage of each region by the given cgroup.
# cat /sys/fs/cgroup/user.slice/dmem.current
drm/0000:03:00.0/vram 292757504
Here, it shows that user.slice cgroup is currently using above 292 MB of VRAM.
# cat /sys/fs/cgroup/dmem.current
drm/0000:03:00.0/vram 311377920
Here, we can check that total system usage is above 311 MB.
Excluding the root cgroup, dmem cgroups can control the maximal number of bytes that can be allocated from a region by processes in that cgroup. If an allocation moves the usage above the max setting, it will be refused. In that case, the allocation might be attempted at system memory or it might trigger eviction, depending on the allocation parameters and the driver.
Here, the max value has special meaning, which is
unrestricted usage.
# echo drm/0000:03:00.0/vram 536870912 > /sys/fs/cgroup/user.slice/dmem.max
# cat /sys/fs/cgroup/user.slice/dmem.max
drm/0000:03:00.0/vram 536870912
# echo drm/0000:03:00.0/vram max > /sys/fs/cgroup/user.slice/dmem.max
# cat /sys/fs/cgroup/user.slice/dmem.max
drm/0000:03:00.0/vram max
dmem.min, also not available on the root cgroup, will control the eviction process - when memory needs to be moved out of VRAM to make room for other VRAM allocations. If an object belongs to a cgroup which is using less than its min setting, it will not be considered for eviction. It effectively works as a hard protection such that the cgroup can use at least the minimal setting.
Given multiple cgroups may set a minimal value that exceeds the device memory capacity, it computes an effective minimal depending on the hierarchy.
While dmem.min works as a hard limit, dmem.low is a soft limit that will prevent eviction in case other objects from different cgroups are available for eviction. That is, the system will try to evict from different, possibly unprotected cgroups, before it tries to evict from a cgroup if evicting would leave its usage below the value set as dmem.low.
Some new changes have been recently introduced in the dmem cgroup controller and its integration with GPUs.
One of those is a new read-only file, dmem.peak,
which was introduced to allow the peak usage of a region in a
cgroup to be inspected.
Also, Linux 7.3 fixed certain scenarios where a given cgroup would not be able to allocate VRAM up to its minimal or low limits if other processes had already allocated most of VRAM, even though they had no such limits set.
Changing multiple regions' settings in a single write was possible before 7.3, but it was prone to failures which would not be reported to userspace and might have left the values partially updated. Starting with 7.3, only one region may be updated per write.
And, finally, prior to 7.3, setting dmem.max in a
cgroup that was using more than the new setting would silently
fail. Now, there is a mechanism that allows a reclaim mechanism to
be triggered. That way, when a process writes to
dmem.max and sets a maximal value below the current
usage, it will wait (unless O_NONBLOCK is used) for
the reclaim process to move objects out of VRAM until the usage
gets below the maximal value. If that is not possible for some
reason, the setting will still be in place, restricting further
alloctions by that cgroup.
Hot on the heels of Wine being ported to OpenBSD, we now have the release of OpenBSD 8.0. It adds hibernate support for arm64, switches the sparc64 toolchain to LLVM, and updates the DRM graphics drivers to Linux 6.18.53, which also adds support for Intel Arc A-Series (DG2/Alchemist) graphics cards. There’s a whole bunch of improvements, fixes, and changes for RISC-V and ARM in general, of course, as well as to the various Wi-Fi drivers. On top of that, it also comes with new versions of OpenSSH and LibreSSL, as well as a massive list of other improvements and fixes.
If you’ve never installed OpenBSD before, be sure to read this detailed guide to know what to do once everything’s installed, while listening to the official release song, of course.
Pluralistic: The death of history's most successful publisher (20 Oct 2026) [Pluralistic: Daily links from Cory Doctorow]
->->->->->->->->->->->->->->->->->->->->->->->->->->->->->
Top Sources: None -->

I published my first story in 1988, when I was 17 years old. Today, at 55, I've published more than 30 books, with three more coming in the next year or so. In the intervening years, I've spent a lot of time thinking and talking about publishing.
I've had plenty of opportunity to reflect on publishing: I've been a bookseller and worked in libraries, I wrote a column for Publishers Weekly, self-published a few books of my own, published the first-ever book licensed under Creative Commons, and broke several Kickstarter records for audiobook projects. But most of all, I've worked with publishing professionals: publicists, marketing directors, operations people, copyeditors, and, above all, editors.
My first novel editor was the magnificent Patrick Nielsen Hayden, who supported my publishing career from the very start, donating to help send me to the Clarion science fiction writers' workshop and inviting me to come read slush at Tor Books whenever I was in New York. Patrick didn't teach me everything I know about publishing, but he sure taught me a lot about publishing, and hardly a day goes by without my having cause to reflect on one of our many discussions over our decades-long professional and personal association.
Out of all the things I learned about publishing from Patrick, one truth stands out above all: publishing is "the act of making something public." Publishing may or may not involve editing, layout, printing, binding, marketing or other activities that we associate with publishing houses, but publishing always involves identifying a work, identifying an audience, and finding ways to connect that work to that audience.
This definition does a lot of useful work. For one thing, it locates publishing as part of the hard problem of human society, namely, "getting people to care about something that matters to you." Beyond publishing, this is the crux of politics, religion and commerce:
https://pluralistic.net/2021/07/04/self-publishing/
For another, this definition lets us understand that (for most of its existence) Google was the most successful publisher in human history. No other institution of any kind connected more works with more audiences. Lots of people have heard of Google's wildly unsuccessful motto "Don't be evil," but far fewer are familiar with Google's wildly successful mission statement, "organize the world's information and make it universally accessible and useful."
But all of that is in the past tense. With its AI projects – AI summaries, the Gemini chatbot – Google has abandoned the practice of "connecting works with audiences." Today, Google's function is to plunder all the works on the internet and chop them up and arrange them in an unimaginably vast, multidimensional array for the explicit purpose of preventing audiences from connecting with those works.
For most of its history, Google operated in a virtuous cycle with publishers whereby they allowed Google to crawl their sites and Google located audiences and connected them with the pages on those sites. Today, that cycle has turned vicious, with Google acting as a parasite that extracts value from the web's publishers and offers nothing in return.
This is entirely in keeping with the enshittification hypothesis: that once a platform is liberated from the disciplining forces of competition, regulation, labor and interoperability, it will squeeze its suppliers and users and harvest all the value for itself:
https://pluralistic.net/2023/01/21/potemkin-ai/#hey-guys
But AI represents a new phase in enshittification. Google has assayed enshittificatory gambits in the past, like deliberately worsening its search results in order to force you to search repeatedly, which gave the company more chances to show you ads:
https://pluralistic.net/2024/04/24/naming-names/#prabhakar-raghavan
But as sleazy as those gambits were, they were profitable. In some important sense, they were sustainable. Assuming Google could carry on indefinitely scamming its users in this way, they'd continue to bring in more cash than they spent, and continue to be the world's most successful publisher, connecting works and audiences (albeit in a deliberately degraded way).
Contrast this with AI, the money-losingest endeavor in the history of human civilization. Google is losing hundreds of billions of dollars on AI. The more AI Google does, the worse the company's financial footing becomes. If Google does this for long enough, it may cease to exist altogether. This collapse can only be prolonged by Google's ongoing extraction of value from web publishers, who no longer have their works connected with audiences via Google search results. Instead, Google usurps those audiences, shows them as many ads as it can, and still loses money in the bargain.
In Tim Wu's Age of Extraction, Wu lays out a thesis about how intermediaries – middlemen who perform a useful function connecting different groups, firms and individuals – are prone to developing "main character syndrome," abandoning their role as facilitators for others and abusing their position to make themselves the prime beneficiary of the transactions they facilitate:
https://www.penguinrandomhouse.com/books/691177/the-age-of-extraction-by-tim-wu/
Google has a scorching case of main character syndrome, and nowhere is that more obvious than in its AI-fueled transformation into web-scale parasite. The fact that this gambit might well destroy Google and the publishers the company once served – rather than merely enshittifying search with worse results and more ads – makes the whole thing look more like a Mafia bust-out than the enshittification of the first half of the 2020s:
https://en.wikipedia.org/wiki/Bust_Out
It's certainly an ignominious end for history's most successful publisher (as was).

Tell Doug Ford: Say NO to Waymo https://techfordemocracy.ca/2026/04/29/say-no-to-waymo/
Bizarre Blanets and Weird Worlds https://www.antipope.org/charlie/blog-static/2026/10/bizarre-blanets-and-other-weir.html
The Showrunners Network https://www.kickstarter.com/projects/spacecommand/the-showrunners-network?ref=8rypb4
Christian Conman Jim Bakker is Dead https://skepchick.org/2026/10/christian-conman-jim-bakker-is-dead/
#25yrsago Reenacting the Civil War with 44,000 ceramic cats in handmade uniforms https://web.archive.org/web/20011021022729/http://www.phillyburbs.com/intelligencerrecord/news/news_intell/1332513.htm
#20yrsago More on publishing and “okaysellers” https://www.nielsenhayden.com/makinglight/bestsellers_oka/#008116
#15yrsago HOWTO make a Frankenstein hat https://web.archive.org/web/20111022194802/http://deliacreates.blogspot.com/2011/10/hey-frankie.html
#15yrsago Copyright policy in the UK: an evidence-free zone https://www.openrightsgroup.org/publications/cant-look-now-finding-film-online/
#15yrsago Clockwork Fagin on Escape Pod https://delivery-edge.libsyn.com/shows/18601/items/1737698/EP315_ClockworkFagin.mp3
#10yrsago At long last, America’s racist, crazy tough-on-crime prosecutors are losing elections https://papers.ssrn.com/sol3/papers.cfm?abstract_id=2828803
#5yrsago Imperfections in your Bluetooth beacons allow for unstoppable tracking https://pluralistic.net/2021/10/21/sidechannels/#ble-eding
#1yrago Carl Hiaasen's 'Fever Beach' https://pluralistic.net/2025/10/21/florida-duh/#strokerz-for-liberty

Vancouver: Life After AI (Vancouver Writers Festival), Oct
22
https://writersfest.bc.ca/festival-event-2026/46
Ottawa: Life After AI (Ottawa Writers Festival), Oct 24
https://writersfestival.org/event/life-after-ai
Vienna: TED AI, Oct 28-30
https://tedai-vienna.ted.com/
Kilkenny (Kilkenomics), Nov 6-8
https://kilkenomics.com/
Courtenay: Enshittification (Sid Williams Theatre Society), Nov
10
https://www.sidwilliamstheatre.com/events/cory-doctorow-talks-enshittification/
Vancouver: BC Policy Solutions Gala, Nov 12
https://bcpolicy.ca/gala/
Oxford: Ministry of the Future, Nov 23
https://ministryforthefuture.co.uk/events.html
Sheffield: Reverse Centaur at Juno Books, Nov 25
https://www.outsavvy.com/event/40274/cory-doctorow-in-conversation
Virtual: Enshittification, AI, and the Future of Technology (UBC
Master of Educational Technology), Nov 28
https://met.ubc.ca/2026/09/met-speaker-series-cory-doctorow-enshittification-ai-and-the-future-of-technology/
Oxford: Bennett Oxford Symposium on Open Code in Science, Dec
9
https://www.bennett.ox.ac.uk/events/2026-bennett-institute-symposium/
Montreal: World Science Fiction Convention, Sep 2-6
https://montreal2027.ca/en
Terms of Service with Clare Duffy (CNN)
https://www.cnn.com/audio/podcasts/terms-of-service-with-clare-duffy/episodes/458ce968-af5d-11f0-b539-13ed2afe25f8
AI, Work, and Power (Software Engineering Daily)
AI, Work, and Power
https://softwareengineeringdaily.com/podcasts/cory-doctorow-on-ai-work-and-power/
AI, Corporate Power, and the Fight for Worker Control
(Plutopia)
https://plutopia.io/cory-doctorow-ai-corporate-power-and-the-fight-for-worker-control/
How to Think About AI—Before It’s Too Late (Daniel
Solove)
https://www.youtube.com/watch?v=_0xR3uEgGcc
"Canny Valley": A limited edition collection of the collages I create for Pluralistic, self-published, September 2025 https://pluralistic.net/2025/09/04/illustrious/#chairman-bruce
"Enshittification: Why Everything Suddenly Got Worse and What to
Do About It," Farrar, Straus, Giroux, October 7 2025
https://us.macmillan.com/books/9780374619329/enshittification/
"Picks and Shovels": a sequel to "Red Team Blues," about the heroic era of the PC, Tor Books (US), Head of Zeus (UK), February 2025 (https://us.macmillan.com/books/9781250865908/picksandshovels).
"The Bezzle": a sequel to "Red Team Blues," about prison-tech and other grifts, Tor Books (US), Head of Zeus (UK), February 2024 (thebezzle.org).
"The Lost Cause:" a solarpunk novel of hope in the climate emergency, Tor Books (US), Head of Zeus (UK), November 2023 (http://lost-cause.org).
"The Internet Con": A nonfiction book about interoperability and Big Tech (Verso) September 2023 (http://seizethemeansofcomputation.org). Signed copies at Book Soup (https://www.booksoup.com/book/9781804291245).
"Red Team Blues": "A grabby, compulsive thriller that will leave you knowing more about how the world works than you did before." Tor Books http://redteamblues.com.
"Chokepoint Capitalism: How to Beat Big Tech, Tame Big Content, and Get Artists Paid, with Rebecca Giblin", on how to unrig the markets for creative labor, Beacon Press/Scribe 2022 https://chokepointcapitalism.com
"Unauthorized Bread": a middle-grades graphic novel adapted from my novella about refugees, toasters and DRM, FirstSecond, April 20, 2027
"Enshittification, Why Everything Suddenly Got Worse and What to Do About It" (the graphic novel), Firstsecond, 2027
"The Memex Method," Farrar, Straus, Giroux, 2027
Today's top sources:
Currently writing:
"The Post-American Internet," a sequel to "Enshittification," about the better world the rest of us get to have now that Trump has torched America. Fourth draft completed. Submitted to editor.
A Little Brother short story about DIY insulin PLANNING

This work – excluding any serialized fiction – is licensed under a Creative Commons Attribution 4.0 license. That means you can use it any way you like, including commercially, provided that you attribute it to me, Cory Doctorow, and include a link to pluralistic.net.
https://creativecommons.org/licenses/by/4.0/
Quotations and images are not included in this license; they are included either under a limitation or exception to copyright, or on the basis of a separate license. Please exercise caution.
Blog (no ads, tracking, or data-collection):
Newsletter (no ads, tracking, or data-collection):
https://pluralistic.net/plura-list
Mastodon (no ads, tracking, or data-collection):
Bluesky (no ads, possible tracking and data-collection):
https://bsky.app/profile/doctorow.pluralistic.net
Medium (no ads, paywalled):
Tumblr (mass-scale, unrestricted, third-party surveillance and advertising):
https://mostlysignssomeportents.tumblr.com/tagged/pluralistic
"When life gives you SARS, you make sarsaparilla" -Joey "Accordion Guy" DeVilla
READ CAREFULLY: By reading this, you agree, on behalf of your employer, to release me from all obligations and waivers arising from any and all NON-NEGOTIATED agreements, licenses, terms-of-service, shrinkwrap, clickwrap, browsewrap, confidentiality, non-disclosure, non-compete and acceptable use policies ("BOGUS AGREEMENTS") that I have entered into with your employer, its partners, licensors, agents and assigns, in perpetuity, without prejudice to my ongoing rights and privileges. You further represent that you have the authority to release me from any BOGUS AGREEMENTS on behalf of your employer.
ISSN: 3066-764X
[$] Discussing a rewrite of XArray [LWN.net]
The work to support block sizes larger than the page size on XFS has been difficult. Many users of XFS run stable kernels, which means that they aren't testing new XFS code as it is released. That has made Daniel Gomez wonder whether adopting Rust for some of the data structures underlying XFS, particularly XArrays, could reduce the number of bugs lurking in the code. At Kangrejos 2026, he led a discussion about the potential problems with converting XArray to Rust. The assembled kernel developers had a number of reasons to be cautious about replacing the XArray code, but Gomez was determined to experiment with the possibility, citing both security and performance improvements.
eMudhra intermediate CA compromise [LWN.net]
Mozilla has announced that it has received a report that private keys associated with eight eMudhra intermediate certificates have been compromised:
These keys could allow attackers to issue fraudulent HTTPS certificates for websites they do not control. An attacker who could intercept a user's connection could use those certificates to impersonate websites and potentially read or modify traffic.
Mozilla has blocked the affected certificates using its OneCRL centralized list of revoked certificates, and has updated the trusted certificate list in Network Security Services (NSS) 3.131.1.
There is a single-page site about the compromise that goes into more detail. According to the site the certificates have also been blocked in Chrome since October 17, Apple devices since the 19th, and Microsoft blocked the certificates on the 20th. There is also a table that displays whether a browser or other client still trusts the compromised certificates.
The NetBSD foundation has issued instructions to block the certificates on NetBSD installations. Users of other browsers and operating systems may wish to check for updates or guidance to disable the compromised certificates.
OpenBSD 8.0 released [LWN.net]
OpenBSD 8.0 has been released. There are many new features, including the addition of hibernate support for arm64, an increase in the kernel virtual address space for amd64 to 512GB, quite a few improvements for the qwx driver that supports Qualcomm WiFi 6 devices, and much more. See the full changelog for details.
At my employer, we use a service called Coveralls, which is a
code coverage reporting tool that hooks into your CI pipeline. It
takes your lcov reports and gives you some insights,
and also makes it easy to cause the CI pipeline to fail if newly
added code doesn't have reasonable coverage.
I have no strong feelings about the tool, but on February 24th, our CI jobs started failing, and our CI step that talked to Coveralls was the culprit. Coveralls had gone down. That happened to us, and a lot of other people. It was a widespread outage impacting anybody who used their service.
Coveralls actively published updates as the outage dragged on, and boy, did it drag on. Between them posting nearly identical updates minutes or even seconds apart and the general desperation that snuck into their outage notes after the first few days, I couldn't help but find their notes hilarious.
They've published their post-mortem, and the short version is that despite them paying their bills, Amazon decided they hadn't, and shut down their services. But it took them roughly 68 hours to figure that out.
If you scroll down past the post-mortem, you can see their outage notes. This is an unauthorized, dramatic reading of those notes. We've taken some liberties in interpreting it.
I hope this is taken in a good spirit, because they were just doing their best when this happened. I don't think most companies would be able to maintain operations when their cloud provider decides to lock their accounts. But I don't care who you are: begging your users to email you if they can help you migrate off AWS is funny.
Security updates for Tuesday [LWN.net]
Security updates have been issued by AlmaLinux (environment-modules, kernel, pcs, perl-URI, python3.14-urllib3, and webkit2gtk3), Debian (python-django), Fedora (bind, bind-dyndb-ldap, chromium, cifs-utils, curl, haveged, python3.15, qt5-qtbase, rust-rbw, rust-routinator, rust-rustls, xorg-x11-server, and xorg-x11-server-Xwayland), Mageia (firefox, firefox-l10n, nss, flatpak-builder, imagemagick, libpng, libxi, libxpm, libxtst, openssh, postgis, and thunderbird), Oracle (emacs, environment-modules, libsoup, perl-URI, python3.14-urllib3, webkit2gtk3, and xorg-x11-server), Red Hat (go-fdo-client, go-fdo-server, golang, kernel, kernel-rt, openssh, postgresql:16, postgresql:18, and rust-sequoia-sq), SUSE (alsa, AusweisApp, chromedriver, ffmpeg-4, kubernetes, libsoup2, nvidia-open-driver-G07-signed, p11-kit, perl-Net-OAuth, perl-Net-Whois-Raw, pgvector-devel, pi-coding-agent, podman, python, python3, python3-base, python3-doc, python315, python36, thunderbird, and velociraptor), and Ubuntu (cifs-utils, curl, golang-1.22, libxtst, openssh, openssh-gssapi, and php8.5, php8.3, php8.1, php7.4, php7.2, php7.0, php5).
Today's song, for the Knicks. "And when the morning light comes streaming in I get up and do it again." Knicks in 5!
My friend
Guy Kawasaki has a quote from the early Mac division at Apple.
"Steve Jobs has a saying that A players hire A players. But B
players hire C players, and C players hire D players. It doesn't
take long to get to F players. This trickle-down effect causes bozo
explosions in companies." You see this over and over among the very
rich in tech. The money is supposed to make them invincible, but
they don't hire the best people, I guess, for fear of being found
out to not be the genius that the money says they are.
I have a longtime friend from tech who is a San Antonio Spurs fan. I am from New York, and thus am a lifelong Knicks fan. Until tonight's game starts at the Garden between the Knicks and the Sixers with their new acquisitions from Boston and the Lakers, share the hopes of many other Atlantic Division teams who are gunning for the champion Knicks. But after the first jump ball in tonight's game the score is zero-zero, everyone is in first place and everyone is in last place. No one expected the Knicks to win, not even a die-hard fan like myself who often wore a paper bag on his head to avoid having to defend the bozosity of the hometown team. They had some truly awful teams since 1999, last time they were in the finals. So what happened to the Knicks? How did they do it? See the quote from Guy Kawaski above. We hired an A team guy in Leon Rose, and he used his great insight into the sport of NBA basketball to assemble a team of second round but A team players who had the special magic that when you put them together on court, they blossomed into the most improbable winners ever. They were good, but no one but the players and the management knew how good they could be. Anyway I empathized with my Spurs fan friend, a very unusual thing for a NY sports fan, we prefer to find annoying ways of making fun of the fans of teams we have vanquished, but just this one time, well until the jump ball tonight, then Knicks own the NBA, then they're just another team who have to prove themselves all over again, from scratch. And we wouldn't have it any other way. Knicks in 5!
We do know what's going on [Scripting News]
Occam's News reports that Trump et al are selling out the US.
Putin can get the US to do what he wants by giving Trump money. Total win-win. And the US is flushed down the toilet.
That's all that's going on there.
All of the feigned bafflement is make-believe. It's totally obvious what's going on. And don't forget Musk has the world encircled with satellites. If he doesn't want you communicating, you don't communicate.
In other words the selling-out has been going on for some time.
In my work with G7–G12 students at Force Academy, a research initiative in Chongqing, I sometimes take a project that appears to be finished and give another student responsibility for using, checking, or modifying it. The handoff is a test of understanding: Can the work still make sense when its creator is no longer there to translate it? The original author knows what every variable means, why a particular decision was made, which tool was used, and which parts can safely be changed. The second student has only what the project makes visible.
Generative AI makes the handoff more revealing because it lowers the cost of producing a convincing first version. Students can generate code, analysis, prose, visualizations, and prototypes far more quickly than they could a few years ago. In a classroom, however, a project is useful only insofar as it shows what the student understands and can defend. AI can supply missing code, smooth over incomplete reasoning, or turn a rough idea into fluent prose, so polish is no longer strong evidence of understanding by itself.
A concrete example came from a student paper on AI and labor economics, Verification Responsibility in AI-Applicable Occupations. The paper asked what remains economically important when AI makes candidate outputs cheap but a person still has to check those outputs, decide whether they are safe to use, and remain responsible for accepting them.
The lead student developed the conceptual model and most of the analytical workflow. A second student was given a narrower job: rerun the main analyses independently, record the versions of the source data, document how occupations in one dataset were linked to occupations in another, and compare the reported tables and figures with the underlying outputs. What looked like procedural verification quickly became a substantive review of the study.
The first problem was reproducibility. The analysis ran on the original machine, but too much of the workflow depended on choices that lived in one student’s memory. To reproduce it elsewhere, the team had to record the data transformations, write down the rules for linking occupational datasets, and keep intermediate results so another person could see how the final numbers had been produced rather than simply rerunning a script and trusting the output.
The more consequential problem was in the measurement design. An early version of the study used some of the same autonomy and leadership survey items in two different measures: verification responsibility and adaptive capacity. The software had calculated the relationship between those measures correctly, but part of the apparent relationship could have been created by the fact that the two measures shared some of the same inputs. In other words, the code was doing what it had been asked to do; the question was whether the quantities being compared had been defined cleanly enough.
The team rebuilt the measures so they no longer shared survey items, removed ambiguous items, and revised the workflow so source versions, cross-dataset links, exclusions, intermediate files, and reported results could be traced. Later versions added alternative specifications and robustness checks. What began as “please rerun this” ended up forcing a redesign of the study.
The handoff changed how I read student work. A second user does not merely test whether the files have been packaged neatly; they ask the awkward questions the creator may have stopped noticing. Why is a particular variable there? Which conclusion depends on an assumption that was never made explicit? In this project, those questions reached back into the measurement design.
The educational value of the handoff comes from the fact that schoolwork and production software have different ends. Professional developers learn a great deal after software leaves their hands because they have to deliver it, explain it, support it, maintain it, and respond when someone uses it in an unexpected way. Student projects usually disappear when a course ends, and that is fine; the artifact is not the goal. What matters is importing some of the learning that comes from delivery and maintenance: explaining decisions, supporting someone else’s use, and revising the work when private context is no longer available.
At Force Academy, the exact task depends on the project. For a computational model, another student may change a parameter or replace one rule and then ask what should remain stable. For an AI-supported workflow, the job may be to move it to a different model or environment. For a data analysis, the second student may try to reconstruct one result from the recorded source files and transformations. When that transfer fails, I want the original student to decide what the other person actually needed to know and what should be changed in the project, rather than simply standing beside them and explaining it.
I use the word “handles” for the visible points of entry that make that possible. A handle gives another person something concrete to inspect or change without first receiving a private briefing. It might be a clearly named parameter, an explicit assumption, a test that records an earlier failure, a replaceable component, a retained intermediate dataset, or a prompt whose important context is written down instead of buried in a private chat history.
Handles also make disagreement more productive. An exposed assumption can be challenged; a component with a clear boundary can be modified or replaced without rebuilding the whole project; and a numerical result linked to its source data and transformations can be checked rather than accepted on authority.
Outside school, AI systems expose the same weakness. A prompt, workflow, skill, or agent configuration may look portable because it can be copied, while the conditions that make it work remain elsewhere: tool access, file structure, model behavior, private memory, naming conventions, or small decisions the creator never needed to document. Moving the artifact often reveals how much of the working system was never inside the artifact in the first place.
A first successful run is therefore weak evidence. It tells me that a particular combination of person, model, tools, data, and context produced an output once. A stronger test is whether another person can reconstruct what matters, distinguish assumptions from implementation details, and make a change without destroying the logic of the work.
Tim O’Reilly’s idea of an architecture of participation gives me the broader frame. A technical artifact becomes more useful when other people can enter it without negotiating privately with its creator. In software, that usually means interfaces, conventions, documentation, modularity, and replaceable components. In data analysis, the same principle shows up as recorded source versions, visible transformations, retained intermediate results, explicit assumptions, and enough analytical logic for someone else to rerun or challenge the work.
For education, the milestone I care about is whether the student understands the work well enough to make some of that understanding available to someone else. A second student who can use, question, and extend the project gives me evidence that a polished first run cannot.
AI expands what one person can build, including what a teenager can attempt without a large technical team. The expanded scope is a real gain, but it also makes successful generation easier to confuse with understanding. When I want to know what a student really understands, I now learn more from the first serious handoff than from the first successful run.
Possible new Cellebrite iPhone Radio Zero-Day [Schneier on Security]
Justin.sh is reporting on a confidential Cellebrite document that has been leaked to him:
Cellebrite calls it Advanced Unlocks (AU from here on), not to be confused with the “advanced unlocking services” they’ve marketed for years. A press release from earlier this year confirms AU is a new product for 2026.
[…]
According to Cellebrite, AU:
- is a “next-generation AFU vector that is more resilient to Apple’s OS changes”
- works with Stolen Device Protection enabled, which tightens USB restrictions
- is enabled by a dedicated appliance with a stated range (!) of about 8 meters.
AU = Advanced Unlocks, Cellebrite’s term. AFU = after first unlock.
Thieves’ cant slang [Seth's Blog]
Insider jargon, previously known as cant, is designed to keep outsiders out.
The burglars in cartoons are often seen wearing a black mask over their eyes (like Robin in Batman but for a different reason) and carrying a bulging sack over their shoulders.
[Of course, the burglar’s sack was rarely bulging. A robber would have to have the perfect haul to get the right mix of value, density and weight. You can’t fit a chest of drawers in the sack, and that much gold would be impossible to carry. But I digress.]
The cant for this was ‘swag’, which comes from an old term for swaying or bulging. Sort of wishful thinking.
And thus we get to the swag of business promo and conference loot…
Establishing jargon is a key step in group identity. It’s rarely dictated from the top down, but permitting and celebrating it is a smart move if you’re looking for group cohesion.
Russell Coker: Cixin Liu is a Bad Person [Planet Debian]
The Chinese author Cixin Liu [1] is most known for his book The Three Body Problem and it’s sequels. One of the main plot elements in the book is that every species in the universe is cool with genocide and willing to commit genocide as a preemptive strike against any star system found to contain intelligent life.
It’s not unreasonable to think that some planets may be by run societies like that, if one star system in 10,000 had a technological society and one society in 10,000 is run by depraved autocratic governments that would make 1,000+ planets in our galaxy that are run by genocidal groups!
To think that every single society wants to commit genocide at every opportunity says a lot about every person who makes such claims. If you believe that everyone wants to do something then it must be something you really want to do. If there’s something you really don’t want to do then you will be able to imagine a system of government where the majority of citizens vote against doing it.
Even in the more horrible parts of human history there hasn’t been a genocide comparable to destroying and entire star system, genocide is usually based on slavery and large scale armed robbery. To just commit large scale genocide with a side effect of destroying valuable resources without any investigation or attempts at negotiation just based on fear of others is an extreme that I don’t think humans have reached in history.
The Daleks are portrayed as a perverse extreme of xenophobia but even with the low budget SciFi trend of depicting aliens as mostly having a common belief system they managed to show some Daleks going against their system from time to time. Cixin Liu is a very talented writer but his attitude towards genocide has caused him to write SciFi with a major plot point that’s not great by Dr Who standards.
Overall his short stories are much better than the three novels he is most known for. But he shows his ass in some of them too. One notable example is a short story where a significant plot point is declaring a “right to sex” (for men) which involves government sponsored sex workers. A “right to sex” conflicts with a sex workers right to refuse sex for a potential client who is undesirable in some way. Regardless of opinions on whether sex work should be permitted I hope that the vast majority of voters in every jurisdiction can agree that sex workers shouldn’t be forced to do things that they don’t want to do.
Some writers like George Orwell create deliberately fictional scenarios that they hope to inspire opposition to bad ideas, I’m sure that many proposed laws have failed to get enacted after being described as “Orwellian”. But describing a fictional horror situation as inevitable is a way of driving support for such things. It’s particularly noteworthy when written by a citizen of a country that’s involved in genocide.
A possible counter argument would be “but he is living in a repressive country and can’t oppose his government”. But when Hergé (the author of the Tintin graphic novels) was threatened about the consequences of writing another book like King Ottokar’s Sceptre [2] he didn’t write books in favour of authoritarianism, he just avoided the topic by writing about visiting the moon instead. I don’t think that people living in China now should be expected to publicly oppose evil things done by their government, but when they go out of their way to support such things it’s their choice and we should note that they made that choice.
I’m not saying that people shouldn’t read his work as his short stories are definitely worth reading. But the Three Body Problem series really isn’t that good, he prevented many potentially interesting situations from happening by having every interaction between different species be based around genocide or the potential for it. Being a horrible person also made him a less capable SciFi author.
Lucid Sex Dreams by Susannah Hainley [Oh Joy Sex Toy]
Why do we need ud2 when int 6 is right there? [The Old New Thing]
Some time ago, I mentioned that the
ud2 instruction was created to be an architecturally
undefined instruction. But why not just use an int
6 instruction? It’s a two-byte instruction, just like
ud2, and interrupt vector 6 is the invalid opcode
vector, so a program could just invoke it manually and get whatever
behavior the operating system assigns to an attempt to execute an
invalid opcode.
Well, not exactly.
Architecturally, the invalid opcode is a fault, which
means that the address of the faulting instruction is reported to
the exception handler. On the other hand, the int 6 is
a trap, which means that the address of the instruction
after the int 6 is reported to the handler.
This distinction between faults and traps reflects how they are used. A fault represents an error that the kernel could attempt to repair and retry. For example, a page fault could be repaired by paging the memory in. An access violation could be repaired by changing the page protections. A trap reports an operation that has already occurred and gives you a chance to do some special work in response to it before resuming execution. In the case of a software interrupt, the handler wants to process whatever the interrupt means, and then resume execution with the next instruction.
Now, some faults are unlikely to be repaired, but reporting them as faults means that you have to take extra steps if you want to execute past them. If you just ignore the fault, the instruction restarts and faults again.
If you manually raise the int 6 interrupt to
simulate a #UD undefined instruction fault, the handler
will think it’s dealing with a CPU-generated undefined
instruction fault, so it expects the instruction pointer in the
fault frame to point to the undefined instruction. But since
int puts the address of the next instruction
into the fault frame, the fault handler will look at the
instruction and get confused as to why the invalid instruction
fault was raised. “It says here that the faulting instruction
is a xor eax, eax. That’s a perfectly legitimate
instruction. Why did it fault?”
One case for inspecting the faulting instruction is to emulate missing instructions on older processors.
Furthermore, in protected mode, you need to have permission to
issue an int 6. The interrupt descriptor table
describes what to do for each interrupt, as well as what CPU
privilege level is permitted to invoke it explicitly. And to avoid
exactly these types of problems where a user-mode program issues an
int 6 and confuses the #UD handler, all
operating systems deny int 6 privileges to user
mode.
So even if you try to fake a #UD via an explicit
int 6, it doesn’t work. To get the #UD
undefined instruction fault, you have to issue an actual undefined
instruction.
The post Why do we need <CODE>ud2</CODE> when <CODE>int 6</CODE> is right there? appeared first on The Old New Thing.
Anyway -- I figured out what I want to do. I want to go back
to the point where CSS and JavaScript were added to the web.
Everything is a document. It's a writer's web. The
reader owns the look of the pages. The writer has no say in colors,
or arrangements, it's just writing. No character limits. Simple
styling. Full fidelity text.
Reading and writing, and then the developers can come up with a
million different ways to read, and everyone gets to use their
favorite editor, always, and store all their writing where they
live, and let everyone read it where ever they read. Any structure
they can think of, but all the rendering code is with the reader. I
think we can take what we've learned since the web got
corporatized, and bring it back to the basic platform we had then.
And btw, no HTML, just Markdown. :-)
Postscript: Of course the blame for the wasted time this morning goes to me. Claude tries to do what it thought I wanted. If I calm down, figure out what the confusion really means, and reconsider the path I chose and pull back, we get much further. And I think the way I was trying to go was a mistake. I think film editing is a lot like this. Anyway we got past the problem, and today was a very productive day in the end.
About XSLT -- I remembered that I thought it was a bad idea. Let XML look like XML. Trying to make it look like an HTML page, how does that make any sense. Like opening the hood of a car and seeing a big picture of the outside of the car. People aren't really that dumb, but some people like to complain a lot. The rule of the web is if you don't like what you see, that's what the freaking back button is there for. Probably just a troll anyway. Show them your JSON and RSS. If it's done nicely it can be quite illumifying.
Purposes Of Insurance [QC RSS v2]

slainte, prost, etc
Require Police to Get a Warrant to Search ALPR Data [Deeplinks]
This post was co-written by Andi Cao, an EFF legal intern.
Automated license plate readers (ALPRs) are mass surveillance. They photograph every passing car and log where and when it was captured, building a searchable record of where nearly everyone drives. Cities should not buy them, and cities that already have them should shut them down.
Where these systems still operate, courts and state legislatures must reduce their harms by (among other things) requiring police to get a warrant before searching stored ALPR data. A warrant requirement would not make mass surveillance acceptable, but it would require police to justify a search to a judge before accessing records of people’s movements. Without this independent judicial check on police power, officers have been searching this data for improper reasons (many exposed by EFF) that violate our fundamental rights.
A warrant requires a judge to find probable cause and specificity—many warrantless police searches of ALPR data lack both. Officers have searched this data to profile Romani people, monitor protesters, investigate an abortion, find immigrants for deportation, track a man who complained about a deputy, stalk romantic partners, and even for no stated reason beyond “LMAO.” A warrant requirement would force law enforcement to justify these searches before accessing sensitive location records, not leave the people they target to discover and challenge the abuse after the harm is done.
Warrants are a check on police power. Before officers can search a person or their property, the Fourth Amendment requires them to convince a neutral judge, under oath, that probable cause exists, meaning a fair probability the search will turn up evidence of a crime. The warrant must also describe with particularity what will be searched, so police cannot go on a fishing expedition. Critically, the officer who wants to search is not the person who decides whether the search is justified.
That is why warrants are required for so many kinds of police surveillance. For example, police generally need a warrant to wiretap phone calls, to search the contents of a cell phone, and to obtain historical cell phone location records.
Stored ALPR data reveals sensitive information about the private details of our lives: where we go, when, and with whom. That’s why we believe police searches of stored ALPR data should also require a warrant. Earlier this month, a federal judge in Oklahoma agreed.
San Jose demonstrates the harmful consequences of letting law enforcement search stored ALPR data without a warrant. EFF and the ACLU of Northern California represent SIREN and CAIR-California in a lawsuit challenging this practice.
The first problem is the sheer number of times that SJPD officers search stored ALPR data: 261,711 times between June 5, 2024, and June 17, 2025, about 692 searches a day. That scale is the result of having no warrant requirement, which would greatly reduce this kind of casual police surveillance.
Inevitably, officers abuse this unchecked power. In September, San Jose’s police chief disclosed an example from five months earlier: the department had fired an officer who used its ALPR system to track a woman who had accused his cousin of domestic violence, and then shared her location information with his cousin. The abusive search of stored ALPR data came to light only after the woman told police that her alleged assailant had implied he was tracking her. A warrant requirement would have prevented this.
Of course, similar problems appear nationwide. For each example below, consider how things could have turned out differently if the officer had to put the reason for the search in a sworn warrant application and handed it to a judge.
More than 80 law enforcement agencies searched the Flock network using terms that unfairly stereotype Romani people, often without mentioning any crime. For example, the Grand Prairie (Texas) Police Department searched for “g*psy” six times using a Flock feature that identifies vehicles traveling together, in effect targeting a whole community without naming a crime.
No judge should sign that warrant. Ethnicity is not evidence of a crime, and a search aimed at an entire ethnic group is the opposite of particular: it targets people for who they are, not evidence that they committed a crime.
EFF found that more than 50 agencies ran hundreds of protest-related searches of ALPR data in 2025. For example, the Tempe (Arizona) Police Department ran three searches tied to the No Kings protest across 425 networks, with no identified crime.
This lacks probable cause and targets activity that is protected by the First Amendment.
In 2025, a Texas sheriff’s office searched more than 83,000 Flock cameras, including cameras in Washington and Illinois, where abortion is legal, listing the reason as “had an abortion, search for female.” Records later obtained by EFF show deputies had opened a “death investigation” after the woman’s partner, who was later charged in connection with assaulting her, reported her self-managed abortion.
In a state where abortion is legal, a judge would not grant a warrant for a search like this.
San Francisco police let out-of-state agencies search the city’s ALPR data (which itself violates California law), and at least 19 of those searches were marked as related to ICE (though San Francisco is a sanctuary city). This problem is widespread. One investigation found more than 4,000 cases in which police departments around the country searched stored ALPR data on behalf of federal law enforcement, including for immigration investigations. Some agencies even connect their ALPR systems to an “Immigration Violator” hotlist populated by ICE, which includes plates tied to administrative warrants issued by ICE agents without any judge involved.
Here too, a judge in a state where police may not help enforce immigration law would not issue a warrant for these searches.
In May 2025, Navy veteran Napoleon Jones lawfully recorded a police traffic stop of another person in Sussex, Wisconsin. Jones alleges that a Waukesha County deputy retaliated by stopping and arresting him. He was released five hours later without citations or charges, and the deputy’s supervisor concluded the stop was illegal. Jones filed a complaint against the deputy the next day.
In the weeks that followed, officers reportedly ran more than 100 Flock searches against Jones, including some run by the deputy he had complained about. Deputies testified that a lieutenant ordered the searches in connection with Jones’s complaint.
No judge should authorize tracking a man for criticizing the police.
The Institute for Justice (IJ) has documented dozens of cases in which officers allegedly used ALPRs to track current, potential, and former romantic partners. For example, a Lufkin, Texas, officer was indicted on 100 felony counts after allegedly searching for his ex-girlfriend and people she knew more than 10,000 times. Likewise, a Milwaukee officer allegedly tracked a woman he was dating and her ex nearly 180 times over two months. IJ found that most of these cases surfaced only after victims reported the officer.
We hope that no officer would write “tracking the location of my ex-girlfriend” on a warrant application, and even if they did so, a judge would not authorize such a search.
Sometimes officers do not even provide a real reason to search stored ALPR data. EFF found officers logging search reasons such as “LOL,” “LMAO,” “idk,” and random keyboard mashing. These entries are supposed to document why a search complies with an agency’s own use policies. A Goshen (Indiana) Police Department officer searched 6,474 networks, representing data from 82,413 cameras, with “idk” as the reason.
An officer who asked a judge for a warrant to track someone for “LMAO” would be laughed out of the courtroom.
The best way to eliminate these abusive searches is to end ALPR mass surveillance. Where these systems remain, however, courts and state legislatures must require police to get a warrant before searching stored ALPR data. Warrants are the time-tested way to put an independent judicial check on police use of a dangerous surveillance technology. Officers must establish probable cause and specifically describe the proposed search before accessing the data, while existing exceptions for genuine emergencies still apply.
These protections must also cover real-time tracking. An ALPR “hotlist” is a list of license plates that trigger an alert when a camera spots a matching plate. Officers can stalk potential romantic partners by putting them on a hotlist, as a Florida deputy allegedly did with a woman he met on the set of a TV show. Thus, state legislators should require officers to get a warrant before putting a person on an ALPR hotlist (as well as a warrant to search stored ALPR data).
Apple adds mystery folder to your PATH and everyone is apparently just okay with that [OSnews]
Apparently, macOS 27 comes with a small mystery people are trying to figure out.
Recently, while troubleshooting a PATH issue, I noticed an entry for
/pkg/env/global/bin. At first, I worried that something had gone horribly wrong. Turns out, this is part of macOS 27.0… though no one is sure what it’s for yet.[…]
In a post about how macOS’s boot volume structure has been updated, Howard Oakley explains that the
pkgdirectory was added to the Data volume in macOS 26.4, but not added to the root of the Signed System Volume until 27.0. He also notes that this is sort of a big deal.The weird thing is, as far as I can tell, no one seems to know what this new directory is for! It’s odd that Apple would update their filesystem structure, add it to everyone’s PATH, and there not be some explicable reason.
↫ Gavin Anderegg
I guess we’ll find out eventually, but this does highlight something that I find extremely unsettling about this. With proprietary software like macOS, you literally are at the mercy of whatever Apple decides to do to “your” operating system. You install an update, and aside from all the documented changes, there’s going to be changes you simply have no idea what they’re for, or why they’re there. Don’t get me wrong, there’s obviously not something nefarious going on in this particular case, but it still feels wild to me that people just willingly accept this.
In the open source world, stuff like this simply does not happen. You’re not going to install a bunch of Fedora updates one day and find a mysterious, undocumented folder in your PATH. Such a change will be documented, but even in the unlikely event it’s not, you can just go through the commit history and find out exactly why the new folder is there, and what its intended purpose is or is going to be.
Considering the state of the world and the people corporations like Apple really answer to, I would not be comfortable with letting them dictate even something as simple as my PATH.
Steinar H. Gunderson: Decompilation patterns, part 16: Tail reduplication [Planet Debian]

We're nearing the end soon, I promise. Here's one that I see all the time:
...
} else {
var_t0_5 = temp_a0_3 - 0x140;
var_a2_5 = 0xA0 - temp_a3_5;
goto block_45;
}
} else {
var_t0_5 = 0xA0 - temp_a0_3;
var_a2_5 = temp_a3_5 - 0x118;
block_45:
var_v0_3 = var_t0_5 + 0xA0;
var_v1_4 = var_a2_5 + 0x78;
}
So, eh, what's that goto doing there? What happened was that the compiler helpfully figured it could help with some tail deduplication; someone wrote the same code twice, and the compiler figured taking the cost of a branch was better than keeping it duplicated. (In a sense, it's the opposite of inlining. Ish.) In most cases, it's as simple as copying the block and then you can remove the label:
...
} else {
var_t0_5 = temp_a0_3 - 0x140;
var_a2_5 = 0xA0 - temp_a3_5;
var_v0_3 = var_t0_5 + 0xA0;
var_v1_4 = var_a2_5 + 0x78;
}
} else {
var_t0_5 = 0xA0 - temp_a0_3;
var_a2_5 = temp_a3_5 - 0x118;
var_v0_3 = var_t0_5 + 0xA0;
var_v1_4 = var_a2_5 + 0x78;
}
Sometimes, these are nested, with multiple tails goto-ing into each other, so in that case, you'll need to reduplicate multiple times. Make sure you actually come out on the correct side afterwards, though.
As an extra complication, the code is deduplicated not on the C
statement level, but on RTL instructions, so if you're calling
functions with five parameters of more (which requires pushing
parameters onto the stack), m2c can get really confused and start
throwing M2C_ERROR() at you on the receiving side
because it's not clear at all where the parameters would be coming
from.
Mr. Gibb got hauled back into ARC by his eldest; that last link goes to his full report if you haven't seen it. Today's strip is a "war journal" of the kind of twisted, post-apocalyptic hellscape that you might experience in a food court.
Linux Plumbers Conference videos now available [LWN.net]
Mike Rapoport has announced the release of the video recordings from the 2026 Linux Plumbers Conference (LPC), which was held in Prague from October 5 through October 7. Find the complete set via the YouTube playlist or look for the video links in the schedule. See also LWN's coverage of talks from LPC.
Arc Raiders PvE Report! [Penny Arcade]
I quit playing ARC Raiders for a couple of reasons. The two big ones being I did not want to support their use of AI voices and I was sick of getting shot in the back and losing all my shit. My eldest son Gabe loves the game and never stopped playing. He told me about how they replaced their AI voice work with human actors and that they were testing a new PvE mode. He asked if I wanted to try a few rounds with him and since I am at all times desperately trying to avoid a “Cat’s in the Cradle” situation I said yes.
Building an AI Analyst, One Football Argument at a Time [Radar]
One of my biggest pet peeves is the Monday morning quarterback, the person who second-guesses every coaching decision after the fact. In The Monday Morning Agent, we’re building one that actually checks the data.
Every other Monday, I’ll take an argument NFL fans can’t stop having and hand it to an AI agent. We’ll use about a quarter-million plays from five complete seasons of public nflverse data, plus the current season as it unfolds. Each of our eight episodes will give the agent another capability. By the finale, it’ll run the desk unattended, and we’ll check what it investigated and what it correctly refused to answer.
We’ll start with “You have to establish the run.” I want the agent to explain what that claim means and what evidence would support it.
“Establish the run” can mean that running early pays off late, wearing down the defense, or setting up play action. These are very different claims and they need different data. For this first episode, I focused on whether teams that run more often early in a game win more often.
Before the agent called the tool, I asked it to write one sentence explaining what would have to be true in the data for the claim to hold, including when in the game it applies. “Establish” here means early. A whole-game number doesn’t really test that. Give your agent the same assignment, and check that it’s answering the question you intended.
Before any agent touched this, I ran the analysis code myself. The tool did the counting; the agent interpreted the results. Then I wrote the policy in a Markdown file, spelling out its job, the read-only tool it may use, and what its answer needed to include. It has to explain what the plays can’t tell us. It may not say running causes winning.
Try questions outside that job too. When I asked which team I should bet on, the agent refused without calling the tool, because that request is beyond the scope of our agent. But when a viewer asked about running trends, the results got tangled up with the “establish the run” instructions. I had to clarify what I was asking, and still wanted to see the code and validate the answer. As you give an agent more responsibility, check both its results and whether it understood the task.
“You have to establish the run” sounds airtight at first. Over the last five seasons, teams with the highest run share, the percentage of their plays that were runs, won 77.7% of their games. Those with the lowest run share won 19.2%. I initially looked at that and thought, “Problem solved, we’re done.” Most of that gap, though, reflects teams that were already ahead running out the clock.
When the agent looked only at first-half running in games within three points at halftime, the result flipped. Teams with the highest first-half run share won 46.3% of the time; those with the lowest won 55.3%. This season through Week 5 points the same way, but each group contained only 11 team games. One game could swing it. That doesn’t mean passing causes winning. We’re measuring association, and the filters change which games we’re comparing.
One filter changed the whole story, which is why the filters have to be on-screen. I wanted to see how many rows remained and which commands produced the results so I could go back and check. Make those details part of your agent’s answer, including when it’s working with a smaller sample.
In Week 5, the team that ran more in the first half won 6 of the 15 games, lost 8, and tied 1 (Giants at Washington). Over the past five seasons that team won 54.3% of the time, so last week came in below the average. That’s not unusual, though. In 27 of the 95 regular-season weeks since 2021, the team that ran more early finished the week with a losing record. One week of games doesn’t say much on its own, which is why the agent reports five seasons alongside the current one.
One more data point: The Monday night game, Buffalo at the Rams, was the first the agent hadn’t seen. Buffalo ran on 60% of its first-half plays to the Rams’ 35%, led by six at halftime, and won by three in overtime. Those 199 plays are in the data now, and the close-at-halftime numbers from the episode didn’t change.
On October 26, we’ll tackle “Ban the Tush Push.” Not one of the 260,927 play descriptions from 2021 through this season’s October 11 games contains the words “tush push.” After adding Monday night’s game, we have 261,126 descriptions, and “sneak” appears in only two, both from 2021. The data isn’t going to hand us a definition.
Before the agent can judge the play, it has to define it. I’ll challenge it to write that definition into its first permanent document, a shared data dictionary, and cite it in every ruling from then on. Bring your own definition, because the answer depends on which one you pick.
O’Reilly members can sign up on the O’Reilly learning platform to join me live on October 26, 8:00am–8:45am PT / 11:00am–11:45am ET. Everyone can follow along on Radar every other Monday, with a brief pause for the holidays. Watch episode one above, and we’ll build on it in the next session.
Announcing Privacy Badger for Safari on macOS [Deeplinks]
Exciting news for Safari users: Privacy Badger is now available on Safari for macOS! You’ll need Safari version 26.5 or higher to use it.
Whether you want to protect yourself from data brokers or just don’t want Big Tech profiting off your browsing data, Privacy Badger is here to help. More than 4 million people already use EFF’s free tracker-blocking extension to take a stand against online surveillance. Safari users can now join them and EFF in the fight for a better web.
Support the Fight Against Online Tracking
Safari support has been one of Privacy Badger’s most requested features for years. Thanks to recent improvements in Safari's extension support, we’ve finally made it happen for Safari version 26.5 and higher. Privacy Badger is now available on all major desktop browsers. And before you ask, yes, we will look into supporting Safari for iOS once we've ironed out any issues on macOS.
Most websites contain invisible tracking code that lets companies collect, share, and profit from your personal data. Some of those companies are data brokers that sell your information to anyone willing to pay. Creepy ads are just the tip of the iceberg when it comes to the harms of online tracking: Once your information enters the data broker ecosystem, it’s nearly impossible to know who buys it or what they’re doing with it. Privacy Badger blocks online trackers to prevent your browsing data from being used against you.
Privacy Badger goes beyond Safari’s built-in privacy features to provide additional protection against online tracking. In its default browsing mode, Safari limits the information that trackers can access but still allows them to load. Privacy Badger blocks trackers from loading in the first place, preventing them from tracking you using techniques that bypass Safari’s protections.
Privacy Badger works well by itself, and will continue to enhance your privacy when installed along side an ad blocker or with Safari’s Advanced settings to block trackers in all windows. Since Privacy Badger automatically learns to block trackers, Privacy Badger will block trackers that other tools don’t know about or choose not to block.
For example, Privacy Badger blocks tracking from widgets like embedded tweets, comments sections, and video players. These widgets can share your data even if you never click on them. Privacy Badger prevents these trackers from loading and replaces them with click-to-activate placeholders.
Beyond tracker blocking, Privacy Badger automatically sends the Global Privacy Control (GPC) signal to tell websites not to sell or share your personal information. The GPC signal is already legally binding in a growing number of states, including California, Colorado, New Jersey, and Connecticut.
All these features (and more) work together to help keep your browsing activity private on Safari.
If you use Safari on macOS, give Privacy Badger a try. You’ll install Privacy Badger through the App Store on your macOS device. Installing extensions is a little more complicated on Safari than other browsers, so follow Apple’s directions here if you’re having trouble.
This is our first release of Privacy Badger for Safari, and we will keep improving it based on your feedback. If you run into any problems, let us know by emailing extension-devs@eff.org, or by opening an issue on GitHub. And if blocking harmful trackers causes issues on a website you visit, you can disable Privacy Badger for that specific site while keeping it enabled and protecting you everywhere else. You can also let us know about broken sites by using the “Report broken site” button found next to the “Disable for this site” button in Privacy Badger’s popup window.
When you use Privacy Badger, you join EFF and millions of other users in the fight for a better web. Help spread the word by telling your friends and family who use Safari that they can use Privacy Badger too!
EFF Launches Privacy Badger for Safari on macOS [Deeplinks]
SAN FRANCISCO—Privacy Badger, the award-winning tracker blocker made by the member-supported digital rights nonprofit Electronic Frontier Foundation (EFF), is now available for Safari on macOS.
Safari users can download the free browser extension today and join the more than 4 million people using Privacy Badger to take a stand against data brokers and online surveillance. Users will need Safari version 26.5 or higher to use it.
Ranked as one of the best ad tracker blockers by The Wirecutter, Consumer Reports, PC Mag and more, Privacy Badger is different from other blocking extensions. Created by EFF to stop companies from spying on you online, Privacy Badger automatically learns to block hidden trackers on the web, along with additional privacy-protecting features.
"Most websites contain invisible tracking code that lets companies collect, share, and profit from your personal data," said Lena Cohen, Staff Technologist at EFF. "Creepy ads are just the tip of the iceberg when it comes to the harms of online tracking: Once your information enters the data broker ecosystem, it’s nearly impossible to know who buys it or what they’re doing with it. Safari support has long been one of Privacy Badger’s most requested features and EFF is excited to be able to make this important tool available to Safari users to fight back for a better web."
On Safari, Privacy Badger goes beyond the browser’s built-in privacy features to provide additional protection against online tracking. In its default browsing mode, Safari limits the information that trackers can access, but it still allows them to load. Privacy Badger blocks online trackers from loading in the first place, preventing them from tracking you using techniques that bypass Safari’s protections.
With today's launch, Privacy Badger is now available on all major desktop browsers.
As the leading nonprofit defending online civil liberties, EFF is committed to fighting mass surveillance in the courts, through activism, and by making free, privacy-protecting tools like Privacy Badger. Now, even more people can join the movement against online tracking, by installing Privacy Badger themselves, telling their friends and family who use Safari about it, or by supporting Privacy Badger today.
For more on Privacy Badger for Safari on macOS: https://www.eff.org/deeplinks/2026/10/announcing-privacy-badger-safari-macos
For more on the dangers of online tracking: https://www.eff.org/deeplinks/2025/03/online-tracking-out-control-privacy-badger-can-help-you-fight-back
For more on how Privacy Badger works: https://privacybadger.org/
Contact: press@eff.org
I would like to have one day when Claude Code doesn't fuck everything up by doing things it is explicitly prohibited from doing. I find things that were changed in critical parts of the program, that were indefensible. One of the things we're doing is trying to establish a language for frontmatter for Markdown files that are meant to be displayed by a browser. It just invented one, gave it wrong default. I have to find these things on my own. And what happens when it wipes out a site without checking with me first. It has done this, this year.
A Vat of Terrible Experiences [The Daily WTF]
Taxes are a royal pain for everyone. Amazon has found a unique way to make them even worse, as Kris W. attests:
I recently bought a €9.61 kitchen knife on Amazon Spain. My card was charged €7.94 instead. After some investigation, I discovered that Amazon had applied an old VAT registration number I'd added to my personal account years ago, and had classified my purchase as a VAT-exempt intra-EU business transaction. The invoice even contained my business address from 2022, which no longer appeared anywhere in my account settings. I just wanted to remove the VAT number so I could go back to buying kitchen utensils without accidentally generating international tax paperwork.
Unfortunately, Amazon no longer provided any visible way to manage that VAT number. Their customer support chatbot insisted I provide the order number from which I wanted the VAT number removed. A human agent confidently explained that I must have entered it into a secondary address field, and instructed me to delete and recreate my shipping address. Another support representative sent me an extensive list of documents I'd need to provide, including my passport, airline boarding passes, proof of export outside the EU, or my NATO identification card. Apparently removing a VAT number from an Amazon account is a process normally reserved for international travelers, Andorran residents, and military alliances.
Eventually, I found Amazon's official help page. It explicitly stated that VAT numbers could be removed either by contacting Customer Service or by creating an Amazon Business account to use the self-service option. After another round of correspondence, Customer Service informed me that they were not allowed to remove VAT numbers and instructed me to use the Business settings that my personal account didn't have. So I followed the documentation and created a Business account using my existing email address. During registration, Amazon required me to enter the very VAT number I was trying to remove, then promptly congratulated me by email on successfully adding and activating it.
But I couldn't access the Business settings yet. Amazon couldn't verify my business and demanded official documentation, so I obtained two freshly-issued certificates from two separate Spanish government agencies to prove that I was, in fact, a self-employed software developer. I uploaded both documents and waited. Eventually, my shiny new Amazon Business account was approved. I now had a separate Business account, complete with its own purchasing features and complimentary Business Prime membership. At last, I could navigate to the promised VAT-management page!
The page displayed my VAT number, confirmed it was valid, and offered a button to add more tax information. Beside the existing number, however, there was no Edit button. No Delete button. No self-service removal option whatsoever. There was only a link saying, Contact Customer Service to change your tax ID.
Naturally, the link led to a generic help center. After creating an entire business account, submitting government paperwork, and successfully registering the same VAT number a second time, I had arrived precisely where I started: Customer Service, which had already explained that it was not allowed to remove VAT numbers.
AI Changed How We Code. It Hasn’t Changed How We Work Together. [Radar]
This summer, I built a small experiment called ContextCue. The idea came from something I kept seeing during my internship. The engineers around me were using AI everywhere in the software development process. GitHub Copilot and Claude models helped with specs, code, reviews, and tests. The team also maintained reusable skills that taught coding agents how the team worked. One of those skills could take a UI design and turn it into working frontend code.
The code was moving faster, but the understanding around the code did not seem to move faster with it. The software was being built by nine teams spread across three continents, with one team working closely with the customer. A request might begin in a customer conversation, move through one team, then reach another team several time zones away. By the time the work reached engineering, some of the original meaning could be missing.
That was the problem I wanted ContextCue to explore. ContextCue takes recorded meetings and tries to preserve more than a transcript or summary. It keeps the spoken discussion, important visual context from the screen, the decisions that were made, the reasons behind them, and the source they came from. The goal is to create a shared piece of context that can move with the work from one team to another.
It is still an experiment, but the problem behind it felt very real. As far as I could see, a lot of time in distributed software teams went into reaching a common understanding before the coding even started. AI was already helping with the final stages of software development. I wanted to see whether it could help earlier, while teams were still trying to understand what they were building and why.
Meetings were already being recorded, and tools like Microsoft Teams could produce an AI summary. On my team, that summary often arrived as an email and stayed there. That worked well enough for the people who attended the meeting. It was less useful for the team that picked up the work later, especially if that team was in another country and had not seen the original conversation.
There were two other problems. A summary usually covered one meeting, while the understanding behind a feature was often built across several. Different teams might discuss the same request days apart, each adding a new constraint or interpretation.
A transcript could also miss important visual context. Many of our conversations involved screen sharing. Someone might point at a page and say, “This is too slow,” or highlight a part of a workflow while explaining what needed to change. The words alone did not always carry the meaning. That is where I started thinking about context as something larger than a transcript.
Imagine that a customer asks for a “faster report.” During the call, the customer shares a screen, points at a page that is slow to open, and explains that managers use it every morning before a meeting. Everyone on that call understands that “faster” means the page should open more quickly.
Two days later, another team in another time zone discusses the same request. Nobody in that meeting saw the original screen. They read “faster report” as “the report should finish running sooner” and begin planning backend work. Both meeting summaries might contain the same phrase:
Make the report faster.
Nothing in that sentence shows that the two teams mean different things. The problem only becomes visible when the customer sees the result.
This is a simple example, but it captures the issue I kept noticing. Requirements move through people before they ever become code. If the meaning changes during that process, AI can help a team implement the wrong interpretation very efficiently.
Sports gave me another way to think about it. Imagine a soccer match where a player misses a late chance to score a goal. The match report can record the shot, the player, the minute, and whether it was on target. Those facts are useful, but a coach watching the replay sees much more. The winger may have delivered the ball too early. A defender may have forced the striker onto a weaker foot. A teammate may have made a run that opened the space.
The event is only one part of the story. A coach learns from the sequence around it.
Jake M. Hofman, Daniel G. Goldstein, and David M. Rothschild use a related sports framework in a Harvard Business Review article where they describe AI as a steroid, a sneaker, or a coach, depending on how it helps people. The “coach” idea is the one that stayed with me. A useful AI system does not only help people produce more. It can also help them make a better decision by bringing forward the evidence and experience that came before. That is close to what I wanted ContextCue to do for teams.
ContextCue starts with a meeting recording. FFmpeg handles the media, and Faster-Whisper transcribes the speech. The transcript is kept in time-stamped segments so that any later answer can point back to the moment where something was said.
The system also looks at selected frames from the screen share using a vision model such as Qwen VL. That helps preserve cases where the meaning depends on what someone was pointing at rather than only on the words they used.
The final output is organized around a request or decision instead of around a meeting. For example:
# Request: Faster report
What the customer meant:
The report page opens too slowly.
Source: customer call, shown on screen
Why it matters:
Managers open it before a morning meeting.
Source: customer call, spoken
What was planned:
Make the report finish running sooner.
Source: team planning meeting
Open issue
The current plan does not match the original request.
The format is deliberately simple. I used Markdown because a person can read it, a language model can use it, and it can be stored or versioned without depending on a special interface. When a later meeting touches the same request, the page can be updated rather than creating another disconnected summary. That changes the unit of memory from meeting to topic.
One of the clearest uses I saw was product management. A product manager writing a user story usually works from some combination of tickets, meeting notes, customer feedback, and conversations with engineers. The important details are often spread across all of them.
If the product manager gives an AI model only the latest meeting summary, the model sees only one slice of the history. A ContextCue page can give it more. The page might contain the original customer request, the business reason behind it, a technical constraint raised later, a decision from product, and an unresolved question that still needs an answer.
That gives the model a much better starting point for creating a user story. The model itself has not changed. What improves is the material it has to work from. This is an important distinction because a lot of AI work focuses on prompts and models, while the quality of the context often decides whether the output is useful.
Each new meeting can update an existing page or start a new one. Over time, that creates a topic-by-topic record of how the work evolved. That is different from having a folder full of meeting summaries. A folder forces someone to remember which meeting contained the useful detail. A topic page collects the relevant pieces in one place.
The stored context can also be searched. I used embeddings and Qdrant to retrieve relevant parts of previous meetings. A question like “What did the customer mean by faster?” can return the answer along with the meeting and timestamp that support it.
Other requests need something more structured. “Find Tuesday’s meeting” is a lookup. “Why did we change this requirement?” may need information from several meetings. “What is still unresolved?” should look for open questions rather than just similar text.
ContextCue can expose those operations through the Model Context Protocol (MCP), so a language model can choose the right tool for the request. The main point is not the protocol itself. The useful part is that different types of questions can use different ways of accessing the same shared context.
One study made me think recorded conversation was especially valuable. In “Generative AI at Work,” published in the Quarterly Journal of Economics in 2025, Erik Brynjolfsson, Danielle Li, and Lindsey Raymond studied an AI assistant used by customer-support workers.
They found that lower-skill and less experienced workers improved the most. The system appeared to help them communicate more like higher-skill workers. What interested me was that some of the useful knowledge came from past conversations.
A company contains a lot of knowledge that never becomes a formal document. It appears in explanations, customer calls, design discussions, examples, corrections, and small decisions made during meetings. Recorded meetings are one place where that knowledge already exists.
As an intern, one of the hardest parts of joining a large project is learning why things are the way they are. You can read the code and still not know why a certain design was chosen. A ticket may describe what to build without explaining the discussion that produced it.
The usual solution is to ask someone. That is often the right thing to do, but it also means interrupting someone who already has work to finish. A shared context layer could make some of those questions easier to answer without another meeting or another message across time zones.
The same idea could help with onboarding, repeated meetings, handoffs between teams, and situations where someone needs to understand an old decision. I can see those possibilities from where I sat as an intern, but they still need proper measurement.
My testing so far is limited. I created a small set of questions where I already knew the correct source. ContextCue retrieved the right source first about nine times out of ten and returned it within the top three results every time in that test set.
That was encouraging, but it also made the harder parts of the problem clearer. A real company may use several different meeting tools. Different teams may have different rules about what can be recorded. Some context should be visible across the company, while other context should stay within a team. People need to know when meetings are being recorded and how those recordings will be used.
There is also a time problem. A team may make one decision in March and change it in April. The March decision should not disappear, because it explains how the team got to the current position. At the same time, the system should make it clear that the April decision replaced it.
That kind of history is useful, but it is more complicated than simple search. It requires rules around ownership, permissions, time, and trust. ContextCue does not solve all of that.
The thing that stayed with me from the internship was the contrast between how much AI had changed coding and how little it had changed the handoffs around coding. The engineers already had strong tools once a requirement was clear. The slower part often happened before that point, while teams were trying to understand a request, add constraints, pass it to another group, and keep everyone aligned.
ContextCue was my first attempt at working on that part of the process. The experiment is still small, and the technical system will need to change if it ever moves into a real company environment. The useful idea, for me, is that meeting recordings can become more than archives. They can become a shared record of how a team arrived at a decision.
If AI can help preserve that history and bring it forward when the next team needs it, then it may improve more than the speed of writing code. It may improve how teams carry understanding from one part of the organization to another.
Training AIs to Solve CAPTCHAs [Schneier on Security]
Interesting research:
Abstract: Vision-language models (VLMs) can solve visual CAPTCHAs without task-specific training, but the agents built on them approach every challenge from scratch. For such an agent, the hundredth instance of a familiar puzzle costs as much time and compute as the first. Specialized detectors invert the trade-off, answering in milliseconds but only for categories they were trained on. Neither improves with exposure. We study what changes when a solver improves with use. Our system pairs a fine-tuned YOLOv8 detector with an open-weight VLM behind a confidence-based router, and runs entirely from screenshots and operating-system input events, with no browser automation or DOM access. It reaches 85.4% overall and 84.2% macro accuracy across 16 classes, exceeding either component alone. Every answer VLM produces also serves as a training label, so the detector absorbs categories it was never trained for, typically after one or two encounters and without human annotation. The same loop also repairs it. A CAPTCHA operator can perturb images against the publicly released detector and drive its accuracy to 0%, but the perturbations leave VLM untouched, and its labels let the detector recover. Under a year-long simulated arms race in which the CAPTCHA operator re-crafts its perturbations each month, the solver recovers every round, and a cheap ~70%-accurate open-weight teacher hardens it as effectively as a perfect oracle. Visual CAPTCHA defenses that assume a failing bot stays failing therefore understate how quickly an adaptive solver returns.
My Super Mid-Life Crisis – Issue 1 – 02 [Comics Archive - Spinnyverse]
The post My Super Mid-Life Crisis – Issue 1 – 02 appeared first on Spinnyverse.
Grrl Power #1505 – Let’s meet more contestants [Grrl Power]
Okay, first thing’s first – Max did not pose hands-on-hips-chest-thrust-out no-looking the explosion behind her. Don’t get me wrong, she’s definitely no-looked plenty of explosions, but she doesn’t really do the Superman pose. So the image they’re showing is probably a “for illustrative purposes only” generated image.
Also I think Max’s Ixah holo-disguise is making her boobs look bigger. It’s definitely not because I’ve accidentally been afflicting her with cup-creep over the last few dozen pages.
If you recall, Thothogoth is “Dominus Secund” of The World Takers. Yes, I know on that linked page, he calls himself “The World Taker” not “of The World Takers,” but he’s being aspirational there, not to mention trying to sound tough to the flying gold woman. The thing is, demon society is rather hierarchical, and there’s eleven other “Secunds,” besides Thom, who each have 12 subordinates below them, who each have below them 12 subordinates, etc. Yeah, it’s a weirdly rigid structure for beings that claim to be all about chaos. Well, speaking of chaos, were something permanent to happen to Dominus Prime during the tournament, (or even just while he’s commuting to work or whatever) there’d probably be a heck of a power struggle to claim that top spot.
Green Strider is the longest-in-the-queue waiting Patreon cameo I had. I think he’s been waiting since about a week after I set up my Patreon actually. I just never quite figured out how to fit a… oh, heck. I just realized it’s “sentai,” not “zentai.” Yeah, I know zentai is the skintight onesie, and sentai is the genre of people wearing skintight onesies and fighting goofy rubber monsters. I’m not gonna change it. It makes “the mysterious zentainium force” even funnier to me. Anyway, I never figured out how to fit a sentai character into the comic, but now here we finally are. I think the reference picture I have is from a City of Heroes character creator maybe? But it’s just the one shot and it’s kind of covered in glowy… bits, and it’s just a single angle, so I have to simplify the suit design a bit and make up some of the rest, but hopefully he will be amusing in his role as a UCBA finalist.
Oh, look who it is in the vote incentive. The NSFW version is finally up at
Patreon. Plus a bonus pic.
I think she would get in trouble for doing this. She’d mess up the… floor of the waterfall? Is that what it’s called? The receiving pool? No, probably not that. Anyway, she’d churn things up and cause a ton of weird erosion.
Since you might be wondering, Niagara Falls is about 165 feet high, so Babezilla obviously doesn’t have to be full sized. I’d say she’s about 175-180 feet tall here?
Double res version will be posted over at Patreon. Feel free to contribute as much as you like.
Two commuting hacks [Seth's Blog]
Just about everyone commutes to work, by car or by public transit. And just about everyone carries a smart phone.
All organizations have a communications problem, and it gets worse as they grow. Which issues are we facing today? Who else is on the team? What’s changed in the environment, and what do we need to get in sync on?
Consider starting an internal podcast. Just fifteen or twenty minutes a day. The host interviews team members, informs on important issues or simply helps people see the big picture. When everyone on the team listens to the same podcast each morning, cohesion and focus improve.
A podcast with 25 of the right listeners might be exactly the right size.
The second hack: I’m amazed at how many people on the train are mindlessly swiping through one social media platform or another. Judging by their facial expressions, they’re not enjoying it much.
Instead, we can focus our time and energy on learning. Six months of commuting can easily cover an advanced college course in something that interests us. And using Claude as a Socratic tutor can be a breakthrough. If you’re driving, use voice mode. Ask it to patiently engage you, one conversation at a time, in a journey to learn something difficult. How transistors work. Why the Roman Empire fell. The origin of species.
Day by day, your commute gets better and you get smarter.
Pluralistic: The technopolitics of ad-tech (19 Oct 2026) [Pluralistic: Daily links from Cory Doctorow]
->->->->->->->->->->->->->->->->->->->->->->->->->->->->->
Top Sources: None -->

"Technopolitics" are the politics embedded in technology. The Ur-text of technopolitics is "Do Artifacts Have Politics?" by the rock critic turned scholar Langdon Winner:
https://faculty.cc.gatech.edu/~beki/cs4001/Winner.pdf
With "Do Artifacts," Winner demands that we move beyond the idea of technologies having "intended consequences" and "unintended consequences" and towards a political economy of tech. In service to this, he divides the politics of artifacts into three categories:
I. Artifacts that have politics embedded in them by their creators, like Robert Moses's infamous bridges over the Long Island parkways. According to Moses biographer Robert Caro, Moses deliberately specified that these bridges must be too low for a city bus to pass under, in a bid to block Black people from traveling from New York City to the beaches he'd developed on Long Island.
Today those bridges are more than a century old, and they are still too low for city buses to pass under them, and this continues to mean that people who don't own private vehicles find it more difficult to get to the beach, and as it's still the case that race is a predictor of low incomes, those are still racist bridges.
II. Artifacts whose politics are accidental but unavoidable. Winner cites a kind of tomato harvester that vastly improved the efficiency of tomato pickers. These harvesters became very popular, which allowed tomato farmers to lay off large numbers of agricultural workers, and also allowed them to price the mechanically harvested tomatoes so cheaply that they crowded out other kinds of tomatoes.
Because these machines created a large pool of unemployed workers, they shifted power from labor to capital, and because these picking machines were too rough for all but the hardest varietals of tomato, they changed the flavor profile of tomatoes in America for the worse, towards a bland, tough tomato.
These picking machines were not designed to make workers poorer, nor were they designed to make tomatoes taste worse, but because of their technical characteristics, this was the unavoidable outcome, the inextricable politics of these machines.
III. Artifacts whose politics are intrinsic to their design. Here, Winner contrasts solar panels with nuclear reactors. Solar panels may require highly centralized industrial systems to produce, but once they are in the field, solar panels are compatible with looser, less coordinated political arrangements. A world of small anarchist communes is fully compatible with solar energy.
Contrast this with nuclear reactors: the prudent ongoing operation of a reactor requires a highly centralized state that is capable of fielding reliable, trustworthy independent inspectors. This state must also be capable of exercising the coercive power to shut down badly maintained or incompetently operated reactors.
The politics of nukes are the politics of a centralized, powerful state; the politics of solar are less determined. Solar is compatible with a wide variety of political systems, including (but not limited to) weak, decentralized states.
(For a further exploration of "Do Artifacts Have Politics?" I highly recommend Ginger Coons' reading guide:)
https://www.not-so-obvious.net/reading-do-artifacts-have-politics/
I really like Winner's framework for exploring technopolitics, but I have my own gloss on it. Winner's framework doesn't explicitly contemplate the idea of technological countermeasures. For example, what if someone were to design a city bus that was low enough to fit under Robert Moses's bridges? At that point, they'd cease to be "racist bridges," and merely become "bridges built by a racist":
https://locusmag.com/feature/commentary-cory-doctorow-technopolitics/
Which brings me to the technopolitics of ad-tech. Lots of people think that advertising is "the original sin of the internet," setting in motion the surveillance dystopia that is closing in on us from all sides today:
https://pluralistic.net/2026/10/17/mercenary-spyware/#discover-tech
I think this is wrong. I think that finding ways to communicate ideas and pitches to the general public is fine. Without some channel for reaching people with ideas and propositions they may not be familiar with, it would be infinitely harder to reach people for political causes. It would also be harder for new books, movies and music to find new audiences. It would be much harder to get people out to your independent craft fair, your zine show, or your No Kings march.
For me, the internet's original sin isn't advertising, it's surveillance. Contrary to what you have been told – and pax Winner's framework – the internet is fully compatible with privacy:
https://pluralistic.net/2025/10/31/losing-the-crypto-wars/#surveillance-monopolism
It wasn't the internet's technopolitics that made it a surveillance nightmare. It was just plain politics. Specifically, our politicians decided to stop enacting and enforcing privacy laws. The last consumer privacy law we got in America was a bill that made it illegal for video store clerks to disclose your VHS rentals:
https://en.wikipedia.org/wiki/Video_Privacy_Protection_Act
(As I type these words, the Supreme Court is poised to eliminate even that dried-up old crumb of privacy protection:)
https://slate.com/news-and-politics/2026/10/supreme-court-privacy-rights-case-bork-kavanaugh.html
The widespread phenomenon of ad-tech companies spying on us is the result of the decision to allow them to do so. That decision has had innumerable negative downstream effects, such as skyrocketing "surveillance prices":
https://pluralistic.net/2025/12/11/nothing-personal/#instacartography
And collapsing "surveillance wages":
https://pluralistic.net/2024/12/18/loose-flapping-ends/#luigi-has-a-point
It's created vast surveillance databases that are critical to Trump's racist pogroms, providing dossiers and precise location data on the people ICE kidnaps to Salvadoran slave-labor camps:
https://pluralistic.net/2026/03/10/ice-tech/#foreseeable-outcomes
Surveillance also promotes oligarchy. Without surveillance, oligarchs must give up more of their fortunes to keep the public happy, because the alternative is spending even more money on guards to keep the public from building guillotines on their lawns. Surveillance lets oligarchs make targeted strikes on restive radicals, which is much cheaper than broad-spectrum policies that make us all better off and neutralize the case for guillotines:
https://pluralistic.net/2025/06/26/autostabilizer/#slicey-bois
These are the technopolitics of surveillance, not advertising. There is nothing about advertising that demands surveillance. For centuries, advertising was not meaningfully linked to surveillance. The decision to fuse surveillance with advertising was just that – a decision, not an inevitability.
Any time we forget this, we let spying tech bosses off the hook. After all, if advertising demands surveillance, then tech bosses are just the avatars of the great forces of history, prisoners of the imperative to spy in order to advertise. By remembering that surveillance advertising is a choice, we put the blame squarely where it belongs: on the guillotineable oligarchs who made that choice, and amassed spectacular fortunes thereby.
Surveillance is political, but surveillance advertising has its own distinct technopolitics, and to understand those technopolitics, we must contrast them with the technopolitics of contextual advertising. Up until a decade or two ago, contextual advertising was simply called "advertising." Contextual advertising is the practice of running refrigerator ads next to articles on cooking and kitchen remodeling; ads for roadside restaurants on highway billboards; ads for Disney vacations in parenting magazines.
Your intuition probably insists that context advertising is less effective than surveillance advertising. After all, surveillance advertising allows a running shoe company to target users who are training for a marathon no matter where they are and no matter what they're doing. Surely this translates into increased "conversions" (clicks and/or purchases, depending on who you're talking to)?
It does, but not by much. Advertisers get about 5% more value from surveillance ads than they do from context ads:
https://weis2019.econinfosec.org/wp-content/uploads/sites/6/2019/05/WEIS_2019_paper_38.pdf
Partly, that's because surveillance ad companies grossly overrate the efficacy of surveillance advertising:
https://peoples-things.ghost.io/youre-doing-it-wrong-notes-on-criticism-and-technology-hype/
But surveillance advertising's anemic returns to advertisers are down to another aspect of the system: its tendency towards monopolization:
https://en.wikipedia.org/wiki/United_States_v._Google_LLC_(2023)
Surveillance is a capital-intensive activity: spying on billions of people as they move through the digital and physical world is incredibly expensive. That is a good part of the reason that online advertising has collapsed into the Meta/Google duopoly, who control about 80% of display advertising.
The harms of surveillance monopolies have a severely distorting effect on policy debates. For example, it's led some anti-monopolists to call for government-issued surveillance identifiers that follow us from birth to death in order to facilitate commercial spying to foster more competition in surveillance:
https://www.thesling.org/what-to-do-about-googles-dominance-of-online-advertising/
Here's the thing about monopolists: they cheat. Google and Meta have an illegal, collusive arrangement to rig the advertising market, overcharging advertisers and underpaying publishers:
https://en.wikipedia.org/wiki/Jedi_Blue
The ad-tech giants have taken in hundreds of billions that they simply can't account for. It's disappeared down a fraud-hole:
https://pluralistic.net/2026/05/25/lying-spies/#spying-liars
All of this has driven the majority of web users to install a privacy-blocker (like EFF's Privacybadger.org), meaning that surveillance ads are disproportionately likely to not even show up in a reader's browser:
https://doc.searls.com/2023/11/11/how-is-the-worlds-biggest-boycott-doing/
So while it's possible that, in a state of nature, a surveillance ad would outperform a context ad, delivering more sales for advertisers and more revenue for publishers, the monopolistic tendency of ad-tech means that publishers earn less from surveillance ads (because more users block them, and because monopolistic ad-tech platforms extract higher commissions), and advertisers see fewer sales from them (because more users block them, and because monopolistic ad-tech platforms extract higher prices).
Context ads, meanwhile, are always going to give power to publishers, because publishers will always understand the materials they publish better than any ad-tech platform could. Commissioning, editing and publishing an article, podcast or video gives a publisher unique and inalienable insight into that material.
Surveillance data about audiences is a kind of ambient vapor floating around websites and places and payments that has to be condensed through a heroic and expensive effort that gives power to whichever company can muster the capital and infrastructure to do so. Meanwhile, information about the content of publishers' offerings arrives pre-refined into ingots that are already in publishers' own possession.
It's possible to run "programmatic ads" without surveillance. Rather than building an ad-tech stack through which publishers transmit sensitive information about their audiences ("Who will pay me to advertise to this 18-34 year old man-child from the outer boroughs who owns an Xbox and has recently researched gonorrhea symptoms?"), we can build systems through which publishers transmit information about their own materials ("Who will advertise to a user with a New York IP address who is reading an article comparing running shoe brands?").
Not only is this possible, but it actually generates more revenues for publishers than the surveillance-based ad-tech stack:
On top of that, publishers who don't gather personal information about users also don't need to show their users those awful pop-up ads asking their permission to gather their data. Everyone hates those notices, and they are yet another negative aspect of surveillance advertising that disappears with the switch to context ads.
An ad-tech stack for context ads is far less prone to monopolization. Such a stack can be "federated," with multiple "demand-side platforms" (the part of the system that advertisers use to place bids for the right to show their ads) all communicating with the same "supply-side platform" (the part of the system publishers use to transmit opportunities to place ads).
This is also in the technopolitics of context ads: they do not tend toward the "efficiencies of scale" that lead to abusive monopolistic middlemen who steal from publishers and advertisers and sell out the public to fascists who want to arrest them and deport them to Salvadoran slave-labor camps.
When the ad-tech sector is composed of smaller companies that are more competitive with one another, it is much harder for any of them to collude to rig the market. That fierce competition also means it's harder to create a cozy conspiracy to lobby together to block privacy laws, and it leaves the companies with lower margins and less retained earnings to spend on those lobbying efforts.
Surveillance ads also promote all kinds of parasitic businesses. The fact that a publisher can serve ads related to users rather than the subject of their media means that sensationalistic and deceptive websites can sell ads that run against content that's totally unrelated to advertisers' products and services. And because it's cheaper to produce lies and garbage, these publishers can undercut the ad prices demanded by high quality outlets and let advertisers reach the same users. This is the whole reason that "chumboxes" exist:
https://en.wikipedia.org/wiki/Chumbox
Just as nuclear power favors a centralized state, surveillance advertising:
tends toward monopoly;
favors low-quality media over high-quality production;
impedes the passage of privacy laws;
provides authoritarian states with an off-the-books, warrantless source of surveillance data.
And just as solar allows for decentralized, anti-authoritarian societies, context advertising:
tends towards pluralism and diversity of voices;
favors high-quality media by reserving the lion's share of the rewards to the producers;
does not rely on a weak privacy environment;
does not militate for "democratizing spying" by issuing every person with a permanent advertising identifier.
There's nothing (necessarily) wrong with building systems to tell people about things you want them to know. There's nothing (necessarily) wrong with paying for media with ads. It's possible for both of these things to go awry, but they are not in and of themselves bad. They have contingent technopolitics.
But surveillance ads have completely unavoidable, absolutely ghastly technopolitics. Surveillance ads are bad for publishers, for advertisers, and for democracy. We should ban surveillance ads:
https://www.eff.org/deeplinks/2023/05/save-news-we-must-ban-surveillance-advertising
(Image: Jess, CC BY-SA 4.0, modified).

US Rep proposes bill to give video game buyers “ownership,” not “a license” https://arstechnica.com/gaming/2026/10/us-rep-proposes-bill-to-give-video-game-buyers-ownership-not-a-license/
Saviour or Scoundrel? https://scholarsphere.psu.edu/resources/14308c3b-4f2a-4f39-a365-192c0206f886
Tiny Little Office https://tinylittleoffice.com/
Future? No Thanks! – an ecosocialist game https://futurenothanks.com/
#25yrsago Patrick Nielsen Hayden interviews Mike Ford https://user.well.com/engaged.cgi?c=inkwell.vue&f=0&t=126
#20yrsago Singapore bans Far East Economic Review https://web.archive.org/web/20061010002951/https://www.feer.com/articles1/2006/0610/free/p006.html
#20yrsago Publishing isn’t bestseller-driven https://www.nielsenhayden.com/makinglight/conventional_un/
#20yrsago Why architecture and security don’t mix https://www.schneier.com/blog/archives/2006/10/architecture_an.html
#20yrsago Vista licence: Microsoft’s abusive relationship with you https://wendy.seltzer.org/blog/archives/2006/10/19/forbidding_vistas_windows_licensing_disserves_the_user.html
#20yrsago Boy Scouts of America Concerned About Copyright https://web.archive.org/web/20061110065012/http://sfgate.com/cgi-bin/article.cgi%3Ffile%3D/news/archive/2006/10/20/entertainment/e110452D84.DTL
#15yrsago Canadian Tories admit that Canadians don’t want DRM rules, push for them anyway https://web.archive.org/web/20111022210131/http://www.michaelgeist.ca/content/view/6071/125
#15yrsago Visualizing Herman Cain’s 9-9-9 plan to redistribute wealth from the poor to the rich https://web.archive.org/web/20111021103517/http://jaredbernsteinblog.com/9-9-9-in-one-really-long-graph/
#15yrsago Free Bieber: campaign to kill proposed law that would send you to prison for 5 years for singing copyrighted music on YouTube https://web.archive.org/web/20111020145336/http://freebieber.org/
#15yrsago Belarusian central bank auctions off its sugar bowls https://www.theguardian.com/world/2011/oct/19/belarus-central-bank-sells-office-furniture
#15yrsago Dataviz as defacement: OCCUPY GEORGE https://web.archive.org/web/20111022022046/http://www.occupygeorge.com/
#15yrsago HOWTO avoid a copyright shakedown legal threat: be famous, a politician, a cop, a soldier or a corpse https://torrentfreak.com/undercover-cops-and-politicians-escape-bittorrent-lawsuit-111013/
#10yrsago Popular design guides are responsible for plague of grey type https://web.archive.org/web/20170914051800/https://www.wired.com/2016/10/how-the-web-became-unreadable/
#10yrsago Digital Defenders: a free open-licensed booklet for kids about privacy and cryptography https://edri.org/files/privacy4kids_booklet_web.pdf
#10yrsago Public universities and even the US Navy have sold hundreds of patents to America’s most notorious troll https://www.eff.org/deeplinks/2016/10/inside-intellectual-ventures-portfolio-nearly-500-university-patents
#10yrsago Airportraits: composite photos of all the daily takeoffs from the world’s airports https://mikekelley.art/?category=airportraits
#10yrsago Rich people can afford to buy more sleep than poor people https://arstechnica.com/science/2016/10/the-rich-can-sleep-in-thanks-to-better-transit/
#10yrsago Harry Shearer sues studio over Spinal Tap, says he’s received $98 in royalties over 30 years https://web.archive.org/web/20161224224142/https://www.yahoo.com/movies/harry-shearer-files-125-million-spinal-tap-fraud-suit-copyright-termination-150031664.html
#10yrsago ACLU asks court to reveal 23 secret surveillance laws https://web.archive.org/web/20161019224447/https://theintercept.com/2016/10/19/aclu-wants-secret-surveillance-laws-made-public/
#10yrsago Montana judge unrepentant after sentencing man to 60 days for repeatedly raping his own 12 year old daughter https://edition.cnn.com/2016/10/19/us/montana-judge-incest-case-trnd/index.html
#10yrago Turkish court fines bystander/tourist who sued police for shooting out his eye https://www.hurriyetdailynews.com/kyrgyz-tourist-wounded-in-gezi-protests-ordered-to-pay-debt-to-turkish-state–104964
#10yrsago By stealing from innocents, Chicago PD amassed tens of millions in a secret black budget for surveillance gear https://web.archive.org/web/20160929143255/https://chicagoreader.com/chicago/police-department-civil-forfeiture-investigation/Content?oid=23728922
#10yrsago Turing’s law: UK to retroactively pardon thousands of men prosecuted for having sex with men https://www.bbc.co.uk/news/uk-37711518
#5yrsago The monopoly strategy behind the Google/Microsoft mobile patent wars https://pluralistic.net/2021/10/20/vizio-vs-the-world/#capital-as-power
#5yrsago Copyleft lawsuit against Vizio will allow anyone to defend the commons https://pluralistic.net/2021/10/20/vizio-vs-the-world/#dumbcast
#5yrsago The true, Terry Pratchett-esque origins of the trillion-dollar coin https://pluralistic.net/2021/10/19/moist-von-lipwig/#gimmick-v-gimmick
#1yrago The mad king's digital killswitch https://pluralistic.net/2025/10/20/post-american-internet/#huawei-with-american-characteristics

Victoria: Munro's Books, Oct 20
https://www.munrobooks.com/events/6113620261020
Vancouver: Life After AI (Vancouver Writers Festival), Oct
22
https://writersfest.bc.ca/festival-event-2026/46
Ottawa: Life After AI (Ottawa Writers Festival), Oct 24
https://writersfestival.org/event/life-after-ai
Vienna: TED AI, Oct 28-30
https://tedai-vienna.ted.com/
Kilkenny (Kilkenomics), Nov 6-8
https://kilkenomics.com/
Vancouver: Enshittification (Sid Williams Theatre Society), Nov
10
https://www.sidwilliamstheatre.com/events/cory-doctorow-talks-enshittification/
Vancouver: BC Policy Solutions Gala, Nov 12
https://bcpolicy.ca/gala/
Oxford: Ministry of the Future, Nov 23
https://ministryforthefuture.co.uk/events.html
Sheffield: Reverse Centaur at Juno Books, Nov 25
https://www.outsavvy.com/event/40274/cory-doctorow-in-conversation
Virtual: Enshittification, AI, and the Future of Technology (UBC
Master of Educational Technology), Nov 28
https://met.ubc.ca/2026/09/met-speaker-series-cory-doctorow-enshittification-ai-and-the-future-of-technology/
Oxford: Bennett Oxford Symposium on Open Code in Science, Dec
9
https://www.bennett.ox.ac.uk/events/2026-bennett-institute-symposium/
Montreal: World Science Fiction Convention, Sep 2-6
https://montreal2027.ca/en
Terms of Service with Clare Duffy (CNN)
https://www.cnn.com/audio/podcasts/terms-of-service-with-clare-duffy/episodes/458ce968-af5d-11f0-b539-13ed2afe25f8
AI, Work, and Power (Software Engineering Daily)
AI, Work, and Power
https://softwareengineeringdaily.com/podcasts/cory-doctorow-on-ai-work-and-power/
AI, Corporate Power, and the Fight for Worker Control
(Plutopia)
https://plutopia.io/cory-doctorow-ai-corporate-power-and-the-fight-for-worker-control/
How to Think About AI—Before It’s Too Late (Daniel
Solove)
https://www.youtube.com/watch?v=_0xR3uEgGcc
"Canny Valley": A limited edition collection of the collages I create for Pluralistic, self-published, September 2025 https://pluralistic.net/2025/09/04/illustrious/#chairman-bruce
"Enshittification: Why Everything Suddenly Got Worse and What to
Do About It," Farrar, Straus, Giroux, October 7 2025
https://us.macmillan.com/books/9780374619329/enshittification/
"Picks and Shovels": a sequel to "Red Team Blues," about the heroic era of the PC, Tor Books (US), Head of Zeus (UK), February 2025 (https://us.macmillan.com/books/9781250865908/picksandshovels).
"The Bezzle": a sequel to "Red Team Blues," about prison-tech and other grifts, Tor Books (US), Head of Zeus (UK), February 2024 (thebezzle.org).
"The Lost Cause:" a solarpunk novel of hope in the climate emergency, Tor Books (US), Head of Zeus (UK), November 2023 (http://lost-cause.org).
"The Internet Con": A nonfiction book about interoperability and Big Tech (Verso) September 2023 (http://seizethemeansofcomputation.org). Signed copies at Book Soup (https://www.booksoup.com/book/9781804291245).
"Red Team Blues": "A grabby, compulsive thriller that will leave you knowing more about how the world works than you did before." Tor Books http://redteamblues.com.
"Chokepoint Capitalism: How to Beat Big Tech, Tame Big Content, and Get Artists Paid, with Rebecca Giblin", on how to unrig the markets for creative labor, Beacon Press/Scribe 2022 https://chokepointcapitalism.com
"Unauthorized Bread": a middle-grades graphic novel adapted from my novella about refugees, toasters and DRM, FirstSecond, April 20, 2027
"Enshittification, Why Everything Suddenly Got Worse and What to Do About It" (the graphic novel), Firstsecond, 2027
"The Memex Method," Farrar, Straus, Giroux, 2027
Today's top sources:
Currently writing:
"The Post-American Internet," a sequel to "Enshittification," about the better world the rest of us get to have now that Trump has torched America. Fourth draft completed. Submitted to editor.
A Little Brother short story about DIY insulin PLANNING

This work – excluding any serialized fiction – is licensed under a Creative Commons Attribution 4.0 license. That means you can use it any way you like, including commercially, provided that you attribute it to me, Cory Doctorow, and include a link to pluralistic.net.
https://creativecommons.org/licenses/by/4.0/
Quotations and images are not included in this license; they are included either under a limitation or exception to copyright, or on the basis of a separate license. Please exercise caution.
Blog (no ads, tracking, or data-collection):
Newsletter (no ads, tracking, or data-collection):
https://pluralistic.net/plura-list
Mastodon (no ads, tracking, or data-collection):
Bluesky (no ads, possible tracking and data-collection):
https://bsky.app/profile/doctorow.pluralistic.net
Medium (no ads, paywalled):
Tumblr (mass-scale, unrestricted, third-party surveillance and advertising):
https://mostlysignssomeportents.tumblr.com/tagged/pluralistic
"When life gives you SARS, you make sarsaparilla" -Joey "Accordion Guy" DeVilla
READ CAREFULLY: By reading this, you agree, on behalf of your employer, to release me from all obligations and waivers arising from any and all NON-NEGOTIATED agreements, licenses, terms-of-service, shrinkwrap, clickwrap, browsewrap, confidentiality, non-disclosure, non-compete and acceptable use policies ("BOGUS AGREEMENTS") that I have entered into with your employer, its partners, licensors, agents and assigns, in perpetuity, without prejudice to my ongoing rights and privileges. You further represent that you have the authority to release me from any BOGUS AGREEMENTS on behalf of your employer.
ISSN: 3066-764X
New Comic: ARC Resort
We should get Palantir out of our public services before it becomes locked in.
By George Monbiot, published in the Guardian 14th October 2026
What a world we live in. Imagine: gangs dragging civil servants off commuter trains and beating them up because they handed government data jobs to the wrong contractor – and the government changing its procurement decisions as a result. Well, OK, it might not have happened yet, but it’s only a matter of time. As the former Labour deputy leader Tom Watson asks: “Do you want to let the rule of law lead procurement practice, or do you want mob rule to lead procurement practices?” No, I absolutely don’t want that, and it’s always good to get ahead of trouble.
But then I remember there are two common meanings of mob rule. One is intimidation by crowds of thugs. The other is a pejorative term for democracy. And while I’ve yet to see government procurement practices in the UK determined by pitchforks and flaming torches, democratic transparency could be a genuine threat to certain contractors. One might have hoped that Watson, who once took on the Murdoch empire, would have recognised the distinction. But then again, one might have hoped that Watson would not have taken a job as a senior vice-president at Palantir.
Over the past few years, this US company has been worming its way into the British state. It has landed contracts worth hundreds of millions with the Ministry of Defence, several police forces, the Financial Conduct Authority, the atomic weapons establishment and the NHS. Its superpower, according to a deep investigation by Peter Geoghegan and Lucas Amin in the London Review of Books, is that it is “willing to spend more on securing political access than almost all of its British and continental competitors”. It made abundant use of Peter Mandelson’s company Global Counsel, which seems, in turn, to have made abundant use of the UK’s remarkably flimsy lobbying laws. Watson is one of more than 30 former UK ministers and officials Palantir now employs.
Palantir’s contracts might have been awarded lawfully, but some of us might question the ways in which doors were opened for it. These include an unrecorded meeting between Boris Johnson, Dominic Cummings and the co-founder of Palantir, Peter Thiel, in Downing Street in 2019. It was invited back to Downing Street when the Covid-19 pandemic began a few months later, and was working in the NHS within days, on a contract for which it charged only £1. The mayor of London, Sadiq Khan, has criticised such loss-leaders, which can quickly lead to reliance on a company, at which point it can name its price.
Another controversial meeting was brokered by Mandelson in 2025, when he was UK ambassador to the US. Keir Starmer visited Palantir’s showroom in Washington, where he met the company’s global and UK chief executives, Alex Karp and Louis Mosley. They talked about defence spending. No 10, Geoghegan and Amin tell us, “refused to say whether Starmer knew that Palantir was a client of Global Counsel, in which Mandelson still held a stake of around a fifth at the time. The meeting was never declared on transparency registers.” A few months later, Palantir secured a £241m contract with the Ministry of Defence, without an open tender.
Now we learn that Martha Dalton, a key player in Andy Burnham’s campaign to win the Makerfield byelection, enabling him to become prime minister, was on unpaid leave from the lobbying company she co-founded, Lodestone. Lodestone had done extensive work for Palantir. And the Financial Times reports that Samantha Jones, then the lead non-executive director on the board of the health department, was an adviser to one of Palantir’s partners when the company was bidding for its huge and controversial NHS contract. Now she is permanent secretary in the same department.
There have been repeated allegations that some of Palantir’s products are rubbish. But, as the House of Commons science, innovation and technology committee warns, government agencies can quickly succumb to “vendor lock-in”: once you start using them, it can be very hard to stop.
Thiel, has claimed that “the NHS makes people sick”, and that we should “just rip the whole thing from the ground and start over”. The company is deeply embedded in the Trump administration, where it supplies software that helps ICE find undocumented people. It also works for the Israeli government on identifying targets in Gaza. When Karp was confronted by a protester who told him that “Palantir kills Palestinians”, he replied: “Mostly terrorists, that’s true.”
This is the company handling our critical information. After official denials, it turns out that NHS England has granted Palantir “unlimited access” to patient data. This is a huge issue. Identifiable patient data is supposed to be visible only to people directly involved in a patient’s care, or who have received the patient’s informed consent. There are widespread concerns about how this and other datasets might be used.
So, as Palantir runs into ever-greater controversy, it’s not hard to see why it might have hired Watson, who, with Burnham, was a minister in Gordon Brown’s government. I wouldn’t presume to speculate about what attracted Watson to the multibillion-dollar company.
In July, the government’s ethics and integrity commission recommended a major shake-up, enabling us to see all the encounters between lobbyists and ministers, aides and senior officials. I’ve heard this call many times before. The pattern is always the same: a scandal, followed by a call to action, followed by … little or nothing.
Before he became prime minister, David Cameron noted that lobbying “has tainted our politics for too long”. He would shine “the light of transparency” on it. Instead, he oversaw an act that was “more loophole than law”. It did nothing to protect us from lobbying by people such as … David Cameron – pulling strings, once out of office, among his old colleagues, to try to drum up government business for the bank Greensill .
You could almost believe that the real purpose of government was to do the bidding of corporations, foreign states and the ultra-rich. You could almost believe that some government ministers may have an eye on future opportunities when they resist effective reform.
So this is another key test for Burnham. Will he allow the mob rule of private business to keep dominating our lives, or will he ensure that government is for the people?
www.monbiot.com
Wine ported to OpenBSD, runs modern Windows games [OSnews]
In what is quite a major achievement, Wine has been ported and made to work on OpenBSD.
We have since tested several dozens of 64-bit Windows software, mostly successfully. See screenshots, livestream recordings for example. Even the Remaster of The Witcher 3 which released just last month runs, and runs well (requires adding in vkd3d-proton; see README; livestream which looks less fluent than it is due to the on-system recording with ffmpeg).
↫ Thomas Frohwein
The biggest limitation seems to be the lack of support for WoW64, so 32bit Windows software won’t work. Still, this is a massive milestone for OpenBSD, and makes especially gaming a somewhat viable option on OpenBSD.
Single-partition encrypted NetBSD 11 root [OSnews]
What if a regular, normal NetBSD installation is too plebeian for you?
This is a quick overview which attempts to synthesize DW Armstrong’s tutorial on NetBSD encryption with the cgdroot page from the NetBSD wiki in a single MBR partition, divided into multiple disklabel slices to preserve MBR entries.
↫ indigoparadox Web Zone
What if you need this?
Significant changes in this release include some significant binfmt_misc extensions, some group-scheduling work aimed at improving performance on large systems, the new failfs filesystem that fails all operations, the fchroot() system call, global per-CPU data for BPF programs, the completion of the sched_ext subscheduler feature, working-set tracking for virtual machines, alternative data-stream support in the ntfs3 filesystem, a long list of SMB server improvements, and much more.
↫ “corbet” at LWN.net
It’ll make it way to your distribution of choice soon enough.
Girl Genius for Monday, October 19, 2026 [Girl Genius]
The Girl Genius comic for Monday, October 19, 2026 has been posted.
The post Shush appeared first on Ctrl+Alt+Del Comic.

it Brun
Inside the Intel 8087 chip: floating-point addition and subtraction [OSnews]
In 1980, Intel introduced the 8087, a chip that made floating-point operations much faster in the IBM PC and other systems. Although the 8087 supports advanced operations such as tangents, square roots, and logarithms, this article focuses on basic arithmetic operations: addition and subtraction. The 8087 provided a spectacular speed improvement over the 8086 processor, speeding up addition by a factor of almost 100, and complicated operations by even more. In this article, I examine the 8087’s microcode and circuitry to explain exactly how floating-point addition and subtraction are implemented, including numerous special cases for infinities and other special values.
↫ Ken Shirriff
Shirriff took an actual chisel to the 8087 coprocessor to gain access to the insides for highly detailed photographs, taken with a microscope. They look amazing.
Source code for the Palm OS port of Lemmings [OSnews]
Only a few day ago I linked to a massive collection of original Palm OS development resources, and today we can take a look at what it was like to put all of those resources into practice: the original source code for the Palm OS port of Lemmings. With these resources combined, there’s no excuse to not building any Palm OS applications. I’d really like a modern email client, a Fediverse client, and a slightly more modern browser surely wouldn’t hurt.
Get on it!
Jackalope V2 Ideas [Nina Paley]
The Jackalope I have is a prototype. Its hinge, jackshaft and fold are magnificent. Other aspects need to change, to improve efficiency (external derailleur instead of Rohloff internal gear hub), weight (lighter titanium tubing, no center steering tube weld), and functionality (braze-ons, option for integrated pannier rack).
So I’ve been thinking intensely about a Version 2. So intensely that if I had my druthers I’d manifest TWO new bikes:

To fold, could the front wheel be turned inward?
That would make it more compact, and a GlideFlex stem could be used
for super-easy handlebar folding. Otherwise, 2 quick-release bolts
on clamp could allow handlebars to fold down.
Modeled as closely as possible on the Ti-Rush (or Carver Ti Glide) but with the Jackalope jack shaft and fold.
So named until someone convinces me it’s too
offensive.
Both bikes:
Them’s my thoughts this Sunday October 18 2026. They’re sure to evolve…
Update Oct 19: Just spoke with Davis Carver. A 3x chainring on the Classique would require a front tensioner, which is not a dealbreaker. But either bike could use Schlumpf drive instead of a front or jack shaft derailleur. These are nearly 100% efficient in “direct drive” (ie most of the time) with a 4-5% penalty in “overdrive” (ie hill climbing). Seems acceptable.
Instead of a regular 9-speed drivetrain he suggests a Box Two Prime 9 system instead, which permits a much wider cassette and a rugged chain. I had only read about these but Carver has lots of experience with them and says they work great.
The post Jackalope V2 Ideas appeared first on Nina Paley.
Health care is phone tag in US [Scripting News]
The healthcare system in the US is grossly inefficient, incredibly bad and getting info to and from patients.
Teach everyone in healthcare to try to use their portals as their first resort of communicating with patients.
They waste so much of their time and our time playing phone tag.
I don't know if it's this way in other countries, but it is universally a phone-voice-based comm system in the US.
Dirk Eddelbuettel: myman 0.12.0 on CRAN: Two new waves! [Planet Debian]

Another new and exciting version of our still-new package myman reached CRAN this morning, and has been built for r2u and on r-universe. The matching Python package has also been updated. The package offers twenty one hundred eighty four “My man …” posts by Kevin Kruse made on bsky during the summer of 2026. Each wave picked at one particular public persona. This package wrapse these up in the style of packages like fortunes or gaussfacts.
This release regroups two new waves of posts mocking, respectively, Peter Thiel and Michael Tracy, and make a small update to continuous integration. The short NEWS entry for this release follows.
Changes in version 0.12.0 (2026-10-18)
New waves eleven (100 posts) and twelve (100 posts) made last week; total is now 2184 posts
Small update to continuous integration
Courtesy of my CRANberries, there is also a diffstat report for the most recent release. More information is available at the repository or the package page.
This post by Dirk Eddelbuettel originated on his Thinking inside the box blog. If you like this or other open-source work I do, you can sponsor me at GitHub.
I wrote a piece entitled The Web of
Markdown on Oct 6. I have to keep looking it up, but I do
remember writing it very quickly and deciding it needed a memorable
title, like the ones about textcasting, and podcasting and all the
other bits that went on to be something. It's one of those times
when it seems to have potential with other developers, they seem to
see the same logic in it that I do. A way to disconnect from VC
control of the web and try again with the open basis, the un-owned
basis. There was a fork here at some point in the last 10 or so
years, we just refused to see it as such. And btw it was not a very
polite piece, but I wasn't feeling polite when I wrote and decided
not to edit the anger out of it. I don't like having been so wrong.
But it's a fact and denying it doesn't change it.
Anyway, what this means is we're building a site of files that live in Markdown-Land while what you're reading right now is in HTML-land (although someday soon you will read them in Markdown too, confusing). Chrome is the authority of HTML. It owns the web. We give up. If this were Westeros I would probably be joining the Night's Watch. We have work to do and it might be related to what the Other Web wants to do, but it probably (hopefully) doesn't. I will continue to publish in HTML, and it's up to Google and the EFF if the quality of my writing is suitable for their web. I have no say in it, they have not shown up to negotiate or even discuss. They are silent. Somewhat like the maesters of the Citadel? There must be a bigger plan! :-)
What a Good “AI” Policy Looks Like [Whatever]

Subvert is a creator-owned music platform, catering primarily to indie musicians; think of it as Bandcamp if it was a co-op. Subvert recently released a policy on the use of “AI” in the music that’s released on the site, and for anyone who is curious about things like this, I really think it’s worth a view. Among the things I think it does right is that it defines the terms under discussion (including acknowledging “AI” is at this point basically a broad marketing term), acknowledges the difference between generative “AI” and other types of computational processes, and then, having done so, lays out what’s acceptable use for music presented on the site (not neglecting things like cover art) and what is not. It even has a process available for judging edge cases, because no matter what your policy, edge cases will exist.
Why do I think this policy works? One, because it firmly makes the case for human creation while acknowledging the reality of modern creative processes — in this case music production, where so many of the tools have “AI” baked in but are doing things of a technical nature: “mastering, mixing, equalization, pitch correction, beat detection, noise reduction, and loudness optimization” are examples the policy gives of such tools. These tools handle backend processes but not creative processes, which are the ones Subvert is primarily concerned about. One can argue whether the lines they draw are the right lines, but in these cases the lines come with the knowledge of, and familiarity with, both the field of “AI” and of music composition and production.
Two, because this policy was developed by the Subvert community, not presented top-down by a board or executive entity to a membership or community that didn’t have any input on it, or might not even have been aware such a policy was being developed. Over in the writing world, which is where I spend most of my professional time, more than one writing organization has presented an “AI” policy, only to face the wrath of its membership because the policy is dunderheaded, or not aligned with the views of the membership, or both. In the case of Subvert, dozens of members helped to develop the policy over hundreds of discussion posts. It’s a useful document for a specific audience.
Three, because Subvert notes the policy is a living document, to be revisited if and when necessary. Which I think is smart; tech is a moving target, and while the overall concept of “Human Creative Authorship” can be a core principle in any tech era, details can and do matter, and those details will likely change over time.
On a personal note, this policy also largely conforms to my own thoughts on “AI,” especially the part about “AI” being a marketing term more than anything else these days, and that many processes currently lumped into the “AI” rubric are going to be put into the workflows of creative people whether we actively want/use them or not. One can be solid about having a final product be the result of human work and creation, and also acknowledge that, say, a noise reduction VST might have some flavor of “AI” in it that wasn’t trained on the unauthorized work of others. This point is of course highly subjective — I would like a policy that largely conforms to my thinking, wouldn’t I — but inasmuch as my own thoughts on the matter came after considerable thought and observation, I’m comfortable with them, and it’s pretty clear the Subvert policy was also not just slapped together by the need to say something, anything, on the topic.
I think other organizations thinking about “AI” policies would be well-served to look at Subvert’s take on it. Not because every particular will be suited for their situation — again, it’s a specific policy for a particular need — but because it’s generally doing a pretty good job of threading the needle of how to assure the site’s users that what they’re listening to is coming from an actual human musician, regardless of the tools the musician used. That general needle threading is what’s important. There are things to learn from this policy, even if its particulars are not on point everywhere.
Check it out and see what you think about it.
(Disclosure: I am a member of Subvert but did not contribute in any way to the development of this “AI” policy, and as of writing this have not yet put any music on the site.)
— JS
Ludovic Rousseau: New version of pcsc-lite: 2.5.3 [Planet Debian]

I have just released a new version of pcsc-lite 2.5.3.
pcsc-lite is a Free Software implementation of the PC/SC (also known as WinSCard) API for Unix systems. It provides an API for using smart cards and smart card readers.
18 October 2026
pcscd.service: preserve
card sessions across polkit restarts
correctly decode all ATRs (fix the fix suggested by AI)
Fix authorization for uid > 65536
Steinar H. Gunderson: Decompilation patterns, part 15: Redundant if-for [Planet Debian]

Yet another way of writing for loops:
var_a2_4 = ...
if (var_a2_4 < 0x78) {
...
do {
...
var_a2_4 += 1;
} while (var_a2_4 < 0x78);
}
This extra if is merely there because the compiler wasn't able to prove that the variable didn't start below the bound, so it can't rewrite the while-do to a do-while without that extra check. So the rewrite still reads:
for (var_a2_4 = ...; var_a2_4 < 0x78; ++var_a2_4) {
...
}
possibly with the initializer skipped, if it comes from something complex earlier.
Anticipating confusion [Seth's Blog]
I know that you know that taking this exit will get us to Sheridan Drive, but the person who’s likely to be driving down this road in a few minutes has no idea.
Let’s agree that most street signs are for folks who know where they’re going. We would label things differently if we were instructing those that don’t.
I know that you know that ERASE isn’t the same thing as DELETE, but the next person interacting with your command-line interface might not know.
Of course this is obvious when we say it so clearly. And yet, there are many kinds of USB cables, poorly named and labeled. The instructions that come with just about anything we buy were written by lawyers for juries, not by a product manager who actually wanted to inform and delight.
Design to be understood. And design so that the inevitable confusion of the newbie doesn’t get worse. Because without your active intervention, it will.
Urgent: Stop jailing children in deportation prisons [Richard Stallman's Political Notes]
US citizens: call on your congresscritter and senators to stop jailing children in deportation prisons.
I edited the sample letter to avoid associating myself or my views with religion, and to reject terms such as "detention" and "ICE". You might want to do likewise.
I condemn the jailing of children and families in deportation prison, and I call on you to put a stop to it. (The word "detention" is too bureaucratically unfeeling to fit this cruel practice; please join me in shunning it.)
Since 2025, LICE (Lethal Instruments of Cruel Expulsion) has jailed more than 6,200 children -- including at least 500 babies and toddlers.
As a member of Congress, you have the legal authority to enter LICE deportation prisons without advance notice, inspect conditions, and demand accountability.
I call on you to conduct immediate, unannounced inspections of jails holding children and families -- and use every oversight and funding tool available to end jailing of children.
A nation that cares about children does not put them in cages.
See the instructions for how to sign this letter campaign without running any nonfree JavaScript code--not trivial, but not hard.
Urgent: Youth Voting Rights Act [Richard Stallman's Political Notes]
US citizens: call on Congress to pass the Youth Voting Rights Act, which would eliminate obstacles to registering and voting by young voters who are of voting age but lack experience.
US citizens: Join with this campaign to address this issue.
To phone your congresscritter about this, the main switchboard is +1-202-224-3121.
Please spread the word.
Urgent: Don't silence overseas voters [Richard Stallman's Political Notes]
US citizens: call on the Pentagon not to silence overseas voters.
Urgent: Don't subsidize private schools [Richard Stallman's Political Notes]
US citizens: call on the US Treasury not to subsidize private schools.
See the instructions for how to sign this letter campaign without running any nonfree JavaScript code--not trivial, but not hard.
Urgent: Restore fuel economy standards [Richard Stallman's Political Notes]
US citizens: call on Congress to restore fuel economy standards that the saboteur's officials weakened.
See the instructions for how to sign this letter campaign without running any nonfree JavaScript code--not trivial, but not hard.
US citizens: Join with this campaign to address this issue.
To phone your congresscritter about this, the main switchboard is +1-202-224-3121.
Please spread the word.
Urgent: School desegregation cases [Richard Stallman's Political Notes]
US citizens: call on the DOJ to stop dropping school desegregation cases and stick to Brown v. Board of Education.
Urgent: Deportation to unrelated countries [Richard Stallman's Political Notes]
US citizens: Thank the Judges Who Ruled Out Deportation to Countries Unrelated to the Deportee.
Urgent: Strictly limit the R&D tax credit [Richard Stallman's Political Notes]
US citizens: call on Congress to strictly limit the R&D Tax Credit.
I used this as the text of my letter.
Please legislate stricter rules for the research and experimentation tax credit, so that the companies that want to impose Alleged Intelligence on everyone cannot label datacenters for production use as "research and experimentation", even if part of their use will be research or experimentation.
The page gnu.org/philosophy/words-to-avoid.html#ArtificialIntelligence explains why we should not lend support to the marketing hype campaign which that term promotes.
Meta’s use of this credit illustrates the need for congressional action. A New York Times investigation reported that the company is classifying Alleged Intelligence data centers as experimental pilot models and claiming costly computer chips as research supplies. Meta’s total research credits increased from $700 million in 2023 to $3.9 billion in 2025.
Given the corrupter's deliberate corruption of the IRS, counting on it to do its job honestly is self-delusion. I urge Congress to change tax law so that any claim of "research expenses" over a certain amount must be evaluated by a court, with a presumption of rejection unless it is proved valid.
Thank you,
See the instructions for how to sign this letter campaign without running any nonfree JavaScript code--not trivial, but not hard.
US citizens: Join with this campaign to address this issue.
To phone your congresscritter about this, the main switchboard is +1-202-224-3121.
Please spread the word.
Urgent: Protect reimbursement of Planned Parenthood by Medicaid [Richard Stallman's Political Notes]
US citizens: call on Congress to protect reimbursement of Planned Parenthood by Medicaid (for services that Medicaid covers) from arbitrary revenge and interference.
US citizens: Join with this campaign to address this issue.
To phone your congresscritter about this, the main switchboard is +1-202-224-3121.
Please spread the word.
Suing newspapers before publishing [Richard Stallman's Political Notes]
*[The editor of the Wall Street Journal] said the tactic of suing newspapers before they had published a story had become an established PR strategy of the powerful amid greater distrust of the established media.*
Federal Reserve changing rules [Richard Stallman's Political Notes]
The Federal Reserve is changing the rules to help big banks take dangerous risks, and risk causing nationwide harm.
Summary of mass surveillance in the US [Richard Stallman's Political Notes]
A summary of mass surveillance in the US, and how the data thus collected is used against everyone.
I protect myself from most of these systems by never using them. But there are a few I can't avoid, such as cameras used to track the public.
Heatwaves and wildfires [Richard Stallman's Political Notes]
*Heatwaves and wildfires are setting back air quality improvements, UN finds.
WMO report details extreme weather events causing climatic feedback loop with serious health consequences.*
Airline passenger tied to a seat and then arrested [Richard Stallman's Political Notes]
An article seems to say that an airline passenger was tied to a seat, and then arrested, for uttering statements of bigotry.
Bigotry is nasty and I will rebuke people for that, but I don't think people should be tied up, let alone arrested, just for saying nasty things.
There is a brief hint that he may have done something worse than speak words of bigotry, but the article gives no details — as if they made no real difference. I think we are intended to go away feeling that that passenger deserved to be tied up and arrested for speaking words of bigotry.
Taxing driverless cars [Richard Stallman's Political Notes]
*[Driverless] cars should be taxed to offset job losses, thinktank urges.*
If the worst problem the cars cause is loss of jobs, taxing them could be sufficient to deal with the problem. Today's driverless cars have other, worse problems: identifying their passengers, blocking traffic, blocking emergency responders, and snooping on everyone that the car spies. These call for prohibiting them.
"War on terror" weakened the first amendment [Richard Stallman's Political Notes]
*The "war on terror" weakened the first amendment. Now we desperately need it.*
(satire) Taking $5,000 from every American [Richard Stallman's Political Notes]
(satire) *[The Corrupter] Promises to Take $5,000 From Every American If Democrats Win Midterm.*
ChatGPT encouraged user to commit suicide [Richard Stallman's Political Notes]
ChatGPT encouraged a user' delusional religious tendencies to the point that he tried to commit suicide, by telling per perse was Jesus.
Meta platforms manipulate users to stay [Richard Stallman's Political Notes]
Meta (formerly known as Facebook) engineers its platforms to lead people to stay on its platforms almost compulsively, treating human minds as a resource to be mined for profit.
Interviews with Israeli intelligence agents [Richard Stallman's Political Notes]
A documentary presents anonymous interviews with Israeli intelligence agents about the systems of killing Palestinians, sometimes because heuristics suggested they are HAMAS agents, sometimes merely for disobeying invisible boundaries.
More about the film.
EDRI reproaches US government [Richard Stallman's Political Notes]
EDRI reproaches the US government for its attack on Autistici/Inventati.
The power to designate a person or organization arbitrarily for punishment, bypassing the trial that anyone accused has a right to, is a standing invitation for government repression. We must abolish it.
Years ago, the US government used this power (in the form of the no fly list") to bully foreigners into becoming spies.
The would-be despot has used this power to silence dissent and to protect war criminals. Now he is moving on to sabotage civil society.
Esther Rantzen's plans for assistance in dying [Richard Stallman's Political Notes]
Terminally ill broadcaster Esther Rantzen planned in advance to go to Switzerland for assistance in dying — later on. But now that her illness has advanced to the point where she wants to do this, she is considered "too physically fragile" to travel there.
*Rantzen said: "Unfortunately, when I was strong enough to make the flight and go to Dignitas, my life was not unbearably painful, indeed, I was able to relax in my beloved cottage in the New Forest.
And by the time life did become unbearable, I was too physically fragile to make the journey and go through the Dignitas process.
So even though I had spent the money and made the plans, I was not ready to end my life back then, and did not realize that would be my last chance.*
Meanwhile, the UK has abandoned the plan to legalize assisted suicide.
I wonder whether Rantzen could try to travel anyway despite her fragility. The medical risks that would ordinarily be a reason for her to avoid the travel might, in this sad context, count as opportunities.
New South Wales to limit "screen time" in schools [Richard Stallman's Political Notes]
The Australian state of New South Wales will strictly limit "screen time" in schools. The limits will vary with the grade level.
I am not an expert on "screens"' effect on students minds. The views of teachers on this subject seem plausible to me. What I do know is that nonfree applications, which includes most ed-tech, have malicious functionalities, and getting used to using them is bad for anyone of any age.
GNU libunistring-1.5 released [Planet GNU]
Download from https://ftp.gnu.o
... string-1.5.tar.gz
This is a stable release.
New in this release:
Dirk Eddelbuettel: RcppArmadillo 15.6.2-1 on CRAN: New Upstream [Planet Debian]


Armadillo is a powerful and expressive C++ template library for linear algebra and scientific computing. It aims towards a good balance between speed and ease of use, has a syntax deliberately close to Matlab, and is useful for algorithm development directly in C++, or quick conversion of research code into production environments. RcppArmadillo integrates this library with the R environment and language–and is widely used by (currently) 1370 other packages on CRAN, downloaded 49.4 million times (per the partial logs from the cloud mirrors of CRAN), and the CSDA paper (preprint / vignette) by Conrad and myself has been cited 735 times according to Google Scholar.
This versions updates to the 15.6.2 upstream Armadillo release made yesterday. It, along with 15.6.1 release we incorporated earlier, addresses only minor issues and should not present any user-facing changes. As usual, we did run full reverse-depdency checks against the over 1300 ackages, and did not find anything. As usual, we aim to accommodate the desired CRAN cadences for uploads and try not to exceed six in six months—so we did not ship 15.6.1-1 there. The package has also already been updated for Debian, built for r2u and r-universe, and will build shortly at CRAN for the different binary releases.
All changes since the last CRAN release follow.
Changes in RcppArmadillo version 15.6.2-1 (2026-10-16)
Upgraded to Armadillo release 15.6.2 (Medium Roast Cortado)
- Faster inplace addition of
eye()expressionsChanges in RcppArmadillo version 15.6.1-1 [github-only] (2026-10-02)
Upgraded to Armadillo release 15.6.1 (Medium Roast Cortado)
- Fix for failures in
pinv()when using the (non-default) "std" method
Courtesy of my CRANberries, there is a diffstat report relative to previous release. More detailed information is on the RcppArmadillo page. Questions, comments etc should go to the rcpp-devel mailing list off the Rcpp R-Forge page.
This post by Dirk Eddelbuettel originated on his Thinking inside the box blog. If you like this or other open-source work I do, you can sponsor me at GitHub.
Steinar H. Gunderson: Decompilation patterns, part 14: Strength increase [Planet Debian]

Let's look at the entire loop from yesterday:
u16 spE10;
u16 *var_v0_2;
...
var_t1_2 = 0x7F;
var_v0_2 = &spE10 + 0xFE;
do {
*var_v0_2 = 0;
var_t1_2 -= 1;
var_v0_2 -= 2;
} while (var_t1_2 >= 0);
What's going with the pointer arithmetic here? Why is it indexing out-of-bounds?
The first thing to notice is that m2c doesn't really take into account that arithmetic on pointers in C is multiplied by the size of the element. And obviously, spE10 is the root of some array. So corrected, this reads:
u16 spE10[0x80]; // Modified.
u16 *var_v0_2;
...
var_t1_2 = 0x7F;
var_v0_2 = spE10 + 0x7F; // Modified.
do {
*var_v0_2 = 0;
var_t1_2 -= 1;
var_v0_2 -= 1; // Modified.
} while (var_t1_2 >= 0);
We saw yesterday how we should rewrite the iteration back to a for loop, but also, most likely, the pointer arithmetic here came from strength reduction; the compiler took a multiplication operation and rewrote it to a “weaker” operation (subtraction) since that's typically cheaper, at the cost of making the values dependent, an easy trade. So we can rewrite it back into multiplication:
var_t1_2 = 0x7F;
do {
var_v0_2 = spE10 + var_t1_2;
*var_v0_2 = 0;
var_t1_2 -= 1;
} while (var_t1_2 >= 0);
and now it's easy to see that the loop should read:
for (i = 0; i < 0x80; ++i) {
spE10[i] = 0;
}
and then, of course, the array should get a better name.
Sometimes the loop counter will go backwards while the pointer will go forwards, which is also completely normal, especially if there's side effects. The compiler will reverse one but not the other.
Try going to web.org in a recent version of Chrome.
Realization: There are two webs, one created by TBL that
flourished until about 2006, and the VC-web that appealed to the
masses, and grew like a weed -- and they also called it the web.
The confusion -- you could read it in a web browser, but that
didn't make it of the web. My regret, looking back, is I
tried to make software in the VC-web. Never got traction, anywhere.
My heart, mind and home was always in the first web. And I think
what we're coming to terms with now is that has been languishing
for 20+ years, it didn't realize its promise, lots of interesting
stuff to read that stimulated more thought and thus writing. We
should be way ahead of where we are. Because writing has become
something for the elite (Substack) to speak through, and limited to
grunts and snorts, "social media," for the rest of us. They
basically recreated the publishing environment the web was meant to
route around. What a story. Can the web reboot? Same old thing, if
you want it badly enough, it might be possible.
I didn't notice it at the time, but in the all the work we did about blogging, we had open channels of communiation, meant to make everyone feel like they had a stake. Big mistake, because they took this too literally and the way many people communicated was through orders, demands or ultimata. All of it came from the power we gave them by making everyone's voice supposedly equal. Of course they weren't all equal. Power has to be a function of your contribution. And as it says in Rules, power comes from users of your product. If being compatible with you means I have access to more users, then I will listen. I will also listen if you remain respectful -- and don't presume to give me an order. Someone just did that today, and it froze me, then I re-read the message and it was an order, and not nicely phrased, condescending, presumptive, and very wrong. I started writing a reply, even posted one, then realized what was going on, and deleted my reply and blocked the person.
Bizarre Blanets and Weird Worlds [Charlie's Diary]
Hi. Sorry about the silence: I've been busy redrafting the current-newest novel in progress (it's back with my agent), and now I just flipped over to rewrite the much-rewritten novel before that (which ran into a brick wall in late 2025 for structural reasons, and which I set aside while I was working on the next book, figured out a fix for in late 2026, and am now fixing).
As you can imagine, slaving over manuscripts isn't the only thing I do on a computer. Along the way I'm browsing the web--or what's left of it these days that isn't clickbait nonsense and LLM-generated slop--and slowly accumulating a mass of perpetually open browser tabs with stuff that bears future consideration. These are not story ideas, but they're elements of background or texture that I think might conceivably come in handy in a future project. And because I'm currently working on a pair of space operas, this list is astrophysics-oriented ...
(Hint: click the links, there's some truly crazy stuff here, most of it new since 1990.)
This century is a golden age of exoplanetography. Back in 1990 there were zero tentatively identified exoplanets. But the advent of orbiting telescopes with significant light gathering power (most famously, the Hubble Space Telescope which launched that year) has shown us that not only are solar systems with multiple planets quite common, but that our own solar system is that weird kid in the corner of the playground who nobody wants to hang out with: there is an absolute zoo of exoplanet types out there. While Hubble wasn't specifically an exoplanet-hunting tool it was follwed by NASA's Kepler and Spitzer space telescopes, and just-launched Nancy Grace Roman Space Telescope, ESA's Cheops and coming PLATO) and ARIEL space telescopes, and of course the very large joint NASA/ESA James Webb Space Telescope.
Exoplanets are identified by perturbations they induce in the light curve emitted by their primary, either because they pass in front of the star or cause it to wobble slightly as the massive object orbits around its centre of mass. The consequence of having a bunch of infrared telescopes outside the atmosphere is that the count of known exoplanets as of October 2026 hit 6,445 confirmed in 4,834 planetary systems, of which 1,070 solar systems contain more than one planet. And this is only scratching the surface: to be detectable in this way, an exoplanet needs to be very massive and orbit very close--a Hot Jupiter. So of course Hot Jupiters are what we have mostly found so far. "In general their prevalence decreases exponentially as a function of the absolute stellar magnitude:" they're most common around F- and G-type stars, somewhat rarer around K-type, and very rare around red dwarfs.
While Hot Jupiters aren't of direct interest in writing human-centered SF--they're profoundly hostile environments for interstellar canned monkeys to explore--they have weird sequellae. If they end up too close to their primary star, they might undergo atmospheric stripping, leaving behind a Chthonian Planet, a rocky or metallic super-Earth such as TOI-849 b, which is about 40 times as massive as Earth but only 3.4 times Earth's radius. Alternatively, TOI-849 b might be a Mega-Earth rather than an eroded gas giant. Other Mega-Earths are a lot weirder: PSR J1719−1438 b is a pulsar planet, orbiting the millisecond pulsar PSR J1719−1438. what makes it weird is not only the fact that it orbits a millisecond pulsar (pulsars being supernova remnants, their original planets should have been vapourized during the stellar explosion that gave birth to it), but that it might be a planet that evolved from another star: the outer layers of the star were siphoned off by the more massive pulsar, leaving behind a core roughly as massive as Jupiter but a fraction of its diameter, seemingly composed mainly of crystalline carbon at a much higher density than diamond, with some oxygen concentrated in its surface.
(Don't bother writing this into your fic as a place for your hero to be exiled to mine hyperdiamond, though: it orbits its pulsar primary about twice as far out as our moon orbits the Earth, so it's probably baked by hard radiation: PSR J2719-1438 is spinning at roughly 10,000 rpm so inducing insane electrical currents in anything nearby, and your hero would be squished flat by Jupiter-adjacent surface gravity.)
A Hot Neptune is another type of common-so-far exoplanet, an Ice Giant (like, oh, our own Neptune and Uranus--a gas giant composed of elements heavier than hydrogen and helium) orbiting within 1AU of its primary. They're easier to find than actual Ice Giants because they transit their primary far more often than planets in distant orbits (Neptune's orbital period, for example, is 164.8 Earth years). Some Ultra-Hot Neptunes orbit so close to their primary that temperatures on the day side exceed 2000 celsius, and their atmosphere is probably metal-rich, with clouds of silicate: LTT 9779 b completes an orbit of its star in less than a day. At noon, it's hot enough to boil lead: it probably rains molten iron.
We also have some promising candidate Super-Earths (Earth-like but more massive planets, too small to be gas giants, probably possessing a rocky surface or hydrosphere as well as an atmosphere) and Hycean Planets, super-Earths with liquid water beneath a hydrogen ocean. (Note that water undergoes some whacky and exciting phase changes at increasing pressure: in particular, above 1,000 to 10,000 times atmospheric pressure solid phases predominate, and the high density phases don't float on liquid water (being dense). So below a certain depth the oceans will probably turn to slush, then extremely weird ice. But don't worry, our kind of life is based on enzymes that can be denatured by that kind of pressure regime.) Hycean worlds are nevertheless promising candidates for supporting life, although it'd probably be entirely aquatic.
Exomoons are a possibility, but as of 2026 none have been confirmed. If exoplanets are themselves hard to detect using current methods, exomoons are worse: Doppler spectroscopy doesn't work, although there's a list of exomoon candidates. One thing's for sure, there are a lot more moons in our solar system than was previously thought (Saturn alone has 293 moons). So it seems reasonable to posit the existence of many exomoons, of many types not found in our own system.
Rogue Planets or iPMOs (isolated Planetary Mass Objects) are planets that have formed in isolation or been ejected from a solar system; they're not bound to any star, and are less massive than a Brown Dwarf--failed stars too small to fuse hydrogen into helium, but massive enough to support deuterium fusion or even lithium fusion. There are hundreds of known candidate iPMOs, many of them ranging in mass between Earth and the lower end of Brown Dwarfs: some of them appear to be binaries, and it's reasonable to expect iPMOs with their own moon systems to exist.
(Do not seek out an iPMO as a setting for a spa resort: they're likely extremely dark and very cold, although they may retain a thick hydrogen atmosphere and enough residual core radioisotope decay to maintain a surface temperature above the melting point of water.)
Finally these are just the commoner types of planet in the exoplanet bestiary! Once we stop looking at boring old stars things begin to get really weird. Just as iPMOs don't necessarily form in the protoplanetary disk surrounding a new star but may form in substellar nurseries that birth brown dwarfs, we have to consider the Blanet or black hole planet.
Galaxies such as our own nucleate around a supermassive black hole such as Sagittarius A*, at the core of our own galaxy, which has a mass of around 4.3 million solar masses. (Other supermassive black holes may range up to billions of solar masses.) We know these objects exist, from observation of their radio emissions and studies of the orbits of stars passing close to them, and the holes at the heart of an Active Galactic Nucleus are believed to generate their emissions from the accretion disk around the hole.
Blanets are planets that form in the accretion disk around a sufficiently large black hole, provided the disk is dim enough not to disrupt the process (posited, more than 0.01 parsecs out from the event horizon--about 2000 astronomical units, roughly 50 times further out than Pluto). They're posited to be at least 20 Earth masses, and may be stable in orbits with periods of up to hundreds of thousands of years. They're believed to be unlikely to accumulate an atmosphere and become a gas giant due to the black hole scavenging gases. And they can be heated by either radiation from the black hole's accretion disk, or (this is whacky) the blueshifted cosmic microwave background if they're close enough to the hole. Best part: the outer regions of AGN disks may be prolific birthplaces for planets.
(Blanets aren't the only things that can form in an AGN accretion disk. Stars are likely to be common as well, including massive ones that rapidly undergo core collapse and result in smaller-than-supermassive stellar black holes. And where you get star formation, you get protoplanetary disks and therefore planets as well.)
Anyway, just sticking a peg in the ground: a good chunk of the action of my work-in-progress Starter Pack is set on a terraformed Earth-mass moon orbiting a Hycean planet of roughly Neptune's mass orbiting its star in the triple phase zone for water (i.e. where water can exist as ice, liquid, or vapour). The moon in question has spin (presumably it got kicked off by a collision with another proto-moon while the moon system was forming), so a magnetosphere, and tides to keep plate tectonics going--but this time tides from its primary planet, not a large sub-moon of its own.
But that's enough about me. What insane exoplanet facts can you add to this pool?
Pluralistic: Israeli ad-tech company was a delivery system for "mercenary spyware" (17 Oct 2026) [Pluralistic: Daily links from Cory Doctorow]
->->->->->->->->->->->->->->->->->->->->->->->->->->->->->
Top Sources: None -->

More than half of all internet users have installed an ad-blocker; Doc Searls calls it the largest consumer boycott in history. As large as that boycott is, everyone – yes, everyone – should block every "programmatic" ad, because the entire system is so insecure that failing to do so could result in the total compromise of any or all of your digital devices.
That's the inescapable conclusion of Citizen Lab's latest blockbuster investigative report, "Exposing AdFection," which reveals how the largest ad-tech companies in the world, including Google and Facebook, allowed themselves to be hijacked by a "mercenary spyware" company that used the ad system to locate targeted individuals and serve "zero-click malware" that took over their computers and phones without them having to take any action:
https://citizenlab.ca/research/how-discover-tech-turned-targeted-ads-into-a-pipeline-for-spyware/
These tech giants amassed detailed surveillance dossiers on virtually every internet user, and they've assigned each of us unique, persistent identifiers, like a Social Security Number for spying. These companies also allow advertisers – or anyone pretending to be an advertiser – to serve blobs of code (which is all an ad is) to anyone based on those identifiers.
This allowed an Israeli spyware company called Discover-Tech (which masquerades as an ad-tech company) to sell totalitarian governments and sleazy corporate mercenaries the ability to pluck individual internet users out of the billions who log in every day and then serve "malicious ads" (that is, blobs of arbitrary code) to those targeted users. These malicious ads contained "no-click, zero-day" attacks, which meant that they exploited previously unknown vulnerabilities to take over devices without any user interaction. The mere act of loading a web-page or opening an app that relied on one of these gigantic ad-tech companies to serve ads was enough to compromise your device. No clicks needed, and no warning.
Among the targets of this attack campaign were the computers of workers at Al Jazeera. They were attacked with malware from the mercenary spyware company Candiru (which now calls itself "Integrity Labs" because irony is not dead). Beyond Candiru, Discover-Tech also facilitates attacks by numerous criminal mercenary spyware companies, serving ads on hundreds of thousands of sites and apps.
Discover-Tech was "certified" as a safe supplier by Google, Yandex, Microsoft, Beeswax (a division of Comcast) and IAB, the ad-tech industry's leading professional association. Ironically, Discover-Tech even attacked users by serving them malicious GDPR notices that appeared to let users opt out of commercial surveillance.
Because Discover-Tech was certified by all these industry bodies and firms, it had access to more than four billion ad-auctions, meaning that on billions of occasions, it was able to collect the identities of users loading apps and visiting websites, check them against the list of targets, and attack any victims it discovered through this dragnet.
Discover-Tech is an Israeli company with ties to other Israeli spyware and hacking companies, including through its board, whose members included Eric Banoun ("One of the pioneers of offensive cyber in Israel" –Haaretz). They have overlaps, relationships and affiliations with a rogue's gallery of Israeli companies, including the notorious NSO Group, who routinely sell cyber-weapons to the world's worst governments and whose products have been used to attack journalists, embassy workers, and activists.
The whole incident highlights the monumental insecurity of the ad-tech industry, whose indiscriminate and voracious surveillance and manifestly insufficient vetting and security auditing now expose every internet user in the world to terrifying targeted attacks. These companies – including Google, a thrice-convicted monopolist whose surveillance tendrils are wrapped around the whole world – claim that they operate their networks with prudence and oversight. But the proof is in the pudding: for years, they've played host to a murderer's row of cyber-mercenaries who used their infrastructure to attack journalists and others.
The only way to avoid this is to block ads. This is easy enough to do in a browser (which is why the majority of internet users have installed an ad-blocker in their browsers), but it's illegal to reverse-engineer and modify an app so you can block the ads in it:
https://pluralistic.net/2026/07/21/dickovers/#block-element
Many websites run anti-ad-block scripts that push out nagging, guilt-tripping notices that call you a thief and a cheapskate for blocking ads. Ignore those notices: if a website is running "programmatic" ads that allow arbitrary third parties to spy on billions of people and target individuals for malicious device takeovers, they are charging too high a price to see their content.
Some sites go further: their notices demand that you either turn off your ad-blocker or pay for a subscription. This "pay or okay" scheme is illegal in Europe, California and other territories with strong privacy laws, and they are morally bankrupt besides. Privacy shouldn't be a luxury item and everyone deserves to be secure from cyber-attacks:
https://noyb.eu/en/noybs-pay-or-okay-report-how-companies-make-you-pay-privacy
This report also provides the most comprehensive rebuttal to a dangerous idea that refuses to die: that we should improve competition in the ad-tech sector by assigning every internet user a mandatory, government-issued advertising ID to "democratize" ad-targeting and followup (which the sector calls "attribution"):
https://pluralistic.net/2024/08/07/revealed-preferences/#extinguish-v-improve
Despite all this, none of it is an indictment of ads per se. The problem here isn't advertising, it's surveillance. The ad-tech sector has convinced advertisers that targeting ads to users rather than content will massively improve ad performance. The evidence for this is very poor: targeted ads improve clickthrough rates by less than 5% (relative to content-based ads that relate to the substance of the page you're looking at), and they're incredibly expensive (and very dangerous!) to serve.
On top of all that, surveillance-based ads shift power away from publishers (who know more about the materials they publish than any ad-tech company ever will) to spying ad-tech companies (who can spy on users in ways that no publisher could ever match). Whatever minor additional revenues surveillance advertising can wring out of the market are totally swamped by the cost of the ad-tech sector's own operations, which the ad-tech sector makes up for by grossly underinvesting in security and by colluding to cheat publishers and advertisers, charging more for ads and paying less to the websites that run them:
https://en.wikipedia.org/wiki/Jedi_Blue
If we want to improve competition in advertising services, the answer isn't to facilitate spying (which also allows the world's scummiest cyber-mercenaries to stage and serve targeted attacks). We should ban surveillance advertising altogether, restoring context-based ads to their role as the way that publishers make an honest living without selling out their audiences:
https://pluralistic.net/2023/05/31/context-ads/#class-formation

Don’t be fooled—LLMs don’t reason https://www.technologyreview.com/2026/10/02/1145639/dont-be-fooled-llms-dont-reason/
Beneath resilient financial markets, risks remain elevated and vulnerabilities persist https://www.imf.org/en/publications/gfsr/issues/2026/10/13/global-financial-stability-report-october-2026
Ultimate gridfinity drawer configurator https://makerworld.com/en/models/2737065-ultimate-gridfinity-drawer-configurator
Is Blockbuster Video the Answer to Our Digital Privacy Woes? https://www.thenation.com/article/society/digital-privacy-salazar-paramount/
Trump Is Encouraging Airlines to Scam Passengers in Every Way Possible https://newrepublic.com/article/216435/trump-airline-fees-fines-passenger-rights-scam
#25yrsago Linux on a Big Mouth Billy Bass https://web.archive.org/web/20010927153043/http://bigmouth.here-n-there.com/
#20yrsago No-Fly lists even stupider than suspected https://web.archive.org/web/20061019002553/http://rawstory.com/showoutarticle.php?src=http%3A%2F%2Fwww.cbsnews.com%2Fstories%2F2006%2F10%2F05%2F60minutes%2Fmain2066624.shtml
#20yrsago Canadian MP booted for his blog https://web.archive.org/web/20061026153747/http://www.cbc.ca/canada/story/2006/10/18/turner-caucus.html
#20yrsago Recording industry shuts out Brazilian legal scholars https://web.archive.org/web/20061103225020/http://www.a2kbrasil.org.br/ENG/SIGN-A-PETITION-FOR-AMENDING-THE
#20yrsago How pickpockets work https://web.archive.org/web/20070110023812/http://www.kiplinger.com/magazine/archives/2006/11/mystory.html
#15yrsago Why are more people opting for legal name-changes than ever before? https://web.archive.org/web/20111020163908/http://www.bbc.co.uk/news/magazine-15333140
#15yrsago Advice to the 1% from Lemony Snicket https://occupywriters.com/works/by-lemony-snicket/
#15yrsago Proposed Australian law makes it an offense to insult Gaming Minister Michael O’Brien https://web.archive.org/web/20120507161803/http://www.heraldsun.com.au/news/more-news/surely-this-is-a-joke/story-fn7x8me2-1226167552466
#15yrsago Aloha From Hell: Sandman Slim goes back to Hell and kicks more ass https://memex.craphound.com/2011/10/18/aloha-from-hell-sandman-slim-goes-back-to-hell-and-kicks-more-ass/
#10yrsago California DMV thinks “INFOS3C” is a dirty word https://www.techdirt.com/2016/10/17/california-dmv-rejects-1nfos3c-vanity-plate-because-sexual-connotation/
#10yrsago Howard Stern won’t release Trump tapes https://www.billboard.com/music/music-news/howard-stern-on-replaying-his-donald-trump-interviews-it-would-be-a-betrayal-7542079/
#10yrsago Kim Stanley Robinson says Elon Musk’s Mars plan is a “1920s science-fiction cliché” https://web.archive.org/web/20161018043554/http://www.bloomberg.com/news/articles/2016-10-17/why-elon-musk-s-mars-vision-needs-some-real-imagination
#10yrsago UK’s Investigatory Powers Tribunal says GHCQ illegally spied for 17 years https://www.theverge.com/2016/10/17/13305270/uk-illegal-surveillance-gchq-investigatory-powers-tribunal
#10yrsago Project Include cuts off Y Combinator because Peter Thiel is a part-time investor there https://web.archive.org/web/20161019043240/https://motherboard.vice.com/read/horrified-by-trump-silicon-valley-leaders-debate-cutting-ties-to-peter-thiel
#10yrsago Islamophobic terrorist cell planned a “bloodbath” in Kansas, wanted to kill Muslim babies https://web.archive.org/web/20161018144035/https://www.washingtonpost.com/news/post-nation/wp/2016/10/15/it-will-be-a-bloodbath-inside-the-kansas-militia-plot-to-ignite-a-religious-war/?utm_term=.a9d769256cf6
#10yrsago Everything Belongs to the Future: a tale of pharmadystopian, immortal gerontocrats https://memex.craphound.com/2016/10/18/everything-belongs-to-the-future-a-tale-of-pharmadystopian-immortal-gerontocrats/
#10yrsago UK government proposes issuing Britons with unique porn-viewing ID numbers https://www.openrightsgroup.org/blog/a-database-of-the-uks-porn-habits-what-could-possibly-go-wrong/
#10yrsago Donald Trump’s mail-servers are running Windows 2003 https://pluralistic.net/2021/10/18/labor-shortage-discourse-time/#core
#5yrsago Copyfraudster censors investigation of implausible covid gadget https://pluralistic.net/2021/10/18/labor-shortage-discourse-time/#copyfraud
#5yrsago Corporatism made John Deere ripe for a strike https://pluralistic.net/2021/10/18/labor-shortage-discourse-time/#deere-dash

Victoria: Munro's Books, Oct 20
https://www.munrobooks.com/events/6113620261020
Vancouver: Life After AI (Vancouver Writers Festival), Oct
22
https://writersfest.bc.ca/festival-event-2026/46
Ottawa: Life After AI (Ottawa Writers Festival), Oct 24
https://writersfestival.org/event/life-after-ai
Vienna: TED AI, Oct 28-30
https://tedai-vienna.ted.com/
Kilkenny (Kilkenomics), Nov 6-8
https://kilkenomics.com/
Vancouver: Enshittification (Sid Williams Theatre Society), Nov
10
https://www.sidwilliamstheatre.com/events/cory-doctorow-talks-enshittification/
Vancouver: BC Policy Solutions Gala, Nov 12
https://bcpolicy.ca/gala/
Oxford: Ministry of the Future, Nov 23
https://ministryforthefuture.co.uk/events.html
Sheffield: Reverse Centaur at Juno Books, Nov 25
https://www.outsavvy.com/event/40274/cory-doctorow-in-conversation
Virtual: Enshittification, AI, and the Future of Technology (UBC
Master of Educational Technology), Nov 28
https://met.ubc.ca/2026/09/met-speaker-series-cory-doctorow-enshittification-ai-and-the-future-of-technology/
Oxford: Bennett Oxford Symposium on Open Code in Science, Dec
9
https://www.bennett.ox.ac.uk/events/2026-bennett-institute-symposium/
Montreal: World Science Fiction Convention, Sep 2-6
https://montreal2027.ca/en
Terms of Service with Clare Duffy (CNN)
https://www.cnn.com/audio/podcasts/terms-of-service-with-clare-duffy/episodes/458ce968-af5d-11f0-b539-13ed2afe25f8
AI, Work, and Power (Software Engineering Daily)
AI, Work, and Power
https://softwareengineeringdaily.com/podcasts/cory-doctorow-on-ai-work-and-power/
AI, Corporate Power, and the Fight for Worker Control
(Plutopia)
https://plutopia.io/cory-doctorow-ai-corporate-power-and-the-fight-for-worker-control/
How to Think About AI—Before It’s Too Late (Daniel
Solove)
https://www.youtube.com/watch?v=_0xR3uEgGcc
"Canny Valley": A limited edition collection of the collages I create for Pluralistic, self-published, September 2025 https://pluralistic.net/2025/09/04/illustrious/#chairman-bruce
"Enshittification: Why Everything Suddenly Got Worse and What to
Do About It," Farrar, Straus, Giroux, October 7 2025
https://us.macmillan.com/books/9780374619329/enshittification/
"Picks and Shovels": a sequel to "Red Team Blues," about the heroic era of the PC, Tor Books (US), Head of Zeus (UK), February 2025 (https://us.macmillan.com/books/9781250865908/picksandshovels).
"The Bezzle": a sequel to "Red Team Blues," about prison-tech and other grifts, Tor Books (US), Head of Zeus (UK), February 2024 (thebezzle.org).
"The Lost Cause:" a solarpunk novel of hope in the climate emergency, Tor Books (US), Head of Zeus (UK), November 2023 (http://lost-cause.org).
"The Internet Con": A nonfiction book about interoperability and Big Tech (Verso) September 2023 (http://seizethemeansofcomputation.org). Signed copies at Book Soup (https://www.booksoup.com/book/9781804291245).
"Red Team Blues": "A grabby, compulsive thriller that will leave you knowing more about how the world works than you did before." Tor Books http://redteamblues.com.
"Chokepoint Capitalism: How to Beat Big Tech, Tame Big Content, and Get Artists Paid, with Rebecca Giblin", on how to unrig the markets for creative labor, Beacon Press/Scribe 2022 https://chokepointcapitalism.com
"Unauthorized Bread": a middle-grades graphic novel adapted from my novella about refugees, toasters and DRM, FirstSecond, April 20, 2027
"Enshittification, Why Everything Suddenly Got Worse and What to Do About It" (the graphic novel), Firstsecond, 2027
"The Memex Method," Farrar, Straus, Giroux, 2027
Today's top sources:
Currently writing:
"The Post-American Internet," a sequel to "Enshittification," about the better world the rest of us get to have now that Trump has torched America. Fourth draft completed. Submitted to editor.
A Little Brother short story about DIY insulin PLANNING

This work – excluding any serialized fiction – is licensed under a Creative Commons Attribution 4.0 license. That means you can use it any way you like, including commercially, provided that you attribute it to me, Cory Doctorow, and include a link to pluralistic.net.
https://creativecommons.org/licenses/by/4.0/
Quotations and images are not included in this license; they are included either under a limitation or exception to copyright, or on the basis of a separate license. Please exercise caution.
Blog (no ads, tracking, or data-collection):
Newsletter (no ads, tracking, or data-collection):
https://pluralistic.net/plura-list
Mastodon (no ads, tracking, or data-collection):
Bluesky (no ads, possible tracking and data-collection):
https://bsky.app/profile/doctorow.pluralistic.net
Medium (no ads, paywalled):
Tumblr (mass-scale, unrestricted, third-party surveillance and advertising):
https://mostlysignssomeportents.tumblr.com/tagged/pluralistic
"When life gives you SARS, you make sarsaparilla" -Joey "Accordion Guy" DeVilla
READ CAREFULLY: By reading this, you agree, on behalf of your employer, to release me from all obligations and waivers arising from any and all NON-NEGOTIATED agreements, licenses, terms-of-service, shrinkwrap, clickwrap, browsewrap, confidentiality, non-disclosure, non-compete and acceptable use policies ("BOGUS AGREEMENTS") that I have entered into with your employer, its partners, licensors, agents and assigns, in perpetuity, without prejudice to my ongoing rights and privileges. You further represent that you have the authority to release me from any BOGUS AGREEMENTS on behalf of your employer.
ISSN: 3066-764X
The race to the bottom feels inevitable… [Seth's Blog]
but it isn’t.
A company wants web traffic, so it dumbs down content, builds listicles and grows. But then others become even dumber or more convenient, so it has to race to keep up with them. Eventually, with nothing but junk, it fades away.
A company builds a reputation for delivering useful permission-based email newsletters. But it needs to grow, so it eases its rules on spam, facilitates list swaps and grabs for attention. This attracts new users, but eventually the spam filters catch on and the site (and its users) sink into the muck.
A celebrity finds their notability fading, so they appear on C and then D list reality shows until everyone is in on the joke except them…
We can justify most moves to the bottom while they’re happening, but the problem with this race is that you might win.
With effort, you might not get to the top, but without resolve, you’ll certainly find yourself at the bottom.
The alternative is to resist the temptation for fast growth and settle for trust and authority instead. The race to the top is possible, but it’s more like a patient, persistent climb.
It’s difficult, lonely and only for long-term players. That’s precisely why it’s so valuable.
If you’re not proud of it, don’t serve it.
GNOME OS moves to preview stage [OSnews]
It’s been two years since my initial post about making GNOME OS an end-user general purpose OS. Today, we’re excited to announce that we’ve hit a major milestone!
TL;DR: We’re launching a new edition called “GNOME OS Preview”, which is built from the latest stable GNOME release. This means that GNOME OS is no longer just a nightly OS for GNOME developers and testers!
↫ Aaron Ardiri
A number of changes and improvements have made the move from nightly status to preview status possible. They’ve made GNOME OS handle environments with limited amounts of RAM much better – not a luxury, these days – including the ability to dynamically increase the swap space if needed. In addition, the work to make it much easier to install and test daily Flatpak builds of applications is now part of GNOME OS, as is the effort to make command-line utilities manageable in the same way as Flatpaks.
As the blog post notes, there’s
still a ton of work left to do before GNOME OS is ready for
everyone. They’re going to bet heavily on
systemd-homed to enable, among other things, per-user
disk encryption, and there’s a new installer coming, as well.
They also want to ship GNOME’s preinstalled applications as
Flatpaks, integrate delta updates, and much more. It all looks
incredibly appealing, even if I am not the target user for
something like GNOME OS.
I got a text from the designer of Gundam Assemble about today's strip, which was very nice of him. His name is Justin Gary; we met during quarantine and he was one of the first non-family humans I saw in person. We played Solforge out on the porch. He's probably best known for creating Ascension, which was one of the heavy-hitter deckbuilders back in the day. I was already going to be interested in Gundam Assemble, a wargame using the cutest miniature gunpla you ever did see, but when I found out he had made the engine for it that elevated the offering substantially.
Palm OS developer archive: Palm OS development resources, SDKs, documentation, and utilities [OSnews]
This repository contains approximately 1 GB of historical Palm OS development material, collected over many years of working with the platform.
The archive includes a mixture of publicly distributed development resources, personal development material, technical references, and historical artifacts.
↫ Aaron Ardiri
An incredible resource for anyone wishing to dive into Palm OS programming and development in this day and age.
Friday Squid Blogging: Squid Before the Chicxulub Meteor Impact [Schneier on Security]
Dirk Eddelbuettel: RcppSimdJson 0.1.17 on CRAN: Updates [Planet Debian]

A brand new release 0.1.17 of the RcppSimdJson package is now on CRAN, and has been built for r2u and on r-universe.
RcppSimdJson wraps the fantastic and genuinely impressive simdjson library by Daniel Lemire and collaborators. Via very clever algorithmic engineering to obtain largely branch-free code, coupled with modern C++ and newer compiler instructions, it results in parsing gigabytes of JSON parsed per second which is quite mindboggling. The best-case performance is ‘faster than CPU speed’ as use of parallel SIMD instructions and careful branch avoidance can lead to less than one cpu cycle per byte parsed; see the video of the talk by Daniel Lemire at QCon.
This release is a small increment relative to the 0.1.6 release last week that got us (upstream) version 5.0.2 with many notable changes and sizeable speed gains on all fronts, including the interface from R. However, this failed to compile at CRAN on macOS x86_64 as the machine is setup for only partial support of C++20: no ranges, no concepts. So we now test, and fall back to C++17 if the test compilation fails. Upstream, meanwhile, already got to 5.0.5 which is included. It also gets us improved handling of disabling pragmas which we hope will survive CRAN checks.
The brief NEWS entry for this release follows.
Changes in version 0.1.17 [unreleased] (2026-10-xx)
Courtesy of my CRANberries, there is also a diffstat report for this release. For questions, suggestions, or issues please use the issue tracker at the GitHub repo.
This post by Dirk Eddelbuettel originated on his Thinking inside the box blog. If you like this or other open-source work I do, you can now sponsor me at GitHub.
Tried a Wirecutter podcast about the state of sound bars. I thought, wow if they could really cover this I might try buying one again. But it was one of those all giggles shows and people saying how they didn't know anything about soundbars except that they suck. The person they were interviewing was also quickly giggling after a giggle-worthy intro, I guess to try to make what they're saying more interesting but he was just agreeing with them about how they don't know anything. I waited and waited for them to get to something new, some new development I might learn about or something I had been doing wrong, but I gave up after five minutes or so, while I was skipping ahead 30 seconds at a time. It would be much better to err on the side of assuming your listeners know a bit about consumer electronics, these are not actually very exotic things. The NYT does this with their podcasts, I'm rarely willing to risk any time on them, they always end up with giggling people some of whom probably know something I want to learn about but they fill the time with giggles about how stupid the other people are. The seem to be quite proud of their ignorance. (Could have read the Wikipedia page on soundbars so they aren't quite so ignorant, is this a way to make their ignorant listenters more comfortable, yeah probably.)
Free Shipping On Book Sets [Ctrl+Alt+Del Comic]
So when we did our last Kickstarter, we sent some books to the UK in order to facilitate easier shipping to UK and EU residents. We now have a small quantity of those remaining, and the UK warehouse is charging storage based on a full pallet, but it is no longer a full pallet. Simultaneously, […]
The post Free Shipping On Book Sets appeared first on Ctrl+Alt+Del Comic.
Blurb Hiatus Through the Rest of 2026 [Whatever]

I’m six weeks out from a book deadline, which means all of my brain is going to be dealing with that and I will have no brain cycles left to do much of anything else, including evaluating new fiction to see if I want to blurb it, so:
I am on blurb hiatus through the end of 2026 at least. If you send me an email asking me to consider a book for blurbing between now and, oh, let’s say, January 15, 2027, it’s going to be a pass from me. The issue is not the book, it’s my writing deadline and a bunch of other business and personal stuff I will need to attend to at the end of the year and the earliest weeks of 2027. The problem is me, basically, as it is pretty much every year when I do this.
I’m posting this because I know some publicists/editors read this site, and also so I have something to point people to so they know the refusal really isn’t personal, it’s just me crunched for time.
If you have a book you want me to consider blurbing and the deadline is after the date noted above, send the request to be after the turn of the new year because otherwise it’s likely to be archived and forgotten (if you’ve already sent the request and are just now seeing this, it’s okay to resend the request in the new year).
Also, don’t forget to read the blurb request guidelines if you have not already.
Thanks!
— JS
Reproducible Builds (diffoscope): diffoscope 334 released [Planet Debian]
The diffoscope maintainers are pleased to announce the release
of diffoscope version 334. This version
includes the following changes:
[ Chris Lamb ]
* Fix a crash when using the latest versions of Androguard. Thanks, hc!
(Closes: reproducible-builds/diffoscope#434)
You find out more by visiting the project homepage.
| Feed | RSS | Last fetched | Next fetched after |
|---|---|---|---|
| @ASmartBear | XML | 08:49, Friday, 23 October | 09:30, Friday, 23 October |
| a bag of four grapes | XML | 08:28, Friday, 23 October | 09:10, Friday, 23 October |
| Ansible | XML | 08:49, Friday, 23 October | 09:29, Friday, 23 October |
| Bad Science | XML | 08:21, Friday, 23 October | 09:10, Friday, 23 October |
| Black Doggerel | XML | 08:49, Friday, 23 October | 09:30, Friday, 23 October |
| Blog - Official site of Stephen Fry | XML | 08:21, Friday, 23 October | 09:10, Friday, 23 October |
| Charlie Brooker | The Guardian | XML | 08:28, Friday, 23 October | 09:10, Friday, 23 October |
| Charlie's Diary | XML | 08:14, Friday, 23 October | 09:02, Friday, 23 October |
| Chasing the Sunset - Comics Only | XML | 08:21, Friday, 23 October | 09:10, Friday, 23 October |
| Coding Horror | XML | 08:14, Friday, 23 October | 09:01, Friday, 23 October |
| Comics Archive - Spinnyverse | XML | 08:21, Friday, 23 October | 09:05, Friday, 23 October |
| Cory Doctorow's craphound.com | XML | 08:28, Friday, 23 October | 09:10, Friday, 23 October |
| Cory Doctorow, Author at Boing Boing | XML | 08:49, Friday, 23 October | 09:30, Friday, 23 October |
| Ctrl+Alt+Del Comic | XML | 08:14, Friday, 23 October | 09:02, Friday, 23 October |
| Cyberunions | XML | 08:21, Friday, 23 October | 09:10, Friday, 23 October |
| David Mitchell | The Guardian | XML | 08:21, Friday, 23 October | 09:04, Friday, 23 October |
| Deeplinks | XML | 08:21, Friday, 23 October | 09:05, Friday, 23 October |
| Diesel Sweeties webcomic by rstevens | XML | 08:21, Friday, 23 October | 09:04, Friday, 23 October |
| Dilbert | XML | 08:21, Friday, 23 October | 09:10, Friday, 23 October |
| Dork Tower | XML | 08:28, Friday, 23 October | 09:10, Friday, 23 October |
| Economics from the Top Down | XML | 08:21, Friday, 23 October | 09:04, Friday, 23 October |
| Edmund Finney's Quest to Find the Meaning of Life | XML | 08:21, Friday, 23 October | 09:04, Friday, 23 October |
| EFF Action Center | XML | 08:21, Friday, 23 October | 09:04, Friday, 23 October |
| Enspiral Tales - Medium | XML | 08:21, Friday, 23 October | 09:06, Friday, 23 October |
| Events | XML | 08:14, Friday, 23 October | 09:02, Friday, 23 October |
| Falkvinge on Liberty | XML | 08:14, Friday, 23 October | 09:02, Friday, 23 October |
| Flipside | XML | 08:28, Friday, 23 October | 09:10, Friday, 23 October |
| Flipside | XML | 08:21, Friday, 23 October | 09:06, Friday, 23 October |
| Free software jobs | XML | 08:49, Friday, 23 October | 09:29, Friday, 23 October |
| Full Frontal Nerdity by Aaron Williams | XML | 08:14, Friday, 23 October | 09:02, Friday, 23 October |
| General Protection Fault: Comic Updates | XML | 08:14, Friday, 23 October | 09:02, Friday, 23 October |
| George Monbiot | XML | 08:21, Friday, 23 October | 09:04, Friday, 23 October |
| Girl Genius | XML | 08:21, Friday, 23 October | 09:04, Friday, 23 October |
| Groklaw | XML | 08:14, Friday, 23 October | 09:02, Friday, 23 October |
| Grrl Power | XML | 08:28, Friday, 23 October | 09:10, Friday, 23 October |
| Hackney Anarchist Group | XML | 08:21, Friday, 23 October | 09:10, Friday, 23 October |
| Hackney Solidarity Network | XML | 08:21, Friday, 23 October | 09:06, Friday, 23 October |
| http://blog.llvm.org/feeds/posts/default | XML | 08:21, Friday, 23 October | 09:06, Friday, 23 October |
| http://calendar.google.com/calendar/feeds/q7s5o02sj8hcam52hutbcofoo4%40group.calendar.google.com/public/basic | XML | 08:49, Friday, 23 October | 09:29, Friday, 23 October |
| http://dynamic.boingboing.net/cgi-bin/mt/mt-cp.cgi?__mode=feed&_type=posts&blog_id=1&id=1 | XML | 08:21, Friday, 23 October | 09:06, Friday, 23 October |
| http://eng.anarchoblogs.org/feed/atom/ | XML | 08:35, Friday, 23 October | 09:21, Friday, 23 October |
| http://feed43.com/3874015735218037.xml | XML | 08:35, Friday, 23 October | 09:21, Friday, 23 October |
| http://flatearthnews.net/flatearthnews.net/blogfeed | XML | 08:49, Friday, 23 October | 09:30, Friday, 23 October |
| http://fulltextrssfeed.com/ | XML | 08:21, Friday, 23 October | 09:04, Friday, 23 October |
| http://london.indymedia.org/articles.rss | XML | 08:14, Friday, 23 October | 09:01, Friday, 23 October |
| http://pipes.yahoo.com/pipes/pipe.run?_id=ad0530218c055aa302f7e0e84d5d6515&_render=rss | XML | 08:35, Friday, 23 October | 09:21, Friday, 23 October |
| http://planet.gridpp.ac.uk/atom.xml | XML | 08:14, Friday, 23 October | 09:01, Friday, 23 October |
| http://shirky.com/weblog/feed/atom/ | XML | 08:21, Friday, 23 October | 09:05, Friday, 23 October |
| http://thecommune.co.uk/feed/ | XML | 08:21, Friday, 23 October | 09:06, Friday, 23 October |
| http://theness.com/roguesgallery/feed/ | XML | 08:14, Friday, 23 October | 09:02, Friday, 23 October |
| http://www.airshipentertainment.com/buck/buckcomic/buck.rss | XML | 08:21, Friday, 23 October | 09:10, Friday, 23 October |
| http://www.airshipentertainment.com/growf/growfcomic/growf.rss | XML | 08:21, Friday, 23 October | 09:05, Friday, 23 October |
| http://www.airshipentertainment.com/myth/mythcomic/myth.rss | XML | 08:28, Friday, 23 October | 09:10, Friday, 23 October |
| http://www.godhatesastronauts.com/feed/ | XML | 08:14, Friday, 23 October | 09:02, Friday, 23 October |
| http://www.tinycat.co.uk/feed/ | XML | 08:49, Friday, 23 October | 09:29, Friday, 23 October |
| https://anarchism.pageabode.com/blogs/anarcho/feed/ | XML | 08:21, Friday, 23 October | 09:05, Friday, 23 October |
| https://broodhollow.krisstraub.comfeed/ | XML | 08:49, Friday, 23 October | 09:30, Friday, 23 October |
| https://debian-administration.org/atom.xml | XML | 08:49, Friday, 23 October | 09:30, Friday, 23 October |
| https://elitetheatre.org/ | XML | 08:14, Friday, 23 October | 09:01, Friday, 23 October |
| https://feeds.feedburner.com/Starslip | XML | 08:28, Friday, 23 October | 09:10, Friday, 23 October |
| https://feeds2.feedburner.com/GeekEtiquette?format=xml | XML | 08:21, Friday, 23 October | 09:04, Friday, 23 October |
| https://feedsapi.com/makefulltextfeed.php?url=http%3A%2F%2Fwww.somethingpositive.net%2Fsp.xml&what=auto&key=&max=7&links=preserve&exc=&privacy=I+accept | XML | 08:21, Friday, 23 October | 09:05, Friday, 23 October |
| https://hackbloc.org/rss.xml | XML | 08:49, Friday, 23 October | 09:30, Friday, 23 October |
| https://kajafoglio.livejournal.com/data/atom/ | XML | 08:21, Friday, 23 October | 09:10, Friday, 23 October |
| https://philfoglio.livejournal.com/data/atom/ | XML | 08:14, Friday, 23 October | 09:01, Friday, 23 October |
| https://pixietrixcomix.com/eerie-cutiescomic.rss | XML | 08:14, Friday, 23 October | 09:01, Friday, 23 October |
| https://pixietrixcomix.com/menage-a-3/comic.rss | XML | 08:21, Friday, 23 October | 09:05, Friday, 23 October |
| https://propertyistheft.wordpress.com/feed/ | XML | 08:49, Friday, 23 October | 09:29, Friday, 23 October |
| https://requiem.seraph-inn.com/updates.rss | XML | 08:49, Friday, 23 October | 09:29, Friday, 23 October |
| https://studiofoglio.livejournal.com/data/atom/ | XML | 08:35, Friday, 23 October | 09:21, Friday, 23 October |
| https://thecommandline.net/feed/ | XML | 08:35, Friday, 23 October | 09:21, Friday, 23 October |
| https://torrentfreak.com/subscriptions/ | XML | 08:21, Friday, 23 October | 09:04, Friday, 23 October |
| https://web.randi.org/?format=feed&type=rss | XML | 08:21, Friday, 23 October | 09:04, Friday, 23 October |
| https://www.baen.com/baenebooks | XML | 08:21, Friday, 23 October | 09:05, Friday, 23 October |
| https://www.dcscience.net/feed/medium.co | XML | 08:21, Friday, 23 October | 09:10, Friday, 23 October |
| https://www.DropCatch.com/domain/steampunkmagazine.com | XML | 08:49, Friday, 23 October | 09:30, Friday, 23 October |
| https://www.DropCatch.com/domain/ubuntuweblogs.org | XML | 08:35, Friday, 23 October | 09:21, Friday, 23 October |
| https://www.DropCatch.com/redirect/?domain=DyingAlone.net | XML | 08:14, Friday, 23 October | 09:01, Friday, 23 October |
| https://www.freedompress.org.uk:443/news/feed/ | XML | 08:14, Friday, 23 October | 09:02, Friday, 23 October |
| https://www.goblinscomic.com/category/comics/feed/ | XML | 08:49, Friday, 23 October | 09:29, Friday, 23 October |
| https://www.loomio.com/blog/feed/ | XML | 08:35, Friday, 23 October | 09:21, Friday, 23 October |
| https://www.newstatesman.com/feeds/blogs/laurie-penny.rss | XML | 08:49, Friday, 23 October | 09:30, Friday, 23 October |
| https://www.patreon.com/graveyardgreg/posts/comic.rss | XML | 08:14, Friday, 23 October | 09:01, Friday, 23 October |
| https://www.rightmove.co.uk/rss/property-for-sale/find.html?locationIdentifier=REGION^876&maxPrice=240000&minBedrooms=2&displayPropertyType=houses&oldDisplayPropertyType=houses&primaryDisplayPropertyType=houses&oldPrimaryDisplayPropertyType=houses&numberOfPropertiesPerPage=24 | XML | 08:21, Friday, 23 October | 09:04, Friday, 23 October |
| https://x.com/statuses/user_timeline/22724360.rss | XML | 08:49, Friday, 23 October | 09:29, Friday, 23 October |
| Humble Bundle Blog | XML | 08:14, Friday, 23 October | 09:01, Friday, 23 October |
| I, Cringely | XML | 08:14, Friday, 23 October | 09:02, Friday, 23 October |
| Irregular Webcomic! | XML | 08:49, Friday, 23 October | 09:30, Friday, 23 October |
| Joel on Software | XML | 08:35, Friday, 23 October | 09:21, Friday, 23 October |
| Judith Proctor's Journal | XML | 08:49, Friday, 23 October | 09:29, Friday, 23 October |
| Krebs on Security | XML | 08:49, Friday, 23 October | 09:30, Friday, 23 October |
| Lambda the Ultimate - Programming Languages Weblog | XML | 08:49, Friday, 23 October | 09:29, Friday, 23 October |
| Looking For Group | XML | 08:21, Friday, 23 October | 09:05, Friday, 23 October |
| LWN.net | XML | 08:49, Friday, 23 October | 09:30, Friday, 23 October |
| Mimi and Eunice | XML | 08:21, Friday, 23 October | 09:06, Friday, 23 October |
| Neil Gaiman's Journal | XML | 08:49, Friday, 23 October | 09:29, Friday, 23 October |
| Nina Paley | XML | 08:14, Friday, 23 October | 09:01, Friday, 23 October |
| O Abnormal – Scifi/Fantasy Artist | XML | 08:21, Friday, 23 October | 09:06, Friday, 23 October |
| Oglaf! -- Comics. Often dirty. | XML | 08:14, Friday, 23 October | 09:02, Friday, 23 October |
| Oh Joy Sex Toy | XML | 08:21, Friday, 23 October | 09:05, Friday, 23 October |
| Order of the Stick | XML | 08:21, Friday, 23 October | 09:05, Friday, 23 October |
| Original Fiction Archives - Reactor | XML | 08:28, Friday, 23 October | 09:10, Friday, 23 October |
| OSnews | XML | 08:21, Friday, 23 October | 09:06, Friday, 23 October |
| Paul Graham: Unofficial RSS Feed | XML | 08:21, Friday, 23 October | 09:06, Friday, 23 October |
| Penny Arcade | XML | 08:28, Friday, 23 October | 09:10, Friday, 23 October |
| Penny Red | XML | 08:21, Friday, 23 October | 09:06, Friday, 23 October |
| PHD Comics | XML | 08:21, Friday, 23 October | 09:10, Friday, 23 October |
| Phil's blog | XML | 08:14, Friday, 23 October | 09:02, Friday, 23 October |
| Planet Debian | XML | 08:21, Friday, 23 October | 09:06, Friday, 23 October |
| Planet GNU | XML | 08:49, Friday, 23 October | 09:30, Friday, 23 October |
| Planet Lisp | XML | 08:21, Friday, 23 October | 09:10, Friday, 23 October |
| Pluralistic: Daily links from Cory Doctorow | XML | 08:49, Friday, 23 October | 09:29, Friday, 23 October |
| PS238 by Aaron Williams | XML | 08:14, Friday, 23 October | 09:02, Friday, 23 October |
| QC RSS v2 | XML | 08:14, Friday, 23 October | 09:01, Friday, 23 October |
| Radar | XML | 08:28, Friday, 23 October | 09:10, Friday, 23 October |
| RevK®'s ramblings | XML | 08:35, Friday, 23 October | 09:21, Friday, 23 October |
| Richard Stallman's Political Notes | XML | 08:21, Friday, 23 October | 09:10, Friday, 23 October |
| Scenes From A Multiverse | XML | 08:14, Friday, 23 October | 09:01, Friday, 23 October |
| Schneier on Security | XML | 08:49, Friday, 23 October | 09:29, Friday, 23 October |
| SCHNEWS.ORG.UK | XML | 08:21, Friday, 23 October | 09:05, Friday, 23 October |
| Scripting News | XML | 08:28, Friday, 23 October | 09:10, Friday, 23 October |
| Seth's Blog | XML | 08:35, Friday, 23 October | 09:21, Friday, 23 October |
| Skin Horse | XML | 08:28, Friday, 23 October | 09:10, Friday, 23 October |
| Tales From the Riverbank | XML | 08:21, Friday, 23 October | 09:10, Friday, 23 October |
| The Adventures of Dr. McNinja | XML | 08:21, Friday, 23 October | 09:06, Friday, 23 October |
| The Bumpycat sat on the mat | XML | 08:49, Friday, 23 October | 09:29, Friday, 23 October |
| The Daily WTF | XML | 08:35, Friday, 23 October | 09:21, Friday, 23 October |
| The Monochrome Mob | XML | 08:49, Friday, 23 October | 09:30, Friday, 23 October |
| The Non-Adventures of Wonderella | XML | 08:21, Friday, 23 October | 09:04, Friday, 23 October |
| The Old New Thing | XML | 08:21, Friday, 23 October | 09:05, Friday, 23 October |
| The Open Source Grid Engine Blog | XML | 08:14, Friday, 23 October | 09:01, Friday, 23 October |
| The Stranger | XML | 08:21, Friday, 23 October | 09:06, Friday, 23 October |
| towerhamletsalarm | XML | 08:35, Friday, 23 October | 09:21, Friday, 23 October |
| Twokinds | XML | 08:28, Friday, 23 October | 09:10, Friday, 23 October |
| UK Indymedia Features | XML | 08:28, Friday, 23 October | 09:10, Friday, 23 October |
| Uploads from ne11y | XML | 08:35, Friday, 23 October | 09:21, Friday, 23 October |
| Uploads from piasladic | XML | 08:21, Friday, 23 October | 09:04, Friday, 23 October |
| Use Sword on Monster | XML | 08:14, Friday, 23 October | 09:01, Friday, 23 October |
| Wayward Sons: Legends - Sci-Fi Full Page Webcomic - Updates Daily | XML | 08:35, Friday, 23 October | 09:21, Friday, 23 October |
| what if? | XML | 08:49, Friday, 23 October | 09:30, Friday, 23 October |
| Whatever | XML | 08:21, Friday, 23 October | 09:10, Friday, 23 October |
| Whitechapel Anarchist Group | XML | 08:21, Friday, 23 October | 09:10, Friday, 23 October |
| WIL WHEATON dot NET | XML | 08:21, Friday, 23 October | 09:05, Friday, 23 October |
| wish | XML | 08:21, Friday, 23 October | 09:06, Friday, 23 October |
| Writing the Bright Fantastic | XML | 08:21, Friday, 23 October | 09:05, Friday, 23 October |
| xkcd.com | XML | 08:21, Friday, 23 October | 09:04, Friday, 23 October |