Thanks for reading! Follow me on Mastodon and Bluesky. Subscribe to my Blog and Notes or Combined feeds.

OAuth and personal data like my bookmarks tool can be handled by direct PDS access. For social and aggregate features, you need to sync and listen to the event stream and then cache data locally. Dan Abramov has a nice example. Services like microcosm exist, but for how long? Who knows. Seems expensive to keep that free!

I want to expand features on attic.social that’ll need a database. I plan to prototype something basic to see how it performs. Maybe I can self-host on my Raspberry Pi alongside my PDS?

Thanks for reading! Follow me on Mastodon and Bluesky. Subscribe to my Blog and Notes or Combined feeds.

I get why it can’t just be a JavaScript API. That’d be abused or instigated at the wrong time. Users will either click “go away”, i.e. “accept”, like people blindly accept cookie banners — you can click “no”, ya know? — or they’ll get annoyed and block it entirely; web notifications.

Edit: I was reminded of navigator.geolocation, now I’m even more confused. Guess I’ve got reading to do.

Why can’t it be used inside a <form> without JavaScript? I’m sure that’s been discussed I just haven’t found an answer yet.

What are geolocated coordinates good for? Maps, obviously. That requires a 3rd-party service. They can be scarily good at centring on a location already. Otherwise coords are kinda useless without reverse geocoding to get an address. That too requires a 3rd-party, e.g. Google, Loqate, Mapbox etc. Haven’t they already solved the problem? I’m not sure an extremely finicky <geolocation> will improve user experience.

Personally, I was planning to use an extension like uBlock Origin to remove this thing from the entire web. Testing it on Matuzović’s blog revealed that macOS requires “Location Services” to be enabled per-app, so accepting my browser’s confirmation failed anyway.

Thanks for reading! Follow me on Mastodon and Bluesky. Subscribe to my Blog and Notes or Combined feeds.

I guess Apple makes good laptop monitors because I nailed it!

Thanks for reading! Follow me on Mastodon and Bluesky. Subscribe to my Blog and Notes or Combined feeds.

This button grinds my gears! What does it do? Who knows! There is not even a tooltip. Why does the left-most button have an immediate action but the mystery arrow opens a context menu?

I hate modern UI icons! Assorted bézier curves are not a UX/UI strategy. Designer are busy congratulating themselves whilst I’m left clueless. At least Apple adds a text label in some cases.

Ahhhhh! I need coffee. The week is still salvageable!

Edit: there’s an open issue.

Thanks for reading! Follow me on Mastodon and Bluesky. Subscribe to my Blog and Notes or Combined feeds.

InvalidClientError: Validation of “client_assertion” failed: “iat” claim timestamp check failed (it should be in the past)

This issue was not easily reproduced but became more common later in the day. I’m running my PDS on a Raspberry Pi with DietPi. Config showed that it was syncing time daily (around midnight).

Apparently time was drifting enough that by the following afternoon the millisecond tolerance of atproto OAuth began to balk! I switched to hourly sync and it’s now working. This isn’t the first time I’ve ran into time sync issues on a side quest.

Edit: Tangled has a troubleshooting login issues note with advice.

Thanks for reading! Follow me on Mastodon and Bluesky. Subscribe to my Blog and Notes or Combined feeds.

A court record reviewed by 404 Media shows privacy-focused email provider Proton Mail handed over payment data related to a Stop Cop City email account to the Swiss government, which handed it to the FBI.

Proton Mail Helped FBI Unmask Anonymous ‘Stop Cop City’ Protester - Joseph Cox

Basically, Proton were forced to comply with Swiss law. This is not the first time. The 404 headline is misleading clickbait. I’m not Proton’s biggest fan. I caused a viral PR disaster in January. I won’t defend Proton but why is the focus on them and not the erosion of privacy by governments worldwide?

This is only a story because it happened to Proton. Google hands over hundreds of thousands of accounts each year. Google mail is not encrypted. Proton complied with 8,313 legal orders in 2025 for what little unencrypted data then can give.

But okay, screw Proton. Now what? What reputable email provider offers fully anonymous, untraceable, and encrypted email? None do. Every Proton disaster people flip the table. Nobody can suggest a service that does better or is immune. Fastmail, an Australian company, reports surprisingly low data access requests if their transparency report is to be believed. Fastmail is also unencrypted. Do you think they’ll break the law for you if it comes knocking?

By the way, which email provider do you think @404media.co uses?

Thanks for reading! Follow me on Mastodon and Bluesky. Subscribe to my Blog and Notes or Combined feeds.

These tools, and the companies that manufacture them, have tremendous costs — to our labor, to our environment, to our futures. And as we’ve been seeing, those costs also include actual human lives.

Propellant. - Ethan Marcotte

Before you kneel down and place the slop pail under your LLM today, take a minute to remember what you’re supporting.

Thanks for reading! Follow me on Mastodon and Bluesky. Subscribe to my Blog and Notes or Combined feeds.

Thanks for reading! Follow me on Mastodon and Bluesky. Subscribe to my Blog and Notes or Combined feeds.

In my online undergraduate P5.js course, students are about to begin the module on motion and physics, including a bit of physics simulation using Matter.js. It suddenly occurred to me that I had never seen anybody put together this particular demo before, and I realized it had to be done. Messy source code at:

https://editor.p5js.org/isohedral/full/vJa5RiZWs

Mastodon - Craig S. Kaplan

This physics simulation of the famous XKCD comic is perfect. Bravo, Craig!

Thanks for reading! Follow me on Mastodon and Bluesky. Subscribe to my Blog and Notes or Combined feeds.

You may not be able to delete your Pages project if it has a high number (over 100) of deployments. The Cloudflare team is tracking this issue.

Delete a project with a high number of deployments

Cloudflare’s solution is a node script that you must run yourself to delete projects via the API. It took over 15 minutes hiting each deployment one by one.

Cloudflare is a serious company.

Thanks for reading! Follow me on Mastodon and Bluesky. Subscribe to my Blog and Notes or Combined feeds.

Thanks for reading! Follow me on Mastodon and Bluesky. Subscribe to my Blog and Notes or Combined feeds.

I’m bored of hearing about it, bored of seeing people I respect(ed) fawn over it and it’s really not doing my mental health any good.

I’m feeling this too. I feel obliged to fight and mock the mania that threatens my career but it’s relentless and exhausting. I’m preaching to the choir at this point. What do I gain other than melancholy?

My stance is clear. I really should focus my energy elsewhere. I don’t think I’ll unsubscribe entirely but I need to repeatedly ask myself: is this worth giving attention?

Thanks for reading! Follow me on Mastodon and Bluesky. Subscribe to my Blog and Notes or Combined feeds.

Both Google and Anthropic are crying foul over “distillation attacks”. This is highly unfair, they stole their data the hard way.

Thanks for reading! Follow me on Mastodon and Bluesky. Subscribe to my Blog and Notes or Combined feeds.

The care is the work.

The care creates the value.

AI doesn’t care. AI is just another tool.

Continvoucly Morged Value - Matthias Ott

Last week I wrote on the socials:

what AI reveals is just how many people have given up, or never cared to begin with. clock in, slop around, clock out

As Matthias Ott notes, by reducing professionals to reviewers of machine output they are devalued and disrespected. Who will continue to care? To get a tune out of an LLM requires a high level of domain expertise. But the work is reduced to drudgery. Are we expecting the next generation to train for a professional craft, with all the pride and enthusiasm necessary, only to switch off and become a human LLM once they’re competent enough?

Thanks for reading! Follow me on Mastodon and Bluesky. Subscribe to my Blog and Notes or Combined feeds.

This is not a minor bug trend. It is a systematic civil-rights failure that has now found its way into software as a whole, through lightning-fast adoption of AI systems that are trained on over 20 years of institutional barriers.

AI is locking people out. At Scale.

I don’t have the chops to say whether this benchmark is fair but it can’t be worse than any other “AI” benchmark. It’s shocking how many developers think you can say the magic word “accessibility”. How many are even asking? A recent Syntax podcast left me falling to my knees in Tesco.

Is it better to have an accessibility agent for completing accessibility tasks or an accessibility skill that any agent can use, or is it better to have an accessibility skill that an accessibility agent can use? So skill, agent, or agent plus skill. Like, what is the ideal combination there? And and the answer that I personally landed on is it basically depends on what you’re doing. Like, if this is a one off thing and you’re saying, I wanna I yeah. Hey. Go fix accessibility issues, then an accessibility skill is more than appropriate for that. And that for the most part, that is the answer. The answer is, hey. Just go off and fix these issues. But if this is a longer running thing where you’re, like, gonna go back and forth with it, like, hey. I want you to go and do a full audit.

AI Coding Explained - Syntax #980 - Scott Tolinski (transcript)

Thanks for reading! Follow me on Mastodon and Bluesky. Subscribe to my Blog and Notes or Combined feeds.

Thanks for reading! Follow me on Mastodon and Bluesky. Subscribe to my Blog and Notes or Combined feeds.

NPMX has gained 2K stars and 178 contributors on GitHub^† in little over one month. JSR has only attracted 2.9K stars and 86 contributors with a two year head start.

Did Deno fumble that hard? I’ve stopped following the JavaScript ecosystem churn. I don’t see the appeal of either NPMX or JSR. All I need is good package search and both fail terribly for different reasons.

^† Don’t @ me, that’s how JavaScript is measured.

Thanks for reading! Follow me on Mastodon and Bluesky. Subscribe to my Blog and Notes or Combined feeds.

In this new AI world, “taste” is the thing everyone claims is the new supreme skill.

But I think “care” is the one I want to see in the products I buy.

AI is sold as a shortcut to short-term profit, at the expense of seemingly everything else. Care is what’s required for long-term success.

That’s why I develop for those who care.

Thanks for reading! Follow me on Mastodon and Bluesky. Subscribe to my Blog and Notes or Combined feeds.

Credit to an unknown hero who shared this a few days ago.

Thanks for reading! Follow me on Mastodon and Bluesky. Subscribe to my Blog and Notes or Combined feeds.