"Anyone who has to analyze software for a living should also bear in mind that German prosecutors apparently consider having a decompiler on your computer to be evidence of criminal behavior."

Open a text editor, see password and try it out can be a criminal offence according to a German court. RIDICULOUS!!! https://www.heise.de/en/news/Federal-Constitutional-Court-rejects-appeal-in-Modern-Solution-case-10663687.html "#ModernSolution had stored the data of all shoppers ... in a […]

wtaf? Copilot just auto-enabled itself in VS Code somehow. Like I didn't even know the extension was installed, and then I started getting these scary ass prompts about copilot

fuck around, find out - lawyer mode https://www.kpbs.org/news/science-technology/2025/09/22/california-issues-historic-fine-over-lawyers-chatgpt-fabrications

The BDFL of that train-themed framework has publicly argued that strong, centralized leadership with full control over what eventually ends up shipping in #opensource projects is the only way OSS can work. But he's wrong. Those aren't the facts. Many successful OSS projects have governance […]

just dropping this here, no reason why https://www.youtube.com/watch?v=0mWM0S1dMro

Client ID Metadata Documents are now at the Call For Adoption phase of standardisation: https://datatracker.ietf.org/doc/draft-parecki-oauth-client-id-metadata-document/ So if you're an OAuth implementer, please do voice your support, concerns, questions, etc.

This is a neat look at my GitHub contributions data over time. I'm still not sure what all my activity was in 2013 though. I was working for a very closed source company at the time 🤔

A little interesting thing that I never built for Mastodon servers, but could have with some difficulty, is an account registration flow that included billing. I have a feeling it'd be easier to develop for PDSes, maybe, though it might require an entryway server, or just using invite codes?

LinkedIn now enables "use my data for AI training" by default. You have to go to Settings & Privacy -> Data Privacy to turn it off. Opt-in by default should be illegal. #linkedin #ai #privacy #ml #gdpr #eu

Here's a neat little thing I learned this week: How to ignore files in a git repository locally, without modifying the .gitignore that's tracked under version control: #git

Not me having to allow this 500 times because an ansible deploy shelled out to 1password CLI for credentials a lot.

This is amazing.

"finders fee" or colloquially known as "bribe" https://mas.to/@carnage4life/115233944519094632

Okay y'all, so I was adding DID documents to ActivityPDS, because I wanted the client to "just work" without a custom IdResolver or HandleResolver, and I've just encountered the weirdest most unexpected DNS behavior.

Big yikes: Ruby Central does a hostile takeover of rubygems and bundler: https://pup-e.com/goodbye-rubygems.pdf

#fediforumfriday: this week I've mostly been working on a side project experimenting with OAuth for decentralized & distributed web; To bootstrap this, rather than writing it all from scratch, I worked on reusing the atproto/oauth-provider package, which provides a LOT of functionality […]

This is really good to see from Bluesky Social PBC — the PLC directory being in a separate organisation (a Swiss Association) makes a lot of sense, and safeguards against political instability harming its operation […]

Well, that was fun, just noticed an "Unknown" network extension in MacOS settings and it turned out to be protonvpn which I'd uninstalled via cleanmymac. Had to follow: - […]

@thisismissem @tesaguri Added in https://codeberg.org/fediverse/fep/pulls/683 > If the server allows clients to upload arbitrary files, it MUST serve media from a different origin (e.g. from a different subdomain).

None of these besides maybe the security thing are interesting to me, sorry VS Code.

Why use a URL shortener when you can use a phishy URL extender? https://phishyurl.com/ Keep your security people alert and awake, generate phishing-looking redirecting link #infosec

For a sneak preview of my followup to the Fediverse Schema Observatory, there's now a project page on the lab website for the ActivityPub Fuzzer: https://asml.cyber.harvard.edu/activitypub-fuzzer/ Basically it lets an ActivityPub server developer test against incoming messages from Fediverse […]

Like a community saying "nah, your tired old sexist, homophobic and racist jokes aren't welcome" is on the comedian to keep pace with society's changing tastes. But the government/state shutting you down & threatening you because they don't like you? That's limiting free speech.

It's kinda poignant now everyone is learning what limitations on free speech really are like, and it's not what the racist or sexist comedians would claim: people deciding against seeing you or hosting your shows is very different to government shutting you down.

Wait, what was controversial is that piece? There's literally nothing there, I was expecting a reference to "rest in piss" or something, but instead it's just about how trump kept answering questions about Charlie Kirks murder with a response about his vanity project, which _is_ weird […]

Huh, spam from 1Password offering me “Early access to Comet, the new AI browser from Perplexity”. I’m perplexed all right, about why 1Password, an outfit I mostly like, is doing this. I want a serious relationship with my security-technology providers, not a spammy one that flirts with sketchy […]

this is fucked up and bullshit and one of my pet peeves: employers should not be demanding you use your personal communications equipment. https://oldbytes.space/@feoh/115215401541166467 if you do, you should be easily deducting that as a job expense, but then that would entail for workers to […]

I semi regularly get people demanding updates on FIRES I am one person, who's chronically ill, who barely makes ends meet because grant funding only pays out once you complete milestones, so I'm working poor for maybe months at a time, trying to build something for others. Oh, and I lead two […]

This is a really really good improvement to see in the Fediverse: Using `Link`s within `attachment` to distribute information about links that the author intends to have previews displayed. https://socialhub.activitypub.rocks/t/fep-8967-generating-link-previews-for-attached-links/5598/1 This […]

Here's a thought: custom feeds for ActivityPub would just be collections requested with cursor pagination parameters & authentication via the proxy. Like, nothing says your collection needs to serve the same content to all requestors, likewise, you don't even need to serve the same content to […]

*whispers: currently a bunch of my dev work is being chronicled on my bluesky account, because it's probably most interesting for them for now, in case you're wondering where I am*

We probably need to rename the AppView - Paul's Leaflets https://pfrazee.leaflet.pub/3lyucxaykg22w This'll almost certainly be an issue we'll encounter with more complex ActivityPub API apps.

It kinda surprises me how infrequently you hear Madonna being played at kink parties, when she's arguably the most famous kinky musician..

The complaint form Ofcom says you should use to report websites for violations of the #onlinesafetyact does not allow you to enter URLs, because it might be illegal for Ofcom to look at them. What is going ON over there.

Online Safety Act 2021 (Australia) https://connect.iftas.org/library/legal-regulatory/online-safety-act-2021-australia/

Numerous journalists and writers purged today for posting factually about a slain regime ally, a bomb threat at the DNC HQ, 6 HBCUs closed due to bomb threats, shots fired at the Naval Academy, and that's just today.

An Interactive Guide to TanStack DB | Frontend at Scale https://frontendatscale.com/blog/tanstack-db/

Anyone wanna take a guess where I learned about this on demand TLS feature in caddy? https://hachyderm.io/@thisismissem/115188735848060327

TIL about Caddy's on demand TLS feature, where you can basically point an entire *.example.com to Caddy and Caddy will automatically issue TLS certs for all matching names if a "ask" service returns 2xx. So you can basically do really easy custom subdomains for people using your application […]

There has been a rush among centrists like Gavin Newsom and Ezra Klein to brush over the hateful life of Charlie Kirk and valorize the man. Let me be clear, killing Charlie Kirk was wrong and abhorrent. We must condemn murder without sanitizing a man who built his empire on hate. My latest piece.

We all dodged a bullet (npm attack) https://xeiaso.net/notes/2025/we-dodged-a-bullet/

Pro-tip for npm: rather than using a classic access token in your ~/.npmrc file, generate a granular access token that only has read permissions. That way if something does compromise you, they only get access to the read token and cannot publish on your behalf. #npm #npmattack

that the main way people use groups for microblogging is suddenly defunct because one person forgot to renew their domain might be a good indication that decentralisation and network resilience includes more than counting the number of servers

@laurenshof Oh wow, from further down the linked thread: "The .CH, .ES, .FR, .LI, .PE, .SG, .COM.SG, .COM.AU, .ORG.AU, .NET.AU TLDs must be renewed 12 days prior to the actual expiration date. If not renewed, the domain will enter the redemption stage right away regardless of the number of days […]

Re AT Protocol "versus" ActivityPub "There does not have to be a “winning” protocol. We do not build a better open social web for everyone by fighting and arguing about protocol superiority." Strongly endorse; collaboration on ths will work way better than competition […]

Recently there has been a lot of discourse about ActivityPub and AT Protocol which has been quite dividing and heated. Yesterday at the Social Web CG meeting (the group that maintains the ActivityPub and related specifications), I proposed releasing a statement that counters the narrative that […]