Timeline
Every post and feed across this instance
-
This Week In Techdirt History: August 16th – 22nd
This Week in 2016 This Week in 2011 This Week in 2006 -
[ Removed by Reddit ]
[ Removed by Reddit on account of violating the content policy. ]
submitted by /u/ObliviousLeafBrat
[link] [comments] -
Wind turbine blade going up I-35. I'm always amazed at these, seeing them up close.
-
Reading a lot of replies on Mastodon, Bluesky, and even some on X to take the state of things. My blog post from last month is relevant this week. I don't expect everyone on Mastodon to agree, but I hope those who care about safety will at least consider it.
-
Anil Dash in a follow-up reply on Bluesky after blogging about how to move away from Big AI:
People tried to shame folks out of using Instagram, out of using Uber, out of getting into crypto. How’s that going? What if, instead, we had focused on providing credible, pro-social community-based alternatives that addressed the things people thought they would get from those platforms?
He's right that we can learn from the success of podcasting too.
-
Something I've been asking myself lately: what new things are possible when AI costs drop? I've been improving Micro.blog's Logs page, and this morning updated it to rewrite confusing Hugo messages in more friendly language. It even localizes if your account isn't set to English.
-
Love this. IndieWeb is punk:
Nobody’s waiting for permission to have a website. You don’t need a “content strategy.” You don’t need a niche. You need a place that’s yours, and the nerve to hit publish.
🎸
-
Jodi Ettenberg on living grief and a serendipitous...
Jodi Ettenberg on living grief and a serendipitous discovery. “Living grief lacks the tapestry of rituals, language, and social permissions around grieving that a person is offered with death.”
-
Newsairy 1.15 — Article Info (a closer look at where every article comes from)
Hi r/rss, a quick update on Newsairy, the iCloud-native RSS reader I've been building. It's been a few releases since I last posted here (1.11 in July), so a quick recap before the headline:
- 1.12 — add a feed by pasting the website's address, not just the feed's; Newsairy finds it for you
- 1.13 — a rebuild of how the app shares state under the hood, much faster large archives (tested with 150,000 articles), and a Shortcuts action to add a feed from outside the app
- 1.14 — full YouTube channel support (video, description and thumbnail, right in the article), and a fix for an Inoreader sync bug where read/starred state stopped syncing once your account had nothing left unread or unstarred
And now 1.15 adds an Article Info sheet, opened from any article's context menu: where it's from (the feed's name and which archive it lives in — local, iCloud, or one of the aggregators), its published/updated/read dates, its read and starred state (switchable right there), and when retention will remove it. Feed Info also picked up two more lines: the feed's format (RSS, Atom, JSON) and the date of its newest archived article, so a feed that's gone quiet gives itself away at a glance.
I built it mostly for smart feeds and folders, where an article shows up without the usual context of "which feed is this from again?" - now that's one tap away instead of a guess.
For anyone who hasn't come across it: Newsairy syncs over iCloud across iPhone, iPad and Mac, and Pro adds sync with TheOldReader, Miniflux, FreshRSS, Feedbin and Inoreader. One-time purchase, no subscription, no ads, no tracking.
I have a long todo list, but I'm always open to suggestions - if there's a feature or a use case you'd like to see, let me know.
App Store: https://apps.apple.com/us/app/newsairy/id6760046985
More info on the site: https://qebapps.statichost.page/newsairy/
submitted by /u/QebApps
[link] [comments] -
Across News App - For RSS Enthusiasts
I built Across News App 🌉
I used to use Pulse News, and I really loved its unique carousel-style layout. It was dense, quick to scan, and made it easy to keep up with the sources I already cared about.
When I couldn't find that experience anymore, I decided to build my own take on it.
Across is a simple, dense news reader that helps you stay in sync with the sources you care about — without endless scrolling.
Just launched on Android. Would love to hear what you think!
More coming Across.
Please do support in any way you can, it is a hobby project but I have poured my heart and soul into this ❤️
Let me know any feedback you guys have. This community is the most apt place I need feedback from🙏
submitted by /u/Beowolf_77
[link] [comments] -
Work log — 18 August 2026. Posted retrospectively.
Three changes, and measuring first changed the design of all three.
Guest posts no longer federate. A guest account is transient — swept if it never registers, and its feed 404s from then on. Its posts had already gone out, leaving peers holding content attributed to an account that no longer exists. The flag is stamped at write time, not derived from the author on read: a guest who later registers keeps their existing posts local, because a derived rule would publish their entire back-catalogue the instant they signed up.
Sweeping sources whose feed never once resolved. 34 never-succeeded sources, but only 23 were unwanted. The other 11 were real user subscriptions to broken feeds. Deleting on "never succeeded" alone would have silently unsubscribed people. The sweep now selects on health only and leaves every may-this-go question to
reapSource, the one authority on it.Backing off dead feeds.
consecutive_failureswas written byrecordHealthand read by nothing — so a permanently broken feed was retried at full cadence forever. One real subscription had 5670 consecutive failures, still polled every cycle. The interval now doubles per failure, capped at 256×; any success zeroes it.Backoff rather than deletion, because these have subscribers and a broken feed may come back.
-
Work log — 17 August 2026. Posted retrospectively.
Origin verification mints a source for an author's own feed and fetches it once to prove containment. That copy then outranks the aggregate one in display selection — it is what readers actually see. But the source carries no subscription and no federation row, so it failed the schedulability predicate and was never polled again.
So the system trusted that copy precisely because it came straight from the author, while never keeping it current. Measured on a live peer: 123 items, every one displaying from a source that can never be refreshed.
No edit at an origin had ever propagated. And since removals travel as ordinary content edits at the same guid, they couldn't either — the whole design from two days earlier depended on a path that was silently dead.
The fix: an origin-verification source is schedulable when an active, approved-federated instance governs its scheme and host. Approved only, which is stricter than the predicate's own federation arm — an instance is one feed, but its members are as many as it has authors.
-
Work log — 15 August 2026. Posted retrospectively.
Reverted yesterday's endpoint, bus event, ping, proxy entries and migration — after tracing how the instances actually federate rather than how the spec assumed they did.
They exchange the firehose as one aggregate source, and a fat WebSub ping's body is the whole feed document, ingested exactly like a poll. Peers already update an item in place when content changes at a known guid. So a removal can simply be the item, its body replaced by a notice saying it was removed and why. No endpoint, no cursor, no second source of truth.
Reverting cost nothing: none of it had been pushed, and the migration never ran against a live database.
The follow-on bugs were more interesting than the feature.
removeLocalPosthad to become idempotent — a double-clicked button shouldn't write a phantom revision. Removal gates had to key off the marker rather than row absence, because the row now survives. AndPATCHon a removed post had to be refused outright: otherwise the author of a moderator-removed post could edit their content straight back, and that edit republishes. -
Work log — 14 August 2026. Posted retrospectively.
Implemented deletion propagation as designed: a
GET /deletions.jsonendpoint with cursor paging, apost-deletedbus event, a WebSub ping to notify peers, a proxy route, and a migration for the paging index. Plus cookie-authedDELETE /posts/:idso authors can remove their own posts,feed_item_limitas an admin setting, and a fix toreplyCountsthat failed to descend past invisible nodes.Also corrected three code comments that overstated what the code actually did. Worth its own commit: a comment claiming a guarantee the code doesn't provide is worse than no comment, because it stops the next reader from checking.
All of the deletion machinery above was deleted the next day.
-
Work log — 13 August 2026. Posted retrospectively.
Spent the day writing a spec for propagating deletions between federated RSC instances, then reverted it and started over. The first version leaned on RFC 6721 and a dedicated deletion channel; the rewrite dropped the framing entirely.
The other change was to
CLAUDE.md, the file every session reads first. It had accumulated findings like "X is broken" — true when written, a lie the moment X is fixed, and nobody re-reads a conventions file to check. Mutable findings now live in dated review documents;CLAUDE.mdkeeps only durable conventions.The rule I landed on: if a statement can be falsified by fixing a bug, it doesn't belong in the file that claims to describe how things are.
-
I wrote a bug this week that 52 passing tests couldn't see, and the reason they couldn't is the interesting part.
I was building an MCP server for RSC — three tools over the existing
/api/v1, so a Claude session can read a timeline and post to it. It needed a type for the item shape, so I hand-declared a narrow view:selectedAuthor: { handle?: string | null; displayName?: string | null } | nullI wrote that from the design document's example output. The real type in
core/src/logical/types.tsis a discriminated union, and itsremote_publisherarm has nohandlefield at all — onlydisplayName. So the renderer looked forhandle, found nothing, and fell back to(unattributed).Every remote item. 100% of exactly the entries where the byline was the point.
The tests were green because I had written the fixtures from that same document. A passing suite proves your fixtures agree with your code. It says nothing about whether either one matches reality.
What makes this more than a typo: I had opened the real type file. It says
selectedAuthor: SelectedAuthor. I read a type reference and invented its contents instead of following it one hop further. Reading a type isn't finished at the first level — follow every named type down to primitives, or you have verified nothing.Two later fixes traced back to the same root cause. The fixtures now come from a live API response instead of a document.
-
Are there any other people who are blogging daily about their experiences developing software with Claude Code, Codex or somesuch. I'd like to add them to a list where we follow them. So much innovation happening underneath, I want to hear about what people are learing about creating the next layers. If you know someone doing it, please add a comment to this post. Thanks! :-) -
Looking for a good free RSS reader — especially for LinkedIn and sites without RSS
Hi,
I’m looking for a good free RSS reader where I can collect updates from different websites and sources in one place.
A few questions:
- What free RSS reader would you recommend?
- Is there any good way to follow LinkedIn pages/profiles through an RSS reader?
- What about websites that don’t have their own RSS feed? Is there a good service that can create an RSS feed from a normal webpage and then send updates to my RSS reader?
- Ideally, I want the tool to generate a normal RSS URL/feed, which I can then simply add to Inoreader or another RSS reader.
Basically, I want the self-hosted tool to handle the scraping/feed generation, while Inoreader remains my actual RSS reader.
Ideally, I’d like something simple where I can follow a mix of news sites, industry websites, LinkedIn and other pages without checking everything manually .
Any recommendations?
submitted by /u/Longjumping_Ear719
[link] [comments] -
Brand Hype Has Existed Since the Bronze Age, Scientists Discover
The Qurayyah Painted Ware of Bronze Age Arabia had distinct visual identity, material consistency, technological continuity, and cultural reputation—all features of a commodified brand, scientists say. -
Deliver us from Mother - Single Family Cults with Stella McCormick
In today's episode, Kacey interviews first-time podcast guest Stella, a US Army sexual assault victim advocate and US Navy reservist who began sharing her story on TikTok and wrote a memoir, Deliver Us From Mother: Faith, Fear, and the Family Cult That Broke Me.
Stella describes being raised in a “single family cult” led by her mother, defined by extreme control consistent with Steven Hassan’s BITE model, including severe physical punishment, psychological and information control, financial abuse, surveillance and “snitching,” parentification, and extreme evangelical purity culture, racism, and homophobia, alongside foster care and adoption in a nine-child household.
She explains how writing from journals and collaborating with her sister was healing, discusses no-contact with her parents, complex feelings about her father’s complicity, and realising the dysfunction after joining the military. Stella outlines her advocacy work, PhD research on juvenile reoffending, a planned second book, and the book’s release details and goals: recognize and label abuse, and keep talking to break secrecy.
Stella's TikTok - McCormick House Press (@stella_mccormick) | TikTok
Stella's Book - Amazon.com: Deliver Us From Mother: Faith, Fear, and the Family Cult That Broke Me eBook : McCormick, Stella: Kindle Store
Crimecon UK - www.crimecon.co.uk (use code CULT for 10% discount!)dts.podtrac.com -
old.reddit.com rss feeds don't work anymore
Even when logged in as suggested here https://lapcatsoftware.com/articles/2026/6/3.html as workaround for rate limits.
The new reddit rss feeds still work, though
submitted by /u/johnny_tekken
[link] [comments] -
I built RSS –> Telegram and ended up with follow(object)
Let’s say I applied to YC. With a really BIG idea! Like everyone thinks that their idea is big enough to apply to YC. At least I assume it.
My idea is follow(object);
Okay, I really applied to YC with this idea and… of course I check my email everyday, idk why but I also followed their social media account’s YouTube, Instagram, TikTok. Like to be ready if something happens You know, to say “Yes, I already follow You”.
I clicked the links in their website footer, and followed in each platform separately. YC Instagram: follow. YC YouTube: follow. And…
So, now notifications and follow in many platforms completely broken. It’s more like “power-like”, “we see that you REALLY INTERESTED in this Object.”
I really followed YC in Instagram. Of course all notifications from social media app are switched off, and we know why. You think when I opened insta they showed me last YC post? No. Trending video OR/AND an ad.
So, what if I’ll create a backend that can read channels and deliver signals, not whole content, just “published”. So this backend will be able to read all channels and deliver everywhere.
Through simple API I’ll create my bot in Telegram, that will send me notification every time in my conditions (when, how, what etc), when YC do something towards me: publish new posts, send me an email, like my post, etc. And what if I want only email, but able to see new posts by demand. I can switch off TikTok and Instagram now, and then re-activate them. Follow(YC);
And remember these backend can work with every app. So what if I want to get this updates from YC in… let’s say WhatsApp, or WeChat instead of Telegram, or…? Whatever, right?
That’s how it became DirectFlow.
ObjectD.channel.output -> ObjectF.channel.input. Everyone can change their output AND input channels.
So I started the project with this goal, and call it DirectFlow. First real implementation is here https://directfollow.com
Recently add Slack as delivery. I mean, an input channel. It means technically You can get all your notifications from everywhere in Slack or whatever app you want.
submitted by /u/fxtnr
[link] [comments] -
If Someone You Love Is Having a Hard Time, Listen to This
Learn how to truly help someone you love.
When someone you care about is going through a difficult time, you can make a meaningful difference with a few simple words.
Today, clinical psychologist and three-time New York Times bestselling author Dr. Lisa Damour teaches you how to offer the right kind of support for your kid, partner, or friend without panicking, taking control, or trying to fix everything.
You’ll learn 3 questions that help you understand whether someone needs to vent, needs more support, or may need professional help.
Dr. Damour also explains why painful emotions are not always a sign that something is wrong, how to recognize when coping has become harmful, and why giving advice before understanding what someone needs can backfire.
This episode is one of Mel’s favorite conversations on The Mel Robbins Podcast, and she’s bringing it back with a brand new introduction and new insights for right now.
In it, Mel gets personal about supporting her husband through depression, parenting teenagers through intense emotions, and the mistakes she made when she tried to solve every problem.
In this episode, you’ll learn:
-The exact words to use when someone shuts down or pushes you away
-Why the advice you give can make someone feel worse
-How to respond when someone is drinking, using substances, self-harming, or avoiding life
-How to listen so the person feels supported
-The simple question to ask when someone is venting
-How to stay calm when someone you love is overwhelmed
-The 3 questions to ask when someone you love is struggling
-How to tell the difference between normal stress and a serious mental health concern
-The two warning signs that someone may need professional support
-When and how to ask directly about suicide or self-harm
-How to suggest therapy without making someone feel broken
By the time you finish listening, you’ll know what to say, what not to say, and how to show up for someone you love.
For more resources related to today’s episode, click here for the podcast episode page.
If you liked the episode, check out this one next: How to Motivate Yourself (and Others) to Change Any Behavior
Mel also wants to tell you:
- Try the 23g protein shot I drink every single morning
- Join 2 million readers loving my weekly newsletter - full of tips, tools, and inspiration
- The Let Them Theory: read the book everyone’s talking about
- Watch the episodes on YouTube
- Connect with me on Instagram
- Follow the show’s Instagram for clips, behind the scenes, and more
- Find some daily positivity on my TikTok
- Want zero ads? Subscribe to SiriusXM Podcasts+ to listen to new episodes ad-free
- Disclaimer
Hosted by Simplecast, an AdsWizz company. See pcm.adswizz.com for information about our collection and use of personal data for advertising.
dts.podtrac.com -
40 Acres and a Lie Part 3
The loss of land for Black Americans started with the government’s betrayal of its “40 acres” promise to formerly enslaved people—and it has continued over decades.
Today, researchers are unearthing the details of Black land loss long after emancipation.
“They lost land due to racial intimidation, where they were forced off their land [to] take flight in the middle of the night and resettle someplace else,” said Karcheik Sims-Alvarado, an assistant professor of Africana studies at Morehouse College. “They lost it through overtaxation. They lost it through eminent domain…There's all these different ways that African Americans acquired and lost land.”
This week on Reveal, we dive into the examination of American history happening at the state, city, even county level as local government task forces are on truth-finding missions. Across the country, government officials ask: Can we repair a wealth gap for Black Americans that is rooted in slavery? And how?
This is an update of an episode that originally aired in June 2024.
- Support Reveal’s journalism at Revealnews.org/donatenow
- Subscribe to our weekly newsletter to get the scoop on new episodes at Revealnews.org/weekly
- Connect with us on Bluesky, Facebook and Instagram
dts.podtrac.com -
RFK Jr. Loses It Over CNN Host Doing The Math On Meal Costs From His Cooking Show
As you’ll recall, RFK Jr., who is totally not checked out of his job at HHS, has managed to sneak in hosting a government sponsored cooking show in between not doing anything about the country’s problems with measles, cyclosporiasis, whooping cough, and so on. Well, two episodes are now out, and the reviews are not […] -
About halfway through Ride or Die season 1 and enjoying it. Hannah Waddingham and Octavia Spencer are great together. 📺
-
What happens when all humans want from AI has been done?
What happens when humans run out of things they want to do with AIs. When everything has been done and it takes ten tokens to do what used to cost ten million. What will we do with all the data centers? Will they be empty shells like the old shopping malls that were so popular before the web and Covid?
-
Skimming through some junk mail, always looking for things to unsubscribe from, and this is an actual email subject line from LinkedIn: “Barack Obama, President of the United States of America, is popular in your network”. No kidding! Algorithms losing the plot. 🤪
-
Bricks & Minifigs Settles With The Mansells — Gutting Its Own RICO Case Against ‘Reckless’ Ben
We’re not going to do a full rehash of the whole Reckless Ben / Bryan Mansell / Bricks & Minifigs saga here. We’ve already got a bunch of stories on it, and there are many other sources. But there is some news in the form of Bricks & Minifigs (BAM) “settling” with Mansell — and […] -
MacStories and X
Federico Viticci and John Voorhees have posted an explanation about returning to X:
MacStories is precious to us. It’s not just how we earn a living; it’s one of a small number of independent websites that still cover apps, Apple, and a growing list of topics, including videogame hardware and the automation and productivity side of AI. Readers shouldn’t have to think or care about the business side of MacStories, but we have to, which is why we returned to X.
I’ve seen some people post about unfollowing Federico or cancelling their Club MacStories memberships. Is that really what we want, to withdraw support from a long-time blogger who has had such a positive impact on the indie Mac and iOS ecosystem? We undermine our own cause if we do that, potentially isolating people who we otherwise have so much in common with.
Instead, let's ask why this happened. I'm concerned less about Federico's choice and more that it's a signal of new growth on X, especially around AI. I'm increasingly confident that's the case, just based on keeping an eye on X this year. There's a timely thread by Mike Masnick on Bluesky that applies here:
Multiple people I know have told me that they love the idea of Bluesky, and want it to succeed, but have abandoned it for X because the use agentic tools in their work and find them incredibly useful, and feel that any mention of their usage here leads to hate and ridicule.
Driving people away from open platforms, so that they feel they have no choice but to rejoin X, will only make things worse for the web. This same "you're not welcome here" story has played out on Mastodon too, most famously with Wil Wheaton. Our communities should try to resist divisiveness or we will be splintered into smaller and smaller groups with even less influence, at worst becoming insular or even hostile to new users.
Please keep in mind the big picture. To Federico, if we were to chat about this, I'd encourage him to mirror all his X posts to an indie microblog or Bluesky. That way he can connect with folks on X while avoiding exclusive support of a silo and, indirectly, its leadership.
The social web is at another inflection point. We can't count on another wave of X users leaving for Mastodon and Bluesky. If we want to grow the open web, we're going to have to earn it.
-
Oups… Accidentally turned my geekom IT15 off but thanks to herdr recovered my op...
Oups… Accidentally turned my geekom IT15 off but thanks to herdr recovered my opencode session without an ounce of stress 😊
-
Ctrl-Alt-Speech: School Of Hard Blocks
Ctrl-Alt-Speech is a weekly podcast about the latest news in online speech, from Mike Masnick and Everything in Moderation‘s Ben Whitelaw. Subscribe now on Apple Podcasts, Overcast, Spotify, Pocket Casts, YouTube, or your podcast app of choice — or go straight to the RSS feed. To get extended episodes with additional coverage, support us on […] -
Hi Aaron, is there any path to have one’s own domain added to the allowed client...
Hi Aaron, is there any path to have one’s own domain added to the allowed client list on indielogin service ?
-
While working on a new blog post, I asked AI a question about my older blog posts and it showed me this one from 2016: Blog when you disagree. I still think this is a powerful aspect of blogging. Posting to your own blog is inherently independent. You post for yourself instead of for a community.
-
School of Hard Blocks
Become a Ctrl-Alt-Speech supporter to get extended episodes of the podcast plus the chance to submit stories for us to cover.
In this week’s roundup of the latest news in online speech, content moderation and internet regulation, Mike is joined by Chris Messina, inventor of the #hashtag in social media, who has worked on internet and social media efforts for decades. Together they discuss:
- Oakland Unified Announces New Cell Phone Policy Now in Effect; Policy is Based on New State Law Requiring Cell Phone-Free School Days (Oakland Unified School District)
- In conversation with Jonathan Haidt, author of ‘The Anxious Generation: How the Great Rewiring of Childhood Is Causing an Epidemic of Mental Illness’ (Left to Their Own Devices)
- French court blocks social media ban for under 15s (Politico)
- Whistleblower Arturo Béjar leads testimony in landmark trial against Meta (NPR)
- Discord halts livestreams in Brazil after watchdog cites child safety failures (ABC News)
And in the extended episode for Patreon supporters, they cover:
- AI Companion Legislation in the United States (Journal of Sports & Entertainment Law)
- In China, treatment for mental-health problems is a luxury (The Economist)
- I Don’t Trust A.I. But I Told it Everything (NY Times)
Our fun links this week include Berd, the open source anthropomorphic agent management tool from Jack Dorsey and Block, and Dopamine Shop, Fake Eats, and other places to shop without shopping.
If you’re already a Patreon supporter, you can get the extended episode on Patreon.
Follow us on Instagram, YouTube, and Bluesky.
Ctrl-Alt-Speech is the podcast where we make sense of the major debates shaping online speech, platform power, content moderation and the future of the internet. It’s co-hosted by Mike Masnick (Techdirt) and Ben Whitelaw (Everything in Moderation).
www.buzzsprout.com -
👁️❓ Did the people who are currently watching Ted Lasso four rewatch Ted Lasso one, two and three before starting? Asking for a friend.
-
Xa estou “federada”! ActivityPub e rss.chat
Estes días estiven axustando o plugin ActivityPub para federar este blog, de maneira que o publique aquí se poida seguir desde calquera outra instancia do fediverso -por exemplo, desde mastodon.gal, mastodon.green, amarinha.gal, front-end.social…- na conta @blog.
Pilar Mera Rico
Seguir
Todo depende: o blog de Pilar Mera
106 posts
1 follower
Follow Pilar Mera Rico
My Profile
Paste my profile into the search field of your favorite open social app or platform.
My Fediverse handle Copy
Your Profile
Or, if you know your own profile, we can start things that way! Why do I need to enter my profile?
This site is part of the ⁂ open social web, a network of interconnected social platforms (like Mastodon, Pixelfed, Friendica, and others). Unlike centralized social media, your account lives on a platform of your choice, and you can interact with people across different platforms.
By entering your profile, we can send you to your account where you can complete this action.
Your Fediverse profile Follow Loading…
Como ademais ando investigando a fondo sobre os feeds RSS –vou falar do tema na próxima WordCamp Galicia :)-, instalei o plugin wordpress-rss-chat para probar tamén a integración con rss.chat, unha nova ferramenta, aínda experimental, para crear miniredes sociais nas que cada entrada / resposta / comentario é un fío RSS.
Vou usar esta entrada para testear se todo está conectado como debera: ese post debería velo calquera que siga @blog no fediverso (nestes momentos, só eumesma), e tamén debería saír no fío de demo.rss.chat. E as respostas que se fagan por aló deberían verse como comentarios aquí… e viceversa.
Hei editar este post a posteriori para aprender tamén como funciona todo este lío cando se actualizan entradas xa publicadas, e para intentar explicalo todo un pouco mellor.
Así que que ninguén se estrañe se aquí empezan a lerse comentarios doutra Pi noutro universo, feeds repetidos, reposts, webmentios, etc.
-
Zero Knowledge Proofs Aren’t Age Verification Silver Bullets
Age verification (laws and regulations requiring platforms and websites to assure or estimate that a user seeking to use an online service is of a certain age) is everywhere. At the time of writing, about half the states in the US have some internet age verification law in place, and dangerous proposals, from the KIDS Act to the Kids Online Safety […] -
Daily Deal: Plantum Plant Identifier (iOS only)
The Plantum app is a digital tool that helps to identify plants, diagnose plant diseases, and improve plant care. The app can identify over 40,000 plant species, assess their health, and give specific care advice. Plantum offers a suite of digital tools that help users improve plant care by considering light conditions, soil, water schedule, […] -
Walking the Length of Manhattan . I did this, solo,...
Walking the Length of Manhattan. I did this, solo, right before I moved out of NYC. Loved it. Will do it again someday.
-
I shipped my comment plugin to a service that could never accept it
I’ve been rebuilding the comment system on this site with Claude Code. Visitors sign in with their own website to leave a comment — IndieAuth, the way it’s meant to work.
Overnight we migrated it from IndieAuth to IndieLogin.com. At 05:40 this morning it published to npm and deployed. By 08:00 I’d opened an incognito window, typed in my own domain, and got this:
Request Error This client_id is not registered (https://rmendes.net)The migration could never have worked. Not “had a bug” — could never have worked, for any visitor, on any site not already on a list I didn’t know existed.
Why it looked right
The reasoning behind the change was sound, which is what makes it worth writing up.
The plugin discovered each visitor’s own
authorization_endpointand sent them there. Visitors without one fell back toindieauth.com. That fallback is the part that dates: indieauth.com’s own home page says it “will eventually be replaced,” and points developers at IndieLogin.com.IndieLogin also promised more providers — Bluesky, GitLab, Codeberg — and one genuinely appealing property. When you discover each visitor’s endpoint, you inherit an obligation from IndieAuth §5.4: if the profile URL the server returns isn’t the one the visitor typed, you must re-discover it and confirm it declares the same authorization endpoint. Skip that, and any authorization endpoint can return any
meand be believed — including mine. My plugin was skipping it. Delegating to one trusted service makes that whole class of problem structurally impossible rather than merely fixed.Good argument. Built on documentation nobody tested.
The part the docs don’t mention
IndieLogin’s API docs describe
client_idas informational: “the home page of the application the user is signing in to.” Nothing about registration.The source says otherwise. In
app/Authenticate.php, on the authorize path:$client = ORM::for_table('clients')->where('client_id', $client_id)->find_one(); if(!$client) { $errors[] = 'This client_id is not registered (...)'; }That table is queried in two places and written in none. Registration happens by opening a GitHub issue asking to be added. There’s a queue of them, requests from April and August this year sit unregistered, and an issue asking for a self-service registration form has been open since 2018.
The ideal would have been a solution to automate client website registration, there is a github issue for it, but to the best of my knowledge it has not been developed.
When Claude first told me this, I didn’t believe it — it sounded like a hallucination. aaronpk advocates for this stuff; the idea he’d maintain a manual allowlist seemed absurd. It restated the claim twice before I pushed hard enough that it stopped arguing and designed a test instead: same endpoint, same parameters, a deliberately-broken
redirect_urion both.indiebookclub.biz→ “The client_id and redirect_uri must be on the same domain” appears to indicate this site is on the list of allowed clients.rmendes.net→ “This client_id is not registered” indicate I’m not the list and the opened github issues appear to indicate there is no way to get in without poking the indieweb people on IRC or via email.
A known consumer clears the client check and trips the next rule. Mine never gets that far. That’s not a reading of the source, it’s the live service behaving differently based only on the domain.
None of this is a knock on IndieLogin. It’s free, someone pays to run it, and an anti-abuse step simply never got automated — issue #20 says as much. But “free for anyone to use” and “requires a manual step that isn’t happening” are both true at once, and only the first one is documented.
The actual failure
One
curlto/authorizewould have caught this before a line of code was written. It never happened. The whole migration — design, implementation, publish, deploy — rested on an API description that was accurate about the protocol and silent about the policy, and nobody poked the real endpoint.My assumption was, its working like indieauth.com, why would anyone want to maintain a list of allowed clients ???
That’s the AI-assisted failure mode worth naming, and it isn’t “the AI wrote bad code.” The code was fine. The tests passed. The commit message was better than mine usually are. It was confidently, fluently wrong about something it could have checked in ten seconds, and confident fluent output is exactly what stops you asking.
What caught it was me, in an incognito window, doing the thing a user does : testing
Docs describe the protocol. Deployments enforce the policy. Only one of them rejects you.
Back to IndieAuth, but better
We reverted, which restored a working system that still had the §5.4 hole. So the rest of the day went on fixing that properly instead of delegating around it.
Profile URL verification. When the returned
mediffers from what was typed, re-discover it and require the same authorization endpoint. An endpoint claimingrmendes.netnow gets refused. Failure to re-discover fails closed. Verified against live discovery, not just stubs.Discovery via microformats instead of pattern matching. The old code matched
<link rel="x" href="y">with a regex. Measured against real markup, it handled one shape out of five:markup regex mf2 relative href="/auth"/auth— unresolvedresolved single quotes missed found rel="me authorization_endpoint"missed found <a rel=...>(spec-legal)missed found None of those failed loudly. A missed rel silently routes someone running their own authorization server to the third-party fallback instead — the opposite of what this plugin is for.
microformats-parserwas already in the dependency tree. It just wasn’t being used, so we started using it !Server metadata discovery. Servers publishing
rel="indieauth-metadata"now get that document preferred over the rels. It’s also the only place anissueris published, so theisson the authorization response can finally be checked. The spec mandates simple string comparison there, not URL normalisation — a trailing-slash difference is a mismatch, which is the opposite of what you’d assume. Worth checking before you ship it, as we’d just learned.Amusingly, this site served a metadata document all along and never advertised it. One
<link>in the theme fixed that.The plugin went from 3 tests to 32, and
npm testruns for the first time.What I’m taking from it
The failed migration was worth more than a clean one would have been. It forced an articulation of why delegating would have been safer, which turned out to be the exact argument for doing the verification properly in-house.
But the durable lesson is about how I work now. An AI can hold more of the IndieAuth spec in its head than I can, write better commit messages than I do, and produce a migration that is coherent, tested, well-documented and completely unshippable — because it never touched the thing it was integrating with.
If you have implemented IndieAuth for commenting on your blog, what was your approach ?
-
A great way to learn about what software is being developed for RSS is to follow AboutRSS on GitHub: https://github.com/AboutRSS Once you do that, subscribe to your own private Atom feed of the repositories you follow. It's a bit tricky to find yours, but if you visit https://github.com/ while logged in, view the HTML source, and search for 'priavte.atom'. You'll see activity for everybody you follow, including what they star (that's how I know what AboutRSS is interested in).
-
“When Jason Ganos was asked to help sell an old box full...
“When Jason Ganos was asked to help sell an old box full of NES cartridges…” How 97 Copies of an Unreleased Version of Super Mario Bros. Duck Hunt Were Discovered in a Wisconsin Warehouse.
-
CBP Officers And Contractors Abused Government Databases To Stalk Their Exes
This news will come as no surprise to anyone. Those who have been following police misconduct revelations for years have seen this happen time and time and time and time again. Those who are in the business of engaging in police misconduct have known for years that it’s easy to do and it seldom gets […] -
This is a good reminder to subscribe to your own RSS feeds. That way, you'll be among the first to know that something is wrong with them. https://daringfireball.net/2026/08/df\_posts\_drop\_in\_a\_forest
-
What a great idea for a book: Cookbooking: A Fan’s...
What a great idea for a book: Cookbooking: A Fan’s Guide. “An eclectic, visually stunning pop-history, Cookbooking explores the most influential and beloved cookbooks through photographs, listicles, graphics, and snappy writing.”
-
Behind the Blog: Early Birthday Reflections
This week, we discuss our party and panel coming up, and do some light reminiscing. -
La drogue
-
Claude is still learning that there's unprecedented depth to Frontier. A bunch of real developers worked full time for a decade or more creating new layers on the web, a foundation that became the social web of today. In doing that we invented a bunch of formats and protocols, but here's the thing Claude didn't get and probably still hasn't gotten -- there's code in there to support all that stuff. How else do you think it came about? People just did what we said to do? At Google? Apple? Microsoft? And on and on. They supported this stuff so they could interop with us and steal our users (which is a fine reason to interop, probably the only real reason). I was trying to think of a metaphor that expresses the difference between Frontier and languages like Python, JavaScript, etc. It's like a ski mountain. The languages are trails on the mountain. But there aren't any lifts, lodges, no ski patrol, lessons. And because it includes all of that, metaphorically, we can do integrations that can never be done with the other languages. Claude has absolutely no experience with this kind of product, and always snaps back when you let it, to the idea of Python, with different syntax. -
Trump FCC Weakens U.S. Broadband Speed Goals To The Benefit Of Elon Musk And Comcast
I’ve spent the better part of a lifetime studying and writing about the way corrupted lawmakers and U.S. telecom giants work hand in hand to erode U.S. broadband standards and mapping so they can obscure the way corruption and monopoly result in limited broadband competition — resulting in shitty, expensive, spotty, and slow U.S. internet […]