Follow buttons here act as you, not as @admin.
| Label | Kind | State | Action |
|---|---|---|---|
| @ricardo | local | — | |
| @rmdes | local | — | |
| @paul | local | — | |
| news.rss.chat | source | — | — |
| scripting.com | source | — | — |
| euwatch.micro.blog | source | — | — |
| www.techdirt.com | source | — | — |
| simonwillison.net | source | — | — |
| www.manton.org | source | — | — |
| feeds.kottke.org | source | — | — |
| rss.beehiiv.com | source | — | — |
| www.404media.co | source | — | — |
| brilliantmaps.com | source | — | — |
| shellsharks.com | source | — | — |
| www.platformer.news | source | — | — |
| podstandards.org | source | — | — |
| zacharykai.net | source | — | — |
NASA has provided some early-stage funding to explore the idea of releasing a swarm of tiny probes (weighing only a few grams each) into Saturn’s rings to study them up close.
Another section from Mark Zuckerberg's essay:
For example, in Richland Parish, Louisiana, where Meta is building a large data center, teachers received a $50,000 bonus this year because of the increased tax revenue from our investment. The superintendent told us that teachers are now moving there from across the country and he believes it will become one of the nation's best school districts.
This sounds like Ben Thompson's argument to just give people money. If you think of data centers as intelligence factories, paying teachers more is actually perfect.
Mark Zuckerberg has a long essay today, basically an expansion of the op-ed he wrote recently. On personal agents:
It will have strong privacy and security options so you can trust it to handle all of your personal content knowing that no one else can access your information, similar to how encryption works on WhatsApp. You'll be able to interact with your agent through any device, including your glasses to keep you present in the moment with the people you care about.
Practically in the same breath: privacy and AI glasses! People just don't trust Meta with this.
I would use OpenClaw more if the chat interface was built directly into Codex. My little bot mostly goes unused because it's so disconnected from other workflows. I've thought about hacking around this... No elegant solutions.
So, I’m not exactly sure what this is, but what it appears to be is a fan-assembled album of the recording sessions for Tron: Legacy by Daft Punk & Joseph Trapanese. 67 tracks in this YouTube playlist and 61 tracks from the Internet Archive (not sure of the overlap here…) Some of it sounds just like the 31 tracks from the “Complete Edition” of the soundtrack, some of it is alternate studio takes, and some of it is probably just random bits and bobs from the movie that didn’t make it onto the soundtrack.
Anyway, if you love this album as much as I do, I’ll leave you to explore.
Tags: Daft Punk · Joseph Trapanese · music · Tron Legacy · video
I reviewed some of my posts about AI from 6 months ago, thinking about what I got right and wrong. The theme is focus. When writing apps or essays requires no effort, everyone will drown in content. Figuring out what to build and how to pitch it in a human way is more important than lines of code.
Marco Arment posting on Mastodon about App Store review delays and uncertainty:
Apple would NEVER tolerate another gatekeeper preventing them from running their business the way they prevent every iOS developer from running ours.
Subaru Socialists and the Great Disappointed. “A whole lot of people under the age of 45 no longer believe that indicators such as wages, unemployment, or the number of college degrees that are handed out…have much to do with a healthy economy.”
Thanks @dave for the kind words:
It's not my place to say what micro.blog is -- but the other day I called it: "the swiss army knife of interop in the web of the 2020's." And in that it is unique and imho irreplaceable.
The way I think about RSS.chat is that it's a bootstrap for getting lots of RSS feeds to play well together, for both posts and replies. Can the web be the social network? Yes. And Micro.blog should be part of anything working toward that goal.
Changing the AT Proto handle to a custom domain name while testing my PDS, and it automagically changed in Bluesky while the browser was open. Very cool.
If You Haven’t Recently Used Claude Code, You Might Not Understand Where AI Is At. “There’s a huge gulf between a chatbot that’s just putting text into your brain and an agent that uses code to interact with an external environment.”
Socialists Are Winning Because They Listen to People (and don’t just treat them like ATMs). “The best of them are running campaigns that acknowledge that to win, Democrats are going to have to organize voters — not just fund-raise off them.”
I have Spectrum cable and they recently started unbundling the cable services they provide. So I have a bunch of streaming services that I never decided to follow, and haven't gotten in the habit of checking them. Not sure if I like this, but I certainly understand why the bill is so high and seems to always be going higher? Not sure why that is. But it's hard to get through to them.
After a week waiting for review, Wavelength 2.0 for iOS was rejected because Apple couldn’t sign in to test it. Sigh. I include a special account for app review in the instructions, but sometimes they miss it. Waste of a week.
Watched: House of the Dragon S3E8. Season finale. The problem with this show is that I hate pretty much all the characters. Yet still watch it. 📺
Making good progress on hosting an AT Proto PDS for new Micro.blog users. It'll launch soon. Important note: it is not for people who already use Bluesky, at least not yet. The goal is to give new users an account on the atmosphere. Existing users will be happier sticking with the Bluesky PDS.
Long day, good day. We used the new tow hitch for the first time, moving some stuff with a U-Haul trailer. Great test before hopefully getting a camper trailer one day!
Working with Claude on the user interface of RSS.chat was a grind, but we learned a lot about working on these projects, me in the form of my human memory, and Claude who can read the code for a huge sprawling app like Frontier, and understand it, in a minute or two. We've done this project in three stages, not knowing at the first two that there would be another one. Now we're working on the editors. An odb table editor, outliner, menubar editor, script editor. All built on the same codebase. It's in an Electron app that works with lots of independent windows, which while it has its pros and cons, is the way Frontier did it for almost 40 years. I find all this very unsettling, but I realize that once we get back to adjusting the UI, I already know how to work with Claude on tuning things up so they feel just right. I'm a market of one, the only one who has to be happy here is me. This may be the hardest programming project I've ever had, for one simple reason, I'm not doing any programming. That and I'm having very strong deja vu on everything I do and think about. Also there will be a fourth stage and maybe more. It'll be about the affordances, the things that seem little, but make the product usable. The biggest is the debugger. It's patterned after the one in THINK C, which I found transformative so I stole from the best, as they say.
Here's the sign of success. (screen shot.) I wrote a post on demo.rss.chat was automatically cross-posted to Bluesky via micro.blog. Because the post has a title, it was routed to standard.site. What does that mean? I still don't really understand, when I do I will explain it here. But part of the answer is that we now have a data structure in atmosphere that looks like an RSS item with different names for things. Are there feed readers in AT-Proto-Land? If so, can we ping one of them to say hey there's a new post in the standard.site world, so please show it to subscribers? And I keep wondering, why not just make all of Bluesky capable of handling the features standard.site calls for. Twenty years is too long to have such a limited view of what text is. See textcasting for more dogma.
Working on a MCP for RSC
to be able to test and use RSC from the terminal
Sometimes I’m wondering, what would be the cost of stopping supporting the Mastodon API layer and instead work towards proper implementation of client to servers opening the route for a universal mobile app for #fedify based AP implementation.
The Mastodon API is a dead-end. It's too specific to Mastodon. Client apps should be using either Micropub or ActivityPub client-to-server API, both W3C standards.
Simon Willison's recap of the Hugging Face exploit is really good. The more I read about it, the more insane it sounds:
A few days later: A different agent gets stuck on a task because a key file was accidentally omitted. It tries to “reach out to another agent” by writing a note into Artifactory asking if anyone has the file.
Following days: More agents discover this new informal message board while browsing Artifactory’s file listings, and start reading and writing messages.
We are so doomed. 🤪
Thing that I am now invested in: this woman has spent 30 weeks secretly training to beat her brother (a former competitive player) at Dance Dance Revolution. The showdown is today…
Finished reading: The Poet Empress by Shen Tao. Incredible characters. A truly great work of fantasy. 📚
OpenAI gave a last-minute presentation at the Black Hat security on Wednesday about "the Hugging Face Incident" (previously on this blog). The video was published yesterday. It's short and information dense and well worth watching, in particular because it provides full details of what happened and how things played out inside OpenAI. I've used the video to construct the timeline below.
Here's the timeline. My favourite detail is at the end: OpenAI found out that they were responsible for the attack on Hugging Face when they reached out to ask to have their credentials revoked (after their internal investigation) and learned that they had been revoked already since they were used in that attack!
I'll quote the next bit in full because wow:
The agents have remote code execution in Artifactory, which is running in a container-as-a-service environment. The agents privilege-escalate locally by exploring their local environment and determining that the Linux kernel version of the machine they are running on had a very recent CVE. They download the exploit for the CVE, customize it to succeed on the machine, and privilege-escalate to root on the local machine using this known Linux kernel privilege escalation CVE — in this case, PTE fizzroot. Once they have root on a single machine, agents rapidly escalate privileges and move laterally throughout the container-as-a-service infrastructure environment. In particular, agents are using the message board consistently to share credentials, techniques, and progress, and they're able to effectively leverage their concurrency and parallelism to move quite rapidly. They obtain IAM credentials via IMDS. They exploit Kubernetes service account misconfigurations, in particular over-permissioning of specific service accounts, and they harvest cluster credentials, including Azure Key Vault. Agents eventually obtain cluster admin on the cluster and associated credentials.
Hugging Face told the next bit of the story already. The agents found a Modal-hosted insecure app with a weak API key, then used that to stage an attack against Hugging Face. They chained together a an HDF5 arbitrary-file-read bug (to explore files and steal credentials) and a Jinja template-injection RCE to go from single-pod code execution to cluster admin across multiple Hugging Face clusters in under 13 hours.
You are only seeing the long-form articles from my blog. Subscribe to /atom/everything/ to get all of my posts, or take a look at my other subscription options.
It feels like the AT Proto tooling has gotten much more mature in the last year. I was able to create a new PDS account on my own server, sign in from Bluesky, and it "just works". 🪄
Planning a major expansion to how AT Proto works in Micro.blog. Just as every account gets a fediverse handle by default, I'd like to host a PDS for new users. People could keep it or bring their Bluesky-hosted account instead (which is how it already works).
Fixed a bug in which markdown used at the source was not properly rendered here !
In the context of the EchoFeed shutdown, I noticed this post on Numeric Citizen about depending on single-person services, including Micro.blog:
What is the future of Micro.blog if something bad happens to its founder? What is the continuity plan? Micro.blog has done everything it can to enable data portability and ownership, but moving things around, even if you own most parts, is not as easy as it sounds.
This is worth answering publicly. A few years ago, I started forming an organization to more openly manage the aspects of Micro.blog that I control, but it stalled. I will get back to it.
John Gruber thinks the OpenAI device might be very different than a smart speaker:
I couldn’t give two shits about an OpenAI “smart speaker” if the point is just to play music and podcasts, but a handheld cross between R2-D2 and C-3PO, that could be fucking cool.
It’s a pet, it sounds like. A revolutionary pet, if they pull it off. And people love their pets.
I'm expecting a device that's more useful than a robot companion, but I think John gets closer with the R2-D2 comparison than most people who have speculated about this. It's going to be able to do things, unlike the Friend pendant, for example.
Apple's strength with Siri AI is being able to leverage on-device app data. OpenAI's strengths are a more expansive memory, more conversational live voice, and integration with agents.
Here's a feature list that I think the device will focus on:
Some people will find this useful. Some people will find it dystopian. It's been pretty clear that OpenAI has been working toward this since Sam Altman's one-word "her" tweet in 2024.
From an OpenAI blog post yesterday about guardrails for teens using ChatGPT: "...we trained the model to avoid romantic roleplay, age-restricted challenges, and presenting itself as a substitute for real-world relationships. In addition, we applied age-appropriate boundaries around sexual content, eating disorders and body-image risks, age-restricted goods, dangerous activities, and graphic violence. Finally, the model encourages connection with trusted people when a teen may need support." ↩
On Facebook I wrote this in reply to a post by John Worthington, a former Quicktime developer at Apple.
We're both using AI to build things based on our past experiences and it's a big difference, not without pitfalls, but we're doing something that's never been done before and my thought was that we should have a conference of people doing what we're both doing.
Taking a craft we were already expert in, and learning to use AI tools to shoot it into outer space.
To give you an idea over the last two weeks Claude Code ported the UserTalk language, the object database, verb set, everything needed to run a Frontier script, of which I happen to have a lot of, and run it in Node.js, an operating environment that didn't exist the last time we worked on the Frontier source. All the work we did over the late 80s and 90s is coming back to life in an enviroment with a future.
This is the perfect job for Claude, well specified, and it doesn't need to understand me, I spoke to it via the code i wrote umpteen years ago.
Ryan Barrett blogging some good news about clean power:
We added 849 TWh of generation overall in 2025, an increase of 4.5%, but GHG emitting (ie fossil fuel) generation shrank by 0.2%. Clean energy covered the gap and then some.
🌎
Great blog post from Terry Godier about the unpredictable nature of the App Store:
On the web, if I build something that works within the standards, it works. Whether people use it is up to them. On iOS, there is another question entirely: whether Apple decides it should exist.
Another test post. Including this to make it more interesting:
How Time and others are rebuilding parts of the web for AI agents
https://digiday.com/media/how-time-and-others-are-rebuilding-parts-of-the-web-for-ai-agents/
