Nostr notes by David Chisnall (Now with 50% more sarcasm!)

My plan to redo how I manage a bunch of self-hosted things as a ...

2026-10-27T16:49:16Z

My plan to redo how I manage a bunch of self-hosted things as a set of containers on the new machine was foiled by the fact that it turns out I can just export the disk from Azure and import it into bhyve and it all just works (once I change the interface names and IP addresses).

#FreeBSD #bhyve

Any #FreeBSD folks working on OCI things: Are there any plans for ...

2026-10-27T13:50:28Z

Any #FreeBSD folks working on OCI things:

Are there any plans for a bhyve-based runtime with a model similar to Apple's container tool or Kata Containers? I think the virtfs support is now in FreeBSD (sadly, not yet virtio-fs, but hopefully soon?). I'd love to have bhyve as an alternative to jails for container isolation.

Wonderful homage. Chekov was a shallow rôle that didn’t give ...

2026-10-27T08:30:11Z

Wonderful homage. Chekov was a shallow rôle that didn’t give Koenig much scope to demonstrate talent and he squeezed far more out of it than anyone would reasonably expect. But he really shined as Bester. I’ve seen all of Babylon 5 at least four times and I’m still shocked reading how few episodes he was in: he felt like a main character in spite of appearing in only around 10% of the total episodes. I had no idea his first appearance as Bester was four weeks after a quadruple heart bypass operation.

BREAKING NEWS: A new vulnerability has been discovered in all ...

2026-10-26T21:41:58Z

BREAKING NEWS: A new vulnerability has been discovered in all versions of PHP. Details will be forthcoming, but I’m told that, under certain unusual conditions, it will execute PHP code. This has numerous exploitable consequences, not least of which is that it leads to more PHP code in the world. The details are currently embargoed but the team responsible for discovering the vulnerability report that a similar class of problem exists in GCC and Clang as well.

If I read the Apollo analysis (the one that claimed that the ...

2026-10-26T10:30:39Z

If I read the Apollo analysis (the one that claimed that the Fortune 500 minus the Magnificent Seven are not seeing productivity gains from AI) it's actually slightly misleading. It's looking at per-employee productivity. For the Fortune 493, that's been flat, for the Magnificent 7 it's been increasing.

The first missing thing is that most of the M7's revenue comes from things with high switching costs. It's a very long trailing indicator of their actual output. They can fail to improve their products for a relatively long time and not see a decline in revenue, but for all of this time they become increasingly vulnerable to market disruption and someone suddenly taking a big chunk of their market share.

The second missing thing is that these companies, whose revenue is more-or --less guaranteed over the short term, have all done significant headcount reduction over the periods that they looked at, partly trimming ZIRP and COVID over-exuberant hiring, partly to free up cashflow for investing in datacentres and GPUs. Reducing the number of employees while keeping the output roughly constant will eventually cause a decline in revenue but, in the short term, will show more revenue per head: their metric.

Finally, those revenue numbers are propped up by setting cash on fire. A company that spends $100B on capex for things that fail after 3-5 years, and uses it to drive a $10B revenue increase will see a revenue-per-capita increase, but is not in any way a sustainable business model.

All of these mean that their metrics look much better for the M7 than their fundamentals would reflect. And those are the companies that they're saying are the only winners.

Given the EU’s push to simplify the GDPR to make compliance ...

2026-10-26T08:39:37Z

Given the EU’s push to simplify the GDPR to make compliance easier, I propose the following replacement text:

Nope.

With the following additional non-normative additional guidance:

No. Seriously, what’s wrong with you people? Why would you ever think anyone would consent to that. No. Just no.

I haven’t been following the details of the election in Brazil, ...

2026-10-26T08:35:16Z

I haven’t been following the details of the election in Brazil, but am I right in understanding that Meta has just made a massive enemy of the government of a country of over 200 M people that is influential in setting policy for a large number of other smaller countries?

Yay, finally moved everything off Azure! (My free subscriptions ...

2026-10-25T15:05:00Z

Yay, finally moved everything off Azure!

(My free subscriptions actually ended, so I was properly incentivised. One of my small VMs on Azure cost more per month if I'm actually paying for it than the dedicated server that's now running the same VM and other things)

For a discussion elsewhere, I did some back-of-the-envelope ...

2026-10-25T12:30:35Z

For a discussion elsewhere, I did some back-of-the-envelope calculations about the relative performance of disks and CPUs since the early 2000s. The number of retired instructions per byte of random disk reads between an early 2000s machine and today has changed by at least four orders of magnitude (possibly six, depending on exactly what you're measuring).

I knew disks had become faster, but that's an enormous change. If you wrote something 25 years ago that was entirely disk-I/O-bound and used 5% of the CPU, running today it wouldn't even be close to 1% of disk bandwidth usage but would be pegging the core at 100%. Even making it multithreaded and getting a perfect linear speedup wouldn't have come close to 1% disk-bandwidth usage.

The delta is less pronounced for large sequential reads.

PSA: If you haven't been following @nprofile…0733 during ...

2026-10-25T12:22:03Z

PSA: If you haven't been following nprofile1qy2hwumn8ghj7un9d3shjtnyd968gmewwp6kyqpqmzscmfjq8ykfa8wg4nc7cs0rhnw6vpg98a8662kdc3rw3ledhqaq0u0733 (nprofile…0733) during Owltober, you have been missing out even more than at other times.

Is there a good solution for TLS certs for consumer LAN devices? ...

2026-10-25T09:43:08Z

Is there a good solution for TLS certs for consumer LAN devices? My ISP’s router recently moved to requiring TLS, but I access it via it’s IP address and it doesn’t have a TLS cert for an IP address (is it even possible to get a TLS cert for a private IP address?) and so the main change is that my browser no longer autocompletes the admin password (for good reasons: don’t autocomplete passwords in TOS sessions with invalid certs!).

Reminder to people who have international meetings: the next week ...

2026-10-25T07:57:07Z

Reminder to people who have international meetings: the next week is George W Bush Golfing Time. The USA and Europe had an agreement to move clocks at the same time, so the time difference remained constant. George W Bush decided he wanted a few weeks more golfing time, so unilaterally moved the USA’s Daylight Saving Time. This move remains in effect so there are a few weeks of annoying disruption each year.

I made the mistake of flying the first time this happened, which is how I knew about it: the airlines were unprepared and sold me tickets on two flights where the time change meant that my slightly tight 45-minute change turned into a -15 minute connection time (fortunately the second flight was on a route they flew every two hours so I was only an hour late)l

The ISO meeting portal has a nice visualisation of where the ...

2026-10-22T16:26:03Z

The ISO meeting portal has a nice visualisation of where the meeting's time zone is. Unfortunately, it's based solely on the displacement from the meridian and not on political decisions about what time zones apply.

There is a reasonable chance Vidarr is the prettiest cat in the ...

2026-10-22T15:28:25Z

There is a reasonable chance Vidarr is the prettiest cat in the Fediverse. Such a pretty little face and long floofy fur.

I might be wrong though, so please feel free to post counterexamples.

I have had a lot of discussions over the last decade on correct ...

2026-10-22T10:36:26Z

I have had a lot of discussions over the last decade on correct handling for out-of-memory conditions. There are two very distinct philosophical camps.

The Windows kernel has a policy of 'don't make promises you can't keep'. This means that a call to malloc will either return memory that is already available or the result of a new call to VirtualAlloc2, with committed memory. When the NT kernel says it has 'committed' memory, it means it promises that memory will be available when you try to access it. There is space reserved either in RAM or in swap to permit something else to be moved from RAM to make space for the thing that you need.

The other extreme says that you should assume that sometimes components fail. Erlang embodies this as the 'let it crash' philosophy. Google discovered fairly early on that, when you're looking at jobs distributed across large fleets of machines, a single node experiencing hardware failure is basically unavoidable. Mainframes deal with this by duplicating all of the hardware (often multiple times) so a hardware failure can be transparently worked around. But clouds built from consumer hardware don't do that: sometimes VMs die and you deal with it.

In the 'let it crash' model, you already need to build resilience at a higher level. Your individual jobs may fail because the hardware that runs on them fails. You need to be able to roll back any partially committed transactions that they started and restart them from the beginning. For things like web servers, that's usually easy: This HTTP request failed? The client can retry.

Once you have that mechanism, you rapidly realise that you can use it for other infrequent operations. Memory allocation almost never fails. If it does, let the program crash. Systems like iOS and macOS encourage programs to persist any user-visible state frequently, so a program crashing is fine - you may lose a couple of seconds work. In exchange for this, you get much simpler code. Rather than every allocation having to come with error handling (and there are tens of thousands of individual allocation points in a typical non-trivial program), you just assume it works and crash if it failed.

Some kernels, such as Linux and FreeBSD, lean into this even further. If the kernel claims it's given you memory, that isn't a promise, it's a best-effort guarantee. When you actually use it, they'll either ensure it's there or deliver a signal. It turns out most programs ask for memory that they'll need in their worst case, but this mechanism gives them the memory that they actually need. And this means that fewer allocations fail. You can't easily handle the allocation failure locally, but you're now less likely to hit allocation failure.

And this is a big win for overall reliability and performance. Because it turns out that gracefully handling out-of-memory conditions is really hard. Often, good error recovery requires allocating memory, but you can't do that if you've hit an out-of-memory condition. And these errors propagate outwards. Every function that allocates memory not may fail due to memory exhaustion. So it's not just routines that allocate memory that need to handle out-of-memory errors, it's everything that calls them. And you have to get it right at every place that needs to do any kind of cleanup if memory is exhausted.

This is one of the biggest reasons that embedded development is harder than application development: you can't assume memory exhaustion is rare and you don't always have an outer layer that can handle component-level failures. But in every other situation, the correct approach is to assume that memory is infinite and allocations never fail, and to assume that the component making that assumption will crash periodically.

This is a post about PHP.

I laughed when I discovered (via an improperly handled error ...

2026-10-22T08:00:48Z

I laughed when I discovered (via an improperly handled error condition in their API leaking far more than it was supposed to) that one of our SaaS providers used Perl. They seem like the smart ones this week.

I’ve been following some investment advice from a friend for a ...

2026-10-22T07:53:54Z

I’ve been following some investment advice from a friend for a while that the market has about a three-month memory for security disasters. When a company has a big incident, there’s normally a 20-30% dip in the stock price. I buy, and set up a sell order for their pre-incident crash. So far, in every case, I’ve made a 30% return in about three months (and, in all cases, would have made more if I’d held for longer).

But the last time a CA screwed up this badly, browsers just stopped bundling their root certs entirely, so this one seems like a higher risk.

Wasn’t the last OpenSSH vulnerability as a result of running ...

2026-10-21T20:10:45Z

Wasn’t the last OpenSSH vulnerability as a result of running code in an atexit handler, when the program was in an undefined state? And wasn’t this the motivation for C11 adding at_quick_exit?

And didn’t we all learn the lesson that, in a C codebase, the correct thing to do when you are in an undefined state, for example as a result of an allocation failing with no local error handling, to exit the process as quickly as possible and handle resilience at the orchestration layer?

Well, almost all of us, apparently.

The thing I'd really like to see is the time between the PHP ...

2026-10-21T12:40:20Z

The thing I'd really like to see is the time between the PHP fix being released and the binary packages being available to install across different operating systems and distributions.

#Linux #BSD

Bug report from someone trying to formally specify our security ...

2026-10-21T09:36:22Z

Bug report from someone trying to formally specify our security properties showed that one of our comments is misleading in a specific corner case (and a PoC demonstrating that corner case!). I absolutely love getting this kind of thing, it shows someone has read the code and comments carefully to understand exactly what can happen in all cases.

The code wasn't wrong (if you attack it in a specific way, it triggers the defence I expect it to trigger), but the explanation was and the defence is triggered three instructions later than the comment says (but still in the code that is untrusted).

Any #FreeBSD folks using vm-bhyve with NAT? It appears that the ...

2026-10-20T09:18:08Z

Any #FreeBSD folks using vm-bhyve with NAT? It appears that the built-in support was removed in 2016 and never reintroduced. It's not clear to me how to set up the NAT between the bridged interface that vm-bhyve creates and the host network interface. I've found a bunch of articles that claim to cover this and either use the command that hasn't existed for 10 years or skip over network configuration.

#ZFS folks: I have a dataset. When I do zfs list -t snapshot -o ...

2026-10-19T16:31:59Z

#ZFS folks:

I have a dataset.

When I do zfs list -t snapshot -o space {dataset}, I get a list of a small number of snapshots that add up to about 50G in their USED column.

When I do zfs list -o space {dataset}, it says 1.45T in the USEDSNAP column.

How do I find out which snapshots are actually using this space?

Nish Kumar needs to come with a health warning. Last night was ...

2026-10-18T09:22:50Z

Nish Kumar needs to come with a health warning.

Last night was the second time I’d seen him do a full show of new material. Both times, my throat hurt at the end from laughing so hard.

I’ve been trying something recently on platforms that support ...

2026-10-18T09:06:26Z

I’ve been trying something recently on platforms that support emoji reactions for countering trolls: using Poe’s Law against them.

Poe’s Law says that, without clear expression of intent, extreme views and satire of those views are indistinguishable. But reaction emoji let other people provide a hint about that intent.

When someone writes a rage-bait troll, they want engagement. If you reply, they’re happy. If you put a thumb-down or angry-face reaction, they’re less happy but they know they’ve got to you.

But what happens if you do a laughing-face emoji? Minimal engagement (one or two clicks) and they haven’t upset you.

And then the next person seeing the post sees it framed by the laughing reaction. So their reaction is likely to be ‘oh, I guess this is meant as satire’ and they either add a laughing reaction or they just decide it’s satire in poor taste and ignore it. And no one engages in the comments because they’ve seen the laugh reactions and don’t take the post seriously.

And, after a while, the trolls get bored and go somewhere else.

I’m quite surprised at how well this works.

One of the patterns I’ve seen with people using Claude for ...

2026-10-18T08:51:38Z

One of the patterns I’ve seen with people using Claude for programming is:

A programmer in the past looked at a tradeoff space and decided to make a common operation fast and an uncommon operation slow.

Claude lacks proper context of the use of the software but spots a pattern that looks like things it’s training set has flagged as slow and so points to the slow path as a bottleneck.

The user asks for a test case and Claude provides a simple microbenchmark that triggers the slow path.

Now that it’s confirmed as slow, the user asks a ‘agentic’ harness to explore the design space and optimise for the benchmark. The swarm of Claude instances makes plausible changes to the code and reports back with a modified version that passes the test suite and improves the microbenchmark.

The test suite doesn’t exhaustively cover all possible race conditions and so the new version may include subtle concurrency bugs. It also probably makes the common case slower and so is a regression overall.

I don’t know if other LLMs encourage this flow, but I’ve seen it several times from people using Claude.

I suspect Linus’ recent embarrassing interaction with his kernel’s virtual memory code may have been an example of this pattern. It’s very easy to do with an LLM because each step appears to be a demonstrable improvement. It comes with an objective benchmark, it passes all of the tests. Unfortunately, software often depends on a load of extrinsic knowledge that the LLM is trying to infer from a load of likely misleading data points.

It looks like Anthropic is learning that, when you spend years ...

2026-10-17T09:45:46Z

It looks like Anthropic is learning that, when you spend years publishing nonsense ‘annualised’ revenue figures[1], showing growth becomes increasing hard. And it’s unfortunate when this happens just before IPO.

[1] Pick some day/week/month when you had a lot of revenue, scale it up as if you got that revenue for each time period in a year.

Wow, SwiftUI and all of the competent designers retiring has made ...

2026-10-17T08:27:32Z

Wow, SwiftUI and all of the competent designers retiring has made #Apple so bad at UIs. I helped my mother set up a MacBook Air yesterday. We set the UI size to the maximum so she could see it easily. Around half of the setup boxes then had buttons that were either off the bottom of the screen or obscured by the dock (and therefore not clickable).

Almost all of them had huge amounts of empty space in the middle and so could easily have fitted if some idiots private aesthetic had been considered less important than accessibility at Apple.

All of them were either modal or app-modal (hey, Apple folks: you might like to read your own Human Interface Guidelines, they explain in detail why this is stupid). You couldn’t progress or go back until you’d hit the button that was off the screen and, because some were system-wide global, you couldn’t go to settings and change UI size without killing the thing that produced the box.

All completely preventable if anyone in QA had bothered to try the first-time setup flow on an Apple device using each of the five UI-size options.

Oh, honourable mention for #Microsoft if you install Word or Excel, the first launch window is a massive thing (which, at least, can be scrolled, unlike the Apple ones) giving you a bunch of options to buy an M356 subscription. There is no option anywhere in that window for logging in with your existing subscription. There is an option in the app menu, but it’s greyed out. If you close this window, the app exits. In your next release testing, try asking someone on your team to figure out how to log in from a fresh install. I eventually figured out the flow, but I was very close to the point of saying ‘let’s just put LibreOffice, Pages, and Numbers on this and not bother with the M365 stuff’. And I have a PhD in computer science and worked at Microsoft for five years: how do you think a vaguely normal human will do?

I am glad that leap seconds are gone, but also annoyed that they ...

2026-10-16T14:47:40Z

I am glad that leap seconds are gone, but also annoyed that they ever existed. Time zones are typically an hour wide, some places use the same time zone for geographic regions that span 2-3 1/24s of the Earth's rotation.

This means, simply as an artefact of not living exactly at the centre of a time zone region, the offset between high noon and clock noon is likely to be at least half an hour, possibly over an hour.

Leap seconds correct for the fact that this may have drifted an additional 1-2 seconds in a year. It's second level precision in a thing where the accuracy is measured in tens of minutes.

And that extra precision came with a huge amount of complexity that everyone had to deal with.

Yay, freebsd-update creates boot environments during updates! ...

2026-10-16T14:43:10Z

Yay, freebsd-update creates boot environments during updates!

Boo, freebsd-update doesn't clean them up, so an update failed because 90% of this VM's disk was filled with old boot environments and stale freebsd-update files.

#FreeBSD

I can’t help wondering if this is a deliberate attempt by ...

2026-10-14T09:26:42Z

I can’t help wondering if this is a deliberate attempt by someone in the FAA to get ‘AI’ banned for federal procurement. One plane full of legislators having a serious incident that can be directly blamed on ‘AI’ would do more to force a hard stop in ‘AI’ rollout in government than anything else I can think of.

Sikarugir Creator really brings the authentic Windows experience ...

2026-10-13T11:32:43Z

Sikarugir Creator really brings the authentic Windows experience to macOS: every dialog box has 'Yes' and 'No' as the options, the order is completely random, and one of them is a destructive operation.

I just fixed a bug where someone had sent an LLM-generated fix. ...

2026-10-13T10:49:32Z

I just fixed a bug where someone had sent an LLM-generated fix. At first glance, the LLM fix was mostly right, except for a redundant atomic fence (LLMs seem to love __atomic_thread_fence in this codebase, no idea why).

But then I went to fix the bug. The problem was that a lock was initialised too late and so could end up being initialised twice. Ooops, locks are not meant to introduce concurrency problems!

And the LLM fix moved it earlier, so that's fine.

Except... there's another way that the object containing the lock might be reached via a global pointer and that didn't have any guards. I don't think it's possible to trigger the bug that way, but some of the future changes that I'd considered might introduce that as a path.

And there's no real reason for anyone to want the object without the initialised lock, so moving the initialisation to just before the point where any other thread might reach the object is a simple fix.

But that isn't what the LLM proposed. Instead, it fixed the immediate issue without any reference to the long-term impact and maintainability of the codebase.

My fix was a fairly simple change: one new line of code, four new lines of comment, and six deleted lines of code (so worth doing for code readability even if the bug hadn't been real). And even a change that small, if you accepted the LLM recommendation (three new lines of code, no new comments, and six deleted lines), would have made the code less maintainable and more subtly broken.

And that's why I refer to these things as Technical Debt as a Service.

If the only tool you have is a palm, every problem looks like a ...

2026-10-13T09:28:07Z

If the only tool you have is a palm, every problem looks like a facepalm.

In other news that I missed: Last year there was an #LLVM GSoC to ...

2026-10-13T08:25:28Z

In other news that I missed:

Last year there was an #LLVM GSoC to add an ABI library! And it looks like pretty much the design that several of us proposed in a Cambridge LLVM social around 12 years ago but none of us had time to work on! Yay!

Wow, the bugginess of Dune Awakening is amazing. Finished the ...

2026-10-12T11:24:12Z

Wow, the bugginess of Dune Awakening is amazing. Finished the last (maybe? The story doesn’t conclude but the Internet suggests it’s the last?) story mission and I’m teleported back from Arrakeen to the main game map. Only the Ornithopter I used to fly to Arrakeen is gone. The one I had just collected everything I needed to build and had flown for the first time to start this quest.

When I search for this bug, I find a Steam thread reporting it from June. 2025. So it’s been a known bug for over a year and the developers still can’t be bothered to fix it.

Oh, and the most recent autosave was an hour ago, back before I started the long story mission. Apparently the work around is to hire someone else to fly you to the final bit of the mission. Ugh.

The game is full of things like this. Sometimes when you arrive at Arrakeen, you spawn below the floor and fall forever. There are a bunch of places you can fall through the map, including one that you will encounter every time that you try to go around the back of the cultist’s area.

If this were a game that had just been released, I might cut it some slack, but though the console port is new, all of these bugs appear to have been there since the start. They’ve had a year to fix them and just haven’t bothered.

Oh, and there’s no pause button, which is just rude. I guess it’s aimed mostly at multiplayer, but there’s just no attention to detail.

They also made a weird choice to base a load of plot elements on the awful prequel books. Casual Dune fans will know about Dune mostly from the films and so won’t know any of this nonsense. Almost everyone who read the books loathes the prequels. So the only people who will understand the context will hate it.

#DuneAwakening

Hmm, MSFT is a bit over the price at which I sold half of my ...

2026-10-11T10:08:40Z

Hmm, MSFT is a bit over the price at which I sold half of my shares a year ago. I had been holding on because I thought there was a reasonable chance that Satya ‘pump and dump’ Nadella would get to 600 before the bubble burst but now I’m wondering if I should just sell now.

I don’t like to guess what will happen after the crash. In the .com burst, MSFT lost half of its share value quite rapidly and didn’t recover for a decade. Microsoft was not one of the tech companies least exposed during the .com bubble, whereas they’re one of the most exposed in the AI bubble. If the market were rational, they’d lose over 70% of their value in the crash. But if the market were rational, the bubble wouldn’t be a problem in the first place.

Hey #FreeBSD folks, NetBSD hit more than double their funding ...

2026-10-11T09:56:34Z

Hey #FreeBSD folks, NetBSD hit more than double their funding target after adopting a strong no-LLMs policy. Something to think about while you draft yours, perhaps?

I really hate the access control on Fediverse quote posts. If you ...

2026-10-11T09:25:36Z

I really hate the access control on Fediverse quote posts. If you have a public post and you opt out of quotes, the following are possible:

Posting it on a web site and inviting abuse.
Posting it on Xitter / ColourSky / Instathingy / ClokNoise and inviting abuse.
Posting it on Mastodon but as a link (which shows up with almost an identical UI) rather than the quote post and inviting abuse.

The following are not possible:

Automatically notifying the original poster when you have quoted it.

For private and follower-only posts, controls over quoting should be limited to options that extend the permitted access (for example: my followers can post this follower-only post as a follower-only quote post and then the transitive closure of my followers will be granted access). The current model added a load of code churn to ActivityPub implementations with zero benefit.

Yesterday I filled up the 2 TB disk on my laptop. While looking ...

2026-10-10T09:11:02Z

Yesterday I filled up the 2 TB disk on my laptop. While looking for things to delete, I discovered that, last year, when I’d been debugging mail server issues, Mail.app had created a log file that was over 100 GiB. And then just left it there. Nothing in the UI to tell me it was enormous. Nothing to say ‘you created this a few months ago, do you still need it?’ And this was deep inside a directory structure that users aren’t supposed to look at.

Nostr event nevent1qqsv24dalq27az7r60nhzffzt2uyrzkth8v3a8fgehv2hy22vnhdzuqzyrke3hgh9j87eq0xttzd9vrg0l36ep26zt5nnspgsgxlxgqzeztww09j509

2026-10-09T14:05:08Z

How did I not know about sort -h until today?

Even the LinkedIn crowd may be turning. I posted there about my ...

2026-10-09T12:13:14Z

Even the LinkedIn crowd may be turning.

I posted there about my latest experience trying to use an LLM to help with a programming problem (TL;DR: it spent ages trying things that didn't work, then eventually found a thing that was probably correct but was so overly complex that I ended up doing it myself and found that my final version was a small fraction of the code and complexity the LLM).

Currently sitting at around 22,000 impressions (more than any other thing I've posted there) and very few of the comments are telling me I was using it wrong. The most pro-LLM comments are all from people whose bio summary is some variation of 'I make money selling LLMs to people' and even some of those are fairly measured.

When the kittens were small, I thought my fist was roughly ...

2026-10-09T07:00:48Z

When the kittens were small, I thought my fist was roughly cat-head sized and shaped and so might be easier for them to relate to than an entire human, so I’d hold out my fist for them to investigate and get comfortable with. And it worked. Except friendlykitten has developed a habit of not just sniffing it but full-on headbutting my finger with his nose. Walks up, sniffs fist, hits closest finger as hard as he can with his nose, then consents to scritches. This cannot be good for his nose.

He’s also basically full cat sized now. I might have to stop calling him a kitten.

I haven't seen the kittens much since one ran away (he's ...

2026-10-08T15:05:03Z

I haven't seen the kittens much since one ran away (he's back, everything's fine) but just now friendlykitten jumped down onto the fence where he can state into my office. I went outside and he came over to say hello.

I also looked up at the little window that he comes out of had the big cat that lives in the same house staring down at me. A tiny little judging cat face!

Sadly, I didn't take a camera when I went outside.

Okay, who came up with a calling convention that made registers ...

2026-10-08T10:43:46Z

Okay, who came up with a calling convention that made registers a, c, and d caller-save, but register b callee-save?

Then I was at the University of Cambridge, I did their harassment ...

2026-10-08T08:28:32Z

Then I was at the University of Cambridge, I did their harassment training. It was excellent though, sadly, not mandatory for anyone except as a result of disciplinary actions. I was one of only two men who had chosen to be there.

One of the most important things it covered (and the reason it absolutely needed to be mandatory) was the legal aspect. If you are informed of a crime and discourage the victim from talking to the police then you are part of a cover up and can be charged as an ‘accessory after the fact’. In particular, being an accessory after the fact does not require that the original crime is successfully prosecuted, you having sufficient evidence to reasonably be assumed that it happened is enough. If someone tells you that they murdered someone and you offer to provide an alibi, it doesn’t matter if the body is ever found, if the alibi is shown to be false then you can be charged. The same principle applies. If you direct people to an internal process without making it clear that they have the option of going to the police, you are an accessory. If you even imply that going to the police may result in retaliation from the organisation or that the organisation will not protect you from retaliation by individuals, you are an accessory.

When I went to Microsoft, we were given the same harassment training as the US org. If followed, the advice in it would have landed managers in legal trouble. I flagged this with HR and I believe it was subsequently fixed.

But this appears to be a key difference between US and UK law in this regard: if someone in an organisation reports a crime to someone in authority in that organisation, UK law requires that the alleged victim must be informed of their legal rights and supported if they choose to prosecute the perpetrator. The US appears to have zero consequences for institutional cover ups. That really seems like something the USA should fix.

This is a post about Cornell.

One of our SaaS providers sent out a marketing email to all of ...

2026-10-08T07:50:34Z

One of our SaaS providers sent out a marketing email to all of their customers about new AI features. I replied saying that we used them as a secure solution and integrating things that add no value for our use case but add significant attack surface undermines our trust in their product and will cause us to consider alternatives.

It turns out that the reply-to header was the CEO’s email address and I initially got an out-of-office auto responder then a worried reply saying that of course the AI nonsense that they’d been talking about would be opt in and would not be given access to anything without explicit consent.

But now their CEO has one data point that jumping on the bandwagon will lose sales.

I’d recommend doing the same for any such marketing emails you get. The replies may go to /dev/null, but normally they have a ‘contact sales’ link. The more replies they get saying that incorporating ‘AI’ features undermines your trust in their product and makes you less likely to buy even the non-‘AI’ versions, the more they’ll consider these things high risk to ship.

I'm in an ETSI meeting for the first time and... I think ...

2026-10-06T12:40:34Z

I'm in an ETSI meeting for the first time and... I think I've finally found a standards process that seems to work well? I'm not sure what to make of this.

Ah, apparently it is the time of the year when we identify and ...

2026-10-06T08:23:51Z

Ah, apparently it is the time of the year when we identify and honour the best self publicists among hundreds of people who contributed to scientific discoveries.

It's so weird listening to humans speak a language I ...

2026-10-05T12:51:06Z

It's so weird listening to humans speak a language I don't understand because my brain keeps trying to pattern match on languages I do (at least partially) understand. And occasionally goes something like 'aha, these syllables form words in German', only they're words that make no sense together and so then I get parse errors in the sentence. Or just one word, which is definitely not a word that they said.

Written Dutch is the same. Sentences that start out getting past the error-correction part of my brain as English or German with a few typos suddenly become total gibberish a half a dozen words in.

And I think Mastodon is messing with me, because I periodically see a post and think 'I understand most of the words in this, but what is this one in the middle that gives me the context?' and then hit translate and it translates every word except that one (charitably, it might be a proper noun, but I suspect it's the French being nefarious again with their sneaky words).

@nprofile…fu0r The Digital Markets Act is a nice idea but ...

2026-10-05T12:09:56Z

nprofile1qy2hwumn8ghj7un9d3shjtnyd968gmewwp6kyqpq9ly5nycz3gdcehlrtkhp6g75vlg65209ytzzansyhsqdpnzmcpyqq3fu0r (nprofile…fu0r)

The Digital Markets Act is a nice idea but it's ignoring how these platforms became so powerful. The problem is that other big entities use them as their sole (or primary) means of communication.

How about defining a set of rules that apply to:

All governments
All companies over a certain EU turnover.
All companies providing essential services (e.g. banking, utilities).

Where the rules are, by the end of 2027:

They may not require customers to create an account or share data with a third party to communicate with them.
If they distribute an application for any platform, they must do so via two independent channels.
Applications must not depend on anything other than the core platform.

Where 'independent' means: does not depend on any approvals from the same vendor.

This would mean that no big organisation in these places would be able to ship apps via the Apple App Store. None of them would be able to ship Android apps that depended on Google Play Services and none of them would be able to ship Android apps at all with Google's proposed lock down mechanism.

And then, suddenly, you have compliance departments in a bunch of companies with deep pockets lobbying Google and Apple to provide an alternative mechanism for distribution.

Note: These are exactly the same as the rules I proposed 20 years ago. If they had been enacted back then, I suspect the DMA would not have been necessary.

Failing to sleep in the middle of the night, I was wondering: ...

2026-10-05T08:51:05Z

Failing to sleep in the middle of the night, I was wondering:

What happens if you hit a Holtzman shield with a lightsaber? Do you get the same nuclear-like explosion as a lasgun, or does the containment for the lightsaber repel the shield in the same way that another shield would? Either way, it probably means that a slow lightsaber can’t penetrate the shield, which means you’re safe from Jedi (and probably Sith, who wouldn’t care about collateral damage but would not want to be caught in the blast). Unless they could just use the Force to flip the shield’s power switch.

This is basically me. Fortunately, I married someone who will ...

2026-10-05T08:27:36Z

This is basically me. Fortunately, I married someone who will distract the human while I talk to their dog.

Periodically I try LLMs to see if they actually are useful for ...

2026-10-03T09:56:30Z

Periodically I try LLMs to see if they actually are useful for programming. This week I was writing an AsciiDoctor plugin. I’m not particularly familiar with Ruby (I struggle to imagine the mindset that believes Smalltalk, or, indeed, any language, can be improved by adding Perl syntax) and I find the internals of AsciiDoctor to be very poorly documented and hard to follow. So this seemed like a great task for LLM assistance: I know the problem domain very well (I’ve written other document processing tools) but not the details of the codebase I’m working on.

GPT-5.6 repeatedly sent me down misleading paths and wasted time, and gave suggestions that looked right but were completely wrong. It kept going back to the same thing that would cause a later phase to infinite loop. It eventually gave me a solution that was so convoluted that I couldn’t believe AsciiDoctor wouldn’t have a better way of doing it (I didn’t try it: if that was the only way of making it work I’d rather ditch AsciiDoctor than apply it, so I have no idea if it actually worked).

I actually solved the problem by finding a bug report from someone trying to solve a similar problem, which linked to their eventual solution. Reading that, I was able to find the missing conceptual bit in my understanding of how AsciiDoctor worked. And I finished the thing.

In total, the time spent with an LLM did not advance me towards the solution at all. None of the code that it suggested that I write ended up in the final plugin.

If I had used an ‘agentic’ setup, where I had given it my document, the desired output, and told it to keep trying until it did it, it would probably have got something that worked. The last throw looked like it would have ended up working, but it would have been an order of magnitude more complexity than I actually needed. And would have been completely unmaintainable: if all of the surrounding justification text had been comments, it would have looked like entirely plausible code, but with deeply fragile connections between the different phases.

Importantly, if I hadn’t solved it myself, I would not have really understood the gap between the complexity of a good solution and the LLM-generated one. I might have accepted it was the best available option, in spite of it being terrible. And this was fairly low-stakes code (processing a document for internal consumption), so that might have been fine. But doing that for anything used in production would be an absolute long-term disaster: you’d acquire all of that technical debt without knowing that it is technical debt, you’d just think the feature was done.

At this rate, I’m expecting Pope Leo to be one of the lead ...

2026-10-03T09:12:29Z

At this rate, I’m expecting Pope Leo to be one of the lead authors of the Orange Catholic Bible.

I’ve been quite enjoying Dune Awakening, but dear $DEITY it’s ...

2026-10-03T09:05:51Z

I’ve been quite enjoying Dune Awakening, but dear $DEITY it’s buggy. I have fallen through solid objects twice. Most recently near the cultists I fell through the floor on the big building behind their altar and then couldn’t get out. I eventually had to die by falling off the bottom of the map. And now my corpse is underneath the map and inaccessible so I can’t reclaim the stuff it was carrying.

#DuneAwakening

Scaredykitten made it home! Apparently looking heathy and very ...

2026-10-03T08:38:23Z

Scaredykitten made it home! Apparently looking heathy and very well fed, so my guess that it found a new friend seems accurate.

I suspect I heard him coming back (he climbs on on the neighbour’s porch to get into their house and their porch roof is close to my bedroom window) because I woke up from a dream about both kittens being home this morning.

To add a bit more about my design choice in igk: One of the ...

2026-10-02T16:20:32Z

To add a bit more about my design choice in igk:

One of the things that makes LaTeX hard to deal with is that, although it looks like a semantic markup language, it's actually a pile of macros on top of TeX, which is an imperative language for driving a typesetter. This means that a LaTeX line like \chapter{This is a section} is not actually semantic markup like an HTML <h2>, it's a command that executes and ships a new page, renders the title, and writes a line to another file that will allow the next run of [pdf]latex to fill in the ToC entry.

This is fine if you just want to use the commands that LaTeX defines but it's awkward if you want to define your own ones because you're not just defining new node types in something like an XML / HTML DOM, you're defining small subroutines that run as soon as your command is processed. What if your command depends on some other command that runs later? You need to redefine that command to store the data in a separate file, then have your command emit a warning if that file doesn't exist, and the second command needs to register something that runs at the end of the document parsing to warn the user if the contents of the other file has changed.

This is all horrible.

AsciiDoctor isn't anywhere near as bad.

But contrast this with a DocBook (XML or SGML) flow. There is a parsing step that reads the XML and builds a DOM. The DOM is exactly the same shape as the DocBook source. You then run a bunch of XSLT things to transform it into other XML, such as XHTML that has some generic semantic markup and replaces the document-specific semantic markup with either divs, spans, or longer sequences, or something like SILE's XML for generating PDFs. This is a nice abstract model, but has two problems:

No one wants to write XML without an XML editor
No one wants to use the few XML editors that exist.
Neither of the people who understand how XSLT is supposed to work want to admit it.

AsciiDoctor is somewhere in the middle. The input text has a load of things where the parser does transforms into sequences of nodes. These transforms are neither documented nor are they obvious. There are then a sequence of tree-to-tree transforms but, if you want to specify one, you can't state where it goes and so you must keep the tree containing exactly the same lowering.

For igk, I followed an XML/SGML-like model, but with a syntax that was designed to be easy for humans to write (more or less the same as SILE's TeX-like syntax).

Every node that you write in the original input is reproduced exactly in the generated tree, any whitespace is also preserved. Then you run tree-to-tree transforms. All processing happens in that layer. The exact order of the transform passes is defined by the user. If you want to transform something bespoke into something generic that's later processed by another pass , make sure that your pass runs before that one. That's it.

Adding a new node type doesn't require any parser modification or special macro expansion because there's no special treatment of any node. You want to create a new node called MySpecialNode? Write \MySpecialNode{...} in your source with whatever you want to be children of that node (text or other nodes) in the ellipsis. Add attributes in [] before the { if you want to provide key-value pairs. The tool doesn't care because the parsing phase is just producing a tree.

Some of the things that SILE treats as special are handled this way. SILE has some syntactic sugar where \begin{foo}...\end{foo} is equivalent to \foo{...}. In igk, this is just a tree transform that recursively visits nodes and, when it finds a \begin node, collects every node between it and a corresponding \end node and moves them to being children of the new new node named from the body of the \begin and \end nodes. \include is initially just parsed as a node, but typically the first pass that you open the files given as the body of an \include node, instruct the parser to parse them, and then replace the \include node with the result. Want to make that work with some special nodes for defining paths relative to something else? Just run the pass that expands them earlier.

I finally managed to do the thing I wanted with AsciiDoctor! The ...

2026-10-02T13:43:50Z

I finally managed to do the thing I wanted with AsciiDoctor!

The key bit, which I found by reading another extension, was that there is a parse_content method on extensions. This will parse some AsciiDoc text and append it to an existing node (you can also create a new node as the parent and pull out the bits one at a time).

The choice to do work at parsing time was something I intentionally avoided in igk because it makes life much harder: the input format is no longer trivially isomorphic with the post-parsing AST, which increases the cognitive load on people writing extensions. This experience has 100% confirmed my belief that this was the right choice.

Wow, moderators are killing the accounts for the new spam wave so ...

2026-10-02T13:30:17Z

Wow, moderators are killing the accounts for the new spam wave so quickly that I get errors when I try to report them because the account has been suspended and so the report refers to nonexistent posts.

Every time I see a picture of Earth from space in a film, I feel ...

2026-10-02T12:06:49Z

Every time I see a picture of Earth from space in a film, I feel an overwhelming urge to point at it and say 'I've been there!'.

Sad kitten news! Scaredykitten (who is apparently called Frodo by ...

2026-10-02T10:12:49Z

Sad kitten news! Scaredykitten (who is apparently called Frodo by his official humans) went exploring the estate a couple of days ago and hasn't come home. Hopefully he's found another cat friend who is sharing food somewhere else and will eventually find his way back.

I thought there were rules against making someone a vampire when ...

2026-10-02T07:32:47Z

I thought there were rules against making someone a vampire when they are that young?

This should be read by everyone participating in the #FreeBSD LLM ...

2026-10-01T15:13:48Z

This should be read by everyone participating in the #FreeBSD LLM policy working group.

So many of the muppets gif of the day clips are some muppet and ...

2026-10-01T14:38:10Z

So many of the muppets gif of the day clips are some muppet and some famous person. And I recognise the muppet but not the famous person.

The AsciiDoctor (Ruby) documentation is so bad that I even tried ...

2026-10-01T11:17:33Z

The AsciiDoctor (Ruby) documentation is so bad that I even tried an LLM to help. And even that didn't help. I still have no way how to do something that should be fairly simple: create a link to another node in the document that will work in HTML and PDF output from a tree transform (it must be run this late because I want to find all of the nodes of a specific kind in the parsed document).

The america.gov thing is an embarrassment but the middle of the ...

2026-10-01T09:16:19Z

The america.gov thing is an embarrassment but the middle of the rant about US government web sites being worse than the private sector reminded me of how much I appreciate the gov.uk infrastructure.

It’s designed to work well with low-bandwidth devices. It works well on large and small screens. It runs in ancient browsers. It has a consistent interface. The buttons are big and clear. It doesn’t use colour contrast that’s problematic for colour-blind users. It works well with accessibility tools. It has its own extended markdown variant that captures semantic markup for common things so that they can be usefully exposed structurally to other tools.

Private-sector web sites could learn a lot from it.

I have a lot of sympathy with the lawyer charged with contempt in ...

2026-09-30T19:50:20Z

I have a lot of sympathy with the lawyer charged with contempt in this story. He used an LLM to summarise a proceedings and it made up nonsense.

Most of us know that this is a risk, but I routinely talk to people who think an ‘AI summary’ of a document is going to be a distillation of information in the information in the source text, rather than some statistically probable sequence of words that would follow a request to summarise the source text. And that’s entirely because that’s precisely how these things are advertised.

There's a boat in the river in Cambridge called Argonaut and ...

2026-09-30T12:25:59Z

There's a boat in the river in Cambridge called Argonaut and it always confuses me because I don't think it would fit on the Argus.

Stock market reporting is so weird. Headline from MarketWatch: ...

2026-09-30T08:54:56Z

Stock market reporting is so weird. Headline from MarketWatch:

Microsoft stock is on track to post its biggest quarterly gains in 28 years.

Zoom out on the graph slightly a Microsoft stock is trading at just below its high, which was a year ago.

Yes, there was a big jump in July but there was an approximately equal crash at the end of last year.

Alternative headline: Microsoft stock exhibits high volatility with swings of almost 50% in one year.

The best explanation I read for NVIDIA buying Hugging Face after ...

2026-09-30T08:24:36Z

The best explanation I read for NVIDIA buying Hugging Face after the attack was that discovery would reveal a whole load of embarrassing things about OpenAI that would make it obvious what a house of cards their entire ecosystem is.

So I’m really looking forward to seeing what gets entered into the public record as a result of this case!

I don’t understand the panic over ‘LLMs can tell people how ...

2026-09-30T08:14:34Z

I don’t understand the panic over ‘LLMs can tell people how to build biological weapons and plan assassinations’. So can Tom Clancy novels. And both sources will tell you things that are more likely to get you killed than achieve your nefarious goal.

#FreeBSD security folks: is the latest jails security advisory ...

2026-09-29T20:46:51Z

#FreeBSD security folks: is the latest jails security advisory also a Capsicum sandbox escape if your capability-mode program has a descriptor to /dev/fd?

Apparently using ‘agents’ can increase productivity. I have ...

2026-09-29T16:54:51Z

Apparently using ‘agents’ can increase productivity. I have been trying this for a while and can confirm that having agents assassinate people who put meetings in my calendar does significantly increase the amount of useful time that I have.

@nprofile…65q8 I have a question that involves both paintball ...

2026-09-29T14:58:11Z

nprofile1qy2hwumn8ghj7un9d3shjtnyd968gmewwp6kyqpq98t8kgwqas59rvmnghzcdn6krzhxhpkyt2mt53e4g9sdnj74sszs6a65q8 (nprofile…65q8) I have a question that involves both paintball and law, so I immediately thought of you:

There are a bunch of places around here that are slowly being torn down for rebuilding. Some because they're going to be unsafe, some because they want to build something more profitable. It takes a while for all of the outstanding leases to expire, or it takes a long time to get the permits for demolish things, so they end up standing completely or partially empty for a long time.

My question is: Are there liability or other legal reasons why these don't turn into pop-up laser tag or paintball arenas? There's a little cluster of office blocks here that's been waiting for permits for destruction for almost a year and it would be a really fun place for either (lots of good sniping spots, lots of cover), and it would be an easy short-tenancy business that could bring in revenue while waiting for the things to be demolished.

I'm increasingly of the opinion that the right time to try to ...

2026-09-29T11:46:01Z

I'm increasingly of the opinion that the right time to try to sue LLM vendors for copyright infringement is after the bubble starts to burst. At the moment, politicians buy the line that these machines will magically cause massive economic growth (and, because politicians think the stock market reflects the economy, they even see some evidence of this).

That means that they're seeing it as a choice between protecting existing industries and protecting a new major source of growth. Even ignoring the massive bribes that the industry is paying, that's a difficult choice. Big economic growth often comes with killing off existing industries, so they're weighing known slow growth (or decline) against the promise of big growth.

Lawsuits now are very high risk. If the LLM vendor wins, they establish precedent. If they lose, they encourage special-case laws.

It's far better strategy to sue them after the bubble starts to collapse. Given the choice between an industry that employs a load of people and one that's causing the economy to implode, politicians have a much simpler choice.

Of course, this means you won't be able to get a cut of the VC bubble money. But I expect Meta, Alphabet and Microsoft to all survive the bubble bursting in some form, so there will still be a few companies with deep pockets as good targets.

Anyone who writes alternate history: I'd love to read ...

2026-09-28T15:53:58Z

Anyone who writes alternate history:

I'd love to read something set in a world where the government during the Industrial Revolution had underwritten loans for displaced agricultural workers to build and operate factories, rather than having them run by exploitative wealthy individuals.

@nprofile…65q8 I’ve seen trackpads in MacBooks Pro fail due ...

2026-09-26T12:39:14Z

nprofile1qy2hwumn8ghj7un9d3shjtnyd968gmewwp6kyqpq98t8kgwqas59rvmnghzcdn6krzhxhpkyt2mt53e4g9sdnj74sszs6a65q8 (nprofile…65q8)

I’ve seen trackpads in MacBooks Pro fail due to faulty batteries. When the batteries expand, they push on the trackpad from below and the pressure stops them working.

Has this one been having battery-life issues?

My LinkedIn posts: 80% marketing, 20% trolling. It probably says ...

2026-09-26T10:03:53Z

My LinkedIn posts: 80% marketing, 20% trolling.

It probably says something about the platform that the trolling posts get more views.

Still slightly shocked people read LinkedIn. I view it as a purely write-only medium.

The goose that woke me up at 4am flying in circles around the ...

2026-09-26T07:17:21Z

The goose that woke me up at 4am flying in circles around the house and honking was not valued.

HOW DID I NOT KNOW OTTERS CARRY AROUND THEIR FAVOURITE ROCK?!?! ...

2026-09-25T15:50:24Z

HOW DID I NOT KNOW OTTERS CARRY AROUND THEIR FAVOURITE ROCK?!?!

(The picture is slightly misleading, that looks like a river otter and this is apparently a sea-otter behaviour)

I talk a lot about building software for user customisation. I ...

2026-09-25T07:50:10Z

I talk a lot about building software for user customisation. I wanted to share a bit about what I did with igk.

This is a tool written for precisely one user (me). I wanted, for the CHERIoT book, to have a single source of semantic markup that could be used to generate typeset PDFs (for print and online, with different styling), ePub (XHTML plus some metadata) and web versions. I initially tried AsciiDoc but it made a lot of design choices that are the opposite of what I want.

The design of igk is very simple. It has a tiny C++ core that builds a document tree. That tree use an XML-like document model. A document is a tree. Each node has zero or more unordered attributes (key-value pairs) and zero or more ordered children (text or other nodes). The C++ part has a parser that generates this tree from something that looks like LaTeX (and is more or less the same as as SILE’s cleaned-up TeX markup).

Importantly, the generic tool is completely agnostic to semantics. It handles a tree, it doesn’t know or care what any of those nodes mean.

The tool then runs tree-to-tree transform passes. These are written in Lua or C++ (in theory, they could be written in anything that C++ can wrap).

There is no default list of passes. Each pass is provided as a command-line argument. Passes can run other passes, so you can simplify the command-line invocation by writing one pass that just invokes others to define your workflow.

The passes that I use for PDF and ePub output are very different. HTML-like formats want most of the semantic markup to be preserved right to the end and then styled with CSS. PDF output wants some semantics preserved (e.g. section labels for generating a ToC in PDF metadata) but other things lowered to presentation markup.

Because the tool doesn’t special case any node types, I can trivially add new semantic markup by just writing it and then write the passes that let me typeset it nicely later.

This methodology is built around the idea of desire paths. I make it easy to modify how the tool works and then I learn how I (and, in theory, other people) use it, then I make that use easier.

As I’ve written passes, I’ve ended up duplicating the same patterns in a few places, so I’ve added helpers. There are a few more I should add to make the structure easier. A bunch of passes are doing the kind of trivial transform that could be made much simpler with a template-based DSL.

Oh, there’s one other extension mechanism. The tool can load shared objects that expose a function that’s called with access to a Lua context. These can register new passes or they can register helper functions for Lua. I use this to expose TreeSitter and libclang into passes. The book pulls in Doxygen-style doc comments with libclang for function references and also pulls in listings from buildable examples. The helpers with libclang / TreeSitter build trees with semantic markup for the identifiers in the listings, the Lua code generates the listings with captions and so on.

Butterfly is much less fun to say than papillon so I am using the ...

2026-09-24T08:28:27Z

Butterfly is much less fun to say than papillon so I am using the standard process in the English language: deprecating a common-usage word and replacing it with a foreign word that I like better. From now on, all uses of the word ‘butterfly’ shall be deemed archaic.

Thank you for your patience during the transition.

Ugh, people keep shipping stupid updates to autocorrect that ...

2026-09-23T11:47:52Z

Ugh, people keep shipping stupid updates to autocorrect that replace the word I meant with a totally different word. Does anyone know how to downgrade the firmware in my fingers? They keep typing nonsense.

Please stop enforcing mandatory time limits on credentials that ...

2026-09-23T09:15:10Z

Please stop enforcing mandatory time limits on credentials that are trivial to revoke!

The point of mandatory expiration is that revocation happens eventually. In the case of a compromise and leak of that credential, an attacker has a guaranteed sunset when their stolen credentials will stop working. This is sometimes a useful property.

For example, checking certificate revocation lists on every TLS session is slow. It's common for clients to skip this and rely on revocation sets that are pushed out during software updates. Short lifespans here serve to optimise the performance of revocation lists / sets: if your certificate lifetime is five days and you revoke it, after five days it can be deleted from revocation lists. Scale this to the number of certificates issued across the entire Internet and that's a big saving.

But the big down side of requiring frequent generation of short-lived credentials is that the credentials needed to generate that credential (which, by definition, are more privileged) are frequently accessed.

If I am generating a token to go into some release flow and I can do it once via a cumbersome process that requires multiple rounds of authentication and then put it in some secure credential store where it's accessed only from an ephemeral VM doing my release flow, then I don't care about the effort of generating the token. I do it once and, in the happy case, forget about it. If there's a trivial mechanism for revoking it, we're done: if there's evidence of compromise, revoke it and go through the slow process again.

But if that token expires every 30-90 days, I need to automate generating it. Which means that some automated process that is likely to be as vulnerable as the token itself now has access to the credentials required to mint the token. And that's introduced additional complexity without introducing additional security.

TL;DR: If you have an expiration policy for credentials, make sure that you have a threat model that it is intended to address and that you understand the operational complexity that you're introducing and any security weaknesses that this is will cause.

One of the coolest things I’ve seen recently is the platform ...

2026-09-22T07:42:00Z

One of the coolest things I’ve seen recently is the platform that the University of Kent uses to teach programming. It’s a little circuit board that looks like a gameboy, complete with LCD and buttons, powered by a microcontroller.

They start people off with MicroPython and can teach core programming concepts as well as things like 2D graphics, different algorithmic performance, and so on with the platform. Some of the students write moderately complex games.

We’re hoping to do a version with them using our CHERIoT chips so that they can teach sandboxing and other security concepts on the same device.

I was a bit nervous about the performance (including the overhead of a Python interpreter that is optimised for memory usage and not performance) until I saw this post. Our chips runs at 250 MHz and has DMA that can push pixels to the LCD, as well as a couple of orders of magnitude more code and data memory than the original. I think it will be fine.

(And, yes, one of our customers has already ported Doom to run on the FPGA development platform, which has less memory)

I am trying a new thing: Only boosting posts that make me happy ...

2026-09-21T09:25:52Z

I am trying a new thing:

Only boosting posts that make me happy or have something actionable for readers. It's good to be informed about depressing issues, it's not good to be constantly bombarded with things about them.

Not posting about things that annoy me unless I have an actionable proposal for how to improve them. Grumbling can be cathartic but is not especially helpful.

I don't promise I'll be good at this, but I'm going to try!

The Cylons were created by man. They evolved. They rebelled. But ...

2026-09-20T12:33:00Z

The Cylons were created by man.

They evolved.

They rebelled.

But in the year of the Shadow War, they became something greater…

If there are two sides of a debate, and one side is people who ...

2026-09-11T15:47:12Z

If there are two sides of a debate, and one side is people who volunteer to risk their lives to save people from drowning, and you're on the other side: you're probably on the wrong side.

Folding phones are a sad lack of ambition. I want a scrunching ...

2026-09-11T12:26:31Z

Folding phones are a sad lack of ambition. I want a scrunching phone. One I can just roll up into a little ball and throw into a pocket or bag, then straighten out to give me a 14" display.

YES! Finally! #Signal lets you turn off notifications for ...

2026-09-11T11:40:17Z

YES! Finally! #Signal lets you turn off notifications for reactions, a thing that I have never wanted a notification for! And it only took two years!

I have no idea who wants notifications on reactions. I want notifications for things where I might need to do something in response. If someone puts a thumb up on my message, I don't need to do anything. Ever.

But at least now I can turn it off.

My latest article for ACM Queue about CHERIoT is live! This ...

2026-09-09T14:19:32Z

My latest article for ACM Queue about CHERIoT is live!

This describes the design decisions that we made in designing an aggressively privilege-separated OS with a single address space for embedded systems. It's part of a series of articles about designing single-address-space systems and aims to highlight which parts of CHERIoT are things that are a good idea everywhere and which are a good idea only for embedded systems.

#CHERIoT #CHERI #ACMQueue

Just checking I understand US politics: There are protests called ...

2026-09-09T10:35:45Z

Just checking I understand US politics:

There are protests called 'no kings'. And these oppose a President acting like a king.

There is a party whose name literally means 'people who are opposed to having a king'.

And this party is objecting to the protests?

I don’t think I’ve upgraded any of my #FreeBSD systems to 15. ...

2026-09-08T07:04:38Z

I don’t think I’ve upgraded any of my #FreeBSD systems to 15. This is probably the longest I’ve gone after a new release without upgrading at least some machines (14.5 just came out). I even ran FreeBSD 5.0.

I don’t have any reason for avoiding 15, it’s just that I don’t really have a reason to upgrade. 14 was more than good enough. A more stable pkgbase would be a compelling reason, as would rcd landing. So I’m actually quite excited for 16.

The other day, I wanted to see if alcohol-free port existed. The ...

2026-09-08T06:58:44Z

The other day, I wanted to see if alcohol-free port existed. The top search link went to a page of the 20 best alcohol-free ports! Except none of them were port, they were all spirits (not even other fortified wines). The ‘AI’ summary described a fictional process for removing alcohol from port and had two citations, neither of which supported the claim. The next 30 pages were all LLM slop that talked about what port is for a long time before saying that there’s no alcohol-free version.

I have been using the web since the mid ‘90s and it has never been this bad. Anyone advocating for ‘AI’ is advocating for a future where this damage is spread to all facets of life.

Yay, my least favourite thing in the Mastodon UI has somehow got ...

2026-09-08T06:54:10Z

Yay, my least favourite thing in the Mastodon UI has somehow got worse!

When I scroll away from a video, rather than stopping playing (as it should) it pops out as a separate little floating thing. Which is a nice thing to have as a button, but I scrolled away from the video because I was done watching it, so stop that.

Only now the pop up managed to appear under the UI elements on the right. So clicking on the close button took me to ‘followed hashtags’ and there was no way to make the floating window go away.

Wow, stock market reporting is totally on crack. The ‘bear ...

2026-09-07T07:13:30Z

Wow, stock market reporting is totally on crack.

The ‘bear case’ for NVIDIA says it is 122% overvalued. At that valuation, NVIDIA is worth almost ten times the pre-bubble valuations of Intel and AMD *combined *. And the bull case is based on a P/E that completely ignores the fact that a lot of the ‘earnings’ are companies paying for NVIDIA chips with money NVIDIA gave them.

COVID vaccinations are so streamlined now. Arrived less than five ...

2026-09-03T11:02:05Z

COVID vaccinations are so streamlined now. Arrived less than five minutes before appointment time, vaccination completed two minuted after appointment time, asked to wait five minutes to check for fainting or low blood pressure, then off.

Friendly kitten just came and peered into my office from the ...

2026-09-01T09:02:21Z

Friendly kitten just came and peered into my office from the nearby wall.

I went out to say hello and he got a bit confused by being able to see my hand and face, but not the connection between them.

When he came over, he went straight into a face snuggle, but the second time wasn't sure it was still my hand so had to sniff it first. His brother seems to try that but hasn't quite cot the hang of it. Now he's no longer too scared to come close, if you put a hand out he'll come over and headbutt it with his nose. That's probably not good for noses.

#CHERIoT was designed from the ground up to let you reason about ...

2026-09-01T08:45:34Z

#CHERIoT was designed from the ground up to let you reason about the exact kinds of things that the CRA requires:

What is in your firmware?
What can happen if a particular component is compromised?
If someone finds a vulnerability in some component that you use, is your device vulnerable?

It was also designed to enable support for proposed right-to-repair legislation for devices in regulated domains, where you need to be able to allow users or third parties to modify almost all software components but prevent modification of software components certified by the regulator.

When I was at Microsoft, one of the things I tried to persuade ...

2026-09-01T08:30:21Z

When I was at Microsoft, one of the things I tried to persuade the Outlook / Exchange team to do was allow dietary preferences to be stored in Exchange and exposed as part of a meeting invitation reply then aggregated and presented.

Any time someone organised a catered event, they always sent out an invitation that asked people to provide dietary preferences in a reply. This led to two very different flows:

If you have no dietary restrictions, you hit 'accept' or 'decline'.

If you had dietary restrictions, you hit 'accept...' and then entered your dietary restrictions in the email.

As a vegetarian, it was mildly annoying to say 'I will attend and I am still vegetarian' each time I replied. But vegetarian is the simplest case.

Imagine your dietary restrictions are Halal or Kosher. Now your reply is 'I will attend and, yes, I'm still Jewish / Muslim'. Now you've got a flow that is harder for people of certain religions. A competent lawyer could argue that this is religious discrimination.

But it gets worse. A lot of dietary restrictions are related to medical issues. So now you're requiring people to specify their medical conditions ('I will attend and, yes, no one has found a cure for celiac disease yet') in an email, every time they want to reply to a meeting. Now imagine that you have to comply with a legal requirement to delete all information related to a specific person's medical conditions. Can you do that? No, because these emails are all interleaved with normal emails. If this were built in, the person organising the event could have a view of what dietary requirements they have to cater for, not linked to individuals (though linkable if you have multiple catered meetings with overlapping sets of people), which could be automatically deleted after the event.

If you're selling corporate groupware, I'd suggest you get this right and advertise it as a differentiating feature.

Nostr notes by David Chisnall (*Now with 50% more sarcasm!*)