Latest

2026-10-27

Week 303: Murder and (musical) mayhem

Someone submitted my post about archiving my gem repositories to Hacker News, the house journal of venture capitalist Silicon Valley techbro orthodoxy, and it made it to the top of the page. Despite my trepidation, to my surprise the discussion (with over 500 comments) was mostly reasonable.

The presidential election result in Brazil was a relief. It’s good news for the Amazon rainforest, and thus for (almost) everyone and everything. It’s bad news for Zuckerberg, a man who always seems to be found on the opposite side of the battlefield from humanity.

Vučić being defeated in Serbia seems like good news, too. Is this a reverse for the far right international? It’s too early to count any chickens: there’s still Israel and the United States to come, and the quinquennial threat of a Le Pen presidency looms larger than ever.

The eMudhra incident, in which their catastrophically insecure private keys were revealed to be so weak that one of them was literally, no word of a lie, just the number four, was one of the funniest screw-ups of all time. Apparently they even used a proper air-gapped hardware module to generate the key, then spoiled it with a poorly-written script.

There were many amusing memes. My contribution:

It’s called two factor authentication because there are two factors and they’re both two.

It’s not great news, because these insecure roots are baked into all kinds of devices that might never get updated, but that’s the fundamental problem with the current model of trust roots: it’s only as secure as the weakest link, and if I take a look at a default installation of Firefox, that includes several governments whose approaches to democracy and privacy might not be as principled as I’d like.

The PHP vulnerability was widely reported across non-tech media. The BBC brought out their “cyber correspondent” who had only learned of the existence of PHP the day before. Remember Gell-Mann Amnesia next time you read the news!

The exploit wasn’t nothing, but it appears that it wasn’t nearly as easily exploitable as the coverage made it seem.

As I cycled home in the drizzle on Tuesday, my bicycle chain snapped. By good fortune I was on a quiet street at the time, not trying to get out ahead of an oncoming car.

After anointing myself in the holy oils (smearing filthy chain grease all over my hands), making a blood offering (I caught my knuckle with an opposing fingernail while using the chain tool) and sacrificing a link to the bicycle gods, my steed was restored to life and I continued home.

I’d put the chain tool in my repair kit when I was cycling across the country and back again, so I wouldn’t be stranded by a broken chain. In the end, I needed it a few miles from home.

I spent three evenings out at events last week.

The first was a Hallowe’en-themed Solve-Along-A-Murder-She-Wrote at the Prince Charles Cinema (now saved from the threat of eviction) on Thursday night.

We ate a very cheap and delicious meal at Govinda’s in Soho beforehand, and tried to spot the Palantir offices in Soho Square as we walked past on our way to the cinema. There are conflicting details online about which building it is – they seem to have migrated around the square over the years – but the deliberate lack of branding and anodyne “employee entrance” laminated A4 signs give it away by trying too hard to say “nothing to see here”.

On Saturday I listened to a candlelit performance of Baroque music from Purcell and other 17th century composers performed by Musica Antica. It was pouring with rain outside, and a room full of damp punters made for not ideal conditions for instruments with traditional gut strings.

I was helping on the bar. It’s not too onerous: very intense for two periods of about fifteen minutes, and relaxed the rest of the time. I joined some of the performers in the pub afterwards, where it occurred to me that unlike my foolish choice of software development, playing theorbo or viol is a relatively secure career. Who would have thought that a few years ago?

Finally, as part of the London Month of the Dead I saw Thomas Truax in the beautiful surroundings of King’s College Chapel on Sunday evening. He plays guitar and a variety of experimental instruments of his own design, accompanied by a mechanical drum machine built around a couple of bicycle wheels. It was entertaining and weird, exactly as I’d hoped.

Quite a few links this week:

• AlpineBSD is “an operating system based on the NetBSD kernel with a userspace inspired by Alpine Linux and the objective of making it possible to use as little AI-generated software as possible. There is no LLM output included in the base system or main package repository”.
• All My Hobbies Are Getting Slopped Up, And It’s Exhausting. “The explosion in vibe coding has created an endless sea of drive-by, unserious, and unmaintained software that is destabilizing longstanding communities.”
• “Some of you have forgotten that only three years ago you were perfectly capable of writing a text, writing an email, telling a bedtime story to a child […]” On the “Faustian bargain” of abandoning your thinking to a machine.
• London’s 8,900 buses are getting a brain transplant. How London bus tracking works, and why it needs an upgrade.
• Shuffle All (with cryptography): “If you wish to iterate a sequence of length n in a random order you can use an ordinary index in the range [0,n), but use format-preserving encryption to transform it to another index.”
• A new model of empathy: The rat. “The free rat, occasionally hearing distress calls from its compatriot, learned to open the cage and did so with greater efficiency over time. It would release the other animal even if there wasn’t the payoff of a reunion with it. Astonishingly, if given access to a small hoard of chocolate chips, the free rat would usually save at least one treat for the captive — which is a lot to expect of a rat.” From 2011. We’re being unfair to rats when we compare traitors to them.
• AI and The Enclosure of the Scientific Commons. “In short, AI is precisely the tool needed to launch an unprecedented enclosure of science, academia, and other information commons. It enables private actors to appropriate the enormous wealth held in the commons at previously unthinkable scales, and it simultaneously enables attacks upon the social systems that have evolved to grow, nurture, and protect those commons.”
• DESLOPPIFY is a tool to make attractive gig posters without the dead hand of the slop machine.
• Technolizenz: Apply for a Techno License · Form TR-909.
• AI-free FOSS Alternatives: “Alternatives to FOSS projects choosing to use and/or support LLMs/AI, as well as tips for requesting better policies or forking.”
• Native HTML and CSS Features That Replaced JavaScript.
• There isn’t an easy exploit for this PHP vulnerability. “The strangest thing is that so many people have independently made this extraordinarily weird defect in judgement. That is because they haven’t independently made this decision. Claude/Etc. has done all of the judgement for them, hence the bizarre distribution in logical errors.”
• Faulty Towers, vibe sickness, and the vibe bobsled. “[T]here is a rot growing beneath our feet and within our walls as our world is swapped out with systems nobody understands. And I fear what it’s going to be like to recover from this all, the price we do not even yet realize we are going to have to pay.”
• EvoGrain: Algorithmic Sound Design with L-Systems and Granular Synthesis.