8organicbits

Idk, Google seems worse there too. I tried "my left hip is hurting".

Google shows an AI overview and "people also ask" with zero search results above the fold. If I page down I see a single search result for clevelandclinic.org, followed by youtube videos and image search results. The next page has a single search result from rush.edu and then "discussions and forums" which has Mayo Clinic and Quora.

DDG also starts with the AI overview (although I disable that) and has two results from webmd.com with deep links to multiple pages on the site, all above the fold. Then the same clevelandclinic.org result as Google but again, adding deep links to other related pages.

I can't comment on the quality of webmd, clevelandclinic, or rush, but Google pushing the user to youtube and quora for medical advise seems worrying.

Interesting, I've seen much better results on DDG. Most recently was the search: `site:feeds.bbci.co.uk inurl:rss.xml` which works on DDG but gives zero results on Google. As far as I can tell, Google just decided not to index these.

The link shows the first six months of 2026 for "all items" as: 2.4%, 2.4%, 3.3%, 3.8%, 4.2%, 3.5%. Gasoline ranged from -7.5% to 40.5% over the same range, which I've definitely noticed.

I use RSS specifically because the people who publish via RSS are not trying to monetize their content.

I don't think this is helpful. The last statistic I saw put RSS at 77% of the web feed market share, higher than Atom. In the web feed market it isn't a protocol on the way out, its the dominant protocol.

While RSS is tricky to parse in practice, many of the challenges are due to invalid feeds, which Atom is not invulnerable to. Its very likely that there is a well-tested feed parser for your favorite programming language, so most developers using feed programmatically don't need to handle those challenges themselves.

For concerns like title encoding or summary vs full text description, you can handle those using namespaces. If you don't like any of the existing namespaces that do that you can create your own.

What do you like about JSON Feed?

One of the downsides I saw when evaluating JSON Feed was that it doesn't use GUIDs, which can cause problems when the same post is present in multiple feeds (I.E. syndication).

When I last looked I found that every feed reader supporting JSON feeds also supported RSS/Atom and every website with a JSON feed also had an RSS or Atom feed, so it seems easiest to ignore the JSON Feed format.

It's great to see someone else using FeedLand. While it has some quirks, is has some clever ideas, like that blogroll feature.

My favorite part of FeedLand is that you can see who subscribes to a blog and where else they subscribe. This makes RSS feel social, without the algorithmic tricks of traditional social media. Here's the listing for my blog, for example: https://feedland.com/?feedurl=https%3A%2F%2Falexsci.com%2Fbl...

> It’s Hovers problem what the price behind the door is.

This feels key to me. If .sexy is changing fees with very short notice, and Hover doesn't have enough time to inform their customers before renewal, then Hover should stop offering .sexy domain names. None of that is a problem for the customer.

The linked article "What I learned from one year of Substack" [1] perfectly sums up my experience. I can't read the article because I only see a coercive demand to subscribe first. Perhaps that's the joke.

[1] https://elizabethtai.com/2023/10/22/what-i-learned-from-one-...

When I checked in 2024 (https://alexsci.com/blog/is-email-confidential-in-transit-ye...), Cloudflare had more domains using DANE than Microsoft. But you're right, DANE is not widely adopted. Lack of support by Google is most notable due to the large number of domains using their service.

Typically you don't want to require authenticated encryption for all outgoing email as many mail servers use certificates that are self-signed or otherwise appear invalid. It isn't as simple as it seems and isn't generally recommended.

What concerns do you have with MTA-STS?

Email currently uses an HTTP request to https://mta-sts.<domain>/.well-known/mta-sts.txt, per RFC 8461. Depending on HTTPS/TLS instead of DNSSEC is one major reason you see this approach gaining popularity.

I think the network effects make email hard to replace, virtually everyone online has an email address. If this could include a migration path, with backwards compatibility with SMTP, I think it would have a better shot of getting adoption.

Modern email already depends on HTTP, with protocols like MTA-STS (https://www.rfc-editor.org/info/rfc8461/) using HTTPS/TLS to improve transit encryption, or Web Key Directory (https://datatracker.ietf.org/doc/draft-koch-openpgp-webkey-s...) which uses HTTP for public key distribution. Personally I think these incremental improvements of SMTP are more promising than replacements, but we deserve better email however we can build it.

I think that statement is vacuous true for all magical thinking.

The low hanging fruit are claude.md, commits co-authored by Copilot, etc.

> wasn't until late December of last year that AI models started to demonstrate particularly interesting capabilities

What are you referring to here?

Does this actually remove from history? The feature says escape, but the back button and history still show the page (Firefox on Android).

I think it's about user agency. When we say that infinite scroll is addictive, we mean that the user keeps on scrolling even when they wish they could stop. It's also about harm. Trapping users on their phones is harmful to their well-being. A person who wants to quit should be able to do so, addictivity that prevents that is harmful.

Reading the bill I see carve-outs for things like "commercial transactions", perhaps allowing Amazon and Temu to use infinite scroll, but not Facebook and TikTok

Forgejo is mention in the article, it powers Codeberg. I agree it doesn't have high adoption, but the news is that it is growing.

I may complain that I don't like the way a sleezy con man talks, and I may be able to detect his communication patterns, but that doesn't mean I want the con man to speak in a different way I can't detect as sleezy. I don't want to talk to the con man.

Obfuscating LLM output to trick the reader into thinking it wasn't LLM output is not respectful.

> respecting the reader

When people say LLM slop is disrespecting the reader, I don't think they are complaining about style.

The unlisted video indexes still exist. https://unlistedvideos.com is one example.

This is an important point, private videos should not be impacted by this as knowing the URL isn't enough to access the video. Unlisted videos are indirect-object reference by design. It's poor security, but the user is expected to understand the tradeoff (if they actually do is questionable).

I'm seeing a ton of restricted mode escapes documented online, like https://0xffsec.com/handbook/shells/restricted-shells/ so I'm not so sure. When basic utilities like less, man, and awk can run subshells it's quite a mess.

Bash restricted mode needing a chroot may suggest that Claude also needs a chroot (or restricted file permissions, jail, etc).

Does that work? I've never seen it used. It seems easy to escape.

The docs seem to suggest using alternate approaches.

> Modern systems provide more secure ways to implement a restricted environment, such as jails, zones, or containers.

https://www.gnu.org/software/bash/manual/html_node/The-Restr...

Cool tool, I'm also surprised by how different the startup stacks are from the general Internet.

For HSTS, don't forget to check the preload list. Domains under .dev are all preloaded, for example, so they don't need to set the header for HSTS to apply.

> How can you check other people's certs?

There are red flags you can look for, but you need to confirm with the domain owner to be sure. CAA records can tell you what CAs are supposed to issue a certificate. Many companies always use the same CA, so a change to a different one could be suspect.

For the wiretapping scenario, domain verified certificates do not protect against that scenario. If the wiretap has full control of your server's network, then it can issue a certificate of its own. No need to compromise a CA.

Is there a detection component here too? Sandboxing development is great, but the next step is to deploy to production. How do you know if something malicious happened in the sandbox, such that you don't deploy the malware further?

> money will shift to those funds that do better

I'm not disagreeing that people invest this way, but I'd like to point out that past performance does not imply future performance, and that investors should consider factors other than just past returns.

Of course plugins that do this already exist. Save your tokens.