dspillett

[of course not having the credentials to leak does not protect us from this sort of bug, it is just one factor in a multipart security stance]

Current state (now we have been bought and are effectively more than an order of magnitude bigger): I definitely don't have opportunity to make a unilateral decision like that. Even though the larger company has a more “fair enough, feel free to go elsewhere” attitude when a small client says “if you can support × that is a dealbreaker for us” then we could previously afford to take as our stance, some of the bigger clients are definitely paying us enough, and do use passwords, that someone above me would overrule a keys-only decision.

I was thinking about interfering with existing sites.

The problem with this is you are adding a moving part to your DNS lookups. It might be worth adding two on separate VPS hosts and have your resolver fall back to the second if the first goes down.

Another, usually more minor, problem is that some services (like CDNs) use the source of your DNS query to modify the response so you get sent to a topologically near-by end-point. This means you might notice such services being slower as you are sent to a PoP near your VPN host not one closer to your actual location.

Other than respawning them as you scroll around, so one starts in an appropriate place as a test comes into view, and resetting them automatically, perhaps on a timer, there probably isn't a better way to properly show it off than that.

https://ubuntu.com/security/CVE-2026-98432#status still shows “work in progress”.

[I know the update is available in “proposed” if you are willing to jumpt through those hoops]

This is true. Even though I'm not much of a mouse user for it, I tend to edit curl commands of much length in a text editor when I'm doing things by hand, then pasting into the terminal.

> especially if the last command didn't do a final "\n" output

Or if your prompt outputs something to stderr instead of stdout so it doesn't get counted when the shell is trying to position where you are in editing the stream. Ubuntu's default prompt under byobu is a pain for this when I move to a different machine and forget to carry my tweaks for that.

For the missing final \n I just hit [enter] an extra time, but getting round the stderr thing isn't quite that simple.

And assuming you mean Google, the question is based on a false premise. They were an advertising company years before gmail was introduced, and an ad-tech company being able to trawl your mail to find ways to advertise at you is a very different proposition to a search company releasing the same product.

It'll take a particularly dumb and lazy AI to replace me.

Or both: the family names having been chosen originally from biblical names, but not continuing for that reason.

I'm a David, and there were many Davids in my University intake year, but I suspect that has less to do with the Bible and more to do with mothers of a certain age range having interests in the Davids Bowie or Essex (or both! - quite possible in my mother's case).

Oh, my sweet summery child :-)

Companies have been doing far more dodgy things, things that look objectively illegal where-as the clean-room reverse engineering thing looks to me (caveat: not a legal expert at all) to be legally defensible, for a long time, definitely pre-AI.

Even if a company operating in your jurisdiction, where you as an individual might have a cat in hell's chance of even trying to sort the situation to your preference, might not, you can bet your last <currency unit> that a company elsewhere will feel more free to do so if they wanted what you have without agreeing to your terms.

So basically: money, and their desire to have more of it, is demanding this.

Get one AI to describe what the code does, and another to implement based on that description. You might even get away with a human doing one of the steps. A variation of the classic “clean room reverse engineering” method that was used by Compaq to reimplement IBM's BIOS and start the clone PC market.

Some argue that “it doesn't work like that” but it certainly seems to be what some people are doing and as yet no one has been confident enough that their copyright extends through this mechanism that they've tested the theory in court.

Note: I'm not saying it is right, but that it might well be perfectly legal. It is definitely possible, practical even. I'd still release stuff under AGPL/similar for the same reasons stated above, but I'd not operate under any illusion that I'd be safe from someone using that method to copy everything they wanted to.

No worries, I'm happy to have very slightly reduced the amount of confusion in the world (especially if it might have been caused by my previous message not being as clear as I thought it was at the time of writing!).

The implication is that while they are waiting for the async loop to complete for one site, the bot can be scraping others that have already had the challenge completed (usually the one challenge stays in force for some time afterwards) or that have no such challenge.

Memory hard challenges will reduce the effectiveness of this, but not remove it completely.

Though that these methods are working at all implies that most (almost all?) bots are not bothering to use such async methods as there are sufficient resources not protected by them that this complication is not yet worth implementing.

Equating bot prevention measures with “please give us permission for 1,000s of companies to stalk you around the Internet, no? Here are some dark patterns to try make you accidentally agree” is rather unfair IMO. They are an inconvenience but for the protection of the sites rather than for the betterment-of-adtech-via-conning-you-the-viewer-with-malicious-compliance.

> Bots can use async or virtual threads and not even have to hold on to a stack while they are waiting for this bullshit

They could, but given these methods seem to work currently most (almost all?) are not. They will start doing so if the amount of resources protected in this way increases to the point where it is worth it, or course, that is why memory-hard processes are being worked on which will make that route less practical.

> cookie banners, and of the that crap should be an automatic F grade on WCAG and should make web sites immediately liable for ADA lawsuits

I can't disagree there, though that would be quite an inefficient process and requires a bunch of money up front from who-ever champions the legal challenge, so I doubt it would actually be at all practical.

I think many don't see the point of robots.txt as it will just be ignored by most bots anyway, so instead concentrate on more complicated measures.

> Today, AI can generate lightweight, standalone, accessible HTML with just the CSS it needs, so a Minimal CSS Framework for Semantic HTML matters less than it used to.

If your answer is "use AI", then why not use AI to not need Pico. This could be maintained for those of us avoiding AI, of course, but we are fewer and further between with each passing day, and likely rolled our own instead of using someone else's framework anyway, so he probably didn't see the point and wanted to spend the time elsewhere.

> brand recognition that shouldn't be throw away

How useful do you think this brand recognition would be in his life? Enough for it to be worth maintaining a project he had presumably moved away from using for his own work & play?

If it is so valuable then maybe someone will make a deal to take over maintainance. Though TBH if this were mine I'd probably prefer to keep the project mine-but-archived than let someone else do what they will with the "brand" thereby diluting what value it might have to me personally. It can just be forked instead, or people can move into one of the already existing forks.

I think "pretty average" is the thing to strive for in a README. The right balance of detailed but concise, not overly festooned with unnecessary verbiage like a stereotypical recipe page, a simple "what is it", "key features", "how to get/install", "more detail on features / example use" structure.

Of course it gets harder to find that balance as the size and scope of a project expands, you have to become judicious with cutting things out and excising them to extended documentation instead of everything being in the README. For a thing this size everything is close to the right balance if you word+arrange it right, for larger projects the README should be a summary of what, how to get, and where the other documentation is.

If this one is AI written (there are signs, but those are things humans have long done which is why AIs copy them) it has been human edited rather than just thrown up as-is.

> as someone who struggles to write readmes

If you are struggling a lot with that, perhaps you are overthinking it or trying to shoehorn in too much detail?

Nah, it's SciFi. They'll find a way of writing them back in. Won't they?

Though I've never seen a v6 address represented that way, it would make then noticeably longer, so I don't know if anything will accept such a string as a valid address. Though IPv4-mapped addresses are sometimes show as a mix (::ffff:10.5.2.1 for 10.5.2.1) so maybe I'm wrong there.

Likewise I've never seen IPv4 addresses written in hex in the wild, but the relevant specs say it is valid. `ping 0xc0a82bc2` works just as well as `ping 192.168.43.194` but I doubt many forms accepting IPv4 addresses will validate that and allow it.