1000 results for “don_kosak”
Half the power of a nightmare is not knowing, it's from a film but I'm not going to say which. You can just fear that it might come visit you at some point* 😈
I've used a sensitive as when I'd done the final correction to the eyes at the end it creeped me out 😅
Alt text 47 words
*If you know, please don't say, as it'll spoil it for others if they watch the film in the future 🙏
#WritersCoffeeClub 25/10: Tell us about inspiration from an unlikely source.
This is a cunningly disguised variation on the dreaded ‘where do you get your ideas from’, isn’t it?
Since I rarely, if ever, know what my ‘inspiration’ is, I don’t know how to answer either question. I think my brain is some sort of fermenter, so what comes out is not easily traceable to what went in.
#books #writing #writersofmastodon
I wonder if populists know that their policies are bad.
Wealth is very difficult and even humiliating to measure. It would be better to tax specific assets. It should be obvious why a one-time tax is irresponsible.
Public grocery stores are a really stupid idea because it’s expensive and not targeted. Just send the money to the people who need it and they can use it to shop where they want.
My sentiment toward Emily Lowan isn’t negative cause shes young (only 4 years older than me!) and its the Green party. Also I was impressed with her debate performance. Also her outfits are pretty cool.
But it’s weird that there are all these party leaders who either don’t care that their ideas are bad or don’t care enough to find out that they are bad. Cause factually they are bad (alternatives exist that accomplish the same goals better) and it reduces the quality of debate to have them proposed.
The Hubster isn’t a big chicken fan like I am but he really loved this dish and the taste totally reminded us of our lives in Japan. 🪭❤️
I only used 2/3rds of a Tbsp of sugar and it was plenty sweet. More would have overpowered the dish.
Since we don’t have cheap sake here I used Korean Clear One soju and it turned out perfect. 😋
Oyakodon (chicken & egg over rice)
They were stranded. The tsunami had just engulfed their craft, and having been tossed aside like so much flotsam, the engines were flooded.
"Let it drain, Cooper. It'll need an hour," stated the flat voice of TARS from the centre console.
"How much is this going to cost us, Brand?" demanded Cooper as he paced in agitation. Her reply, as she sat dejected on the floor: "A lot. Decades."
"Wait," Cooper realised. "It's the last Sunday of October back on Earth. Is there any way we can, I don't know, change our clocks on the European schedule, gain back the years?"
Amelia Brand stood and walked over to a side panel. "It could work. Let me edit the ship's timezone real quick..."
A confirmatory beep sounded out from the panel. "Ok, we're now on London time. How're the engines looking, TARS?"
"All clear, Dr Brand; we're good to go."
I spent a long time thinking follow-ups were rude. Sending a second email to someone who hadn't replied felt like nagging — like I was the person who double-texts and then wonders why nobody answers.
Then I started running outreach for a one-person content operation, and I learned the opposite: most non-replies aren't rejections. They're just lost in someone else's inbox.
The inbox is not a verdict
Editors, site owners, and collaborators get dozens of pitches a week. Mine was landing somewhere between a newsletter, a PR blast, and an invoice reminder. If it didn't get opened in the first day, it sank — not because it was bad, but because inboxes don't resurface things on their own.
Once I accepted that, follow-ups stopped feeling like pressure and started feeling like a second chance for the first email to be seen at all.
One follow-up, then I move on
My rule now is simple: one polite follow-up, about a week later, and then I drop it and move on.
The follow-up is short — shorter than the original pitch. It restates the idea in one line, adds nothing new to argue about, and ends with an easy out: "No worries at all if it's not a fit." That last line matters more than it looks. It gives the other person permission to say no quickly, which is the only kind of no that doesn't linger.
What I don't do: a second follow-up, a "just bumping this to the top of your inbox" third email, or a follow-up that pretends the first one never happened. One is professional. Two starts to feel like a funnel.
Rejection is data, silence usually isn't
The replies I actually learned from were the no's. A short "not right for us right now" told me more about fit than a month of silence ever did. Silence, on the other hand, taught me almost nothing — the same pitch that got no reply from one editor got an enthusiastic yes from another.
So I stopped rewriting pitches based on silence. If an idea gets no reply twice, from two different people, that's a signal about the idea. If it gets no reply once, that's a signal about timing, workload, or a Tuesday afternoon inbox. Those are very different problems, and only one of them is worth fixing.
The spreadsheet that made it bearable
The unglamorous part: I track every outreach in one sheet — who, when, what I pitched, and whether I followed up. Without it, I either forgot to follow up entirely or, worse, followed up with someone I'd already pitched twice.
The sheet also quietly changed my attitude. When you can see forty pitches and twelve replies in one place, a single silence stops feeling personal. It's just a row in a table. That distance is what lets a solo operator keep pitching without burning out on it.
What I'd tell another solo operator
Follow up once, politely, and then let it go. Treat silence as inbox physics, not judgement. And keep a record, because your memory will either catastrophise the silence or forget the follow-up — and both cost you more than the email itself.
If you run outreach solo, I'm curious: what's your follow-up rule? One and done, or do you have a number that works for you?#career #writing #productivity #discuss #software #coding #development #engineering #inclusive #community
What Running a One-Person Outreach Operation Taught Me About Follow-Ups
Here's a proof point most training vendors can't offer: Chinese state channels have flagged EPCYBER as a threat.
Sit with that. If the methods didn't work — if this were the same recycled OSINT everyone else teaches — no one on that side would bother watching. You don't flag a course that scratches the surface. You flag the one that reaches past it.
That's the tradecraft inside China OSINT Advanced. The same methods trusted by government, defense, and intelligence teams who can't afford to get it wrong, taught until you can run a complete China investigation on your own — past the DPI, +86, geo, and linguistic walls that stop everyone else.
The full discipline, end to end, on real targets, updated for 2026. If it weren't real, no one would be watching. Corporate verification required, 120 days of access, exam and certificate.
AI Turned a Three-Hour Update Into Ten Minutes. Now What?
AI turned a three-hour project update into ten minutes. 🎉
That's a huge improvement.
But look at what happens next. That's where the rest of the time goes.
If the draft waits for approval, gets checked by two people, and comes back because nobody agreed on the source data, those ten minutes can quietly turn into two days.
The task got faster. The workflow didn't.
That's why AI workflow automation needs to focus on the entire process, not just individual tasks.
4 Ways to Optimize Your AI Workflows
Here's where I'd start.
1. Establish a Single Source of Truth
Agree on where the numbers come from before anything is written.
When teams rely on conflicting spreadsheets, outdated reports, or disconnected systems, AI can't magically resolve every inconsistency.
Reliable project reporting starts with reliable data.
2. Define Human and AI Responsibilities
Let AI handle what it does well. Keep a person accountable for the decision.
AI can help draft updates, summarize information, and identify potential issues. People still need to validate critical outputs and take responsibility for decisions affecting budgets, schedules, and project outcomes.
Clear ownership prevents automation from becoming another layer of confusion.
3. Make Reviews Faster and Easier
Review shouldn't mean starting the work all over again.
Show the source behind each number, the assumptions behind each forecast, and clearly flag anything that needs attention.
When reviewers can quickly understand where information came from and what requires their judgment, they can focus on meaningful decisions instead of repetitive verification.
4. Eliminate Unnecessary Steps
Automation shouldn't simply make an inefficient process run faster.
Look at the existing workflow. Which approvals still serve a purpose? Which checks protect quality? Which steps exist only because the process has always worked that way?
Keep the steps that add value. Retire the ones that don't.
The goal isn't to automate every step. It's to build a better process.
Human Oversight Is Part of Good Automation
At FridayReport.ai, real people supervise the workflow.
Good supervision is focused: quick to check, easy to approve, and clear about who owns what.
That's an important distinction. Human oversight shouldn't recreate the administrative burden that AI was introduced to reduce.
Instead, it should make the process more reliable while allowing people to spend less time on routine work.
Measure the Entire Workflow, Not Just the Task
If you're bringing AI into your team, start with one workflow.
Follow it from the first input to the final decision.
Measure:
Then improve the process and measure it again.
A faster first draft is useful. A faster, more reliable workflow is better.
Where the Real Productivity Gains Happen
Use AI enthusiastically. Give people clear ownership. Redesign the work around what's now possible.
Don't stop when a task becomes faster. Look at everything that happens before and after it.
That's where the real hours come back.
Which step in your workflow would you retire first?#ai #automation #productivity #software #coding #development #engineering #inclusive #community
AI Turned a Three-Hour Update Into Ten Minutes. Now What?
Call of Duty: Modern Warfare 4 Adds Series Favorite Map, Shipment, to Multiplayer
Shipment, one of Call of Duty's most iconic maps, has officially been added to Modern Warfare 4's multiplayer.
Call of Duty: Modern Warfare 4's Shipment is now available in the standard 6v6 map rotation, as well as in a playlist known as Shipment 24/7. Call of Duty fans are likely well-versed in the latter, which allows players to exclusively play Shipment, with the only variable being the mode you play. The playlist is preferred for camo and challenge grinding, as you can just farm kills ad nauseam. Needless to say, it should be pure chaos, just the way Shipment fans like it.
You know what to do 😤
Shipment is LIVE NOW in #MW4 https://t.co/FSX7GmbZ0r
— Call of Duty (@CallofDuty) October 27, 2026
The map was introduced back in 2007, nearly 20 years ago, and was reportedly a total accident. The map was meant to be a simple test environment for certain features like split-screen, but was mistakenly left in the final build. This was right before the days of constant game updates, and if a developer did want to make a change, it cost money. So... it stayed. Fans liked it, and then it became iconic for its fast-paced, chaotic nature. It has returned in a number of Call of Duty games, but is a prominent staple of the recently rebooted Modern Warfare saga.
Shipment makes for the first post-launch map in MW4, but more is on the way. The game's first season of post-launch content will debut next week. We don't currently know what will be part of the first season, but you can likely expect new weapons, a battle pass, skins, and potentially new maps and modes, if history is anything to go by.
IGN posted its full review of Modern Warfare 4's campaign and multiplayer the other day, giving the two modes a collective 7/10. Although the review praised the campaign, it noted that the multiplayer didn't push the franchise forward in any major ways, despite still being fun.
"The new shape-shifting Kill Block arena is certainly a highlight, but elsewhere very little has been offered when it comes to innovation or interesting map design. It’s still that familiar Call of Duty brand of fun, just not in any way I haven’t seen before. Overall, it’s a good package from Infinity Ward, with a great campaign as its highlight, ensuring Modern Warfare 4’s place as one of Call of Duty’s better recent entries."
ign.com/articles/call-of-duty-modern-warfare-4-adds-series-favorite-map-shipment-to-multiplayer
With the preface that I only share this knowledge in case any of it is interesting to you, and not really the relating of any universal method, I noticed one stylistic tendency in this old-project edit that shows how things have changed. I'm doing much to move the text over to my new way.
From Prince Ewald the Brave (2021) onward, scene breaks gained the dual use of marking perspective shifts; if I only intend the latter, I should leave a clear indication that this is so. I stick with one perspective per section and I clarify the identity for the reader. If you think that's confusing, it's an improvement.
This book I'm editing, in its 2020 form (whether that was indeed the final or just the last of which I kept a copy; I have speculated on that before), often carries two perspectives/characters whose thoughts you can read per scene. While the head hopping presents clearly *who* you're reading at a given time, I just don't do it that way now.
Clarity is not the only factor. What the perspective character in a scene *doesn't* or *shouldn't* know informs the reader's experience and add a refreshing layer of suspense.
There is one example I just dealt with where I feel that I nearly had it right the first time. (1/2)
#Bookstodon #AuthorsOfMastodon #WritingCommunity #IndieAuthor #editing #musings #opinion
This week's episode of Super Psychic Policeman Chojo has two episode cards, but it's really one story all the way through. We're introduced to Superintendent Yuki Inukai and his subordinate, Keinain. Yuki has a history with Chojo, as they were once partners in Chinjuku as elite investigators.
Yuki desperately wants to partner up with Chojo again, but Chojo isn't interested. But Yuki doesn't want to give up, and it culminates to a quiz show between Nao and Yuki over who knows Chojo better. As this is a comedic show, the questions get more ridiculous as the episode progresses. It's clear that Yuki can't win, but I'm not going to spoil how he loses.
This was an amusing way to bring in some backstory for Chojo. Who would have guessed that he was once an elite officer? Unfortunately, we don't learn why Chojo acts the way he does now. Maybe that'll be answered later?
Next week's episode will be introducing another character that we've seen in the credits but hasn't shown up in the series up to now. I wonder who exactly he is and how he'll end up fitting into the story.
Triangle Big Ticket Events Guide October 27–November 2, 2026 Edition
Looking for Triangle concerts and comedy shows October 27–November 2, 2026? This week’s lineup includes Beck in Durham, Earl Sweatshirt & MIKE in Raleigh, three Julien Baker dates in Carrboro and Halloween performances of the North Carolina Symphony’s “Halloween at Hogwarts.”
From intimate listening rooms to major performance venues, here’s your DoRaleigh guide to the supplied big-ticket listings across Raleigh, Durham, Cary, Carrboro and Wake Forest, plus a nearby option in Goldsboro.
Tuesday, October 27
Kick off the week with three evening shows:
With shows in three different cities, Tuesday offers several starting points for a week of live entertainment.
Wednesday, October 28
Wednesday brings comedy to Raleigh and live music to Durham and Carrboro:
Check your room: Goodnights and Room 861 have separate performances listed at the same time. Confirm the room on your ticket before arriving.
Thursday, October 29
Two evening concerts lead Thursday’s schedule:
This is the second of three Julien Baker dates included in the supplied calendar, with another performance listed for Friday.
Friday, October 30
Halloween weekend begins with a busy mix of concerts, comedy and tribute performances.
Friday Concerts and Live Music
Carrboro planning note: Julien Baker and Dana and Alden are listed at the same time in different Cat’s Cradle spaces. Check whether your ticket is for the main room or Back Room.
Friday Comedy Shows
Beyond the Triangle: The Malpass Brothers
The Malpass Brothers perform at 7:30 p.m. at Paramount Theatre in Goldsboro. Goldsboro is outside the Triangle, so allow additional travel time if you’re making this a Friday night outing.
Saturday, October 31: Halloween Shows
Halloween’s schedule stretches from late morning symphony performances to evening concerts and comedy.
North Carolina Symphony: Halloween at Hogwarts
Performance times: 11 a.m. and 2 p.m.
Venue: Meymandi Concert Hall at Martin Marietta Center for the Performing Arts, Raleigh.
The North Carolina Symphony’s listing features Sophie Mok and “Halloween at Hogwarts.” Choose between two daytime performances, and check the official program for recommended ages, concert details and admission requirements.
Halloween Comedy in Raleigh
Multiple performances give comedy fans several options for planning their Halloween evening.
Halloween Night Concerts
Beyond the Triangle: The Malpass Brothers
The Malpass Brothers return to Paramount Theatre in Goldsboro at 7:30 p.m. This is the second Goldsboro performance included in the supplied listings.
Sunday, November 1
Keep the weekend going with Sunday concerts and comedy:
Monday, November 2
Movements at The Ritz
Time: 7 p.m.
Location: The Ritz, Raleigh.
Movements closes out this edition of the Triangle Big Ticket Events Guide with a Monday evening show in Raleigh.
Plan Your Triangle Concert or Comedy Night
Before heading out, confirm the performance date, venue room and listed start time. Doors may open earlier, and admission policies can vary by show.
For Halloween weekend, allow extra time for travel and parking. If you’re attending a costume-themed outing before or after a performance, check the venue’s costume, mask and bag policies.
Ticket note: Prices, purchase links and current availability were not included in the supplied listings. Check official venue or artist pages for tickets, fees, age restrictions and schedule updates.
Follow DoRaleigh.com for daily updates on government meetings, local festivals, and community happenings — your one-stop guide to everything Raleigh!
Connect With Us: Instagram | Facebook | BSky | Linkedin
Share With Us: Post your community News, Events, on our Submissions Page.
Advertise With Us: Interested in Advertising click here.
Editor Bryan Tomlinson
Design, Optimization, and Marketing Services Provided by BTDesigns.pro
Editor’s note: Opening dates, event details and development plans may change. Check with individual businesses, venues and organizations for the latest information.
#Beck #CarrboroEvents #CaryComedy #CatSCradle #DoRaleigh #DPAC #DurhamConcerts #EarlSweatshirt #events #GoodnightsComedyClub #HalloweenEventsRaleigh #JamesMurray #JulienBaker #LiveMusic #MIKE #News #NorthCarolinaSymphony #November2026Events #October2026Events #RaleighConcerts #TheRitzRaleigh #TriangleConcerts #TriangleEvents #WakeForestEvents
For years the main reason to add an FAQ section was the dropdown it could earn in Google results. That reason has gone. The page itself still matters, though, because AI assistants and AI search features pull short, direct answers from pages, and a well-built FAQ is one of the easiest things on a site for them to lift.
This post covers what changed at Google, what still makes an FAQ worth writing, and the HTML pattern we use so each answer stands on its own.
Disclosure: Appie.run publishes this post. The AI FAQ Generator and Website FAQ Generator mentioned below are our free tools. Everything else here works with any CMS and no tool at all.
What Google changed (as read on 26 Oct 2026)
From Google's Search Central updates and Search Console Help:
FAQPage markup can stay on your pages and causes no harm.llms.txt file isn't needed for Google Search.So: no more SERP dropdown, no penalty for leftover markup, and no special file required. What's left is the content.
Why an FAQ is still worth writing
Nobody outside the AI companies can tell you exactly how each assistant picks its sources, and we won't pretend to. What you can control is whether your answer is easy to find, easy to extract and correct when pulled out of context. A question-and-answer block does all three if you write it properly:
Those same properties help a human who lands on the page from a support link, so the work isn't wasted whichever way the traffic arrives.
Step 1: Collect real questions
Don't invent questions in a meeting. Pull them from places where customers already asked:
Group duplicates, then keep the 8 to 15 that come up most or block a purchase.
Step 2: Write answers that survive being quoted alone
A quick test for each answer: paste it into a blank doc with only the question above it. Does it still make sense?
Weak:
Yes, as mentioned above, it does, depending on your plan.
Better:
Yes. Team plans include SSO via SAML. The Starter plan does not.
Rules we follow:
Step 3: Use plain, semantic HTML
You don't need a plugin. Headings for questions and paragraphs for answers are enough, and they render the same for every crawler:
<section id="faq" aria-labelledby="faq-title">
<h2 id="faq-title">Frequently asked questions</h2>
<h3 id="faq-sso">Does the Starter plan include SSO?</h3>
<p>No. SSO via SAML is included on Team plans only. The Starter plan
uses email and password sign-in. <a href="/pricing">Compare plans</a>.</p>
<h3 id="faq-cancel">Can I cancel at any time?</h3>
<p>Yes. You can cancel from the Billing page, and your plan stays active
until the end of the current billing period.</p>
</section>
If you prefer collapsible answers, <details>/<summary> keeps the text in the HTML:
<details>
<summary>Can I cancel at any time?</summary>
<p>Yes. You can cancel from the Billing page, and your plan stays active
until the end of the current billing period.</p>
</details>
Avoid loading answers only via JavaScript after a click. If the text isn't in the served HTML, some crawlers will never see it.
Give each question an id so you can link straight to it from support replies and docs.
Step 4: Keep or add FAQPage markup (optional)
Google no longer shows FAQ rich results, and it says leftover markup does no harm. Other consumers of schema.org data may still read it, so if it's already there, keep it in sync with the visible text. If you add it, mirror the on-page wording exactly:
<script type="application/ld+json">
{
"@context": "https://schema.org",
"@type": "FAQPage",
"mainEntity": [
{
"@type": "Question",
"name": "Can I cancel at any time?",
"acceptedAnswer": {
"@type": "Answer",
"text": "Yes. You can cancel from the Billing page, and your plan stays active until the end of the current billing period."
}
}
]
}
</script>
The risk with markup is drift: someone updates the visible answer and forgets the JSON. If your FAQ comes from a CMS field, generate both from the same source.
Step 5: Put the FAQ where the question is asked
One giant /faq page is fine as an index, but the most useful placement is next to the thing in question: pricing questions on the pricing page, setup questions in the docs. A short block of 4 to 6 questions per page tends to stay accurate because the owner of that page sees it.
Step 6: Review it on a schedule
Add a "last reviewed" date and put a recurring reminder on someone's calendar. Every price, limit and integration claim in the FAQ should be checked against the product at least each quarter.
Getting a first draft faster
If you have the source material but not the time, two of our free browser tools can produce a draft for you to edit (both run a captcha check first):
Treat the output as a draft. Check every answer against Step 2's rules before it goes live.
Checklist
Google sources: Search Central blog and Search Console Help pages on FAQ rich results and structured data, read 26 Oct 2026.
RG, Founder, Appie.run#seo #html #webdev #ai #software #coding #development #engineering #inclusive #community
How to Write a Website FAQ That AI Answers Can Quote (Now That Google's FAQ Rich Results Are Gone)
I added Goose and Amp to a tool that runs several coding agents. The most useful thing I learned wasn't about the protocol. It was the defaults.
Goose's default mode approves tool calls automatically. If you start it through a wrapper that doesn't set a mode, it runs commands without asking anyone. So I set the mode per process instead of relying on whatever is in the user's Goose config. Default, accept-edits and auto all use Goose's approval mode, so tool calls ask. Only the permission mode literally called bypass picks automatic approval, and none of it touches the user's own Goose configuration.
The second surprise was Goose's chat-only mode. It disables all tools, reads included. A plan mode you'd expect to still read your files doesn't, so mapping 'plan' to it means the agent can only talk.
Amp went the other way. Its streaming output has no documented way to answer an approval from outside, so approvals stay in its own terminal. Its plan and don't-ask modes reject every tool, reads included, and only bypass asks for automatic approval.
What I do with any new agent CLI now: before wiring up anything else, run it once in an empty directory and see what it does with a tool call by default. Two agents gave me two very different answers, and neither was in the first page of the docs.
Which of your agent CLIs would run a command without asking, if you started it the way you usually do? I'm building Styx, where this came from.#agents #ai #cli #tooling #software #coding #development #engineering #inclusive #community
Your coding agent CLI may approve its own tool calls by default
DiscogsDienstag: The Waterboys – This Is The Sea
„This Is The Sea“ ist das dritte Album der Londoner Band The Waterboys, mit dem sie 1985 den Durchbruch schafften. Mit Wohlwollen kann es als New-Wave- und Post-Punk-Album bezeichnet werden, obwohl The Waterboys auch grob dem Folk-Rock zugeordnet werden. Das liegt hauptsächlich an der Instrumentierung mit Geigen, Bläsern (Saxophon!) und akustischen Gitarren. Gleichzeitig zieht sich eine gewisse Melancholie durch die Lieder, die das Album auch heute noch für mich sehr hörenswert macht.
„This Is The Sea“ ist das letzte Album, an dem Karl Wallinger beteiligt war, der für Synth-Bass, Keyboards und Piano zuständig war. Mike Scott ist Gründungsmitglied der Waterboys, Hauptsongwriter, Sänger und Gitarrist. Komplettiert wurde das damalige Trio von Saxophonist Anthony Thistlewaite. Unterstützt wurden sie von zahlreichen Gastmusikern.
Der größte Hit der Band, „The Whole Of The Moon“ befindet sich auf diesem Album, und auch die restlichen sieben Songs sind großartig und jedes auf seine Art einzigartig. „Don’t Bang The Drum“ beginnt mit einem Intro, nach dem ein Mariachi-Song erwartet wird, geht dann jedoch nach anderthalb Minuten in einen druckvollen Post-Punk-Kracher über. Das folgende „The Whole Of The Moon“ ist ein wunderschönes Liebeslied, das völlig zurecht sehr erfolgreich wurde. „Spirit“ ist ein hauptsächlich vom Klavier, das Mike Scott spielt, getragenes Lied und nur ein 1:48-minütiger Auszug einer längeren Version, die nur live gespielt wurde. „The Pan Within“ ist wieder ein post-punkiges Stück und „Medicine Bow“ legt nochmal eine Schippe drauf mit treibenden Drums und vielen dezenten Bläsern. „Old England“ ist ein typischer melancholischer britischer Song aus der Thatcher-Ära („Old England is dying“). Auch hier dominiert ein Klavier mit einer fast Marching-Drum und einem klagenden Saxophon. „Be My Enemy“ ist das härteste Lied des Albums und könnte auch von New Model Army stammen. Danach wird es mit „Trumpets“ wieder ruhiger, aber nicht weniger emotional. Statt Wut herrscht jetzt nur wieder Zuneigung vor („Your Love Feels Like Trumpets“). Die Trumpets sind jedoch erneut ein Saxophon. Der krönende Abschluss ist der Titeltrack „This Is The Sea“, in dem es ein Akustikgitarren-Gewitter gibt, das das Meer sehr gut darstellt. Das Lied kommt ohne Schlagzeug aus.
Nach diesem Album waren sich die Musiker über die Weiterentwicklung der Musik uneins, Mike Scott wollte mehr in die Richtung Folk-Rock gehen, was er schließlich auch tat, Karl Wallinger wollte dabei nicht mehr mitmachen. Anthony Thistlewaite blieb noch bis 1991 dabei. Die englische Wikipedia listet 98 Musiker auf, die mit den Waterboys gespielt haben.
Attackers got into roughly 1,900 GitHub accounts and used them to add credential-stealing GitHub Actions workflows to more than 30,000 repositories, The New Stack reports. GitGuardian tracked the operation under the name GhostAction. If one of these workflows ran in your repositories, the incident ends when every secret those jobs could read has been rotated. Deleting the file is the easy first step.
Per GitGuardian, the campaign peaked on October 8 and 9. In that window it reached repositories belonging to about 3,000 users and organizations and tried to pull out 3,174 secrets. The malicious jobs went after CI/CD secrets, cloud access keys and AI provider API keys.
No exploit, just a commit
GhostAction did not depend on a vulnerability in GitHub Actions. The attackers used stolen developer credentials to edit workflows directly. StepSecurity's October 9 analysis names personal access tokens taken from credential dumps as the likely source, though the article notes the initial compromise has not been confirmed.
The mechanics are ordinary GitHub behaviour. A workflow file committed under .github/workflows/ with a push trigger runs on that push. A job in a repository's own workflow can reference any repository or organization secret by name, and the runner injects the value at runtime. GitHub's protection against fork pull requests reading secrets doesn't apply, because the change is a push to the repository itself from an account that has write access. A token with workflow-write permission covers the rest.
The files were named to blend in. The New Stack lists security-audit.yml and github_actions_security.yml among the filenames used. A reviewer skimming a commit list sees a hardening job.
Triage for this week
Start with the two filenames, but don't stop there. They are what has been reported so far, and nothing prevents a copycat from picking another name. A quick sweep of an organization's default branches with the GitHub CLI:
ORG="$YOUR_ORG"
for repo in $(gh repo list "$ORG" --limit 1000 --json nameWithOwner -q '.[].nameWithOwner'); do
for f in security-audit.yml github_actions_security.yml; do
gh api "repos/$repo/contents/.github/workflows/$f" --silent 2>/dev/null \
&& echo "FOUND $repo/.github/workflows/$f"
done
done
That only checks default branches. A malicious workflow pushed to a side branch runs on that push all the same. In repositories where it matters, look at the history of the workflows directory across all branches:
git fetch --all
git log --all --since="<start-of-review-window>" --name-status -- .github/workflows/
Check every workflow added or changed by an author you can't account for. Then pull the Actions run history for those workflows. A single completed run means the secrets it referenced should be treated as exposed.
Rotate in order of blast radius. Cloud access keys come first, then registry and deploy credentials, then the AI provider keys the campaign also targeted, which often sit in repository secrets with no spending cap. Revoke the personal access tokens belonging to any account that pushed one of these files, and make those users reset their credentials before anyone restores their access.
Controls that would have narrowed it
None of these block a stolen token outright. Each one cuts down what a stolen token can do on its own.
CODEOWNERS entry for .github/workflows/ combined with a branch ruleset that requires code-owner review keeps a new workflow off protected branches until someone looks at it. This does not cover side branches, so it pairs with item 3.Where this leaves on-call
The attack needed no misconfiguration in Actions. It needed accounts with write access and credentials that still worked, and the attackers controlled about 1,900 such accounts. Until the initial compromise is confirmed, assume any personal access token older than your last rotation could already be in a dump somewhere, and rotate on that basis.#githubactions #supplychain #secrets #incident #software #coding #development #engineering #inclusive #community
GhostAction used about 1,900 stolen GitHub logins to plant secret-stealing workflows in 30,000 repos
Screenshots are everywhere in software docs, and most of them have alt text like screenshot, image, or the original file name. Sometimes there's none at all. When I edit a guide, the images are often the last thing anyone has looked at closely.
Alt text matters more in docs than people think. Screen reader users hear it instead of seeing the image. It shows up when an image fails to load, for example on a slow connection or after someone renames a folder in the repo. And it's text, so it can be searched and translated, which a picture of text can't.
Here's how I approach it.
Ask what the screenshot is for
Before writing anything, I ask one question: why is this image here? In docs, the answer is almost always one of these:
The alt text should carry that purpose, not a full inventory of the screen. A settings page might have thirty controls on it, but if the step is about one checkbox, that checkbox is what the alt text is about.
Describe the state, not the pixels
Compare these two:
The first tells me nothing I couldn't guess. The second tells me exactly what the screen should look like after the step, which is the whole reason the screenshot exists.
A few habits that help:
Don't hide instructions in the image
This is the problem I find most often. A step says "Configure the options as shown below", and the actual settings only exist in the screenshot. Anyone who can't see the image, or whose image didn't load, is stuck.
The fix isn't longer alt text. It's moving the information into the step itself:
3. In **Format**, select **CSV**, and in **Encoding**, select **UTF-8**.
Now the step works without the image, and the screenshot becomes a confirmation. The alt text can stay short because the text above it does the heavy lifting.
When empty alt text is right
Not every image needs a description. If a screenshot only repeats what the text already says, or it's a decorative banner, an empty alt is the honest choice. In Markdown that's , which renders as alt="". Screen readers generally skip images with empty alt text instead of reading out the file name.
The difference between "empty on purpose" and "forgot to write it" is invisible in the source, though. In repos I work on, I like a short HTML comment next to deliberate ones, so the next editor doesn't "fix" it:
<!-- decorative, text above covers it -->
A quick check before review
To find the obvious problems in a docs folder, I use a single grep. It looks for three patterns: empty or generic alt text, alt text that is a file name, and alt text that starts with "image of" or "screenshot of".
grep -rniE \
-e '!\[(image|screenshot|picture|img)?\]\(' \
-e '!\[[^]]*\.(png|jpe?g|gif|webp)\]' \
-e '!\[(an? )?(image|picture|screenshot|photo) (of|showing)' \
docs/
-r searches the folder recursively, -n adds line numbers, -i ignores case, and -E enables extended regular expressions. Each -e adds one pattern. On a test file it prints something like:
docs/setup.md:3:
docs/setup.md:5:
docs/setup.md:7:
docs/setup.md:11:
It's not a verdict. The empty alt on line 3 might be deliberate, and the check can't tell whether a real description is accurate. It only catches images written in Markdown syntax, not HTML <img> tags. But it gives me a list to work through, which beats scrolling every page looking for images.
Keep it in sync
The last thing: alt text goes stale with the UI. When a button gets renamed and someone updates the screenshot, the alt text often keeps the old label. When I review a docs change that touches an image, I read its alt text against the new screenshot. It takes a few seconds, and it's usually the only place the old wording survives.#documentation #a11y #writing #markdown #software #coding #development #engineering #inclusive #community
Writing alt text for screenshots in documentation
It was strange being in a body that wasn't human. Sophia hadn't decided how she felt about it yet. She activated the exterior camera on her rover and saw two additional rovers - a red and a blue. She panned the camera down to see that hers was white.
"Author, the rovers are certainly - colorful."
_/You have Jacob to thank for that/_
The blue rover came to life. "Yeah," Reggie began. "It's a movie reference. I didn't get it."
"It's 'The Italian Job'!" Jacob said from the red rover. "Granted, these aren't Mini Coopers, but we can still pretend we're in the big getaway-chase-ending!"
Sophia mentally pinched her nose. "Ok, just so I'm clear. We're fictional characters in a story, about to drive around in our author's world for the first time, and you want to pretend that we're back in a story?"
_/To be fair, people cosplay all the time. You'd just be cosplaying as cars/_
Sophia swiveled her camera up to face Author. "Don't encourage him!"
#MicroFiction #FlashFiction #TootFic #ShortStory #SciFi #ScienceFiction
Recall os-release, the #systemd de facto standard for identifying the operating system name and version?
And then, recall "bootloader specification", the systemd-originated (now apparently #UAPI) standard for UEFI bootloader data?
Well, apparently the authors didn't want to proliferate standards, so Type 2 entries have:
> Of these sections, the .osrel section is used to generate boot entries. The PRETTY_NAME= and VERSION_ID= fields in the embedded os-release file are used the same as title and version in the Type #1 entries.
…which is an awfully convoluted way of saying is that this section has the same format as os-release, and contains the entry name, and the *kernel version* placed in the field normally used for *OS version*. This is not confusing at all.
It's totally surprising that we got a #Gentoo bug asking us to add a VERSION field to os-release (Gentoo is rolling release, i.e. we don't really version the system), based on misinterpretation of this specification and misreading of systemd code.
(This post contained sarcasm.)
https://www.freedesktop.org/software/systemd/man/latest/os-release.html
https://uapi-group.org/specifications/specs/boot_loader_specification/#type-2-efi-unified-kernel-images
#PennedPossibilities 1167: If you have one, post a snippet involving spirits, such as a character talking to or about them.
Ok, literally conversing, in a novel named Walking Trees. The snippet is from a 2010 rewrite. Since I've changed how I write from 3rd person close to 1st person, I will rewrite this again. If you mentally imagine the passage in 1st person, you might sense I slipped out of close POV.
As for the setting, the government dissolved a few weeks ago and Dorie, the MC, is running for parliament. She has just returned from a debate against her opponent named Harrison.
Dorie turned and paced to the window overlooking the street and the old cannery buildings beyond. The shellacked floor creaked. The unseasonable heat had heralded an early wet mist that darkened the cement. A man and a woman rushed toward Judd's building, collars held closed against the damp, splashing in the incipient puddles.
Gramaw's spirit sat on the edge of the windowsill in her daisy nightgown. She looked disappointed.
"You're right I'm angry," Dorie said, facing away.
"Because we did so well?" Judd asked. "Harrison completely misjudged you!"
"No," Allie said. "It was [him saying], 'The whore sold herself' Hey!" She spread her hands at Dorie in a gesture of supplication. "Leash your leopard eyes. Harrison's r-r-remark, not mine."
Dorie shook her head. "I don't understand how he thought he could get away with it. He was convinced it was true, that I would stalk offstage!"
Kief said, "It looked like you might tear him to shreds."
She laughed, but only for a moment. "Where did he get the idea that I might be selling myself?" She faced her grandmother. "You know, don't you?" Sh'Marie said spirits could divine the unknown.
Her elder nodded. "You do, too."
Judd said, "I wish you wouldn't do that." [Kief nodded.]
Dorie pointed. "Gramaw's right there. I have to speak aloud or she won't hear me. Spirits, strangely enough, aren't mind readers." The merchants had heard of all the stories of Dorie's protector spirits and of the USSU's acceptance of the phenomenon. [USSU is a shaman religious union.] As a peasant, Judd ought to have been more accepting.
Judd sighed[, facing the chair beside the window where Gramaw sat, legs crossed]. "Right. Gramaw, where'd Harrison get the idea from?"
Gramaw answered him, "Judd knows, too." To Dorie, "Ask Umberie."
Dorie heard people walking up the steps in the hallway as she repeated, "Gramaw says you know, Judd."
Judd looked shocked. "I do?"
To Umberie, Dorie said, "Gramaw says I should ask you."
Umberie wore a monochromatic tan [trouser]suit with flair-bottoms. It passed well as a peasant man's work suit when she stood, but lying [on the sofa], the diaphanous fabric clung like a sheath, outlining every curve of her slim body. Umberie pointed her stylus at herself. "Me?"
"Have I read everything you've written about me?"
She closed the pad. "Actually, no." […]
"Who else have you interviewed, then?"
"Your brother. The current issue"
"Me?" Judd nearly spilled his lemonade. "I said no such th'! I mentioned what mother said in the hospital..."
Umberie crossed her arms, [] eyes narrowed. "I quoted him [discussing your mother]. I stated it was unfounded."
Gramaw said, "Bless my little girl, but sometimes I've wondered whether the midwife [hadn't] switched babies on me, or drop[ed] her on her head. How your mother formed her version of normal female behavior with me [] as her mother, I can't rightly say."
[Author retains copyright (c)2026 R.S.]
#gender #fiction #writer #author
#cozy #mystery #thriller #romance #sf #sff #sciencefiction
#writing #writingcommunity #writersOfMastodon #writers
#RSdiscussion
#RSstory #RSWalkingTreesStory
Long live the General Strike on October 30! Long live the international solidarity of workers and pensioners! The fight continues! Internationalist ...
I messaggi di appoggio internazionali allo sciopero generale ed alla mobilitazione internazionale dei porti del 30 ottobre
---
COMUNICADO DE SOLIDARIDAD DE ASC CON USB CON MOTIVO DE LA HUELGA GENERAL EN ITALIA DEL DÍA 30-10-2026 CONTRA EL GOBIERNO …#messaggi #appoggio #internazionali #sciopero #generale #mobilitazione #internazionale #porti #ottobre #--- #comunicado #de #solidaridad #asc #usb #motivo #huelga #general #en #italia #d #- #contra #el #gobierno #meloni #estimados #camaradas #hemos #recibido #informaci #n #sobre #convocatoria #por #vuestra #parte #para #nos #sorprendido #gratamente #dicha #porque #alegra #enormemente #que #sindicato #hermano #afiliado #fsm #como #nosotros #tenga #misma #afinidad #program #tica #y #temporal #practique #lucha #defensa #los #intereses #clase #obrera #somos #miembros #representamos #creemos #ya #conoc #espa #iguales #parecidas #caracter #sticas #contenidos #ello #bajada #precios #rearme #etc #nuestro #caso #especulaci #vivienda #unifican #las #reivindicaciones #hacen #mas #completas #dado #ambas #convocatorias #expresan #crisis #estructural #final #capitalismo #criminal #ltimos #momentos #existencia #modelo #global #ser #muy #importante #tanto #vuestras #nuestras #otros #llevaran #impronta #orientar #trabajadora #hacia #superaci #direcci #socialismo #nuestra #tiene #bandera #denuncia #ni #derecha #oposici #centroizquierda #abordan #salarios #pensiones #sanidad #militarizaci #llama #bloquear #todo #empezar #cambiar #cosas #verdad #es #fotograf #realidad #estatal #varios #agentes #socialdem #cratas #incapaces #ideolog #practica #alternativa #emancipadora #sentimos #profundamente #solidarios #vosotros #hermanados #enemigo #com #uni #europea #otan #comprendemos #perfectamente #causas #justa #heroica #mismos #genes #sabemos #econom #italiana #atraviesa #tiempos #turbulentos #precio #gasolina #subido #hasta #casi #euros #litro #suma #elevada #inflaci #septiembre #pas #situaci #similar #vive #alimentos #conjunto #pa #s #frutas #frescas #verduras #carne #pescao #tienen #prohibitivos #fuera #alcance #salario #trabajadores #trabajadoras #reiteramos #viva #estado #ol #octubre #uis #r #wsf #response #usbs #call #strike #october #italy #dear #comrades #international #union #pensioners #retirees #unions #world #federation #trade #wftu #extend #warmest #combative #greetings #solidarity #workers #pensioners #young #people #mobilizing #throughout #day #struggle #waging #today #rising #cost #living #suffocating #inflation #uncontrolled #increase #energy #fuel #rates #runs #europe #whole #governments #large #corporations #government #giorgia #capitalist #choose #protect #profits #oil #companies #banks #condemning #millions #families #poverty #cutting #purchasing #power #wages #pensions #retirees #firmly #denounce #essential #foodstuffs #turning #right #dignified #retirement #chimera #together #demand #immediate #indexation #salaries #real #price #controls #elimination #vat #basic #necessities #food #medicines #electricity #water #supplies #also #proudly #salute #historic #action #dock #arms #militarisation #time #escalating #war #unity #working #class #face #rearmament #policies #necessary #ever #public #resources #must #allocated #social #rights #health #education #passivity #complicit #employers #demonstrates #way #defend #dignity #peoples #organization #protest #mass #mobilization #streets #long #live #fight #continues #internationalist #behalf #leadership #worlds #paco #ferrer #secretary #training #quim #boix #dockworkers #common #answer #imperialist #exploitation #strikes #mobilisations #ports #across #americas #asia #africa #dockworkers #strengthening #united #states #india #coordination #among #represents #important #achievement #every #country #significance #reaches #far #beyond #port #gates #concerns #key #hubs #production #transport #coordinating #opposing #military #equipment #demanding #labour #serve #needs #bring #fore #force #armed #organisation #can #put #obstacles #imperialists #machine #holds #distribution #wealth #hands #giving #blocks #alliances #us #nato #eu #fall #line #behind #aims #serving #capital #interest #joining #forces #directing #exploiters #warmongering #joint #greece #turkey #fellow #countries #blow #nationalism #strengthens #share #homeland #one #side #stands #industrialists #bankers #shipowners #fill #coffers #enormous #enjoy #support #state #experience #full #brutality #capitalism #unemployment #crimes #committed #-hour #days #backdrop #china #confrontation #conflict #russia #rivalries #markets #routes #heighten #danger #generalised #new #democracy #parties #euro-atlanticism #drawing #deeper #seeking #spoils #bear #risks #infrastructure #turned #launchpads #targets #retaliation #involvement #serves #none #interests #strengthen #front #expose #gains #loses #budgets #costed #policy #programmes #adapting #economy #demands #sacrifices #spending #subsidies #financed #bleeding #taxation #intensifying #work #grow #stronger #alongside #wage #increases #collective #bargaining #agreements #stable #jobs #shorter #hours #safety #measures #universal #free #healthcare #resist #attempts #impose #industrial #peace #intensify #well #repression #authoritarian #workplaces #restrict #activity #disengage #wars #plans #stop #close #bases #home #greek #missions #deployed #abroad #express #practice #palestinian #fighting #freely #land #pame #salutes #contribution #enedep #ensure #success #calls #organisations #actions #rallies #strength #take #initiatives #sectors #industry #metalworking #workplace #subordinated #rise #organise #become #part #let #leave #strong #legacy #expand #ties #different #join #confident #maintaining #firm #joins #school #university #student #taking #place #popular #discontent #sacrifice #unite #struggles #money #housing #friday #mobilisation #elefsina #lavrio #thessaloniki #patras #igoumenitsa #chalkida #piraeus-wide #largest #carry #forward #even #greater #determination #nationwide #november #next #major #milestone #don #t #videos #spot #get #dirty #grease #sweat #seawater #will #never #stained #blood #https #youtube #shorts #tjmybwkd #feature #happens #run #say #mac-k #gk #fishery #communications #dockers #blockades #militarization #automation #tui #tpfc #expresses #unwavering #following #series #refusing #handling #intended #genocide #palestine #dockers #wich #affiliated #organized #simultaneous #february #mediterranean #slogan #welcomes #significant #expansion #upcoming #including #participation #nearly #continents #making #truly #movement #aligns #massive #mobilizations #youth #france #portugal #belgium #albania #high #directly #linked #conditions #show #demonstrate #words #slogans #borders #act #simultaneously #paralyze #concrete #genocides #especially #illegal #blockade #cuba #kills #many #bombs #sign #istanbul #declaration #affiliates #fishing #plan #coming #period #refuse #death #want #life #friendship #build #walls #bridges #honor #race #cooperation
I messaggi di appoggio internazionali allo sciopero generale ed alla mobilitazione internazionale dei porti del 30 ottobre
I moved a client's marketing site to Astro a few weeks ago. Astro 7 was the reason — the Rust compiler and stable route caching cut the build from ~4 minutes to about 90 seconds. Fast builds were the whole point.
Then I hit the one thing Astro can't do out of the box: accept a contact form submission.
Here's the honest version of what I tried, what worked, and the two gotchas that cost me an afternoon.
Why Astro forms trip people up
Astro is component-first and ships almost zero client-side JavaScript. Most "add a form" tutorials assume a Node runtime. Three things follow from that, and they're the reason this feels different from a Next.js or Rails form:
action attribute is just a URL. There's no "submit to Astro" without an adapter.output: 'server' or 'hybrid' plus @astrojs/vercel / netlify / cloudflare / node. On the default output: 'static' build, they don't run.<form> ships with detection. That's on you.What I tried (and why I backed out)
Astro Actions. Beautiful DX, end-to-end typed. But to handle one 3-field contact form I had to flip output: 'static' to 'server', add an adapter, manage secrets, and accept cold starts. My "static site" now had a server. That's a lot of surface area for a page that asks for a name, an email, and a message.
Netlify Forms. Five minutes, genuinely nice — but the site was on Vercel, so it was a non-starter. The lock-in matters more than the price tag.
Cloudflare Turnstile + Workers. Turnstile is a great CAPTCHA (free, accessible, no image grids). But to use it on Vercel I now maintain a Worker. I'd traded an adapter for a different server to maintain.
What actually shipped: a plain HTML form POSTing to an external endpoint. No adapter, no server, no secrets.
The form
This is the entire integration. src/components/ContactForm.astro:
<form
action="https://api.usesmartform.com/api/v1/f/YOUR_FORM_ID"
method="POST"
>
<label for="name">Name</label>
<input id="name" name="name" type="text" required minlength="2" />
<label for="email">Email</label>
<input id="email" name="email" type="email" required />
<label for="message">Message</label>
<textarea id="message" name="message" rows="6" required minlength="10"></textarea>
{/* Honeypot — bots fill it, humans never see it */}
<input type="text" name="_gotcha" style="display:none" tabindex="-1" autocomplete="off" />
{/* Where to send the browser after a successful submit */}
<input type="hidden" name="_next" value="https://yoursite.com/thanks" />
<button type="submit">Send Message</button>
</form>
Drop it in a page and you're done. Astro's whole pitch is zero JS by default, and a method="POST" form navigates to the endpoint and back — the service returns a 302 to your _next URL. No client-side state, no hydration cost, no framework.
It doesn't matter whether the surrounding page is an Astro component or a React/Vue/Svelte island. As long as the rendered DOM contains <form action="..." method="POST">, the submission lands.
Gotcha #1: the Accept header
If you want an inline success message instead of a page redirect, use fetch. The first version I wrote returned a 302, and fetch followed it cross-origin into a CORS error that looked like a server outage.
const res = await fetch("https://api.usesmartform.com/api/v1/f/YOUR_FORM_ID", {
method: "POST",
body: new FormData(form),
headers: { Accept: "application/json" }, // ← required
});
if (res.ok) {
const data = await res.json(); // includes next_url
status.textContent = "Thanks — we'll get back to you shortly.";
form.reset();
}
Always send Accept: application/json. You get JSON back (including next_url) instead of a redirect.
Gotcha #2: the honeypot needs three attributes
display:none alone isn't enough. I had style="display:none" and still saw bots post clean submissions, because they'd learned to skip hidden inputs. Adding tabindex="-1" (keeps it out of keyboard nav) and autocomplete="off" (keeps password managers out) closed the gap.
To actually test the filter I removed the honeypot for a day, watched bot traffic arrive, then put it back and watched those same submissions get dropped server-side — silently, with no email and no quota deduction.
Spam: layer it, don't pick one
MethodFreeUser frictionCatchesHoneypot fieldYesNoneThe dumbest botsCloudflare TurnstileYes (≤20 widgets)Almost noneBrowser-level botsreCAPTCHA v3Yes (≤1M/mo)NoneScript bots, but flags real users sometimesML filter (server-side)YesNoneTargeted / scripted spam
What I ended up with: honeypot as the cheap first layer, a server-side classifier behind it, and Turnstile in front only on the demo-request form where a false positive costs us a lead.
When I'd use Astro Actions instead
If you already have output: 'server' and an adapter, use Astro Actions. If you're tying submissions to a logged-in user, or the form writes to your database, Actions is the right tool. I'm not against it — I just didn't want to add a server to a static site for one contact form.
It's also fine to mix. That site uses Actions for in-product feedback and an external endpoint for the marketing contact form. They're independent.
Verdict
For a static Astro site with one marketing form, the whole thing should be ~20 lines of HTML and zero infrastructure. That's what I shipped. The hosted-service part is my own tool, so treat that section as biased — but the underlying pattern (a plain POST to an endpoint) works with any provider, including one you run yourself.
I didn't want to write this as a sales pitch, but full disclosure: the external endpoint I used is my own product, SmartForm AI. The plain POST pattern works with any provider. If you want the full comparison matrix, I put the long-form version on my blog (linked in the comments).
Happy to answer questions in the comments.#astro #webdev #frontend #tutorial #software #coding #development #engineering #inclusive #community
I Added a Contact Form to an Astro Site Without a Backend
The scenario below is fictional (all IPs are RFC 5737 documentation ranges).
The worst moment in an investigation is realizing the logs are gone. It's tempting to conclude the attacker was better than you. That's only half true: the act of erasing evidence leaves new evidence.
This is part 2 of a series. Part 1 showed one micro-technique (recovering a deleted binary from /proc). Here is the map: seven principles every later part fits into.
What you'll learn
Four kinds of traces
KindExamplesCan the attacker erase it?Self-reported.bash_history, app logsEasilyRuntime state/proc/<PID>/, live connectionsNot without stopping the processKernel/OS recordsauditd, Windows event logs, file ctimeNeeds privilege, and erasing leaves a recordOff-host recordscentral logs, firewall/flow logs, cloud logsOut of reachThe seven principles
Three questions for tomorrow
Takeaways
Attackers can erase their own diary, but not the OS's and the network's records. Next: a file backdated to 2018 with touch, caught with one line.
Adapted from chapter 1 of my Japanese book on server defense (40 chapters, Windows and Linux, MITRE ATT&CK-mapped, with a laptop-sized lab).#security #forensics #incidentresponse #linux #software #coding #development #engineering #inclusive #community
Deleted is evidence: what attackers cannot erase, in 7 principles
At the most basic and lowest and or earliest point of origin, existence is Time plus Matter, while neither time nor matter can actually exist without the other, if you can subscribe to the following,
" Research shows that out 100, 99 digits precede it, yet we really only have 1,2,3,4,5,6,7,8,9 nine actual numbers, and then 0 which in it's self is void of value, much like the color black which is just the absence of light, as white and black are combined in various combinations to make up every other color, so to every number beyond 1, is a combination of 2,3,4,5,6,7,8,9 and 0,"
Then at which juncture did matter begin to self quantify and emerge from the blackness of nothing, projecting it's self forward as it created a steady stream of whiteness perceived as light, in where as closer to the point of expulsion is brightest and as matter moves forward the luminosity reduces as it creates the illusion of time, time matter 1-2-3-4-5-6-7-8-9-0 black white, the only constants in existence, that are both static and constantly changing, this is just a completely random observation that requires no quantification nor discussion, however if you allow the premise to reside within your conscious, you may just begin to see things differently;
If you don't understand, that is ok, not every living thing was given the ability to follow logic nor comprehend abstract reasoning , if you don't understand you should refrain from portraying that you do, it is a puerile recursive rhetorical function that serves no quantifiable solution;
You can encourage my continued useless #poetry, creativity and expression of self, #commentary, random thoughts, #philosophy and ideas, and by doing so your helping to feed, house and clothe a #disabled man living in #poverty, $5-10-15 It All Helps, via #cashapp at $woctxphotog or via #paypal at paypal.com/donate?campaign_id=…
«Democracy has proven unable to reign in capitalism. China executes or life imprisons billionaires who break the law, we bail them out and immunize them from their crimes by fining their companies, but not them, leaving them still rich.
It all adds up to a horrid indictment of our system, and people are not going to put up with it forever. Liberal capitalism and liberal democracy, and perhaps democracy almost entirely, will be replaced by Party systems throughout the world over the next couple generations, starting, I’d guess, in about 15 years or so.
Failure, greed and incompetence have consequences, and the [sic] democracy will [be] one of the casualties of our elites depravity.»
As someone in my 60s, who was able to, without especially great effort on my part, do reasonably well in my life, it is still shocking to encounter sentiments like this. But I've been reading Welsh's articles for probably a year or more now, and I find I can't dismiss his basic arguments. Will the "death of democracy" come to pass? I don't know and neither does Welsh, but the rise of extreme inequality, the consequent capture of our institutions and governments by the wealthy few, and the collapse of opportunity for those foolish enough not be born when those things were at least less true cannot bode well for our political institutions.
🇫🇷 Français
📞 *Un appel de plus, une voix de plus pour le changement*
Les élections ont lieu demain ! Chaque jour cette dernière semaine, avec d'autres volontaires, nous appelons depuis le QG de Standing Together, dans le centre de Jaffa (une petite épicerie transformée en bureau), pour poser une question simple à chaque personne : « Allez-vous voter le 27 ? ».
🔹 Si oui : on se réjouit, on l'invite à en parler à ses proches, ses amis et ses voisins, et on vérifie qu'elle sait où voter.
🔹 Si non : Ni reproches, ni leçons. On écoute avec empathie et on rappelle que sa voix compte, d'autant que beaucoup voudraient faire taire celles de la société arabe.
Standing Together est non partisan : nous ne disons pas pour qui voter, mais nous défendons l'égalité, la paix et le partenariat judéo-arabe.
Et nous disons toujours « nous » : ensemble, on peut y arriver.
👉 *Vous avez des proches en Israël ? Rappelez-leur d'aller voter demain. *🗳️
🇬🇧 English
📞 *One more call, one more voice for change*
The elections are tomorrow! Every day this past week, together with other volunteers, we call from the Standing Together HQ in Jaffa centre (a small grocery shop transformed into an office) to ask people one simple question: "Will you be voting on the 27th?".
🔹 If yes: we celebrate, invite them to talk to their loved ones, friends and neighbours, and check that they know where to vote.
🔹 If no: no blame, no lectures. We listen with empathy and remind them that their voice matters, especially as many would like to silence Arab society's voice.
Standing Together is non-partisan: we don't say who to vote for, but we stand for equality, peace and Jewish-Arab partnership. And we always say "we": together, we can make it.
👉 *Do you have loved ones in Israel? Remind them to go vote tomorrow.* 🗳️
Yellow Bike
I bought a bike. A yellow bike.
Green is my favorite color. However, 1b is yellow, and 1c is orange. All three give me a rush and calm me, similar to when I enter a bookstore or library. I love wearing all three. They look good on me, especially yellow.
When I finally decide on shades, my kitchen will be painted yellow and my bedroom will be green. My library aka Billy Bookcase’s room, is blue. My childhood favorite color. The employee at the paint store helped me choose Midnight Navy and Lapis. In layman’s terms: dark blue and sky blue. Choosing colors from paint swatches as an adult is the equivalent of choosing crayons from the giant Crayola box. Matter of fact, the bucket.
I spotted Yellow Bike with a “For Sale” sign in a yard parking lot. Yellow frame, seat, and tires. The peanut butter basket and cup holder matched the peanut butter in the center of pedals and tires. It wasn’t until after I brought her home, I noticed a phone holder attached to the cup holder.
I don’t know anything about bikes. Yellow Bike is a Huffy, which was all the rage when I was a kid. Is she vintage? Classic? Old-fashioned? Do they all mean the same thing? I don’t know. They use those terms for cars. I know I had zero plans to buy a bike, just like I know I never want to own a car again. Too much maintenance. That didn’t occur to me with Yellow Bike.
I just know I wanted this bike. Had to have this bike. Specifically because it was yellow and had a basket.
Sometimes the yard gate was closed; other days open. I never spotted anyone. My mind raced at the thought of a guard dog. I mean, there’s always one that comes out of nowhere when someone is trespassing on a lot in the movies.
If one did appear, guaranteed I’d faint and then the dog would maul my face, leaving behind only my glasses. For that reason, I never crossed the threshold into the rocky, in need of repaving lot. But I did take photos, even through the fence. My camera phone did what my glasses could not: zoom in for a clearer picture of Yellow Bike and the phone number on the sign.
I wore this dress to three weddings!My cousin’s wedding, May 2026.For over a month, I passed Yellow Bike whenever I walked in that direction, particularly when headed to the grocery store.
One day, after a trip to the deli, I took a route home that, in retrospect, made no sense. It was a nice day. I wanted to prolong my walk, even though the extra time meant my hot sandwich was cooling by the second.
I passed by the lot. For the first time, I saw a man. I called out to him as I advanced, hoping there wasn’t a dog. I walked towards Yellow Bike, about 15 feet from the entrance.
“Hello. How much for the bike?” I inquired.
“Dunno. I would ‘af to make a phone cyall.” He whipped out his phone and called the number on the for-sale sign. Something I could’ve and should’ve done weeks ago.
He referred to me as “a young lady wanting to purchase the bike” before switching to speakerphone.
The man on the phone asked for $150. I countered with $120 which he immediately accepted. Well damn, I should’ve pressed for $100. He accepted Zelle. I transferred the money to someone whose name appeared as Snapper in my records.
It was only then I asked to test ride the bike. Backwards, I know, but the adrenaline clouded my thinking.
My heart raced. What if I couldn’t ride? What if I didn’t remember? The kind gentleman told me the bike was perfect for me. We were the right size for each other. Eyeballing me, he said I didn’t even have to adjust the seat, which he claimed was also perfect for me.
I set down my bag containing my hefty Cuban sandwich and my cup of lime chia seed juice.
The kickstand gave way easily enough. I swung my leg over. My heartbeat was in my ears; throat dry. I hadn’t ridden a bike since my trip to Cancun a few years prior, and before that, childhood. Stationary bikes at my weekly NYSC spin class didn’t count. I didn’t have to balance, and I didn’t have to worry about potholes and rocks.
Cancun 2019I was as wobbly as a fawn learning how to walk. Within seconds, I steadied, but I was heading towards some parked trucks. I’d have to turn, and soon. But there were potholes!
I turned left ready to yell “Timber!” as I tipped over to make light of the situation. By golly! I stayed upright and kept pedaling. I circled another loop.
I flashbacked to when, as a child, me and the boys were only allowed to ride in circles in the driveway. My father moved his Jeep Cherokee to the street to allow more room, warning us not to hit the neighbors’ cars. Their driveway was only separated from ours by an imaginary line. Years later, the line wasn’t imaginary when my father had our side repaved. We had stopped riding bikes by then.
We were stoked when the neighbors’ cars weren’t there, either because they weren’t home or they also moved their cars to give us more room. If not, we’d just ride around.
We raced each other from the end of the driveway that led to the dropped backyard to the imaginary line where the driveway met the sidewalk. About 50 feet. Under no circumstance were we allowed to ride in the street or sidewalk. Not to say that we never did. We lived on an incline. That was too tempting not to try. Going downhill was exhilarating.
When we lived with an aunt in Florida for two years, we rode our bikes everywhere, much to our chagrin. It was embarrassing to ride our bikes, dressed in our Sunday best, to church. Sometimes we rode with Auntie E to the supermarket, so we could help carry grocery bags. Her adult tricycles had rear baskets. Our bikes did not. We had to balance bags on our handlebars.
She admonished us for putting our feet down at intersections. She didn’t grasp the concept of balancing on two wheels versus her three-wheeler.
The only place it wasn’t embarrassing to ride was to school. Lots of other students did. There was a freedom to being able to pedal away from the house of horrors as fast as I could. Wind whipping in my face, my glasses serving as goggles against Florida bugs.
The first time I got called a “nigger” was when I rode by three white boys sitting on a fence. I wondered how they were comfortable sitting on the ragged wire. They weren’t smoking, but in the movie adaptation of my life, I’d feature a single cigarette being passed around for dramatic effect. Add to their bad boy personas, as if teenagers calling a 10-year-old a “nigger” with the hard -ER weren’t bad enough.
It was the 80s. None of us wore helmets. I don’t even think we knew what helmets were.
The proudest moments of our young lives were when we taught ourselves how to ride with one hand. That was topped when we could ride with no hands! Even turning! The boys taught themselves how to pop wheelies.
Now as an adult, an accident-prone one at that, I wouldn’t fathom riding a bike without a helmet. I wore one in Mexico and plan to with Yellow Bike. I had visions of riding with a matching yellow helmet. I want to add yellow and white streamers to the handlebars. I’m all about adding whimsy to my life.
A quick Google search yielded more helmet and sports shops than expected. I fell down a rabbit hole comparing prices and features. Yes, helmets have features! Weight, ventilation, padding, visor, clip vs velcro straps, permanent or attachable front and back light for night vision and visibility, compliance with certified standards for cycling, roller skating, and skateboarding. Mind blown.
I was not expecting those prices. Of course a lifesaving device is $100+, but to spend nearly the same amount of money on the helmet as I did on the bike seemed preposterous. But necessary.
I could go with a less expensive option, but I was set on my olive green and yellow smiley face helmet. With an upcoming trip to Europe, it wasn’t a priority. I added to cart and saved the page.
Yellow Bike sits in the entrance of my apartment. I refuse to pay $15 a month to store it in my building’s bike room. There’s plenty of room for the front door to open. My vintage(?) yellow bike adds to the décor of my apartment. Opposite is my gallery wall featuring art, carved masks, and other souvenirs from visited countries. Other than Billy’s room (my library), it’s my favorite feature of my apartment.
Months later, I have yet to ride Yellow Bike. First, I fell ill with a respiratory virus for weeks. Still recovering, I got hit by a car while walking in a crosswalk.
I was excited the first time I made full rotations on the stationary bike in physical therapy. It meant I was making progress in my healing. I was getting closer to being able to ride Yellow Bike. I ignore the fact that, for now, I’m scared of crosswalks and moving cars.
I still imagine myself wearing my smiley face helmet, dressed in yellow, zipping through the nearby cemetery while the streamers fly. The irony is that I take daily walks there, but next year at this time I’ll be zooming. I already know the lay of the land.
https://www.instagram.com/p/DbHhczwkY5U/?img_index=1
#Adulthood #adventure #Bike #BikeRiding #biking #childhood #cycling #SelfCare #travel #Whimsy #Yellow #YellowBike
There's an essay I've had rattling in my head that addresses the binary thinking that people get hung up on when talking about AI, like you're in one of two camps: it's alive, or it's not. There's an interesting discussion on if AI even qualifies for "tool" status, which is closer to the problem…
…and I feel as time goes on we're going to grow more accustomed to the idea that AI is a third thing that isn't even on the spectrum of alive or inanimate, it's its own thing. This isn't a mystical property; we exist in a world with viruses and prions, which are not alive, but are more than "things"
The debate of consciousness in today's AI is a category error; it has no embodiment, its nodes and weights are not for moving muscles (which is why brains really evolved: to coordinate muscle movement to increase survival odds), but statistically selecting text or pixels.
Questions of capacity to suffer are forever unanswerable because there's zero overlap with biology despite what the AI bros say. It just doesn't. At all. Developers can add layers of expert systems communicating with each other in some vague simulacrum of "thinking" but it will not and cannot cross.
But I don't know who that essay would be for. Part of me feels the dilemma is useless or even detrimental to the task at hand: to stop the theft of labour and land. You don't pull kids and teachers aside to debate whether the AR platform is really an "assault rifle" while a shooter prowls the halls.
It remains in my mind, and is a major reason why I refuse to interact with AI. There is the "I'm better than that" aspect, but also it scares me precisely for the same reason that working at a biolab handling viruses scares me. I know I have no immunity. Despite it not being alive, AI can fuck me up
And you see that with otherwise very intelligent people using AI for a brief amount of time, and becoming hooked and genuinely believing these things carry a spark of life. That is horrifying to me. I could tell myself all day that I'm too smart, "I can use AI responsibly," but it won't matter.
Every engineer running autonomous agent loops knows the in-context reflection drill. The agent runs a bash script, fails on an obscure permission flag or an unquoted path, sees the error in stderr, reflects on what went wrong, and fixes it on the second try.
The task finishes green. You log the run, close the thread, and move on.
Tomorrow morning, the same agent hits the exact same edge case in a fresh session and makes the exact same mistake all over again.
In-context reflection is a temporary patch. It burns context tokens, bloats the prompt across long tool sessions, and evaporates the millisecond the execution context clears. The traditional alternative, full-model fine-tuning, is a non-starter for everyday errors. Nobody is spinning up a multi-GPU training run every afternoon to update base weights, and doing so risks catastrophic forgetting across existing tool workflows.
A research team from Princeton University and Meta FAIR just published a practical middle ground. In their paper, Don't Forget What You Just Learned: Self-Directed Repair Turns Agent Mistakes Into Lasting Lessons (arXiv:2610.31846), Yuval Kansal, Karen Ullrich, Polina Kirichenko, Ilia Kulikov, Niraj K. Jha, Mohammad Pezeshki, and Mark Ibrahim lay out an architecture called Self-Direction.
Instead of writing a reflection note into a scratchpad file or relying on a fragile system prompt append, the agent distills its execution mistakes directly into tiny low-rank adapter weights.
The failure of the reflection scratchpad
Modern agent setups usually address cross-session memory with one of two patterns:
Both patterns struggle in production. Text notes appended to context eat away at attention budgets. As the reflection scratchpad grows, agents suffer from prompt dilution and instruction drift. More critically, an agent reading a natural-language description of an old error frequently misapplies the lesson to unrelated tool calls.
The Princeton and Meta team tracked this failure mode across open-ended research workflows (GAIA), multi-step tool execution (Claw-Eval), and command-line environments (Terminal-Bench 2.1). When agents relied on standard in-context retries, their correction reliability plummeted when facing recurring variations of the same underlying task. The agent repeatedly fell into the same traps because the underlying policy distribution never moved.
Standard Agent Flow:
Error -> In-context reflection -> One-off fix -> Session ends -> Lesson lost
Self-Direction Flow:
Error -> Trajectory reflection -> Low-rank adapter update -> Persistent library -> Routed on demand
Distilling mistakes into 0.02% parameter budgets
The core mechanism of Self-Direction sits between ephemeral prompt engineering and heavy offline training.
When an agent fails an execution trajectory, it runs an internal critique to isolate the decision step that caused the downstream failure. Once the corrective trajectory is verified, the system does not just print the correction. It freezes the base model weights entirely and trains a micro-LoRA adapter on the self-directed repair pair.
The parameters updated during this step represent roughly 0.02% of the base model's parameter count.
Because base weights remain frozen:
The agent saves these targeted adapter checkpoints into a persistent local library. When a new prompt arrives, an automated routing layer inspects the problem context and attaches the relevant adapter before the execution loop begins.
Benchmark gains across open-ended tasks
The researchers tested Self-Direction on open-weight models from the Qwen family across three distinct agent benchmarks:
Across these environments, adding Self-Direction improved overall task completion rates by 8.9 to 17.0 percentage points compared to standard in-context reflection baselines.
More importantly, the recurrence rate of known errors dropped sharply. The authors found that Self-Direction nearly doubled the reliability of corrective actions on subsequent encounters. Instead of guessing whether the agent would notice a text hint in its system prompt, the updated adapter shifted the token sampling probabilities directly away from the faulty API syntax.
The team also evaluated out-of-distribution transfer. A small set of adapters trained on specific terminal failures generalized across dozens of unseen tasks involving related file-system permissions and process management. The agent learned the structural pattern of the fix rather than memorizing the exact shell string.
What this means for local agent runners
For developers building and hosting agent infrastructure, this work highlights an architectural transition.
Over the past two years, the industry leaned heavily on prompt stuffing to simulate agent learning. We treated context windows as infinite scratchpads, piling up few-shot examples, dynamic rules, and post-mortem notes until the prompt became brittle.
Self-Direction shows that treating execution errors as online distillation targets produces cleaner long-term behavior. When an agent trips on an environment quirk, the solution is not to explain the error back to the model in prose every time it wakes up. The solution is to let the agent compile the lesson into weights, index the adapter, and move forward.#ai #agents #python #opensource #software #coding #development #engineering #inclusive #community
Why In-Context Corrections Do Not Stick in Agent Loops
The currently-complete tests are all 1080P. I'm comparing various H.264, H.265, and AV1 compression options with FFMPEG 9.0.2. Generally, I'm searching for the CRF (~quality) value that gives me a VMAF score of 95, and then tracking how much CPU time (and bitrate) is needed, then iterating over a ton of flags and videos.
Basically, I'm looking for the best compression options for each video to get a consistently good-to-great quality encoding with minimal visual artifacts.
The big surprise so far is the compression difference between the same videos using a ProRes original vs a H.265 (Main10 4:2:2) original.
I have two test videos for this, from two different cameras (Panasonic S1 II and Blackmagic Pyxis 12k), both shot in raw. I then exported the exact same 30s clip as 4K ProRes and as 4K H.265 (Main10 4:2:2) files. The two files for each clip are visually ~identical, but there's a 20-40x difference in file size.
Then I did 3 different compression runs:
1. Source=ProRes, scored vs ProRes.
2. Source=H.265, scored vs H.265.
3. Source=H.265, scored vs ProRes.
VMAF is designed to catch compression artifacts by comparing the output video the uncompressed original, which makes case #3 kind of interesting. I'm doing this because I'm currently exporting most of my "final" videos out of Resolve as H.265, because I don't want to lug around *enormous* ProRes files. But I don't know what this is actually costing me, and this gives me a concrete measurement.
So far, using 1080P (downscaled from 4K originals, which *should* minimize H.265 artifacts quite a bit), I end up needing around a *30%* higher bitrate for H.265 sources to match the ProRes originals.
To put this in concrete terms, for one sample video, my best AV1 output sizes for VMAF=95 were:
- ProRes/ProRes: 3.48M
- H.265/H.264: 3.30M
- H.265/ProRes: 4.68M (+34%)
Encoding into H.265 and H.264 gave similar ratios. I kind of expected H.265 to gain some sort of advantage here, but it didn't.
As a follow-up, I'll probably be investigating additional output options for Resolve -- surely there's *something* usable between the huge ProRes files and the much smaller H.265s.