blog.erincandescent.net

blog.erincandescent.net

The Mastodon 5.0 design is... weird. I don't understand it. I've not hated on previous Mastodon designs but this time, to me it just looks worse than 4.x 🤷‍♀️

I have been doing some work on my blog recently to make it play better with the ATProto ecosystem, and.

I had a lot of dreams back in 2014 as to the sorts of social applications you could build with ActivityPub and very few of them really materialised. In 2026 they have materialised, on ATProto.

It may have taken a decade longer than I'd wanted but its really nice to see.

[8 comments]

For anyone trying to interpret Anthropic's S1 - the "Change in fair value of convertible notes, etc" line with the $72B loss as of June 2026? That's "we have given out a lot of options and the value of our shares have increased and hence these options are now worth more". No "actual" money has been lost here.

It's not nothing (as a protective shareholder you should be very much worried about dilution!) but their actual cash and asset loss over the period is ~€8B

On the operating side they are/were actually very close to profitability, though whether that holds with their recent price cuts is another matter!

[5 comments]

Maybe Unix systems should ship an actual certificate validation daemon that speaks the Server-Based Certificate Validation Protocol (SCVP) or similar so that

  1. everyone can share one SCT-checker etc,
  2. we can centralise fetching updated revocation lists,
  3. we can centralise the logic we'll need for merkle tree certifikates,
  4. we don't have repeats of mistakes like those times certificates ended up in the CA Certificates bundle because they were in the Mozilla root store to be explicitly revoked

bonus points if for k8s & docker setups you can just bind-mount the socket into the container.

[1 comment]

In reply to Today's PHP Security Release, and How We're Strengthening PHP Security

Perhaps if Chainguard are on your advance disclosure lists, they shouldn't be

On October 21st at 07:41 UTC, more than six hours before the coordinated release, Chainguard unilaterally broke the embargo and published built images containing the fix. Like other distributors, Chainguard had received the patch in advance so its users could update the moment the vulnerabilities were disclosed. Any attacker could now study the fix in binary form while every other PHP user was still waiting for the release. This disregarded weeks of work by many parties toward a coordinated disclosure.

[4 comments]