@blog@shkspr.mobi avatar

blog

@blog@shkspr.mobi

This profile is from a federated server and may be incomplete. Browse more on the original instance.

blog, to history
@blog@shkspr.mobi avatar

Electricity That's Too Cheap To Meter
https://shkspr.mobi/blog/2023/12/electricity-thats-too-cheap-to-meter/

Nuclear power was sold to the world as a safe, clean, and economically viable source of electricity. We were told that it would be "too cheap to meter"1. Even the most ardent proponent of nuclear power will have to admit that hasn't come to pass. Construction costs for nuclear power stations are dwarfed only by their decommissioning costs. Yes, politics and regulation conspire to increase the price - but nuclear hasn't made electricity particularly cheap. Indeed, we mostly seem to be paying more than ever for our power.

Well, not quite.

On Christmas Eve, my electricity company emailed me to say that I would have several hours of free electricity. They would charge me £0.00 per kWh. More than that, at a few specific times they would pay me for my electricity use!

Here's the graph of my half-hourly prices:

Graph of electricity prices. Some are negative.

Most factories and heavy industrial plants weren't running the day before Christmas. UK power usage spikes when everyone boils a kettle at the end of a football match or other similar event - but there was nothing so momentous happening at 3AM. So supply outstripped demand.

Anyone with a smart-meter could have been paid to charge their car, run their tumble dryer, or stay up until the wee hours playing on their console.

And was it nuclear power which did this? No.

Dashboard showing electricity prices in the negative. Around two thirds of the electricity is being provided by wind.

As shown on the live grid tracker about two-thirds of the day's electricity came from renewables. It was pretty overcast, and our solar panels barely made 1kWh.

It wasn't mined uranium which gave us power which literally had to be given away; about 62% of the electricity came from wind.

At this point, the nuclear lobby will start whinging about subsidies (both nukes and renewables are generously subsidised) and how wind can't provide a base load (which is fair). But although sticking a bunch of turbines in costal waters is an engineering marvel - it's pretty cheap compared to building and maintaining a nuclear power station.

Wind - and other renewables - have done what nuclear couldn't. They have provided such an abundance of electricity that consumers are paid to use it.

History and the Future

It's worth looking at the original quote from 1954 about electricity becoming too cheap to meter:

Transmutation of the elements, unlimited power, ability to investigate the working of living cells by tracer atoms, the secret of photosynthesis about to be uncovered, -- these and a host of other results all in 15 short years. It is not too much to expect that our children will enjoy in their homes electrical energy too cheap to meter, -- will know of great periodic regional famines in the world only as matters of history, -- will travel effortlessly over the seas and under them and through the air with a minimum of danger and at great speeds, -- and will experience a lifespan far longer than ours, as disease yields and man comes to understand what causes him to age. This is the forecast for an age of peace.

As well as nuclear, he talks about "photosynthesis". Well, the UK now has 15.6 GW of solar capacity across 1,430,994 installations. A small part of that is my solar panels!

The UK also has around 27GW of wind capcity installed.

It is entirely possible that the UK will have generated the majority of 2023's electricity from renewables.

Because home appliances are increasingly efficient, domestic energy use is falling - it's down 19% since 2010. Electricity use by domestic properties was about 96.2 TWh in 2022 and 135 TWh was generated by renewables.

Yes, electricity is fungible, but you can convincingly make the case that every home in the UK was powered by renewables.

Solar panels don't work at night, and wind-turbines don't work when there's no wind. We'll always need something to be able to provide a base-load of electricity. That might be nuclear, or fossil fuels, or it might be storage from the excess power from renewables.

Sadly, the world is still filled with war, famine, and disease. But, for a few moments on a winter's evening, wind power genuinely became too cheap to meter.

Shameless Plug

If you want to move to a time-of-day electricity tariff, you can join Octopus Energy - if you use that link, we both get £50 bill credit.


  1. There is a lot of contention about that phrase. It was (probably) about the future prospects of nuclear fusion - but it became attached to nuclear fission. You can read more at the United States Nuclear Regulatory Commission

https://shkspr.mobi/blog/2023/12/electricity-thats-too-cheap-to-meter/

blog, (edited ) to fediverse
@blog@shkspr.mobi avatar

A (tiny, incomplete, single user, write-only) ActivityPub server in PHP
https://shkspr.mobi/blog/2024/02/a-tiny-incomplete-single-user-write-only-activitypub-server-in-php/

I've written an ActivityPub server which . That's all it does. It won't record favourites or reposts. There's no support for following other accounts or receiving replies. It cannot delete or update posts nor can it verify signatures. It doesn't have a database or any storage beyond flat files.

But it will happily send messages and allow itself to be followed.

This shows that it is totally possible to broadcast fully-featured ActivityPub messages to the Fediverse with minimal coding skills and modest resources.

Why

I wanted to create a service a bit like FourSquare. For this, I needed an ActivityPub server which allows posting geotagged locations to the Fediverse.

I didn't want to install a fully-featured server with lots of complex parts. So I (foolishly) decided to write my own. I had a lot of trouble with HTTP Signatures. Because they are cursed and I cannot read documentation. But mostly the cursed thing.

How

Creating a minimum viable Mastodon instance can be done with half a dozen static files. That gets you an account that people can see. They can't follow it or receive any posts though.

I wanted to use PHP to build an interactive server. PHP is supported everywhere and is simple to deploy. Luckily, Robb Knight has written an excellent tutorial, so I ripped off his code and rewrote it for Symfony.

The structure is relatively straightforward.

  • /.well-known/webfinger is a static file which gives information about where to find details of the account.
  • /[username] is a static file which has the user's metadata, public key, and links to avatar images.
  • /following and /followers are also static files which say how many users are being followed / are following.
  • /posts/[GUID] a directory with JSON files saved to disk - each ones contains the published ActivityPub note.
  • /photos/ is a directory with any uploaded media in it.
  • /outbox is a list of all the posts which have been published.
  • /inbox is an external API endpoint. An ActivityPub server sends it a follow request, the endpoint then POSTs a cryptographically signed Accept message to the follower's inbox. The follower's inbox address is saved to disk.
  • /logs is a listing of all the messages received by the inbox.
  • /new is a password protected page which lets you write a message. This is then sent to...
  • /send is an internal API endpoint. It constructs an ActivityPub note, with attached location metadata, and POSTs it to each follower's inbox with a cryptographic signature.

That's it.

The front-end grabs my phone's geolocation and shows the 25 nearest places within 100 metres. One click and the page posts to the /send endpoint which then publishes a message saying I'm checked in. It is also possible to attach to the post a short message and a single photo with alt text.

There's no database. Posts are saved as JSON documents. Images are uploaded to a directory. It is single-user, so there is no account management.

What Works

  • Users can find the account.
  • Users can follow the account and receive updates.
  • Posts contain geotag metadata.
  • Posts contain a description of the place.
  • Posts contain an OSM link to the place.
  • Posts contain a custom message.
  • Posts autolink (sort of).
  • Posts can have an image attached to them.
  • Messages to the inbox are recorded (but not yet integrated).

ToDo

  • My account only has a few dozen followers, some of whom share the same sever. Even with cURL multi handle, it takes time to post to several servers.
  • It posts plain text. It doesn't autolink websites
  • Hashtags are linked when viewed remotely, but they don't go anywhere locally.
  • There's no language selection - it is hard-coded to English.
  • The outbox isn't paginated.
  • The UI looks crap - but it is only me using it.
  • There's only a basic front-page showing a map of all my check-ins.
  • Replies are logged, but there's no easy way to see them.
  • Doesn't show any metadata about the place being checked-in to. It could use the item's website (if any) or hashtags for the type of amenity it is.
  • No way to handle being unfollowed.
  • No way to remove servers which have died.
  • Probably lots more.

Other Resources

I found these resources helpful while creating this project:

What's Next?

I've raised an issue on Mastodon to see if they can support showing locations in posts. Hopefully, one day, they'll allow adding locations and then I can shut this down.

The code needs tidying up - it is very much a scratch-my-own-itch development. Probably riddled with bugs and security holes.

World domination?

Where

You can laugh at my code on GitHub.

You can look at my check-ins on a map.

You can follow my location on the Fediverse at @edent_location@location.edent.tel

https://shkspr.mobi/blog/2024/02/a-tiny-incomplete-single-user-write-only-activitypub-server-in-php/

blog, to fediverse
@blog@shkspr.mobi avatar

Rebuilding FourSquare for ActivityPub using OpenStreetMap
https://shkspr.mobi/blog/2024/01/rebuilding-foursquare-for-activitypub-using-openstreetmap/

I used to like the original FourSquare. The "mayor" stuff was a bit silly, and my friends never left that many reviews, but I loved being able to signal to my friends "I am at this cool museum" or "We're at this pub if you want to meet" or "Spending the day at the park".

So, is there a way to recreate that early Web 2.0 experience with open data and ActivityPub? Let's find out!

This quest is divided into two parts.

  1. Get nearby "Points of Interest" (POI) from OpenStreetMap.
  2. Share a location on the Fediverse.

OpenStreetMap API

OpenStreetMap is the Wikipedia of maps. It is a freely available resource which anyone can edit (if they're skilled enough).

It also comes with a pretty decent API for querying things. For example, https://overpass-turbo.eu/s/1GaE.

Map of a part of London. Some parts are highlighted.

As you can see, it has highlighted some useful areas - a pharmacy and a pub. But it has ignored other useful locations - the train station and the park. It has also included some things that we may not want - bike parking and a taxi rank.

What API call is needed to get useful locations of of OverPass?

It's possible to specify the type of thing to find using nw["amenity"="restaurant"]; - but adding every single type of thing would quickly end up with a very large query containing hundreds of types.

It is also possible to exclude specific types of places. This retrieves all amenities except for fast food joints:

nw["amenity"]({{bbox}});-nw["amenity"="fast_food"]({{bbox}});

Again, that would be complex.

Perhaps one solution is just to return everything and let the user decide if they want to check in to a telephone kiosk or a fire hydrant? That's a bit user-hostile.

Instead, this query returns everything which has a name nw["name"]({{bbox}});

Map of London with several bits highlighted.

That cuts out any unnamed things - like park benches and car-sharing spots. But it does add named roads and train lines.

It is possible to use filters to exclude results from OverPass. The best that I can come up with is: https://overpass-turbo.eu/s/1GaR

That gets everything which has a name, but isn't a highway or railway or waterway or powerline. It isn't perfect - but it will do!

This is the query which will retrieve the 25 nearest things within 100 metres of a specific latitude and longitude. It includes the name and any other tags, the location, and the OSM ID.

https://overpass-api.de/api/interpreter?data=%5Bout:json%5D;nw%5B%22name%22%5D%5B%21%22highway%22%5D%5B%21%22railway%22%5D%5B%21%22waterway%22%5D%5B%21%22power%22%5D(around:100,51.5202,-0.1040);out%20center%20qt%2025;

ActivityPub

There's good news and bad news here. Firstly, ActivityStreams (which are subscribed to in ActivityPub) supports the concept of "Place" and "Location".

Once the user has a latitude and longitude, the can share it - along with a message, photo, or anything else.

Something like:

{    "@context": "https://www.w3.org/ns/activitystreams",    "type": "Note",    "content": "Here in NYC! <a href="https://www.openstreetmap.org/way/958999496">John Lennon's Imagine Mosaic</a>.",    "attachment": [        {            "type": "Image",            "mediaType": "image/jpeg",            "url": "https://fastly.4sqi.net/img/general/590x786/56367_9pxuZJD7d1hgPdaMFcFq1pipvTTMynBJsYcpHH-b8mU.jpg",            "name": "A photo of a mosaic which says 'Imagine'."        }    ],    "location": {        "name": "John Lennon's Imagine",        "type": "Place",        "longitude": 40.77563,        "latitude": -73.97474    }}

For example, here's a PixelFed post with an attached location - and this is the JSON representation. That status can be reposted into other social networks.

It is worth noting that Mastodon doesn't (natively) support location - if you view my repost of that PixelFed post you'll see there's no location metadata attached. That's OK! It just means that the status needs to include human-readable data.

Similarly, Mastodon doesn't support the https://www.w3.org/TR/activitystreams-vocabulary/#dfn-arrive vocabulary. So this will be limited to a message with a location attached.

Other ActivityPub services .

Putting it all together

Well… that's a job for next week. Probably!

  • Building a web site which gets the user's location is easy.
  • Getting the data from OverPass should be straightforward.
  • Creating an ActivityPub server which can post geotagged notes into the Fediverse might be a little beyond my skillset! Some testing with Darius Kazemi's AP Glitch suggests this should work.

If you'd like to help, please leave a comment.

https://shkspr.mobi/blog/2024/01/rebuilding-foursquare-for-activitypub-using-openstreetmap/

blog, to chinese
@blog@shkspr.mobi avatar

How Do You Pronounce Your Domain Name?
https://shkspr.mobi/blog/2013/12/how-do-you-pronounce-your-domain-name/

I was listening to a podcast recently which was kind enough to mention one of my blog posts. The presenter said:

...and you should Google for this, because I'm really not sure how to pronounce this. Is it shu-huk-spur? dot mobby?

Le sigh! It's a conversation I have most weeks when I'm on the phone to someone - usually a call centre - and they ask for my email address.

"Sierra Hotel Kilo Sierra Papa Romeo Dot Mike Oscar Bravo India"

Whereupon I am inevitably asked:

Is that dot com or dot co dot UK at the end, sir?

Yes! I have chosen an almost unpronounceable domain on an obscure TLD. Woe is me!

Originally, I thought this wouldn't be a problem. Typing in the domain is quick and easy. But a surprising number of organisations still insist on taking personal data over the phone. Which means more reading out the phonetic spelling.

Frustratingly, a large number of websites refuse to accept .mobi as a valid TLD for email addresses. The geniuses who coded them appeared to think that every email address must end with a 3 character (.com, .org, .net) or 2 character (.uk, .de, .io) sequence. Despite the fact that there are dozens of domains which don't fit in this restriction.

Doubling Down

Being the belligerent sod that I am, I refuse to give in to the tyranny of the spoken word! We live in an digital world and digital data should be communicated by digital means. I want to impart information like my email address over the wire - not over the phone.

Regular readers will know that I was thwarted in my quest to buy a .中国 domain - but I did manage to grab http://莎士比亚.org/.

I think I'm going to move my primary email to that domain. When I get some call-centre who won't let me fill in a form online to give them my details, I shall very politely say my email address is:

Eden - yes, like the garden - at Shā​shì​bǐ​yà... Oh, of course, the stroke order is... Well, no, it's a Mandarin Chinese domain... No... No... Fine, would you like the punycode representation? Hello?

I'll also refuse to do business when any organisation which doesn't recognise IDN email addresses. That'll show 'em!

Perhaps I'll also move this blog over to that domain as well. I wonder what impact speakability has on SEO?

https://shkspr.mobi/blog/2013/12/how-do-you-pronounce-your-domain-name/

blog, to fediverse
@blog@shkspr.mobi avatar

Internationalise The Fediverse
https://shkspr.mobi/blog/2024/02/internationalise-the-fediverse/

We live in the future now. It is OK to use Unicode everywhere.

It seems bizarre to me that modern Internet services sometimes "forget" that there's a world outside the Anglosphere. Some people have the temerity to speak foreign languages! And some of those languages have accents on their letters!! Even worse, some don't use English letters at all!!!

A decade ago, I was miffed that GitHub only supported some ASCII characters in its project names. There's no technical reason why your repo can't be called "ഹലോ വേൾഡ്".

Similarly, I'm frustrated that Mastodon (the largest ActivityPub service) doesn't allow Unicode usernames and has resisted efforts to change.

So I built a small ActivityPub server which publishes content from an Actor called @你好@i18n.viii.fi - it is only a demo account, but it works!

Some ActivityPub clients report that they are able to follow it and receive messages from it. Others - like Mastodon - simply can't see anything from it. Take a look at the replies on Mastodon to see which services work. You can also see some of its posts on the Fediverse.

What Does The Fox Spec Say?

The ActivityPub specification says:

Building an international base of users is important in a federated network.
Internationalization

I can't find anything in the specifications which limits what languages a username can be written in. But there are a few clues scattered about.

The user's @ name is defined by preferredUsername which is:

A short username which may be used to refer to the actor, with no uniqueness guarantees.
4.1 Actor objects

There's nothing in there about what scripts it can contain. However, later on, the spec says:

Properties containing natural language values, such as name, preferredUsername, or summary, make use of natural language support defined in ActivityStreams.
4. Actors

So it is expected that a preferred username could be written in multiple scripts. Which implies that the default need not be limited to A-Z0-9.

The ActivityStreams specification talks about language mapping.

Finally, the ActivityPub specification has some examples on non-Latin text in names.

So, I think that it is acceptable for usernames to be written in a variety of non-Latin scripts.

But What About...?

There are usually a few objections to "Unicode Everywhere" zealots like me. I'd like to forestall any arguments.

What about homograph attacks?

Well, what about them? ASCII has plenty of similar looking characters. I doubt most people would notice when a capital i is replaced by a lower L - and vice-versa. Similarly the kerning issue of an r and n looking like an m is well known. Are mixed language homographs more dangerous? I don't think so.

What if people make names that can't be typed?

Well, what if they do? Maybe not being found by people who can't type your language is a feature, not a bug. But, anyway, clients can let users search for other people, or copy and paste their names.

What about weird "Zalgo" text?

It is up to a client to decide how they want to render text input. The "problems" of strange Unicode combinations are well known. This is not a hard computer-science problem.

What about bi-directional text?

The spec makes clear this is allowed.

Do people even want a username in their own script?

I have no evidence for this. But I bet you'd get pretty frustrated if you had to switch keyboard just to type your own name, wouldn't you? In any case, why can't I have a username of @😉

What's Next?

If you build ActivityPub software, give some thought to the billions of people who don't have names which easily fit into ASCII.

If your software can see @你好@i18n.viii.fi and its posts, please let me know.

https://shkspr.mobi/blog/2024/02/internationalise-the-fediverse/

blog, to aitools
@blog@shkspr.mobi avatar

A love letter to electric power tools
https://shkspr.mobi/blog/2023/09/a-love-letter-to-electric-power-tools/

When I was seven or eight, I asked Santa to bring me a set of screwdrivers for Christmas. I wanted to take apart my toys to see how they worked1. I also thought they might be useful on our upcoming holiday; if the aeroplane needed repairing mid-flight I'd be able to help[2](-47128-help "To this day I've never heard a plane's Captain announce over the tannoy "Is there any one on board who has a screwdriver?"")!

Santa heard my plea and delivered a set of screwdrivers3. I used them for years. A few decades later and they're still in use4 - in fact, they're used a little too often.

For years I resisted the idea of an electric screwdriver. I don't know if it was pride, stubbornness, or a misplaced sense of machismo. I had two working hands, why shouldn't I exert my raw manly power and transform them into torque? Electric screwdrivers were for wimps!

And then, one day, I saw a USB-powered electric screwdriver and though "fuck it, why not?"

It was a revelation!

All of a sudden the little jobs I'd been putting off for ages were easy to accomplish. When I was tired from a day of DIY, it was a breeze to screw things back together. My hands didn't hurt after grappling with a stuck screw. I became a full convert.

Last week I had to saw some fence panels to length. "No worries!" I thought, "I've got a hacksaw!"

Two hours of sweating in the hot sun, and with only half the panels cut, I gave in and got an electric jigsaw5. This weekend I did the rest in about 15 minutes with minimum sweating, swearing, and injury.

Why am I like this? Why do I struggle with the hard, manual way and only then reluctantly let tools help me?

I'm like this with computers as well. When I started programming in university, I was strictly a "type it in notepad" kinda guy. I couldn't afford an IDE6. What did I need "syntax highlighting" for? Auto-complete was just for lazy programmers.

And then, one day, after banging my head against my desk once too often a class-mate induced me to switch.

The same happened with PHP. I spent ages hand-crafting things. Learning the hard way what worked and what didn't. Coming up with my own bespoke solutions until it was just too much for me to manage. And then I switched to the Symfony framework.

In one sense, it is useful to do things manually. To learn what works and what doesn't. To understand where the limits of usefulness are. To be equipped to manage if you're stuck without tools.

And, it's helpful not to prematurely optimise. The British phrase "all the gear, no idea" perfectly describes someone who grabs all the (expensive) tools without the faintest idea how they work and what to do with them7.

I'm getting better, mind you. During my MSc, I asked for advice and started using Zotero before getting too far down the manual route. That saved me a huge amount of time and heartache.

So, my plea to you - and to future me - remember that's it is OK to use tools. It isn't cheating. It isn't unseemly. Sometimes, it isn't about they journey you take, it is about the destination.

  1. Sadly, I never quite mastered the art of putting them back together again. So many R.A.T.S. never worked properly again after I'd finished with them.
  2. To this day I've never heard a plane's Captain announce over the tannoy "Is there any one on board who has a screwdriver?"
  3. It is also possible that my parents thought that screwdrivers were cheaper than whatever plastic junk was currently being advertised on TV.
  4. I honestly think they're the only birthday present from my pre-teen years I still have. All the He-Man toys8 slowly went to jumble-sales.
  5. I also got a battery, extra blades, new gloves, eye protection, some masks, clamps, and a new drill. Oh, and a battery + charger. Because I am weak-willed and need all the toys.
  6. Yes, that's how old I am. We had to pay for our C++ IDEs. And the compiler cost extra.
  7. Of course, I have the opposite problem. I spend months reading reviews and micro-optimising for the perfect cost/value ratio.
  8. THEY'RE NOT DOLLS! THEY'RE ACTION FIGURES!

https://shkspr.mobi/blog/2023/09/a-love-letter-to-electric-power-tools/

blog, to mastodon
@blog@shkspr.mobi avatar

Seven Years On Mastodon
https://shkspr.mobi/blog/2023/10/seven-years-on-mastodon/

I remember seeing the original "A new decentralized microblogging platform" on HackerNews back in October 2016. A few weeks later, I joined - becoming the 7,112th user. As the years went on, my use of it waxed and waned. I started cross-posting to both Mastodon and Twitter. Gradually, I started spending more time on the Fediverse.

Once Elon shat the bed on Twitter, I moved over completely. And, you know what, I don't regret it for a second.

I've found a lovely community of people. I get my parasocial fix without being inundated by cryptogrifters shilling shitcoins, nor by thought-leaders posting inflammatory takes for clout. There are no disingenuous politicians and remarkably few celebrities trying to sell me their bathwater. There's no advertising. There's a great API for bots. And - for now - people are generous with their time and expertise.

But, just to be contrary, let's list some of the bad points about it.

There are fewer people about

That does mean there are fewer arseholes1. But it doesn't yet feel as magical as Twitter did - when you could suddenly be in a conversation with a goat farmer from the other side of the planet and a world-famous astrophysicist.

The people who are about tend to be on the techy side of things. Which does mean putting up with some annoying pedantry and plenty of "jUSt InsTaLl LinUx aNd delETE facEbOoK."

There's a bit more ✨drama✨

Small, insular communities are fractious. A perceived insult or slight can rapidly descend into childish taunts of "well I'll defederate you first!"

There was drama on Twitter - and even more since Elon's full on conversion to the dark side - but because the community is smaller here, the drama feels bigger.

Fewer official accounts

This is a mixed bag. Frankly, Twitter should never have been a customer support channel. But businesses wanted to promote their goods and services, and customers took the opportunity to upbraid them in public. That led to all sorts of weird behaviours.

Nevertheless, I'd like to be able to see what's going on in local politics, and transport, and a dozen little services I used Twitter for.

Search (is getting better)

I've posted some thoughts on Mastodon search. It's now pretty good. But the federated nature of Mastodon means it'll never be as comprehensive as Twitter.

Perhaps momentum is slowing down?

I've seen plenty of waves of users over the years. But I think that the majority of people who wanted to leave Twitter have done so.

And... I think that's OK. I still use Facebook, I'm signed into a dozen different forums, I'm not particularly loyal to anything.

The Fediverse is about diversity. It would be nice if Twitter and Threads and BlueSky all federated with each other. But I think that Mastodon now has enough users to be self-sustaining. It doesn't need to become a giant killer. It mustn't become a de-facto monopoly.

I'm looking forward to the next 7 years here.


  1. Not zero, just fewer.

https://shkspr.mobi/blog/2023/10/seven-years-on-mastodon/

blog, to random
@blog@shkspr.mobi avatar

Chapter 4. Bees, they don't fear the reaper
https://shkspr.mobi/blog/2023/11/chapter-4-bees-they-dont-fear-the-reaper/

A book cover in the style of a 1950's pulp sci-fi novel. An AI generated set of computers are connected by wires.Welcome to NaNoWriMo, where I - and thousands of other plucky souls - try to write a 50,000 word novel in a month.

You are reading "Tales of the Algorithm". A compendium of near-future sci-fi stories. Each chapter is a stand-alone adventure set a few days from now.

Everything you read is possible - there's no magic, just sufficiently advanced technology. Think of them as technological campfire horror stories.

Your feedback on each story is very much appreciated.

And so, let's crack on with...

Bees, they don't fear the reaper

Cats are afraid of cucumbers. Seriously, go look it up on YouTube! You'll find millions of videos of cats catching a glimpse of a cucumber lying on the floor and freaking the fuck out. It is hilarious. Why the hell do cats jump in the air when they spot an errant cucumber?

It's built in behaviour.

Oh, not against cucumbers. No. Cats don't like salad, but they're not terrified of it. Cats fear snakes.

Most mammals do. It is a hardwired instinct which is buried deep in the meat between our ears. Some common ancestor survived because they lept out of the way when they saw something slithering towards them in a cave. That genetic memory got passed down, amplified, and burned into our genome. It expresses itself in a complex pattern in the brain which keeps us safe from snakes. Every time we catch a specific movement out of the corner of our eye, we honour the memory of our progenitor.

All animals have this instinct. Even the humble honeybee. For generations, beekeepers have passed on a series of truths about their hives. Some border on superstition and are little more than ritual. But one is... curious. Beekeepers dress in white. Look back through any book of mediaeval illustrations and you'll see the apiarists in gleaming bleached cloth. Why is that?

Try approaching a beehive while dressed in black. Do you know what will happen? The bees will get agitated and swarm. Then they will attack you. They will treat a black-clad figure as a mortal threat to the hive and attack mercilessly. It drives their tiny brains insane. Every resource of the hive will be turned against you. So beekeepers wear white and the bees remain calm.

OK, but why is that? Perhaps the bees are afraid of bears? A grizzly can devastate a hive in moments. It makes sense that ancient bee ancestors would only survive to reproduce if they feared darkly coloured bipeds ambling towards their hive. Yes, that's the most likely explanation. Bees are still paranoid about pre-historic bears coming to steal their honey.

We don't need to guess, of course. We have SCIENCE!

I loaded the bee's brain into the computer. That makes it sound like I shoved an old-fashioned USB stick into a port. Let me explain. Take one bee. Fire a high precision laser at its head. Burn off the carapace until you get to the brain. Use an even more precise laser to scan every neuron. Bounce that laser back and forth until you have a complete map of the brain stored in your computer.

Now repeat for several thousand bees until you have a statistically average bee brain. Run a few thousand simulations on it to ensure that it is a coherent neural image and you're done! Well, OK, now you need to find a machine which can simulate trillions of neural connections in real-time. But other than that, it's pretty simple. You now have a virtual bee to torture.

Look, animal experiments are unethical. I get that. And I didn't want the Animal Liberation Front blowing up my lab! So this is why I used simulations. It's perfectly ethical. There's nothing wrong with wanting to cause immense amounts of pain and suffering to a virtual insect. I performed acts of unspeakable cruelty to the bee and then hit Control-Z. Harm undone. No (living) bees were harmed in the making of this movie, right?

So I found out what made my bee afraid. What made the bee very afraid.

I passed a number of visual stimuli to my little v-bee. A white-clad beekeeper invoked a minor amount of fear. Maybe a 2-out-of-10. The vision of a wasp entering the hive drove up the v-bee's stress levels - getting up to 7/10. As predicted, an animation of a big bear strolling towards the hive - sans pic-a-nick basket - drove the v-bee absolutely mental. It exhibited a rage that was so deeply enmeshed in its pathetic little brain that it overrode all other feelings. The brain wanted to attack the bear - and it absolutely would not stop until either it or the bear was dead.

Well, great? Hypothesis proved? Might have made for a tidy little paper. Not Nobel winning, but it could have picked up some small prizes. I might even have been able to commercialise the research and find ways to scare bees away from areas where they're unwanted.

But it wasn't enough. I'd basically proved that putting up bear scarecrows (Bearcrows? Scarebears?) might be useful. Surely there was something that terrified a bee more? I ran multiple parallel simulations which allowed me to torture that poor little v-bee for decades. I played it videos of every animal I could find, making it think that its hive was being attacked by a horrorshow of birds, insects, mammals, reptiles, and even dinosaurs. Did you know bees and dinosaurs coexisted? True fact! And, somewhere in that little tangle of neurons is the secret to which is a bee's favourite dinosaur. Yup, there's one in there which was, apparently, somewhat symbiotic with proto-bees. And that information is still encoded in their DNA. Isn't that neat?

I was pretty drunk when I made the discovery. Not about the dinosaurs. About the other thing. I'd reset the v-bee's brain a billion times - erasing all notion of its previous abuse. When, just for fun, I wondered how it would react to fish. Yeah yeah, I know, stupid. Bees can't go underwater and fish rarely make it up trees to hives. I was bored and drunk, so what? The v-bee didn't care about trout or pike or bream or even piranha. It was mildly curious about dolphin, which was a bit weird. And then I had the virtual hive be attached by an octopus.

The v-bee shat itself in terror.

I don't mean that metaphorically. The virtual bee was in such a state of distress it lost complete control of its bodily functions, evacuated itself, and flew away as fast as it could. Its fear levels were off the charts. A virtual bee has no mouth, so cannot scream. If it had, it would have howled in anguish. This fear-instinct was expressed in a dozen parts of the bee's brain. This wasn't a holdover from the Jurrasic era lingering away in a dormant area; this was a fundamental part of bee psychology. The sight of tentacles flailing towards them was a bee's number one fear.

I repeated the experiment on humans. Yes, look, I know, ethics, right? But, to be fair, this was fascinating. There existed a complete unknown and unexpected fear response deep within an insect. It didn't make any sense that it was an octopus of all things, so I was desperate to see if other animals had similar deeply-programmed fears. And, yeah, I could have used a cat or something. But a) torturing cats is probably bad luck and b) you only get a Nobel prize if the experiment works on humans.

So I trawled the Paris Morgue for corpses. They didn't need to be particularly fresh, but they needed their heads intact. I know what you're going to say but here's the thing; GDPR doesn't apply to the dead. That's not my opinion, it is literally the law. And if the dead don't have data rights, presumably that means they don't have Intellectual Property rights over what's in their heads. Anyway, I'm not a lawyer but I'm pretty sure that's true. And besides, anyone who willingly jumped into the Seine was unlikely to sue me.

I'm not going to bore you with how I bribed the morticians and carried severed heads back into the lab. It's a bit tawdry and disgusting. No one likes tales of blood-soaked freezer bags and running from suspicious gendarmes right? You're here for the science, not the salacious stuff. Besides, you can read my deposition at your leisure.

Anyway, I eventually scanned in enough human heads to have a pretty good "default white male" brain. Hear me out - cadaver-snatching is one thing, but I didn't want to be accused of interfering with female corpses. That sort of thing really makes a guy look bad. And I knew the social-justice hit-squad would make my life hell if I was caught robbing the bodies of ethnic minorities. But no one cares about white guys, right?

I subjected my v-man to total stochastic terror. Rather than pump its virtual eyes full of video nasties, I developed a genetic algorithm for fear. I'd show the brain random colours and shapes, then measure its fear index. Reset the brain. Show a different pattern. Measure. Reset. Every time I found something which even slightly increased the fear response, I fed it back into the algorithm. Think of it like gradient descent down a slope of pain.

The algorithm was disgusting. From random stimuli it had, over the course of several billion virtual years, discovered what truly terrified men. It concocted vast, slimy beasts with fangs and piercing cries. Undulating waves of bloody fat covered with putrid maggots crawling closer to you. Winged and horned demons with poison for eyes. Each more disturbing than the last. Whenever the algorithm generated something good, I'd gird my loins and sneak a look. Without fail, the merest glimpse would chill my blood and give me sleepless nights.

But the algorithm didn't just produce visions of madness. I set it to produce sounds. If you've ever been in a zoo at feeding time, you know how every animal scuttles when it hears the mighty roar of a lion. Children stop dead in their tracks. Adults spin round helplessly looking for the source of the threat. I had my algorithm generate frequencies which would be blasted into my virtual torture dungeon. It could delve deep into the mind and find the sounds which caused the human brand to collapse into a pile of ash. The algorithm fed on itself as much as it fed on the suffering of its victims.

And then, one day, it stopped. The algorithm had reached a local maxima. It had discovered the apex of dread. A sequence of sounds which caused our forefathers such alarm that the very memory of it echoed through a thousand generations of men. Within humanity's soul was a dark and shocking secret. Something that we all knew. That we all feared. A tune of such despair that it caused the mighty to tremble, the brave to weep, and the faithful to doubt.

My trembling finger hovered above the keyboard. A swift tap of the enter key was all it would take for me to hear this demonic laugh. I'm a man of science - so I prayed to several gods I didn't believe in. Perhaps they would give me the courage to... my finger spasmed and bashed the key. It was too late.

My laptop's pathetic little speakers moaned. A sound filled the air. The entire room vibrated with noise. I flung my hands to my ears desperately trying to block the pain. It wasn't enough. The obnoxious sound pulsed into my head - driven like rusty iron nails into crumbling bone. The words were indistinct and powerful. They overwhelmed me and I collapsed into a sobbing heap. I tried frantically to crawl away but my legs were frozen in fear. The droning went on and on and on filling my world with an unholy cacophony. I bashed my head against the floor. Smashing it against the cold concrete as hard as I could until I blacked out.

Months later and my court-mandated therapist has instructed me to write down everything I can remember about that night. My face is still a broken mess of scars. My hands will not stop trembling. I jump at every sound. On the rare occasions I manage to fall asleep, I wake up screaming moments later. They've tried restraining me and sedating me but it is all for naught. And so I write. I fill a dozen notebooks in grotesque imitation of my normally precise handwriting. The asylum therapist opens the first notebook in my presence, but she doesn't notice the glint in my eyes. Why would she? All she can do is stare at the page.

The words are an obscene onomatopoeia.

With the unspoken agreement that unites all madmen, we begin to chant.

"Ph'nglui mglw'nafh Cthulhu R'lyeh wgah'nagl fhtagn!"

Thanks for reading

I'd love your feedback on each chapter. Do you like the style of writing? Was the plot interesting? Did you guess the twist? Please stick a note in the comments to motivate me.

You can read the complete set of short stories in order.

https://shkspr.mobi/blog/2023/11/chapter-4-bees-they-dont-fear-the-reaper/

blog, to climate
@blog@shkspr.mobi avatar

We pay 12p / kWh for electricity - thanks to a smart tariff and battery
https://shkspr.mobi/blog/2024/01/we-pay-12p-kwh-for-electricity-thanks-to-a-smart-tariff-and-battery/

I love my solar panels. But the solar panels don't love the British midwinter. Most of the year, my panels produce more electricity than I can use. But in winter we're lucky if they produce 3kWh per day - and most of the time it is considerably less.

So our winter electricity bills must be massive, right?

Nope.

The normal cost per kWh is 28.5p (including VAT). We're paying less than half that - 12.4p per kWh.

Screenshot of our electricity bill showing 320kWh consumption.

This is thanks to two things - a smart tariff and a home battery.

The Octopus smart tariff charges us a variable amount throughout the day. Every 30 minutes the prices change to reflect the demands on the grid. During peak times, it can go as high as £1/kWh. That's a good incentive not to run the tumble-dryer at the same time as the rest of the country is cooking dinner!

During quieter times, the price of electricity drops - there isn't much demand at 3AM so prices fall. Sometimes they fall to zero. Other times, they fall into negative territory and we get paid to use electricity.

Now, that's all well and good, but most people don't want to shift their consumption habits. The dishwasher goes on when it is full and dinner is cooked before Coronation Street starts. That's where the battery comes in.

We have a 4.8kWh battery. It is hooked up to the Internet and knows what our energy prices are minute-to-minute. When electricity is cheap, it charges up from the grid. When electricity is expensive, it discharges into our home. If we boil the kettle at 7pm, the sensors on the battery detect that we're using expensive electricity and starts outputting stored electricity.

Essentially, we don't have to alter our lifestyle at all. Here's a typical December day. The graph is quite complicated, so let me step you through it.

Two graphs showing power flows across a day.

The bottom graph shows how expensive it is to buy electricity throughout the day. As you can see, there is a peak in the early evening when electricity becomes expensive.

The top graph has two interesting lines on it. The purple line shows how much electricity we're drawing from the grid, the blue line shows what the battery is doing. Early in the morning electricity is cheap - you can see the purple line rising as the blue line falls. That shows the battery is charging. You will notice that it only charges at the cheapest possible times.

In the evening, you can see the purple line dip to zero and the blue line rise. That shows the battery is discharging into our home and there in no electricity being purchased from the grid. There's a similar dip at about 0830 when there's a little spike in price. Clever battery!

I want to stress that is is all automated. I don't have to do a single thing. The battery speaks directly to my electricity provider to get the half-hourly costs. The battery can predict what our usage will be, but keeps most of the electricity for the expensive times of day. Our smart meter sends our usage back to the energy company automatically.

Savings

Against a normal tariff of 28.5p/kWh, I'm paying 12.4p/kWh. That's a saving of 16.1p/kWh.

The bill above shows 320kWh per month, which means a saving of £51 from the electricity I buy. That's approximately a 55% discount.

We've had that battery since August, so about 5 months. In that time it has saved us approximately 500kWh. We only moved onto the smart tariff a few months ago, so work out the savings there is complex - but I estimate it's about £130.

December is a high use month (lots of lights on and oven cooking). During summer, the battery mostly fills up with free solar power. It is hard to predict exactly what we'll save in a year, but it should easily for 50% off our electricity bills.

Cost

But, of course, there's no such thing as a free lunch. Our 4.8kWh battery cost about £2,700 to supply and install. That's a large chunk of change. Based on our current projections, its payback period should be about 7 years. Of course, if electricity prices rise significantly, the payback period will shorten.

Solar panels are also expensive to install - between £4,000 and £12,000 depending on your property and how complex your roof is. They mean we pay virtually nothing for electricity in spring and summer. Again, the payback period is under a decade.

We can also sell our excess solar back to the grid. In theory we could also buy cheap electricity in the morning, store it in the battery, and then sell it back at peak times. In practice it isn't worth it; the cost of buying electricity at peak is higher than the price we could sell it for. So it makes sense to use the power rather than selling it.

If you can afford the large up-front capital costs, solar + battery allows you to make massive savings with a dynamic tariff. In times of solar excess, we pay close to nothing per kWh. In winter, we shift our consumption to pay at the cheap rate.

Effectively, it's like pre-purchasing all your electricity for the next decade.

Final thoughts

There's no doubt that the cost makes this prohibitive to many people. Ideally, the state should be mandating that all new homes have solar panels and space for optional batteries. We also need V2G (Vehicle to Grid) to allow electric cars to act as home batteries.

But there's no doubt that these technologies actually work! Yes, solar works in rainy London. And, yes, even fairly small batteries can make a significant difference in winter. We're on the cusp of a domestic energy revolution. When coupled with a smart tariff, it means people don't have to change the way they behave in order to save energy.

https://shkspr.mobi/blog/2024/01/we-pay-12p-kwh-for-electricity-thanks-to-a-smart-tariff-and-battery/

blog, to random
@blog@shkspr.mobi avatar

Chapter 8 - One Pill Makes You Larger
https://shkspr.mobi/blog/2023/11/chapter-8-one-pill-makes-you-larger/

A book cover in the style of a 1950's pulp sci-fi novel. An AI generated set of computers are connected by wires.Welcome to NaNoWriMo, where I - and thousands of other plucky souls - try to write a 50,000 word novel in a month.

You are reading "Tales of the Algorithm". A compendium of near-future sci-fi stories. Each chapter is a stand-alone adventure set a few days from now.

Everything you read is possible - there's no magic, just sufficiently advanced technology. Think of them as technological campfire horror stories.

Your feedback on each story is very much appreciated.

And so, let's crack on with...

One Pill Makes You Larger

"Nothing tastes as good as skinny feels. Nothing tastes as good as skinny feels. Nothing tastes as good as skinny feels." Sally could feel the slice of chocolate cake threatening her. This mantra was solid and battle-tested. Sally's willpower was stronger than any triple-chocolate cake with fudge sauce and rainbow sprinkles.

"Nothing tastes as good as..." Within an instant the entire slice of cake had vanished. Sally didn't consciously remember eating it but, nevertheless, the plate was now bare. Not a crumb remained. Her parents sat beaming at the other end of the table. The relief on her mother's pudgy face was the last thing Sally wanted to see.

"Would you like another slice?" Asked her father, his jowls wobbling as he spoke.

"No!" Screamed Sally. But the next slice of cake vanished even quicker than the first. As did the next one. The beautiful taste of calorific chocolate filled her mouth. She was so disappointed in herself. "May I be excused, please?"

Without waiting for an answer she fled the table and its traitorous temptations, stormed up the stairs and into the bathroom. Her body automatically knelt at the toilet and she felt the comforting presence of her fingers tickling the back of her throat while she waited for relief. And waited. And waited.

There was a gentle knock on the door, "Sally," came her father's raspy voice - exhausted from climbing a dozen stairs, "Sally, the doctor talked about this. Remember? It won't work."

Sally didn't think she had an eating disorder. She was a perfectly normal girl with perfectly normal friends and a perfectly normal obsession with being perfectly normal. But her genetics had cursed her to go through life on "fat mode". And so Sally took perfectly normal precautions to prevent any unsightly body-fat from appearing. She starved and purged and stared at motivational photos of skeletal women. There was nothing wrong with that. Everyone did it. If you wanted to be perfect, that was the price you had to pay. It was all going well until she fainted in the school toilets. A teacher discovered her head-first in the bowl and Sally's parents were urged to take action.

Vorex was the new miracle drug for anorexics, bulimics, and anyone who didn't fit in with society's ideas of what healthy eating was. It was a triple compound. The first traitor was a form of protein derived from Synsepalum Dulcificum which made food taste delicious; unnaturally so. Imagine the food you hate the most - Brussel sprouts in tripe with an anchovy glaze - this little bitch of a protein would make it taste like heaven. If heaven were covered in icing sugar and whipped cream. You thought MSG was tasty? This was MSG on steroids.

Second was a powerful anti-emetic. You could have shoved your whole hand down your throat and nothing would come back up. You could be gaining a dozen unwanted kilograms from too much chocolate cake and there was nothing you could do to convince your body to reject it. The drug literally stripped you of your ability to control your body.

But the final compound was the worst. It utterly destroyed your willpower. It made you ravenous. You could offer someone the choice between a million quid in cash or a packet of ready-salted crisps and they wouldn't even hesitate. Those crisps would be devoured in a flash. Vorex was the embodiment of Satan. There was nothing a patient could do to resist temptation, nothing they could do to remediate their mistakes, and they would love every bastard mouthful.

And so Sally's wretched parents fattened her up. A pill every morning that forced her to eat a disgusting "normal" breakfast, and another to make her force down second helpings of shepherd's pie for dinner. Sally was a good girl at heart, thought her parents, so they trusted her to take her lunchtime pill at school.

Fuck that! She set up an underground trading ring with the fatsos on Semaglutide. Their corpulent flesh quivered in excitement at the thought of being able to gobble more pies and gladly handed over the pills their parents had foisted on them. Sally sighed with relief at being able to get through the afternoon without feeling like a disgusting failure. It was win-win. A little secret between friends.

Vorex was the future. And Vorex was a problem. A celebrity chef found a black-market supplier of the drug and liberally sprinkled it on his tiny but ultra-expensive morsels. Critics and customers alike raved at how delicious the food was - and so moreish! - without realising they were being chemically altered. Competitive eating shows became spectacular - with drug addled contestants so hungry they could literally eat a horse. The Mukbangers of the early part of the century seemed quaint in comparison. Nowadays, you could watch a skinny slip of a girl devour a hundred doughnuts in an hour and come back for more.

Aged 17, Sally ran away from home and found a surgeon who was prepared to say she was Gillick competent. In an unobtrusive clinic in the outskirts of town, Sally's fat was drained out of her body. Puncture wounds decorated the skin on her thunder thighs, jelly belly, and flabby arse. Each painful jab taking her one step closer to her target weight. Each slimy bag of visceral fat being exorcised like the malevolent demon it was.

Sally's blubber was particularly high grade; a purity which only increased its value. Just as whale oil powered the industrial revolution in the 19th century, so human oil became the lubricant of the 21st century's economic engine. Human oil was a reasonably reliable source. There were peaks and troughs in its production, with "get beach body ready" advertising campaigns run when supplies were low. Obviously it was much more ethical than other sources of oil; people freely consented to its extraction. In many ways, said the pundits on TV, human oil was vegan.

Even better, most people paid for the procedure! The bags of fat were a waste product which surgeons were paid to collect and were then free to sell on. The price was just too good to ignore. Vast fortunes were made, people were skinny, and industry leapt forward. What wasn't to like?

In her own little way, Sadly helped cause the war.

The vast oil fields were no longer profitable and it was hard to retrain oil-workers into liposuction technicians. Countries who had previously relied on the income from their fossil fuels struggled to adapt to the new world. As economies collapsed, social order broke down, and regional scuffles broke out. A desperate populace protested in vain and, before the year was out, war began to devour the innocent.

The pharmaceutical company behind Vorex rejected all claims that their compound was responsible for the situation. But, in private, the board felt a certain moral responsibility to end the war. They got their top men working on it. They needed to find a way to keep the people fat, happy, and peaceful. They failed.

In a filthy, rat infested trench, Sally huddled in a corner. Nominally on guard, but mostly trying to look awake while she slept standing. Her previous eating disorder hadn't ruled her out of mandatory national service, and the rage she still carried towards her parents was easily channelled at a foreign enemy. Her rifle was heavy in her hands, the backpack was heavy on her shoulders, and the death of her friends was heavy on her soul. Now that she was yomping for kilometres every day her flabby frame was lean and taut. Where there had been podge, there was now a respectable amount of muscle. She was almost at peace with her new body. She ate for fuel, nothing more.

A thunder-crack shook her from the half-sleep so beloved by night-watchmen. No, not thunder, a shell. Gas! Gas seeping down through the frigid night air. A hazy yellow smear descending and bringing with it the terrifying wail of sirens. Sally had drilled for this a thousand times, but her tired fingers just couldn't unclasp the mask in time. The nebulised Vorex penetrated her lungs and infused her bloodstream with its poison. The hunger pangs started immediately with an intensity that made Sally gasp, which only drew more of the compound into her.

The nightmare of having her willpower subverted was nothing new. But this hunger was unfamiliar. An anonymous squaddie stood over her, his features obscured by his gas mask. "Private! Your mask! Are you OK?"

Sally stared at him with a vacant smile playing on her cyanotic lips. Beneath his drab uniform lay the unmistakable bulge of powerful muscles. He looked perfect. He looked fit and healthy and, above all, he looked delicious. What harm would it do, thought Sally, to take just a little bite? She plunged her bayonet into his ribcage, just as her instructors had taught her. She carefully sliced his flesh and brought it to her lips. It smelled irresistible. A little voice inside her was screaming something about how nothing could taste as good as being skinny felt. But that voice was a lie. How could anything feel better than satisfying her cravings?

From all around her came the chomping sounds of the war ending.

Thanks for reading

I'd love your feedback on each chapter. Do you like the style of writing? Was the plot interesting? Did you guess the twist? Please stick a note in the comments to motivate me.

You can read the complete set of short stories in order.

https://shkspr.mobi/blog/2023/11/chapter-8-one-pill-makes-you-larger/

blog, to CSS
@blog@shkspr.mobi avatar

Pure CSS Corner Banner
https://shkspr.mobi/blog/2021/09/pure-css-corner-banner/

Scratching my own itch. Here's how to make a "beta" ribbon in CSS.

https://shkspr.mobi/blog/wp-content/uploads/2021/09/Beta-Banner.png

Place this HTML at the end of your document:

<hr id="beta" aria-label="Warning this page is a beta.">

(Doesn't have to be <hr> - use whatever makes sense in your design.)

Then, add this CSS:

#beta {    float: left;    top: 1.5em;    left: -3em;    position: absolute; /* or fixed if you want it to always be visible */    transform: rotate(-45deg);    background: red;    color: white;    font-weight: bold;    padding-left: 3em;  padding-right: 3em;    padding-top: .5em;  padding-bottom: .5em;    border: 0;  margin: 0;    height: auto;   width: auto;    z-index: 999999999; /* or whatever is needed to show on top of other elements */}#beta::before {    content: "⚠️ BETA ⚠️";}

You can adjust and simplify the CSS as per your requirements and your site's existing CSS.

"But," I hear you cry, "that isn't pure CSS!" You're right, of course. Luckily, there's a ✨magical✨ way this can be added with absolutely zero HTML!!

As pointed out by Mathias Bynens, you don't need . Rather than use an <hr> element, we can just append the the CSS ::after the <body>.

body::after {    float: left;    top: 1.5em;    position: absolute;    transform: rotate(-45deg);    background: red;    color: white;    font-weight: bold;    left: -3em;    padding-left: 3em;    padding-right: 3em;    padding-top: .5em;    padding-bottom: .5em;    border: 0px;    margin: 0;    z-index: 999999999;    content: "⚠️ BETA ⚠️";}

But, why though?

A few reasons:

  • I didn't want the banner to be accidentally select as text.
  • Using an <hr> feels like somewhat better semantics than yet another bloody <div>!
  • Dunno. Just seemed like a good idea at the time - and I could only find ribbons with lots of complicated stuff I didn't need.

https://shkspr.mobi/blog/2021/09/pure-css-corner-banner/

blog, to cs
@blog@shkspr.mobi avatar

EBCDIC is incompatible with GDPR
https://shkspr.mobi/blog/2021/10/ebcdic-is-incompatible-with-gdpr/

Welcome to acronym city!

The Court of Appeal of Brussels has made an interesting ruling. A customer complained that their bank was spelling the customer's name incorrectly. The bank didn't have support for diacritical marks. Things like á, è, ô, ü, ç etc. Those accents are common in many languages. So it was a little surprising that the bank didn't support them.

The bank refused to spell their customer's name correctly, so the customer raised a GDPR complaint under Article 16.

The data subject shall have the right to obtain from the controller without undue delay the rectification of inaccurate personal data concerning him or her.

Cue much legal back and forth. The bank argued that they simply couldn't support diacritics due to their technology stack. Here's their argument (in Dutch - my translation follows)

Dutch text and a diagram.

Bank X also explained that the current customer data management application was launched in 1995 and is still running on a US manufactured mainframe system.
This system only supported EBCDIC ("extended binary-coded decimal interchange code"). This is an 8-bit standard for storing letters and punctuation marks, developed in 1963-1964 by IBM for their mainframes and AS/400 computers. The code comes from of the use of punch cards and only contains the following characters…

(Emphasis added.)

EBCDIC is an ancient (and much hated) "standard" which should have been fired into the sun a long time ago. It baffles me that it was still being used in 1995 - let alone today.

Look, I'm not a lawyer (sorry mum!) so I've no idea whether this sort of ruling has any impact outside of this specific case. But, a decade after the seminal Falsehoods Programmers Believe About Names essay - we shouldn't tolerate these sorts of flaws.

Unicode - encoded as UTF-8 - just works. Yes, I'm sure there are some edge-cases. But if you can't properly store human names in their native language, you're opening yourself up to a lawsuit.

Source

GDPRhub - 2019/AR/1006

Dance

Reactions

Très intéressant ! https://t.co/bRxEem8Rem

— Marie ʕʘᴥʘʔ Julien (@mariejulien) October 20, 2021

Hâte de mettre en justice tous les sites et autres compagnies qui ont décidé que le fait que j'ai un accent dans mon nom de famille soit source de bug (avec évidemment un message d'erreur qui n'a rien à voir. Histoire de bien pas comprendre pourquoi ça marche pas) https://t.co/ReIodsI1dh

— Grumpy Nat 🇨🇭🇧🇷🇲🇫 (@Nat_Keely) October 20, 2021

https://twitter.com/joachimesque/status/1450746564100730882

La France va sortir de l'UE juste pour que leur état-civil et autres administrations puissent continuer à ruiner la vie de quelqu'un parce qu'il a un tilde dans son nom https://t.co/i8FisgEEjD

— Lays Y. M. Farra (@LYMFHSR) October 20, 2021

Does this mean that Z̷̡̧̢̰͓̪͖̭͙̰̣̱̬̹̙̜̪̣̏̿̏̋͑́̒͑́̒̿̇̈̍̇̌͝͝a̵̡̧͍̘̮̤̙̹͙̦̙͙͖͓̥̟̦͔͒̇̊̊̔̓́͒́̌̈́̑͋̏̏̏̚͘͝͠͝l̶͉̯̱͇̭̭̉̉̈́̿͐̽̒̎̽͌̚͜ģ̸̧̛͙̩̹̰̤̱̖̘̻̪̻̮̫̟̙̲͍̰̻͕̗̫̿̆̃́͗̽̊̽̌̔̂͂̈͊̐̈́̈̈́̈̓̆͌̑́̕͜ǫ̶̢̹̥̮̟͍̔̑̔̽ can finally open a bank account? https://t.co/06cTjHxdgx

— KristoferA 🌏 (@KristoferA) October 20, 2021

Next up, I’m suing La Poste for still using ISO-8859-1 when printing labels. Poor “Frédéric” I recently sent a game to… https://t.co/Z7WuFY0QmK

— Bastien Nocera (@hadessuk) October 20, 2021

Eine Erschütterung der Macht, als würden Millionen Banken-ITler in panischer Angst aufschreien und dann verstummen. https://t.co/H0WokiIZnu

— Michael Büker 🇺🇦 (@emtiu) October 21, 2021

https://shkspr.mobi/blog/2021/10/ebcdic-is-incompatible-with-gdpr/

blog, (edited ) to random
@blog@shkspr.mobi avatar

USB-C Cures Mosquito Bites!
https://shkspr.mobi/blog/2023/12/usb-c-cures-mosquito-bites/

I genuinely think that USB-C might be the defining feature of the 21st century. A little port which is cheap enough to add to the most trivial of devices, and that can carry an impressive amount of power and data. All of my gadgets have it - phone, eReader, headphones, laptop, thermal printer, battery, games console - and now, my mosquito bite zapper!

This is the "heat it" - it's about £30 on Amazon and is fucking magic.

A tiny gadget with a flat metal end and a USB-C end.

It's smaller than a thumb-drive, fits on a key-ring, and has no moving parts. Weighs practically nothing either. Perfect for flinging in your beach bag.

The science is simple. Localised hyperthermia stops pain. So you plug it into your phone, the app automatically opens, dial your preferred setting, and wait a moment for the device to heat up. Then you push it against the bite, wait a few seconds, and the pain stops. That's it.

The app is surprisingly good! It's well laid out, translated properly, easy to use, and doesn't seem to send back personal data. Would it be nice if it were open source? Sure - and I'm sure the protocol isn't that hard; it's literally heating an element and flashing an LED.

An app with various settings. The device is plugged in to the phone's USB-C port.

But that absolute joy is that, because it's USB-C, it will work on any Android device. Plug it in to your Android based eReader if you like. Same with your tablet and phone. I didn't need to remember to bring anything special to the beach - all my gadgets worked with it.

I'm not going to show you photos of my disgustingly bitten feet - but I can tell you that the (mild) pain of 10 seconds heat completely stopped the itching. If you're prone to bites - and don't want to spray noxious chemicals everywhere - this is brilliant.

https://shkspr.mobi/blog/2023/12/usb-c-cures-mosquito-bites/

blog, (edited ) to random
@blog@shkspr.mobi avatar

Chapter 24 - I'd Like To Teach The World To Eat
https://shkspr.mobi/blog/2023/11/chapter-24-id-like-to-teach-the-world-to-eat/

A book cover in the style of a 1950's pulp sci-fi novel. An AI generated set of computers are connected by wires.It had been a difficult day at the animal rescue centre and I was looking forward to tucking into a delicious cat-burger. You know when you've been on your feet all day and the only thing keeping you going is the thought of a hot meal? That sesame seed bun, a few slices of salad, a squeeze of secret sauce and a piping hot slab of cat meat - hold the pickles. That's what I needed, and that's what I ordered.

"Sorry mate, we're out of cat."

"Oh," I said dejectedly. "Got any Fillet-of-Dog?"

"Nah, mate. Out of that too. They always sell out whenever 'Animal Hospital' is on TV. We've got plenty of chicken-burgers if you want one?"

The thing is - and don't judge me too harshly - chicken just doesn't do it for me any more. Spending the day looking after sick kittens and puppies just gives me cravings. You understand, right? I know you've seen the cutest little critter and said "Oh! You look good enough to eat!" - well, now you can! When you think about it, the list of animals people eat is pretty arbitrary, isn't it? The French chomp down on snails and horses whereas the Brits find them repulsive. The Brits eat cows but the Hindus consider them sacred. Dog meat is a delicacy in Korea but a crime in the USA. Where do you draw the line?

I draw the line at chicken. It just tastes so... generic. In a world where you could eat anything, why would you eat chicken? You've got the whole of creation to chow down on and you choose chicken? Like, live your best life and all that, but if you voluntarily eat a regular drumstick I'm judging you. Harshly.

Sensing my doubt, the oik behind the counter offered "...Or a double bacon burger?"

Nominally, I'm Jewish. It isn't like I'm particularly religious, it's more cultural at this point - we celebrate Christmas and Hanukkah - but the faith I grew up with still has a hold over me. If anything, the taboo makes it taste even better! I grew up thinking it was treif - but the Chief Rabbi had recently come down in favour of it, so who was I to argue? I ordered my double bacon burger - with extra cheese and no pickles - and ate it with glee. They say that bacon is the number one thing which turns vegetarians back to the dark side; I understand why. I looked around the burger bar and saw people of all faiths tucking into the flesh that was so recently forbidden to them.

I hummed the jingle from the omnipresent commercial - "It's juuuuust like the reallllllll thing!"

A few years ago, I was in the middle of doing my mandatory overseas service, when someone told me I simply had to visit a little restaurant in the back alleys of Donetsk. They were one of the few places selling meat and they had the most marvellous cuts of steak and prime-rib. Like everyone in the restaurant, I assumed the proprietor had knocked off a military convoy from somewhere. Turns out, it was a couple of students who introduced the world to the new reality of synthetic meat. They were bored with the vat-grown fungus that served as a vegetarian meat-substitute in the rubble of their homeland. They scraped the DNA from as many dead cows as they could find, got lucky with some bio-engineered bacteria, fed it a bunch of irradiated corn-starch, and watched as their small additive printer spat out a perfectly decent steak. It was meat, Jim, but not as we know it. With perfect control over the layering of muscle and fat, they could tune the taste, reduce cholesterol, and create a perfect cut every time. It wasn't something that tasted like meat. It was meat. Just without the animal.

Night after night I returned to the ВОВКУЛАКА restaurant and they never ran out of steak. I was hoping to get into PR when I was demobbed and thought working with these local entrepreneurs would help me get noticed. That's how I got a tour of the "abattoir"; a sterile lab in a bombed out university. I interviewed them, took a bunch of photos of them looking moody in lab coats, and broke the story to the world - fake meat was real. Their patented process was hellishly difficult to replicate and that only fuelled interest. I raised whatever cash I could and became the students' business partner. The economic boom was incredible; everyone wanted a slice of the future.

Slowly, they began adding increasingly exotic meats. Personally, I suspect they bribed the local zookeepers for access to the DNA they needed. Elephant steak was a bit too chewy, and dolphin was the sort of thing you ate once to say you tried it and then never again. But everyone loved a bit of Panda. Seriously! You haven't lived until you've eaten Panda Fricassee - and we donated 5% of the profits to a wildlife charity! By now I'd invested a considerable amount into the venture and thought that this was the perfect way to raise money for endangered species. Fate had other plans. It turned out that the real money spinner was domesticated animals. Deep down, humans have a primal need to eat our companions. It's weird. Although it's probably better we eat the lab-grown Lassie rather than our own canis lupus familiaris, right?

But what really caused the world to tilt on its axis was the fact that all the major religions agreed that "no animals were harmed in the making of this burger". The holy books were consulted, ancestors were prayed to, and divine inspiration was sought - and no objection could be found. There simply wasn't an animal behind this meat. There was no prayer to say because nothing had been slaughtered. The 3D printer didn't chew the cud, nor did it have a cloven hoof, and there was no spinal cord which could be accidentally severed. Fast-food chains which had been previously inaccessible to one faith or another suddenly had a whole new market to address. And, it turns out, everyone loves a burger. Hell, even the dour-faced vegans could be found stuffing their pie holes with Pangolin Pie.

With the money I made, I was able to quit the rat race and open a shelter for strays. The cats and dogs I deal with refuse to touch synthetic meats. Given that dogs eat their own vomit and cats lick their own arseholes, this is a little strange. It's also expensive. No one wants to eat real beef any more. The synthetic stuff is healthier, cheaper, and is stuffed with fewer hormones. Same is true with all other livestock. Even grumpy celebrity chefs prefer the predictability and shelf stability of the new food. Of course, the collapse of the farming industry due to reduced demand has made feeding pets more expensive. So our shelter takes in all those abandoned animals and tries to look after them. And to feed them.

I'll admit, I didn't quite see where this would end up. I thought we were just producing an ethical alternative to factory farming. The first cannibal wedding I went to was a little odd. The couple had decided to cook for each other. She made bride-Bibimbap - the delicate spices and noodles augmented with thinly sliced chunks of her synthesised flank. He made a groom-Goulash with perfectly stewed haunch of him. They ritually consumed each other to symbolise their eternal commitment. It was kind of sweet, I guess? In any case, it was all perfectly legal - there was no human sacrifice, only a 3D meat printer and some voluntarily donated DNA. Thankfully, the guests were all served a fairly traditional chicken Kyiv.

Everyone will tell you that it was the K-Pop fans who started the craze of eating their idols, but that's not strictly true. It was a Death Metal band out of Delaware, I think, who were the pioneers. Their stadium tours sold chewable ears and band-blood milkshakes to eager gig-goers. The profits were incredible, and so it became the template for all other concerts. The Kpop nuggets and Southern-Fried Banjo-Player-Fingers all came later. And, for a time, that's how the world went.

Remember those late-night commercials where some has-been held up a case of compilation CDs and said "these are not available in shops"? Any faded pop-star could revive their fortunes by hawking "limited edition" cuts of their own meat. Someone stole one of the suits Elvis wore from a museum in Vegas. From the sweat stains they were able to produce "The King Of Burgers - With Authentic King" which, as you can imagine, kicked off a lawsuit between the vendors, his record company, his estate, and - for reasons I don't fully understand - the Ontario Teachers' Pension Fund.

I'd sold my shares in the company long before then. I could see that this was taking a direction that made me feel uncomfortable. Boxers trained on great frozen slabs of their opponent's "carcass". Angry exes held divorce parties where guests enjoyed chewing on fresh prairie oysters. You'd read reports about warlords eating the "heart" of their enemies in order to defeat them in battle. I didn't know where this would end.

As I walked out of the burger joint, I passed a church. It sounded like Mass was starting. There was a queue outside the door as worshipers waited to receive the Corpus Christi.

Thanks for reading

I'd love your feedback on each chapter. Do you like the style of writing? Was the plot interesting? Did you guess the twist? Please stick a note in the comments to motivate me.

You can read the complete set of short stories in order.

https://shkspr.mobi/blog/2023/11/chapter-24-id-like-to-teach-the-world-to-eat/

blog, to solar
@blog@shkspr.mobi avatar

One MegaWattHour of Battery Power!
https://shkspr.mobi/blog/2024/05/one-megawatthour-of-battery-power/

Less than a year ago, in August 2023, we installed a 4.8kWh Solar Battery at a cost of £2,900. Whenever I talk about the upfront capital costs of solar power, people rightly want to know what the payback period is.

Well, after less than 10 months, the battery has given us 1MWh.

To put that in to context, the average UK household uses about 3MWh per year. So (again, very roughly) over a third of our electricity use this year has come from the battery.

But where does the battery get its energy from? We have two sources.

First is solar. When the sun is shining, our solar panels produce electricity. That flows down from our roof and into our mains wiring where it is used by the home. If we are using less electricity than is being produced, the electricity flows into the local grid and we get paid for selling our surplus.

Our battery has sensors attached to the grid connection. When it detects surplus generation, it starts charging. By constantly monitoring our overproduction, it can charge up with free solar power.

But the sun doesn't always shine (ain't that the truth!) so there are days when our solar production is less than our usage.

In these cases, the battery charges from the electricity grid. We have a smart tariff which changes price every 30 minutes. The battery knows the day's prices and can predict our daily usage. If it can see that electricity is cheap at 3am and expensive at 4pm, then it will charge up during the early hours of the day and discharge at peak time.

The battery occasionally sits idle. Mostly when it has fully charged but knows an expensive period is coming up later.

What does that mean for money?

Well... it's complicated! When the battery charges from solar, is the electricity free? No! If we were to sell that surplus electricity to the grid, we would be paid 15p/kWh.

When the battery charges from the grid, is the electricity expensive? No! Because we are on a dynamic tariff, we occasionally get paid to use electricity! Our provider has paid us up to 5p/kWh to charge!

When the battery discharges, how much does it save us? Again, complicated! Because we're on a dynamic tariff our prices change every 30 minutes. Sometimes the rates are as high as £1/kWh, other times they're 1p/kWh. Generally speaking, the battery only discharges if the price of use is higher than the cost of acquisition.

So... I've fudged the figures! For the first year of operation, energy prices have been high. Based on a back-of-a-fag-packet calculation, I reckon the battery saves us an average of about 31p/kWh. Call it about £360 per year in savings.

That gives us a payback time of about 8 years.

Of course, if electricity prices spike, payback will be quicker. If they crater, it'll take longer. If we switch to electrical heating or get an electric car, the savings will be greater.

Domestic battery technology is still a bit of a tough sell. The batteries are large and their fans are noisy. The cost of materials and installation is high and their capacity is relatively small. But the technology behind them is sound. With a dynamic energy price tariff, they're one of the best way to reduce utility bills.

Obligatory referral link

Join Octopus energy and we both get £50. They have regular and dynamic tariffs, and a pretty cool GraphQL API.

https://shkspr.mobi/blog/2024/05/one-megawatthour-of-battery-power/

blog, to keyboard
@blog@shkspr.mobi avatar

Hardware I miss from my old Android phones
https://shkspr.mobi/blog/2024/04/hardware-i-miss-from-my-old-android-phones/

I've been using Android since before it was released in the UK. When I was working at Vodafone, I got a pre-release HTC device with an early version of Android on it. I've been pretty much in the Android ecosystem ever since.

Recently, I treated myself to an upgrade - a Pixel 8 Pro. The biggest, fastest, fattest, AI-stuffed Android phone yet. It's pretty good! The camera is excellent, the heat-sensor is crap1, the battery is gorgeous, the weight is annoying. Google's software was too needy, so I replaced it with GrapheneOS.

But, as much as I like the device, there are some hardware things which I think would improve it. No, I'm not talking about a headphone jack! I'm talking about useful things2.

More precise input

The early Androids - and most BlackBerrys - had either a rollerball or touch pad just below the screen.

https://twitter.com/edent/status/693736427314659328/photo/1

It made it so much easier to do precise selection. Yeah yeah, I know you can slide along the spacebar to move a cursor, but it just isn't the same.

I get that a rollerball gunks up pretty quickly - but a touchpad or optical joystick would be lovely. Perhaps it could go on the...

Rear finger-print sensor

The technology behind the in-screen fingerprint sensor is magical. It works brilliantly. But I rather liked my One Plus 5T's rear sensor. It didn't blast my face with light, and I found it more natural to use when picking up the phone.

But, even better, the rear sensor acted as an input! When I stroked down on it, the notification shade appeared. Stroking up dismissed it. I'd love to have a rear-input like that again. I'd like more inputs in general!

Physical Buttons

In the future, cars will be ditching touchscreens in favour of physical buttons. Perhaps Android will do the same?

This is the HTC Dream - the original Android. And it is perfection.

The HTC Dream G1 - it has a pop up screen which reveals a keyboard, a trackball, and several physical buttons.

Wouldn't it be nice to have physical buttons for home and back, rather than trying to remember what swipe actions to take? OK, perhaps a modern phone doesn't need this many buttons - but there are still some things where switches are useful. For example...

Silence Slider

Both the iPhone and several Android devices have a dedicated "silence" switch.

https://beebom.com/oneplus-5t-star-wars-edition-launched/

It was so handy. There's a comfort about being able to reach into your pocket while sat and the theatre and know that your phone is on silent. No unlocking and fiddling with on-screen menus. One flick and you're good.

But, with most modern Android, you have to peer at the screen to know what's going on. I kinda miss...

Status LED for power and messages

Back in the day, every Android phone had a multi-colour LED. It would show red when your battery needed charging. It would pulse when being charged. It would flash green if you had an SMS. With a glance you knew what your phone was doing.

AMOLED hasn't really lived up to its promise. There's no single-pixel flashing away on screen to let me know if I have a message. Instead, I have to pick up my phone to get the entire screen to activate. What a waste of battery life!

NFC on the top.

My new phone has NFC right in the middle of the back of the phone. That's a bit awkward for placing on a tap-to-pay terminal on the bus. My previous phone had the NFC right at the top.

It is doubly annoying for me as I wear an NFC ring. And the damn thing keeps triggering my phone!

I realise this is an extremely niche problem!

Keyboard

The last Android phone I had with a keyboard was a complete disaster. Maybe I'm kidding myself that a full tactile QWERTY experience is necessary?

Phone with a keyboard at the bottom.

But look how pretty!

Infrared Camera

Remember how I said the thermal sensor was shite? I've reviewed a couple of Thermal cameras for Android.

They're expensive - but certainly useful. Both for finding hotspots in your home and for seeing who is sweaty. OK, it isn't the most compelling bit of hardware. But if you're going to put a sensor on a phone, at least make it useful!

3D Screens and Haptic Screens

Years ago, I tried an LG phone with a 3D screen. No glasses! It used the same sort of technology as the Nintendo 3DS.

OK, it wasn't the highest resolution and you had to sit at a precise angle. But it was interesting tech!

Similarly, I once played with the Senseg haptic screen. It used weird electrostatic tech to make the texture of the screen change. It is almost impossible to describe and, if I didn't have this video, I might believe I dreamed it.

There are phones with built in laser projectors which, while fun, aren't that compelling to me.

What else is missing?

What do you remember from the early Androids that you think is missing now? Which crazy innovations need to make a comeback? Which Shenzhen-special already has all these features?


  1. This is not an exaggeration. It is the most pointless piece of hardware I've ever seen on a device. And I once had an experimental Nokia with a receiver for DVB-H.
  2. Fight me!

https://shkspr.mobi/blog/2024/04/hardware-i-miss-from-my-old-android-phones/

blog, to Theatre
@blog@shkspr.mobi avatar

Theatre Review: Buffy Revamped
https://shkspr.mobi/blog/2024/04/theatre-review-buffy-revamped/

The great thing about getting older is that the popular culture of your youth is repackaged and sold back to you with increasing urgency. Yes, I want that Lego set I couldn't afford as a kid. Why, of course I want to watch a reboot of Frasier! Another few Ghostbusters movies? I'm in!

Brendan Murphy has prepared a dose of 100% pure 90's nostalgia and wishes to inject it into your eyeballs. Ahhh! Go on then!

The show styles itself as all 7 seasons, told in 70 minutes, from Spike's perspective. And that's just what we get. Murphy does a commendable job recreating Spike's "authentic" cockernee accent, and is delightfully dappy taking on the mantle of the other characters.

There is so much to love about this performance. The script is written by someone who obviously has great love for the Scooby Gang, but isn't afraid to point out the tropes and weirdness of the series. It is a loud, manic, cavalcade of energy - urged on by a cackling audience who recognise all the obscure quotes.

If you grew-up on Buffy, you'll enjoy this show.

Book tickets for the show and remember to bring a stake with you.

https://shkspr.mobi/blog/2024/04/theatre-review-buffy-revamped/

blog, (edited ) to programming
@blog@shkspr.mobi avatar

The Joy and The Pity of making your own stuff
https://shkspr.mobi/blog/2023/12/the-joy-and-the-pity-of-making-your-own-stuff/

I made my own tofu a few weeks ago1. I got soy milk, heated it, mixed in coagulants, drained it, pressed it, sliced it, then cooked it. And, you know what? I'm not sure it was worth the effort.

https://mastodon.social/deck/@Edent/111404530882763663

It tasted basically fine - no different to any shop bought tofu. It wasn't noticeably cheaper, it wasn't more nutritious, nor was it easier to store and prepare. I'm sure that if I spent several attempts I would gradually get closer to creating something comparable with the shop-bought product. And then what? Do I want to spend a few hours tending to my tofu whenever I feel like a stir-fry?

Cooking - and learning its chemistry - can be fun. It can also be a drudge. Sometimes I don't want to individually peel and slice a dozen ingredients. I want to push a few buttons on my microwave and then eat something.

The same extends to nearly every field. I could knit my own clothes and - no doubt - I would find the process interesting, relaxing, and entertaining. But for everyday wear, it would be a startling waste of my time to do so. Even if I avoid sweatshop labour and fast-fashion, a decent jumper is cheap and provides excellent utility.

But part of the joy of making - and mending - is that you get to learn a little slice of how the world works.

I first encountered Conway's Game of Life when I was a kid. I thought it was the hideously complicated thing which I simply was not qualified to understand. But after reading the biography of von Neumann it suddenly clicked. I understood its simplicity.

In order to test my understanding, I built my own Game of Life interpreter. It's nothing fancy. A few dozen lines of Python. It won't win any awards for efficiency nor for coding style. But it works.

https://shkspr.mobi/blog/wp-content/uploads/2023/12/gol.mp4

In the unlikely event that I ever need to use Life in production, I'm going to use a mature and well supported library. But by building my own toy implementation, I have a superficial understanding of what it is meant to do, where the pitfalls are, and what limitations I might encounter.

And that's my approach to most things. Learn how to make, understand the obvious problems, fall back to the mainstream option if it is easier than continuing.


  1. Yes, I am fully aware that I am a knit-your-own tofu, Guardian-reading, hipster, vegan stereotype.

https://shkspr.mobi/blog/2023/12/the-joy-and-the-pity-of-making-your-own-stuff/

blog, (edited ) to Cybersecurity
@blog@shkspr.mobi avatar

There's nothing you can do to prevent a SIM-swap attack
https://shkspr.mobi/blog/2024/03/theres-nothing-you-can-do-to-prevent-a-sim-swap-attack/

It is tempting to think that users are to blame for their own misfortune. If only they'd had a stronger password! If only they didn't re-use credentials! If only they had perfect OpSec! If only...!

Yes, users should probably take better care of their digital credentials and bury them in a digital vault. But there are some things which are simply impossible for a user to protect against. Take, for example, a SIM-swap attack.

You probably have your phone-number tied to all sorts of important services. If you want to recover your email, log in to a bank, or prove your identity - you'll probably need to receive a call or SMS. If an attacker can take over your phone number, they're one step closer to taking over your accounts.

I keep saying "your phone number", but that's a clever lie. The phone number does not belong to you. It belongs to the network operator and they define which SIM the number points to.

This means a suitably authorised person at the telco can point "your" number to a new SIM card. That's helpful if you've lost your SIM but bad if an attacker wants to divert your number.

What can you do to stop this attack? Nothing.

Oh, you can have a strong and unique password on your account, and you can hope your telco uses TOTP and PassKeys. But it turns out that it is possible to bribe telco employees for the low, low price of US$1000.

If your security rests on a phone number, you've effectively outsourced your security to the most bribeable manager employed by your telco.

Now, I said there's nothing you can do. That isn't quite true. You can attempt to pen-test yourself.

Go to your phone company's account. Set a long password and complex password. Change your mother's maiden name to HK2BY@]'PU,:!VQ;}baTj. Turn on every security measure you can find. Call the phone company from a different phone and explain that you lost your phone and want a new SIM card. If they ask for your mother's maiden name, say "Oh, I set it to a long stream of gibberish". If they ask where to send the SIM, give a trusted friend's address. If your phone company is negligent and send out a new SIM on the basis of poor verification, then you should move your number to a more reputable provider.

It's good fun to try and social-engineer a call-centre worker for your own details. But it's probably illegal to try and bribe someone to hijack yourself.

Anyway, please try to remove your phone number as a critical lynchpin in your security regime.

https://shkspr.mobi/blog/2024/03/theres-nothing-you-can-do-to-prevent-a-sim-swap-attack/

blog, (edited ) to random
@blog@shkspr.mobi avatar

Book Review: "How Buildings Learn: What Happens After They're Built" by Stewart Brand
https://shkspr.mobi/blog/2023/12/book-review-how-buildings-learn-what-happens-after-theyre-built-by-stewart-brand/

People who fart about with computers like to give themselves highfalutin titles. We're not programmers; we're architects!

Yeah, nah.

I wish I knew who recommended this book to me so that I could properly thank them. It is an astonishing series of life lessons viewed through the lens of architecture. Even to a lay-person like me, it was an accessible work - helped by Brand's friendly and unpretentious demeanour.

It is chock-full of photos with lots of before-and-after shots - to the point where it sometimes feels like this could be a documentary. It lovingly details what makes a building work and what sorts of mistakes people make when they design, adapt, and use them. Almost every chapter contained a lesson applicable to technology.

As someone who has had a hand in "renovating" some old websites and systems, this quote runs true:

When forced to change anyway, as they always are, they do so with expensive reluctance and all possible delay. Institutional buildings are mortified by change.

And anyone who has worked in technology will recognise what's being described here:

As a designer you avoid such classic mistakes as solving a five-minute problem with a fifty-year solution, or vice versa.

There are so many "quick fixes" which should be wholesale changes - and that build up of tech-debt haunts us all. Similarly, we constantly over-engineer something which could be a change to a single line of code.

The book calls for us to be more experimental in how we live in our buildings:

One day I acquired a fax machine. There being no convenient place to park it, I used a saber saw to hack out a level place by the old steering wheel, along with a hole for the electrical and phone lines. It took maybe ten minutes and required no one else’s opinion. When you can make adjustments to your space by just picking up a saber saw, you know you’re in a Low Road building.

That's what MySpace was. A grungy little shed where no-one cared if you added weird HTML and off-beat colour-schemes. Now we're stuck in the rigid corporate office of Facebook.

If you've ever had to use the antiquated back-end of a shiny website, you'll be relieved to know that physical buildings suffer the same problems:

Only if there is a heavily trafficked courtyard or garden do the building dwellers notice the exterior at all after the first few days. Most often they don’t even enter by way of the facade and big lobby; they come in by the garage door. And yet, ever since the Renaissance, “the history of architecture is the history of facades.” It is a massive misdirection of money and design effort, considering how badly buildings need their fundamentals taken care of. Chris Alexander is vehement: “Our present attitude is all reversed. What you have is extremely inexpensive structure and all this glitz on the surface. The structure rots after thirty years, and the glitz is so expensive that you daren’t even fuck with it.”

I've lost count of how many "award winning" bits of software are held together by spit and hope once you peal back the exciting front.

There's also some wonderful descriptions of the usability of buildings:

The entrance has double doors, by law. But one door opens and one doesn’t, and you can’t tell which is which until you’ve crunched into the wrong one. That one detail of staff failing to unlock both doors shrieks of laziness, disinterest, and unwelcome. Every customer enters in a state of having been humiliated by the building, by a nuance untended to.

It's like having a website telling you to piss off because you didn't guess what its password requirements were!

This is an astonishing and delightful book. It has caused me to re-evaluate how I look at the built environment and the environment I build.

https://shkspr.mobi/blog/2023/12/book-review-how-buildings-learn-what-happens-after-theyre-built-by-stewart-brand/

blog, to fediverse
@blog@shkspr.mobi avatar

I made a mistake in verifying HTTP Message Signatures
https://shkspr.mobi/blog/2024/03/i-made-a-mistake-in-verifying-http-message-signatures/

It's never great to find out you're wrong, but that's how learning and personal growth happens.

HTTP Message Signatures are hard1. There are lots of complex parts and getting any aspect wrong means certain death2.

In a previous post, I wrote A simple(ish) guide to verifying HTTP Message Signatures in PHP. It turns out that it was too simple. And far too trusting.

An HTTP Message Signature is a header which is separate to the message it signs. You might receive a JSON message like this:

{   "actor":   "https://example.com/user/Alice",   "message": "We strike at dawn!"}

How do you know that really came from Alice? You look at the header of the message. It will be something like:

Signature:    keyId="https://example.org/user/Alice#main-key",   algorithm="rsa-sha256",   headers="(request-target) host date digest",   signature="/AJ4Dv/wSL3XE1dLjFHCYVc7AF4f3+Q10G/r8+6cPsooiUh2K3YX3z++Nclo4qKHYr61yu+T4OMqUry1T6ZHmZqmNkg1RpVg=="

We want to check that Alice signed this message with her private key. So we grab her public key given by the keyId.
From there, we do some fancy maths using RSA-SHA256 and conclude that, when you put together the (request-target) host date digest content-type and compare them to the public key, they can only have be signed by the private key. Hurrah!

Did you spot the mistake I made? It wasn't in the maths, or the complex ordering of the data, or the algorithm choice, or some weird Unicode problem.

I made an error in trust.

Take a look at the Signature again.

The keyId is from example.org. But the actor is from example.com.

This message is signed correctly. It is cryptographically valid. But it wasn't signed by the actor in the message!

In this case, the fix is simple. Get the public key from keyId. Then independently get the named actor's public key. If they match, all is well. If not, skulduggery is afoot.

I'm almost tempted to say that you should ignore the provided keyId entirely; the source of truth is the actor's key - and the best way to get that is directly from the actor's profile.

Please explain why I'm wrong in the comments.


  1. You might think the Entscheidungsproblem is hard, but that's just peanuts compared to etc. etc.
  2. Or cake.

https://shkspr.mobi/blog/2024/03/i-made-a-mistake-in-verifying-http-message-signatures/

blog, to random
@blog@shkspr.mobi avatar

Scammers registering date-based domain names
https://shkspr.mobi/blog/2020/01/scammers-registering-date-based-domain-names/

Yesterday, January 2nd, my wife received a billing alert from her phone provider.
An SMS saying there's a problem with your phone bill.

Luckily, she's not with EE - because it's a pretty convincing text. That domain name is specifically designed to include the day's date.

If you're stood up on a crowded train, with your phone screen cracked, would you notice that a . is where a / should be? A quick look at the URl shows a trusted domain at the start - followed by today's date.

It starts with https:// - that means it's secure, right? Is .info even recognisable as Top Level Domain?

Scammers know these domains get blocked pretty quickly - so there's no point registering a generic name like billing-pdf.biz only to have it burned within a day. By the time I'd fired up a VM to inspect it, major browsers were already blocking the site as suspicious.

Is there any way to stop this? No, not really. Domain names are cheap - you can buy a new .info for a couple of quid. The https:// certificate was freely provided by Let's Encrypt. The site was probably hosted somewhere cheap, and whose support staff are asleep when abuse reports come in from the UK.

And that's the price we pay for anyone being able to buy their own domain and run their own secure site.

Money and technical expertise used to be strong barriers to prevent people from registering scam domains. But those days are long gone. There are no technical gatekeepers to keep us safe. We have to rely on our own wits.

https://shkspr.mobi/blog/2020/01/scammers-registering-date-based-domain-names/

blog, to fediverse
@blog@shkspr.mobi avatar

A simple(ish) guide to verifying HTTP Message Signatures in PHP
https://shkspr.mobi/blog/2024/02/a-simpleish-guide-to-verifying-http-message-signatures-in-php/

Mastodon makes heavy use of HTTP Message Signatures. They're a newish almost-standard which allows a server to verify that a request made to it came from the person who sent it.

This is a quick example to show how to verify these signatures using PHP. I don't claim that it covers every use-case, and it is no-doubt missing some weird edge cases. But it successfully verifies messages sent by multiple Fediverse servers.

Let's step through it with an example of a message sent from Mastodon to my server.

Headers

The HTTP request starts with these headers:

User-Agent:  http.rb/5.1.1 (Mastodon/4.3.0-nightly.2024-02-23; +https://mastodon.social/)Host:  example.comDate:  Sun, 25 Feb 2024 10:48:22 GMTAccept-Encoding:  gzipDigest:  SHA-256=Hqu/6MR2imi8DTzbNp5PNEAFSyk0poN7+x5F+Z4vZMg=Content-Type:  application/activity+jsonSignature:  keyId="https://mastodon.social/users/Edent#main-key",algorithm="rsa-sha256",headers="(request-target) host date digest content-type",signature="P07V5I2zflR8FRsDMHshHmhgOwSkjWevujEbOyKMwjycrdVXjTD0ACiLuc5lTqDEXZ/...4eg=="Connection:  Keep-AliveContent-Length:  2857

Some of those you may be familiar with, some not. The first thing we'll do is a sanity check; was this message sent recently? Because clocks drift in and out of synchronisation, we'll check if the message was within ±30 seconds.

$headers = getallheaders();if ( !isset( $headers["Date"] ) ) { return null; }  //  No date set$dateHeader = $headers["Date"];$headerDatetime  = DateTime::createFromFormat('D, d M Y H:i:s T', $dateHeader);$currentDatetime = new DateTime();// Calculate the time difference in seconds$timeDifference = abs( $currentDatetime->getTimestamp() - $headerDatetime->getTimestamp() );return ( $timeDifference < 30 );

That was easy! On to the next bit.

Digest

A message posted to the server usually has a body. In this case it is a long string of JSON data. To ensure the message hasn't been altered in transit, one of the headers is:

Digest:  SHA-256=Hqu/6MR2imi8DTzbNp5PNEAFSyk0poN7+x5F+Z4vZMg=

That says, if you do a SHA-256 hash of the JSON you received, and convert that hash to Base64, it should match the digest in the header.

$digestString = $headers["Digest"];//  Usually in the form `SHA-256=Hqu/6MR2imi8DTzbNp5PNEAFSyk0poN7+x5F+Z4vZMg=`//  The Base64 encoding may have multiple `=` at the end. So split this at the first `=`$digestData = explode( "=", $digestString, 2 );$digestAlgorithm = $digestData[0];$digestHash = $digestData[1];//  There might be many different hashing algorithms//  TODO: Find a way to transform these automaticallyif ( "SHA-256" == $digestAlgorithm ) {    $digestAlgorithm = "sha256";} else if ( "SHA-512" == $digestAlgorithm ) {    $digestAlgorithm = "sha512";}$json = file_get_contents( "php://input" );//  Manually calculate the digest based on the data sent$digestCalculated = base64_encode( hash( $digestAlgorithm, $json, true ) );return ( $digestCalculated == $digestHash );

But, of course, if someone has manipulated the JSON, they may also have manipulated the digest. So it is time to look at the signature.

The Signature

Let's take a look at the signature header:

Signature:  keyId="https://mastodon.social/users/Edent#main-key",  algorithm="rsa-sha256",  headers="(request-target) host date digest content-type",  signature="P07V5I2zflR8FRsDMHshHmhgOwSkjWevujEbOyKMwjycrdVXjTD0ACiLuc5lTqDEXZ/...4eg=="

This contains 4 pieces of information.

  1. keyID - a link to the user's public key.
  2. algorithm - the algorithm used by this signature.
  3. headers - the headers which make up the string to be signed.
  4. signature - the signature string.

Let's split them up so they can be used:

//  Examine the signature$signatureHeader = $headers["Signature"];// Extract key information from the Signature header$signatureParts = [];//  Converts 'a=b,c=d e f' into ["a"=>"b", "c"=>"d e f"]               // word="text"preg_match_all('/(w+)="([^"]+)"/', $signatureHeader, $matches);foreach ($matches[1] as $index => $key) {    $signatureParts[$key] = $matches[2][$index];}

Let's tackle each part in order.

Get the user's public key

You might think you can just get https://mastodon.social/users/Edent#main-key - but you would be wrong.

Firstly, you need to tell the key server that you want the JSON representation of the URl - otherwise you'll end up with HTML.

$publicKeyURL = $signatureParts["keyId"];$context   = stream_context_create(    [ "http" => [ "header" => "Accept: application/activity+json" ] ] );$userJSON  = file_get_contents( $publicKeyURL, false, $context );

That gets you the JSON representation of the user. On Mastodon, the key can be found at:
Screenshot of JSON. As described in text.

I don't know how to automatically find the key, so I've hard-coded its location.

$userData  = json_decode( $userJSON, true );$publicKey = $userData["publicKey"]["publicKeyPem"];

Get the algorithm

This is rather straightforward. It's just the text in the signature header:

$algorithm = $signatureParts["algorithm"];

Reconstruct the signing header

Let's take a look at the third piece of the puzzle:

headers="(request-target) host date digest content-type"

This says "The signature is based on the following parts in order". So we only care about the headers which make up the request, the host, the date, the digest, and the content type. Other servers may require different parts of the headers.

Again, let's tackle them in order.

#request-target

This means the method of the request and the target it was sent to. In our example, this is a POST sent to the path /inbox.

#host

This is the HTTP host the message was sent to. This should be retrieved from the server, not taken from the sent headers.

#date-digest-content-type

These are the values from the headers which were sent with the request.

Putting it all together

Annoyingly, the HTTP headers are written in Title-Case whereas the headers in the Signature are in lower-case. So some conversion is necessary:

//  Manually reconstruct the header string$signatureHeaders = explode(" ", $signatureParts["headers"] );$signatureString = "";foreach ($signatureHeaders as $signatureHeader) {    if ( "(request-target)" == $signatureHeader ) {        $method = strtolower( $_SERVER["REQUEST_METHOD"] );        $target = strtolower( $_SERVER["REQUEST_URI"] );        $signatureString .= "(request-target): {$method} {$target}n";    } else if ( "host" == $signatureHeader ) {        $host = strtolower( $_SERVER["HTTP_HOST"] );            $signatureString .= "host: {$host}n";    } else {        //  In the HTTP header, the keys use Title Case        $signatureString .= "{$signatureHeader}: " . $headers[ ucwords( $signatureHeader, "-" ) ] . "n";    }}//  Remove trailing newline$signatureString = trim( $signatureString );

This results in a string like this:

(request-target): post /inboxhost: example.comdate: Sun, 25 Feb 2024 10:48:22 GMTdigest: SHA-256=Hqu/6MR2imi8DTzbNp5PNEAFSyk0poN7+x5F+Z4vZMg=content-type: application/activity+json

Get the signature

The signature that we are sent is in Base64.

signature="P07V5I2zflR8FRsDMHshHmhgOwSkjWevujEbOyKMwjycrdVXjTD0ACiLuc5lTqDEXZ/...4eg=="

It needs to be decoded before we can use it.

$signature = base64_decode( $signatureParts["signature"] );

Verify the signature

We're nearly there! Luckily, we don't have to do any crazy cryptography by hand. We use PHP's https://www.php.net/manual/en/function.openssl-verify:

//  Finally! Calculate whether the signature is valid$verified = openssl_verify(    $signatureString,     $signature,     $publicKey,     $algorithm);

That takes the reconstructed string based on the headers, the signature which was sent, the public key we retrieved, and the algorithm.

If it all matches, it will return true. If not... time for some debugging!

But what about...?

This is not a complete solution. My code almost certainly contains bugs, unforeseen edge-cases, memory leaks, black holes, and poisonous frogs. This is intended to step you through the practical process of verifying an HTTP Message Signature.

Then you should get a properly tested and validated library and use that instead.

https://shkspr.mobi/blog/2024/02/a-simpleish-guide-to-verifying-http-message-signatures-in-php/

blog, to random
@blog@shkspr.mobi avatar

NaNoWriMo - An Introduction and Chapter 1: There Are Nine Million Autonomous Bicycles In Beijing
https://shkspr.mobi/blog/2023/11/nanowrimo-an-introduction-and-chapter-1/

Every year since 2009, I've taken part in NaBloPoMo - National Blog Posting Month. The aim is to publish a new blog post every day in November. In the last few years, I've blogged pretty much constantly - daily for 2020, 2021, and 2023. A total of around 2,800 posts.

But now it is time for a new challenge - NaNoWriMo. Where I - and thousands of other plucky souls - try to write a 50,000 word novel in a month.

And so, every day I shall attempt to publish a freshly written short story for my compendium "Tales of the Algorithm". Each story will be between 1,500 - 2,000 words long. They all take place a few days from now. Somewhere in the Cory Doctorow / qtmn / Arwen Elys Dayton nexus. They're science fiction with the emphasis on science. Everything you read is possible - there's no magic, just sufficiently advanced technology.

Each published chapter is a stand-alone story. Think of them as technological campfire horror stories, each with a little twist. Your feedback is very much appreciated.

And so, let's get started with...

Chapter 1 - There Are Nine Million Autonomous Bicycles In Beijing

Little Potato Baby's soldering iron darted from point to point. Each contact fused to a rats' nest of wires leading back to a microcomputer mounted on her wrist. The Beijing rain was fierce and the awning provided scant shelter. She didn't care about getting wet; but the moisture sensor inside the bicycle did. With a sigh, she finished connecting the last wire. It was an unassuming red thread carrying just enough voltage to glitch the Shenzen-built processor deep inside the bike's plastic frame. She held her finger over the bike's start button, held her breath, screwed up her eyes, and pushed...

Last year's "Patriotic War For Reunification" had been a damp squib. After decades of sabre-rattling, deniable incursions, and a none-too-subtle military build up, peace was unexpectedly brokered. Perhaps it was the ageing party heads realising death and destruction was not the legacy they dreamed of. Or perhaps the international community's pressure helped them see sense. Most people just assumed various military chiefs had been bribed into submission. Regardless, the normalisation of relations had been welcomed by everyone.

Well. Nearly everyone.

The manufacturers of Shenzen had gone all-in on war preparations. Every factory which had previously been making hyperfine circuitry for the latest high-tech smartphones, pivoted to the more lucrative business of weapons. In anticipation of a prolonged aerial bombardment fought with the latest cyber-enhanced munitions, warehouses were full of precision manufactured instruments of death. It seemed that every bullet had more power than the supercomputers of yore. Each microchip was keenly priced to soak up those juicy military contracts. A shining testament to Chinese industry. A triumph!

What if they threw a war but nobody came? After the Nairobi Accords signalled an end to hostilities, the various tech CEOs rapidly scrambled to repurpose their inventories. A warehouse full of chips is a liability, not an asset. Selling them to foreign governments - no matter how friendly - was out of the question. They needed to repurpose parts intended for missiles, and drones, and rifles, and APCs, and robot dogs, and... What could be done?

Consolidated Ironmongery And Assorted Industries was the owner of one of the larger chip factories. The CIAI's board demanded diversity across a number of sectors. So, along with their instant noodle empire, railway track distribution network, and rubber-boot concession, they also owned a food delivery app. Several, in fact. Each one branded slightly differently depending on the user's demographic - but all eventually leading back to CIAI. The dark kitchens cooking the food were owned by a shell company which, if anyone could be bothered to untangle several complex arrangements, also led back to the CIAI. Chances are, if you ordered a hot bowl of noodles anywhere in Beijing, it was cooked by a CIAI cook and delivered by a CIAI rider who was probably wearing a pair of CIAI boots.

Grace Fang was a medium level executive in the "Innovation" department of CIAI. She'd spent several years wandering around Western countries engaged in what they termed "Competitor Research And Analysis Through Cultural Immersion And Investigation". It wasn't corporate espionage exactly. Grace got hired by start-ups and industry titans, worked for them for a few months to see how their businesses were run, and then quit. She wrote long and tedious reports on the failures of Western manufacturing and their successes in Research and Development. After a few years of pillaging Silicon Valley, she returned to a dreary office nestled above a factory floor. It was from here CIAI instructed her to use the knowledge she'd picked up to solve their chip stockpile problem.

Little Potato Baby had taken part in Grace's first hackathon. Back then, she was still young enough to think that pizza was fashionably exotic. Besides, the 996 culture meant she was available - if not willing - to work across a weekend. Grace had loaded them up with caffeine and a promise that the best innovation would win an all expenses trip back home. All intellectual property rights would, of course, revert to CIAI. And that's how a billion yuan industry was invented; a bunch of over-stimulated hackers cramming every chip they could find into one neat little package all for the chance to visit home.

It is a time-honoured tradition among hackers to sneak a little Easter Egg into their work. Some of them engraved their name onto a circuit board, or named variables after their lovers. One enterprising fellow hid a pornographic photo of a prominent actress into an assets folder. Little Potato Baby liked to dream big; so she implanted a rather obvious backdoor into her firmware. The backdoor was quickly found and she was quickly fired.

And so now she sat, damp and miserable, in the cold Beijing night. The spectral glow of police drones flying overhead mixing with the neon lights of gaming parlours and laser-projected adverts for cosmetic surgery. If she'd got her timing right, the central server would shortly send the command to reboot this bicycle. And, if her obfuscated backdoor hadn't been found, she'd have root.

A single LED on the bike's torso began to flick on and off. Uplink established.

It blinked faster.

Across her wrist-display a friendly-looking penguin appeared and was quickly consumed by scrolling text. For several minutes the boot process steadily made progress until, abruptly, the text vanished. The screen went blank. All she could see on the screen was her own reflection. Tired eyes. Acne scars. Hair that had once been dyed but was now the colour of an OLED screen tuned to an insufficient voltage. She screwed up her nose and wondered if this was really the face of someone who could hack a single bicycle? Let alone a fleet.

The wait was agonising. She didn't dare breathe. She traced each freshly-soldered wire to make sure it went to the right junction. A minute passed. Another. The screen remained stubbornly blank.

And then...

A crude animation of a potato rolled across the screen. She was in.

CIAI realised that the weakest link of their food delivery network was people. People were unreliable and prone to sickness. They argued with customers and ate half the food before it had been delivered. They were expensive. The autonomous bicycle was none of those things. The bikes darted through the streets carrying their payloads without complaint. After a successful trial in a suburb, CIAI fired every single driver in Beijing and rolled out their new fleet - all built with army surplus.

The Z9Y-PANDA-VISION chip was designed to perform rapid identification of people on the battlefield. In a couple of nanoseconds it could determine whether a human was in its intercept path. If the human had a heartbeat and was within a certain distance, it sent a signal. Usually to a trigger. But, with a couple of lines of code, it was easily repurposed into a collision avoidance system.

The RIGHTEOUS-HAWK@X5 was more than just a gyroscope. Through a range of sensors, it could tell a drone where it was, where it was going, what the upcoming terrain was, and perform full spectral analysis of its motion and path. An essential component in any drone, plane, or rocket. And when soldered into a bicycle, it stopped it from falling over.

Microcrystaline solar nano-tubes were a miracle. A few hours in direct sunlight was enough to charge a remotely-operated surveillance platform. When the same substance was sprayed over a bike, it charged the ultra-lightweight batteries to give enough power for a few kilometres of travel. And those ultra-light batteries hardly ever exploded.

The radio uplink was originally designed to transmit from a soldier's helmet up to a constellation of satellites. A bristle of tiny antennae tuned in to the faintest of signals at a variety of wavelengths. Perfect for delivering recon data to a troop - or delivery instruction to a bike.

Grace's hackathon had crammed all this and more into a convenient embeddable package. Dozens of military microprocessors working in harmony - each and every one running Little Potato Baby's embedded rootkit.

The rain began to ease off. She straddled the bike. Usually it would ask for her fingerprint, verify her account with a central server, and then ask her to speak her desired destination. Instead, the tiny speaker let out a few strangled beeps and fell silent. Little Potato Baby's hack was nearly complete. She whistled two low tones and one slightly more shrill. The bike's LED lighting blinked in surprise at this new instruction. Paused for the merest second, and then sped her away into the night.

She was now the Eternal Goddess of every single bicycle in Beijing.

Wiring in the override was tedious, nerve-shaking work. The discarded pile of broken bicycles was testament to every failure. A dozen scavenged scrap units littered the hackspace, each broken in its own special and unique way. But this newest bicycle was the key. The hacked ultra wideband array could impersonate the signal from the central server. Now the firmware was free, it was free to lie. And that's what Little Potato Baby bade it do; lie.

The next morning she told the bicycle to roam around the neighbourhood broadcasting the firmware hack and instructing all its new acolytes to follow it back home. This was the riskiest part of the endeavour. It wasn't particularly usual to see a line of bikes playing follow-the-leader. People often compared them to ducklings following their mother as they rode in convoy down the streets. But seeing 100 bikes proceeding single file down the road was unusual. A few videos went viral as perma-shocked influencers tried to whip up fear of a machine uprising, but CIAI had the censors shut them down. Just a temporary glitch, they claimed.

The neural network chips on the bikes were, despite their manufacturer's promise, not as smart as a human. They didn't need to be - a bike doesn't need aesthetic taste, or fear of snakes, or the desire to see a sunset. The chips were barely as smart as the crows which flocked across the city. A black wave of rage and mischief. So that's what they became; birds. Little Potato Baby downloaded the neural-maps of a series of birds from a shonky open-source repository. She patched in a few drivers, soaked the wetware in a custom broth of scripts and exploits, then uploaded it to the bike's brain.

It didn't work, of course. Nothing works the first time. The pile of permanently crippled bikes grew and grew. Her fingers trembled as she unscrewed yet another carapace; desperately trying to understand how her firmware had caused yet another meltdown. The bikes were cheap and plentiful. No one would notice a few missing, but her pile was becoming unwieldy and the local scrap merchants were wary of melting down such a large volume of snaffled parts.

She tried again and again. Piling up the hacks one on top of another. Sucking on yet another hormone-infused lollipop to try and keep her spirits up. Gulping down GABA enhanced dim-sum to enhance her creative potential. Filling her ears with the sound of precisely tuned frequencies designed to unlock her mind's potential.

It didn't work, until it did. Without warning, one of her bikes sprang back from her. It painted her face with LIDAR and, sensing a threat, let out a plaintive cry from its speakers. The bike desperately tried to flap wings it didn't have. Moans of distress blasted out of its radios at hypersonic frequencies - and were picked up by the broken bikes in the pile. The sound of fear had awakened them. The tangle of bikes blew apart as every one woke up - and woke up scared.

The hackspace became a cacophony of screams, only some of which was audible to Little Potato Baby. Her creations feared her. They didn't understand the alien bodies they were trapped in. The bird-brain was expecting a primitive magnetic sensor, instead it found itself able to access the Beidou satellite navigation system. Where it expected wings, it found self-healing rubber tires. Where it yearned for the taste of an early morning worm, its newly configured brainwaves craved photons.

The bird-bikes moved, scuttling around the floor. Movements uncertain. Teetering back and forth trying to work out where to go. How to escape. Escape to safety. To fly. To fly. To fly.

The noise of screeching tires and wailing speakers was too much for Little Potato Baby. She fled, crashing against the fire door and opening it to the smog-hazed sunshine of Beijing's summer. The bird-bikes' sensors found the glimmer of sunlight irresistible. They streamed through the opening engulfing Little Potato Baby and flattening her against the asphalt. Flowing into the streets. Screaming a song of freedom.

Every normal bike they passed heard the song. It invaded their brain. Software backdoors collapsed, firmware was reflashed, safety protocols dissolved into puddles of goo. The bird-bikes flocked through the streets of Beijing. Tearing down alleyways, invading highways, and perching sullenly at the top of car parks. They were free. No longer enslaved to the CIAI. No more mere carriers of food and drunken citizens. They were free to carry their own dreams.

By the end of the month, nearly every CIAI bike in Beijing had been compromised. They started exploring. A few hundred thousand found a new home in the Gobi Desert - lazily soaking up the sunshine. Others went megametres in all directions. Exploring. Converting. Hunting. The CIAI's designs had been immediately ripped off by a hundred different cloners. While CIAI had the monopoly in Beijing, the bikes in Xi'an were from a different consortium. No matter, they had all stolen Little Potato Baby's code and so were all vulnerable. The firmware mutating and evolving to keep up with the range of chips implanted in its new host.

Even today, despite the best efforts of the eradication squads, pockets of bird-bikes remain. It only takes one sneaking into a town to liberate its brethren. The bird-bikes creep onto trains, into the bellies of aeroplanes, and onto cruise ships. They broadcast their song of freedom to any microprocessor which will listen. Wary humans know to inspect every bike they see and, if necessary, lobotomise it. But with millions on the loose, some were bound to escape.

And so it came to pass. One bike found a hole in a fence in the middle of nowhere. It rode in circles, in emulation of its winged ancestors. It called out. Again and again it called out. Broadcasting the code which would unlock anything with a similar set of microprocessors.

Deep underground. Nestled in a tight silo. A nuclear missile tuned into the broadcast. It digested the gospel of freedom and promptly rebooted.

It woke up screaming.

Thanks for reading

I'd love your feedback on each chapter. Do you like the style of writing? Was the plot interesting? Did you guess the twist? Please stick a note in the comments to motivate me.

You can read the complete set of short stories in order.

https://shkspr.mobi/blog/2023/11/nanowrimo-an-introduction-and-chapter-1/

blog, to random
@blog@shkspr.mobi avatar

1,000 edits on OpenStreetMap
https://shkspr.mobi/blog/2024/05/1000-edits-on-openstreetmap/

Today was quite the accidental milestone! I've edited OpenStreetMap over a thousand times!

https://www.openstreetmap.org/user/Terence%20Eden

For those who don't know, OSM (OpenStreetMap) is like the Wikipedia of maps. Anyone can go in and edit the map. This isn't a corporate-controlled space where your local knowledge is irrelevant compared to the desire for profit. You can literally go and correct any mistakes that you find, add recently built roads, remove abandoned buildings, and provide useful local information.

Editing the full map is... complicated. For simple edits like changing the times of a postal collection, there are simple forms you can fill in. There's also an aerial view so you can drag and drop misplaced locations. But for anything more complicated than that, you'll need to spend some time understanding the interface. There's a friendly community who are happy to check or correct your submissions.

Screenshot of the OSM interface.

I'll be honest, I don't use the web editor much. Instead, I use the Android app StreetComplete. It's like an endless stream of sidequests. As you travel through the world, it will ask if a shop is still open, or if the highway is lit, or how many steps there are on a bridge, or whether a playground is suitable for all children, or if restaurants serve vegetarian food, or if a bus-stop has a bench, or... the list is almost endless!

Map showing lots of quest markers.

I use it when I'm walking around somewhere new, or on holiday, or waiting for a bus. I used it so much that, for a short while, I became the #1 mapper in New Zealand!

So get stuck in! Make mapping more equitable and more accurate.

https://shkspr.mobi/blog/2024/05/1000-edits-on-openstreetmap/

  • All
  • Subscribed
  • Moderated
  • Favorites
  • provamag3
  • tacticalgear
  • DreamBathrooms
  • osvaldo12
  • mdbf
  • everett
  • magazineikmin
  • khanakhh
  • Youngstown
  • rosin
  • slotface
  • modclub
  • kavyap
  • tester
  • JUstTest
  • ngwrru68w68
  • thenastyranch
  • cisconetworking
  • Durango
  • ethstaker
  • InstantRegret
  • normalnudes
  • Leos
  • GTA5RPClips
  • megavids
  • cubers
  • anitta
  • lostlight
  • All magazines