Andy Davies

Andy Davies

@andydavies.me

PM for Web Observability by day Vegetable grower… Eurorack synth dabbler… Bristol Bears Women’s fan by night https://andydavies.me

1.4K followers379 following1.5K posts

Andy Davies reposted

Alex Andreou
@sturdyalex.bsky.social

BBC News just interrupted its coverage to go, live, to Nigel Farage - a man with no contitutional standing in our setup - responding to the budget - a document which nobody has seen yet. WHY

Andy Davies reposted

Colette Delawalla, PhD
@cdelawalla.bsky.social

The 5-year cancer survival rate is up to 70% SIDS deaths have decreased by over 50% 89% decline in tornado deaths All thanks to federal investment in science and OUR tax dollars at work!

Michael Druker 🇨🇦@mdruker.app

Social media loves talking about how everything is getting worse. But what’s something that you’ve seen get _better_ in your lifetime?

Andy Davies reposted

Jonty Wareing
@jonty.bsky.social

Looking for a journalist who covers UK Government tech, ideally with a health slant - any suggestions? I have once again accidentally found a juicy story while poking at data. Sill not certain, but want to get my waterfowl assembled linearly.

Andy Davies
@andydavies.me

People from my home country can be incredibly short sighted at times

Fred Cowell@fascowell.bsky.social

In the long term this is way more destructive than Jackdaw, because it actively slows down electrification and weaning households off residual LNG consumption.

Andy Davies reposted

Mary Branscombe
@marypcbuk.bsky.social

I have to hope that is misquoting something about *most people* not having to know PHP existed. I know I’m a bit weird for caring both about how the technology I write about works as well as why it matters but I won’t get one right without the other

Jack Fifield@jackfifield.uk

"Cyber correspondent Joe Tidy says he didn't know PHP existed until yesterday morning"

Andy Davies reposted

Dan McCrum
@mccrum.bsky.social

A hungry ghost trapped in a jar helps me choose wallpaper. Sure I get medical advice from a hungry ghost trapped in a jar. Er…

hikikomorphism@hikikomorphism.bsky.social

If you can substitute "hungry ghost trapped in a jar" for "AI" in a sentence it's probably a valid use case for LLMs. Take "I have a bunch of hungry ghosts in jars, they mainly write SQL queries for me". Sure. Reasonable use case. "My girlfriend is a hungry ghost I trapped in a jar"? No. Deranged.

Andy Davies reposted

Dreadnought Holiday
@dreadships.bsky.social

Really important, on Trafalgar Day, to observe that there are both women and black people included in this image. It's not anachronistic or "woke" to tell their stories, and ignoring them is doing a disservice not only to those people but also to their contemporaries who made sure they were seen.

Aidan Cook@aidancook.bsky.social

Wasn’t just harbour - they were often wives or partners, and would be on ships “informally”. There are women in “The Death of Nelson”:

Andy Davies reposted

Andrew Nesbitt
@andrewnez.mastodon.social.ap.brid.gy

Trust Stores Are Dependencies Too https://nesbitt.io/2026/10/21/trust-stores-are-dependencies-too.html

nesbitt.ioTrust Stores Are Dependencies TooeMudhra generated eight of its intermediate CA certificates incorrectly, so their private keys can be recovered from the certificates themselves. Firefox (OneCRL and CRLite) and Chrome (CRLSets) blocked the intermediates on 17 October, Apple on the 19th, and Microsoft on the 20th through Windows’ automatic trust list updates. The disclosure page states that “many other clients do not consume revocation information and require software updates”, and its fix table lists the packages that carry their own copy of the roots: * certifi 2026.10.19 and pip 26.2.2 * uv 0.13.4 and pixi 0.82.1 * webpki-roots and webpki-root-certs 1.0.10, rustls-webpki 0.103.16, rustup 1.29.2 * Node.js 22.23.4, 24.22.1 and 26.12.1 * Go 1.27.3 and 1.26.10 * Composer’s ca-bundle, Elixir’s castore 1.0.22, Perl’s Mozilla::CA 20261020 * the curl CA bundle, NSS 3.131.1, and a row of Linux distributions * the `pip3` shipped with macOS, which uses “its own outdated copy of the roots” Michał Górny, who maintains a large part of Gentoo’s Python packaging, traced where certifi alone ends up. Gentoo’s certifi is patched to use the system store, so system Python picks up the change when `ca-certificates` updates. Everywhere else needs its own update: * Each virtualenv and conda environment that installs certifi has its own copy. * pip vendors certifi, so every environment’s pip needs upgrading, using the old pip to fetch the new one. * Python vendors pip through ensurepip to bootstrap new environments, so anywhere ensurepip installs its bundled wheel you wait for a Python release, or upgrade pip after every `python -m venv`. * Lockfiles need certifi bumped, and dependency cooldowns need an exception for it, because a cooldown on a trust store delays the fix. * Rust tools like uv compile webpki-roots into the binary, so each one needs a rebuild and a release, and so does any container image that includes them. * Flatpak runtimes each carry their own `ca-certificates`, and some Flatpak apps carry another copy inside that. ### Bundles in critical packages To find the routes beyond the well-known ones, I pointed git-pkgs/certs at the 6,877 packages that ecosyste.ms marks as critical across PyPI, npm, crates.io, Go, Maven Central, Packagist, NuGet and RubyGems. It downloads each package archive, reads every file statically, and pulls out anything that parses as an X.509 certificate. 116 of those packages contained certificates, about 1.7%, mostly test fixtures and package-signing certs. 28 of them ship something that works as a CA bundle. A separate RubyGems sample added a 29th, honeybadger, from outside the critical list. The full results for all 29 give each package’s version and how it loads its bundle. The real number may be higher, because the scanner reads PEM, DER, JKS and PKCS#12 and skips certificates compiled into native code, and 49 of the 50 platform-specific Python wheels in the sample contained compiled binaries outside those formats. Across the 29, the same `cacert.pem` sets the trusted roots for every TLS connection in some packages and is loaded only on request, or not at all, in others: * Excon, pip and redshift-connector load their bundle alongside the system roots. A root removed from the OS store stays trusted, because the bundle adds it back. * Stripe’s Ruby library and httpclient on MRI build their own `OpenSSL::X509::Store` from the bundle and hand it to the connection, so a `ca-certificates` update leaves them trusting the same roots as before. * Honeybadger, aws-sdk-v1, Guzzle 3, stripe-php and braintree_php point OpenSSL or curl at their own file by default, and a configured path overrides it. gRPC’s Ruby, PHP and Python packages register their bundled roots as the default. * botocore and the AWS CLI use their bundled file when certifi is absent. httplib2 uses its own after checking configured paths, and two of Google’s Java clients fall back to a bundled keystore when the Java installation store is missing. Whether a given deployment hits the fallback depends on what else is installed there. * aws-sdk-core uses system roots by default and switches to its bundle when you call `Aws.use_bundled_cert!`, and gocertifi, Composer’s ca-bundle and ioredis’s RedisCloud profile likewise take effect only when code selects them. nap uses its bundled file once the caller turns on certificate verification. * libv8 carries a bundle inside its vendored copy of depot_tools, and App Engine’s API stubs use theirs for the local development server. virtualenv’s embedded pip wheels each contain a certifi. These ship to every install and are separate from an application’s own HTTPS requests, except that virtualenv installs its wheels as the pip in each environment it creates. ### Removed roots Matching the certificate sets against historical Mozilla releases dates honeybadger’s bundle to 2011 and httpclient’s to 2014 or 2015. Both gems are maintained: httpclient 2.9.0 came out in February 2025 and honeybadger 6.9.3 in September 2026, and both releases still ship those bundles. Algoliasearch, aws-sdk-v1 (last released in April 2017) and Guzzle 3 (whose repository is archived) still contain StartCom roots that Mozilla removed in Firefox 58 in 2017, and those roots stay valid until 2036 and 2039. 26 of the 29 bundle packages contain at least one root that Mozilla has removed from its programme and that is still inside its validity period. Matching exact fingerprints against CCADB’s records gives 95 such roots across those packages. eMudhra issued the compromised intermediates from its emSign Root TLS CA - G3, which emSign ECC Root CA - G3 cross-signs. Root TLS CA - G3 itself is in none of the scanned bundles, so the cross-signing root is the one that matters here. Sectigo also cross-signed each intermediate from its AAA Certificate Services root, a 2004 Comodo certificate valid until 2028. A client that uses a bundle containing emSign ECC Root CA - G3 or AAA Certificate Services as its trust anchors, and skips revocation checks, will accept a chain running from a leaf through a compromised intermediate to that root, because the attacker supplies the intermediates in the TLS handshake. Mozilla removed emSign ECC Root CA - G3 in response to the incident, as its 20 October notice records, so it is one of the 95. The root is in ten of the packages I scanned: Excon, Stripe’s Ruby and PHP libraries, gRPC for Ruby, PHP and Python, Composer’s ca-bundle, gocertifi, App Engine’s API stubs and virtualenv. certifi carried it through 2026.7.22 and dropped it in 2026.10.18, a day before the 2026.10.19 release in the fix table, and a lockfile pinned to 2026.7.22 or another release that included it still installs it. Mozilla ended AAA’s TLS trust in 2025, and certifi dropped it in 2025.4.26. It isn’t among the 95 above, which only counts certificates Mozilla removed from its programme outright. It’s still in 17 of the packages I scanned, including honeybadger, httpclient, aws-sdk-v1, Guzzle 3, algoliasearch, nap, gocertifi, httplib2 and botocore’s fallback. Honeybadger, httpclient on MRI, aws-sdk-v1 and Guzzle 3 use that file as the trust anchor by default, and algoliasearch adds it to an existing store, while the other twelve use it as a fallback or when code selects it. pip 26.2.2 vendors certifi 2026.10.19, which contains neither root. botocore merged a fix removing AAA from its fallback bundle on 20 October, but the latest botocore release still ships it. AWS updated aws-sdk-core’s 2018 bundle the same day the issue was reported and Excon replaced its bundle in 1.8.0, released on 21 October, while gRPC’s backport is still open. ### Package metadata Finding all of this took downloading and parsing every file in nearly seven thousand archives, because the only record of a bundled trust store is the file itself. The manifest, lockfile and SBOM for an app using httpclient record `httpclient 2.9.0`, a checksum, and `pkg:gem/[email protected]`. What the app depends on for TLS is Mozilla’s root list as it stood in 2014, and those documents record it only as httpclient’s name and version. When a root gets pulled, vulnerability scanners and dependency bots downstream match on those names and versions, so a search for “contains AAA Certificate Services” has to start from archive contents. Vlad Miricioiu describes the same gap for compiled code in Binary Dependencies: Identifying the Hidden Packages We All Depend On. A Python wheel that bundles a precompiled C library depends on that library, “even though these dependency relationships are invisible to us”, because the wheel’s metadata lists only its Python dependencies. A CA bundle is what he calls a phantom binary dependency, with a PEM file in place of a `.so`. It’s third-party data, maintained upstream by Mozilla’s root programme on its own release schedule, copied into a package by hand at some point and then carried forward through every release after. When an application depends on certifi directly, its lockfile names certifi and a version, and tools can track it. pip vendors certifi and records the version in `src/pip/_vendor/vendor.txt`, but that file is a convention of pip’s source repository, and the installed wheel’s metadata lists pip alone. webpki-roots shows up in uv’s `Cargo.lock`, but the uv binary you install from PyPI or Homebrew ships as a single executable with the roots compiled in and the lockfile left behind. A file called `cacert.pem` inside a gem appears only in the archive’s file listing, and finding out which roots it holds means parsing it. Few registry schemas have a field for “this package vendors a copy of X at version Y”. Debian’s `Built-Using` field records statically linked sources, and CycloneDX’s `pedigree` records where a component’s contents came from. The generators that produce most SBOMs build from lockfiles, so httpclient’s entry records `httpclient 2.9.0` and omits the 2014 root list inside it.

Andy Davies reposted

Bruce Lawson
@brucel.bsky.social

"In 2022, security researcher Felix Krause showed that Instagram and Facebook’s in-app browsers injected JavaScript into the pages users visited". What if links to web pages simply opened in your default browser on a device that you own. The browser *you* chose and installed, because you trust it?

absolutegeeks.comWhatsApp is building an in-app browser for every link you openWhatsApp is preparing to make one of mobile's more divisive features available to every link in your chats. References found in a recent iOS TestFlight build

Andy Davies reposted

Cat Hicks
@grimalkina.bsky.social

Replying to @grimalkina.bsky.social

Anyway I think it's important to consider this kind of thing in light of the general expert consensus that it's not that young people are avoiding adult thinking, it's that young people are facing very difficult times. I think YA pretty closely tracks that in its trends. www.bbc.com/news/article...

bbc.comYoung people are not snowflakes, head of mental health review saysSpeaking exclusively to the BBC, Prof Peter Fonagy says being young is much harder now than it was.

Andy Davies reposted

Fionchadd
@fionchadd.bsky.social

It’s looking increasingly likely that I’m going to need to start earning a much more regular salary than freelancing is providing, so if anyone has any leads on remote front-end dev roles please hit me up. Everyone I’ve worked with says I’m proactive, communicative & great at what I do.

Andy Davies
@andydavies.me

Trying to book trains via Concur and there doesn’t seem to be a way to choose the route I want Going to Heathrow and want to go via Hayes and Harlington but all it offers is into Paddington and the Heathrow Express or the RailAir bus from Reading 😞

Andy Davies
@andydavies.me

Managed to do nearly perfect poached eggs again, one on the left is a bit untidy but they both had gooey insides

Andy Davies reposted

Gareth Dennis
@garethdennis.uk

Once again, I cannot express the extent to which the least anyone cheerleading trans segregation deserves is hounding out of public life.

Sophie Molly@sophiemolly.co.uk

She was murdered by transphobia 😥😥😥

Andy Davies reposted

Phil Sturgeon 🌳🚵⚓️
@philsturgeon.com

Every study shows that decarbonising and *doing the things we legally agreed to do but needed Insulate Britain to remind us about* are cheaper for everyone and bring bills down. Cutting “The Green Crap” has only ever put bills *up* short term and long term. www.theguardian.com/environment/...

theguardian.comHeat pumps and insulation would cut UK living costs more than new oilfields, study suggestsWarm homes plan would create 50,000 jobs, compared with about 1,100 for Rosebank oilfield, thinktank finds

Andy Davies reposted

performance.now() conference
@perfnow.nl

What if we could provide websites that have the ability to do their thing while being offline? In this talk, I’ll show you how I’ve harnessed the native web APIs to implement offline capabilities while minimizing the amount of Javascript to execute in the browser. Aleth Gueguen at perfnow.nl

Andy Davies reposted

rem / Remy Sharp
@remysharp.com

Guys, yes, *just* the guys, watch this. Jo shouldn't have to tell us, but do ask yourself: have you seen this? Have you done this? Can you do better next time? This work should have always been on us. This also *has* to be ongoing, it's not just fixed once. We have to pass it on.

Jo Franchetti @thisisjofrank.bsky.social

I gave a talk at EMF titled "Men in Tech #YesAllMen", in which I told my experience of being a woman in tech. I was afraid to publish it in case it affected my current or future employment. With all the current news I would like to add my 2¢. So here is the recording: youtu.be/WXL6K1lhvt0?...

youtu.beMen in tech #YesAllMen - EMF 2026YouTube video by Electromagnetic Field

Andy Davies reposted

Phil Sturgeon 🌳🚵⚓️
@philsturgeon.com

Replying to @philsturgeon.com

At @protect.earth we only ask for tree sponsorship for ourselves or the landowners we work with when there is literally zero other funding for them otherwise. No government grants available. No local community fund paying for it. The sponsor pays for it. That’s it. shop.protect.earth

shop.protect.earthSupport Rewilding and Restoration in the UKPurchase trees and other biodiversity improvements to support our work restoring ecosystems as sequestering carbon with nature based solutions across the UK.

Andy Davies reposted

Martin Michalek
@machal.bsky.social

Working on website speed? Help me, please. I’m putting together small study on why it’s sometimes difficult to get faster websites approved I’m interested in your real-world experiences. It takes 3–5 minutes to complete. Every response helps. 🙏 pagespeed.one/en/perfnow #WebPerf #PageSpeed

pagespeed.oneSurvey: How do you get web performance prioritized? | PageSpeed.ONEA voluntary survey on how web performance gets prioritized at work. For people from performance.now() and from elsewhere.

Andy Davies reposted

Eiko Fried
@eikofried.bsky.social

Reading this made me tear up, and that's really special because we Germans only get to tear up twice a year. Professor Peter Fonagy, Chair of the Independent Review into Mental Health Conditions, ADHD and Autism (2026), with his letter to a young person.

The Psychologist@psychmag.bsky.social

You might like this adapted Foreword www.bps.org.uk/psychologist...

bps.org.uk'You are not fragile. You are outnumbered.' | BPSProfessor Peter Fonagy, Chair of the Independent Review into Mental Health Conditions, ADHD and Autism (2026), with his letter to a young person.

Andy Davies reposted

𝚕𝚘𝚞𝚕𝚊 𝚢𝚘𝚛𝚔𝚎
@loulayorke.bsky.social

There is ONE space left for this weekend's Patch & Splice at Asylum Studios, Suffolk with myself, @tomwhitwell.bsky.social of MusicThing & analogue filmmaker Graeme Hogg!! You will learn to Patch AND to Splice! Make your own analogue film! Improvise your own analogue music! @thonksynth.bsky.social

eventbrite.co.ukPatch & SpliceMake your own analogue sounds and visuals using a 16mm film projector and a compact modular synth.

Andy Davies reposted

Ellie Mae O'Hagan
@elliemaeohagan.bsky.social

Earlier this year, E3G released a big report with the Department of War Studies at Kings College which showed that our dependence on gas is a major national security risk. Cutting heat pumps to fund defence is like not paying for a flu jab so you can buy lemsip. It makes no sense.

Andy Davies reposted

James Arthur Cattell
@jacattell.bsky.social

Q: Do you know of any #public or #community owned conference venues in #Manchester that can host 250 people and have at least 8 breakout rooms, please? Dates needed are either Saturday 16 or 23 January 2027. @ukgovcamp.com 2027 ( #ukgc27 ).

Andy Davies
@andydavies.me

Apple claims that Managed WiFi networks associated with a SIM get removed when that SIM is removed but my phone still has networks for O2, Three and Vodafone and I can’t remove the old ones…

Andy Davies reposted

Dan Snow
@thehistoryguy.bsky.social

This a million times. People of colour being dragged on to debate maniacs about imaginary labels & race science is an abomination. proper ‘how German are you’ Nazi shit Note that people like me with white migrant parentage never asked to defend our identity Englishness. Is. A. Made. Up. Thing

Sathnam Sanghera@sathnam.bsky.social

Dear tv and radio producers. Thankyou for the invitation. But, no, I do not want to appear on your show to defend the idea that I am English, after 50 years of living and working here, because the increasingly feral right want to turn this into a "debate" and you cannot see how you're being played

Andy Davies reposted

Dan Davies
@dsquareddigest.bsky.social

Having grown up in Wales, I can testify that if you are actually worried about your culture and history being under threat, the thing to do is write poetry and songs, perform plays, tell stories and organise festivals, not just sit around whining.

Andy Davies reposted

rem / Remy Sharp
@remysharp.com

FOMO over recent conferences? Or even from last year? Join us next month in Brighton for 2026.ffconf.org - join your peers, join the conversations you can't have with your chatbot, join us for 8 amazing talks and one superb day. Get your ticket today, don't FOMO-FFCONF.

Andy Davies reposted

Rachel Parris
@rachelparris.bsky.social

Hey folks. In total honesty my tour is NOT selling well. I’ve sold 30 tickets in a 400 seater in Birmingham, and not much more elsewhere. If you like musical comedy, if you like standup, then please come see my show! And spread the word! The Rachel Parris Songbook tour starts in Nov! Link in bio! 🎶

Andy Davies
@andydavies.me

It’ll be a fabulous day and you definitely buy a ticket I had a ticket but sadly can’t make it anymore as I’ve got to be in the US for work reasons

rem / Remy Sharp @remysharp.com

FOMO over recent conferences? Or even from last year? Join us next month in Brighton for 2026.ffconf.org - join your peers, join the conversations you can't have with your chatbot, join us for 8 amazing talks and one superb day. Get your ticket today, don't FOMO-FFCONF.