voboda

With #localfirst apps and SPAs, DNS hijacks are fatal. All end-user data, even encrypted, is revealed. Anyone else considered this? I'm doing some research, and designing some prototypes.

"[Palantir workers] joined a company that promised to stop abuses of power, and they are watching it build the tools that make those abuses faster, wider, and harder to undo. The question they are left with is ... at what point does building the machine make you responsible for what it does?"

I GET LOGGED OUT. BUT I LOG IN AGAIN

Lessons learned from zKal blog.voboda.com/parking-zkal/

If it has 2 sides, it's propaganda

Had quite a few "oh shit" moments reading this. And it's mostly stuff I thought I knew. sockpuppet.org/blog/2026/03...

jbp.io/2025/05/02/g... "I view GHA runners as public, unsecured shell boxes that I can run scripts on. They can check out and build public code, but at no point should they be given any kind of privileges or secrets."

Dependency inversion, but in space ochagavia.nl/blog/towards...

You use a bare Git repo with a `post-receive` shell script hook. I use GitHub Actions: remote YAML, swiss-cheese key management, OIDC trust glue, job orchestration, delimiter-delimited metadata, opaque internal headers, microservice spaghetti, bug bounties, and CVEs to match. We are not the same.

Quick mitigation: docs.hpc.ut.ee/public/cve-2...

that glitch

It struck me that pet names could actually work with the Reticulum network stack more than with IP, because you actually take your Reticulum address with you when you move in the network. You can't do that with IP addresses, hence the need for DNS.

If I had to identify a list of skills in high impact engineers, it would include: - ecological awe - intellectual humility - respect for the complexity of unfamiliar problems - cross functional communication - resilience engineering - marketing and sales (“Technical skills” aren’t in my top ten)

Dirty Google games to avoid GDPR compliance for EU accounts? @eff.org

One European here, saying thanks to the Hungarians who have been standing up for their values. Hope is alive.

It's pencils down at the hackathon. I put 236 years of US copyright law into a git repository. Every Act of Congress from 1790 to today is a commit. Still some work to be done, and things got frantic at the end, but I'm proud of this! github.com/katelynsills...

If anyone's paying attention, I fixed cookies. :) blog.voboda.com/hdk-sessions/

well @meri.garden, you get to have all the fun meri.garden/posts/using-...

it's pretty fun that the founder of temporal logic was called Arthur Prior

"Crypto was a community that had been building for almost a decade. Economic design was what they did. And nobody had addressed the economic design problem that made their conference weeks full of over-hyped but mostly empty events?" Here is my attempt. blog.voboda.com/density-index/

Working on zkal, I realised I was tackling a general problem: returning to the benefits of open data for communities, but with modern privacy protection for the individual. Came up with a pattern that might be useful (or flawed!) blog.voboda.com/proof-projec...

Sharing a self-nerd-snipe blog.voboda.com/meeting-wher...

"using network architecture to solve issues of power distribution simply shifts bottlenecks rather than eliminating them. A decentralised protocol does not automatically produce decentralised governance, it also moves power to different, less visible places." connectedplaces.online/reports/fedi...

This is the privacy policy I always wanted to write. onelineforyourmind.com/privacy/

blog.voboda.com/the-third-fl... A kinda hacker love story for Berlin.

Given today's LiteLLM supply chain attack, what are people's preferred development environment sandboxes on MacOS these days? I think it's time I started running my development environments somewhere where rogue code can't steal all my ~/... credential files

The Moltbot rename and supply-chain attacks that followed: www.malwarebytes.com/blog/threat-... I run all my dev in a hardened container, but this type of attack grabs API keys silently, and uses them to watch communication. Any ideas on mitigation?

We cannot let them get away with this. And the solution is not to chop of a head of this hydra and call it a day - but to fundamentally change how we do things.

I'm glad this is coming to the forefront. I was deeply inspired by Nikolai Mushgian's attitude to this ( see nikolai.fyi and look at dmap, dpack and minicash's doc ) I even made a little game about this philosophy for Devcon SEA: immutalists.infinite.build