Yeoman programmer and crafter of fine websites. I enjoy space, spaceships, old books, gardens, long walks, and beautiful things. Here be occasional silliness.
Earth
Joined July 2013
- Tweets7.7K
- Following324
- Followers413
- Likes49.9K
Pinned Tweet
🧵Evidence thread of reasons why you need to own and control your digital world. Don't build things of meaning on rented land.
(I'll add to this over time as I encounter examples. Comment with your own, too.)
The real trouble with WordPress’s update frequency has little to do with WP itself, but stems from bad, flaky, slow processes that far too many site owners/maintainers habitually use to manage updates. You cannot adequately manage a website in 2026 using habits from 2016 (or earlier!)
(If you don’t know how to fix those habits, hire me.)
Andron Ocean retweeted
Cooldown now works for WordPress plugins and themes too! WP Packages records when it first serves each version, and resets the clock if a release is changed after the fact on WordPress.org
roots.io/wp-packages-now-sup…
ALT Terminal running "composer update wp-plugin/query-monitor -vv" with a cooldown policy enabled. Composer reports "2 package version(s) withheld by the cooldown policy": wp-plugin/query-monitor 4.1.0, published 2026-10-26, available in 4 days, and wp-plugin/query-monitor 4.1.1, published 2026-10-27, available in 4 days 11 hours.
Composer 2.11 is out 🚀 cooldown dependency policies hold back freshly published package versions for an hour or a day, so compromised releases can be flagged before they reach your composer update. blog.packagist.com/composer-… #php #phpc #composerphp #supplychainsecurity
SUPPORT!
But two things need to happen:
1) UX to set up short-lived credentials has to get easier. Devs will do it if it’s only 2x, 3x harder than grabbing a static secret. The few places that offer it today it’s 10x harder and buried in a maze of config screens. (Malte’s called this out, happily.)
2) OIDC or other short-lived creds have to stop being an enterprise tier feature. We finally got ubiquitous TLS when Let’s Encrypt made it free and easy, same principle applies here. “Only enterprises need the good security” is a toxic paradigm these days.
I've been cooking on this post for a bit, but with the cyber security events of this week I had to ship it:
Long-live static credentials must die. We never want to rotate API keys again.
Turns out only 8% of cloud and SaaS vendors support secure alternative. This is our call to action to change this AND our commitment to do our part:
- We are requiring vendors on our marketplace to support OIDC
- We shipped @shadcn components to make it easier to ship OIDC configuration
- We are expanding OIDC support on our own platform
The last generation got the web from HTTP to HTTPS. It is on us to move past API keys.
vercel.com/blog/death-to-lon…
Andron Ocean retweeted
So basically, today PHP got two critical bugs that let anyone run code on your server without even logging in, which is bad, and then the details leaked before the patch was even out, which is worse, and it works on WordPress and MediaWiki and Magento and Joomla and Laravel, and Censys says like 1.5 million servers are running a version with no fix, so the NSA was like "take your system offline," and the FBI was like "take your system offline," and CISA and the UK and CERT-EU were all like "take your system offline," and then the Prime Minister of Japan, the actual Prime Minister, posted at 5:55 in the morning telling 48.8 million people to take their system offline, so everyone took their system offline, like the Dutch cybersecurity agency took its own website offline, and the Dutch parliament went offline, and the Port of Rotterdam went offline, and Finland and France and Denmark started pulling government sites, and Wikipedia went down, and Archive.org went down, and Asana and GOG and Something Awful went down, and the University of Vienna's webmail went down for some reason, and that's just PHP. Because GitLab also dropped a CVSS 10.0, which is the highest score they give out, for a bug that's been there since 2014, so that's every self-hosted GitLab for twelve years, and then LiteLLM 1.107.0 got hijacked and shipped a credential stealer and a remote access trojan in every single wheel and the Docker images, including latest, and you didn't even have to import it, just installing it was enough, and it's the second time this year, and then Railway paused every deployment on the entire platform because someone got into the environment variables, so now everyone has to rotate every secret they've ever stored there, and TiDB Cloud said someone was walking around inside with stolen credentials for basically a month and an extortion group says they took 10.6 terabytes, and Zeabur got breached for the second time in two months and is just shutting down, like the whole company, and Node.js patched remote code execution and a TLS bypass, and CISA says Plex is being actively exploited, and someone took over 300 Tor exit relays to steal SSH passwords, and SafePay ransomware has hit over 600 critical infrastructure orgs, and India's biggest bank filed a data loss incident, and Japan has been in an official state of emergency in cyberspace since October 9, which honestly explains the 5:55 AM post. Oh, and eMudhra, a certificate authority that's issued over 60 million certificates, whose entire job is proving websites are who they say they are, was supposed to be using private keys that are random numbers over a hundred digits long, and one of them was 4. Just 4. And the others were like 66 and 237. Anyway, it's Wednesday.
Douglas Adams-esque plot twist
Since we currently have *both* a compromised CA that can be used to sign phishing site certs, and an EZ-hack vulnerability in the most widely deployed web application language, it’s probably a good idea to be extra cautious about links in posts, texts, emails, DMs… everywhere.
I want to know how the hell this outfit got their certs installed and trusted on my machines, my OSes, my browsers. Where were the gatekeepers?
Already seeing a big increase in probably-malicious traffic this morning, even before PHP officially releases the patches and reveals the vulnerability.
Oof, this is a mess.
private keys from 8 intermediate CA certs have been compromised (eMudhra)
Happy "Update everything" day to all my pager-carrying friends
emudhra.we-have-a-problem.co…
Yeah… this is going to be a problem. Hopefully not an economy-sized problem.
I agree with a lot of this. Tech folks consistently underestimate the complexity of the real world (reality is messy with large unmodelable domains), and it seems likely that AIs will run aground on the ragged edges just like large human orgs do.
My thoughts on the current state of AI driven software development, why I'm no longer concerned about a runaway intelligence explosion, and what I think is a far worse outcome we could be walking into...
maevyn.codes/decoherence
It’s been obvious that Apple’s marketing team has been falling off for years, but holy cow I did not know rock bottom was that far down.
Andron Ocean retweeted
There was a semi-well known interview of the famed Argentine writer JL Borges where he explains this.
Borges: I have done most of my reading in English. I find English a far finer language than Spanish.
William F Buckley: Why?
Borges: Well, many reasons. Firstly, English is both a Germanic and a Latin language. Those two registers—for any idea you take, you have two words. Those words will not mean exactly the same. For example if I say “regal” that is not exactly the same thing as saying “kingly.” Or if I say “fraternal” that is not the same as saying “brotherly.” Or “dark” and “obscure.” Those words are different. It would make all the difference—speaking for example—the Holy Spirit, it would make all the difference in the world in a poem if I wrote about the Holy Spirit or I wrote the Holy Ghost, since “ghost” is a fine, dark Saxon word, but “spirit” is a light Latin word. Then there is another reason. The reason is that I think that, of all languages, English is the most physical of all languages.
WFB: The most what?
Borges: Physical. You can, for example, say “He loomed over.” You can’t very well say that in Spanish.
WFB: “Asomó?”*
Borges: Well, no, no, they’re not exactly the same. And then you have, in English, you can do almost anything with verbs and prepositions. For example, to “laugh off,” to “dream away.” Those things can’t be said in Spanish. To “live down” something, to “live up to” something—you can’t say those things in Spanish. They can’t be said. Or really in any Romance language.
This seems interesting and correct to me, and notably is the most bullish case for SaaS I have seen made in a long time.
I still think *most* SaaS is screwed, because the new economics of software will not sustain an infinity of variations on todo lists. But there are 📈 niches.
The end of software secrecy is almost upon us. The death of closed source, and the final triumph of open source.
I should have realized this a few months ago when I successfully decompiled the game of Firefighter from an ancient DOS shareware binary. My robot friend was able to tell it had been written in Borland Pascal from looking at the data layout; it gave me back very readable Pascal code with sensibly chosen function and variable names. I transpiled it to Rust and now ship it as part of my heritage games collection.
The thing is, I thought of this as a fun stunt but didn't have any confidence that the technique would scale up to large, real programs. I have since learned that people are now doing this sort of thing with entire AAA games, which are among the most complex software artifacts ever to be shipped as a binary. If they can be decompiled, anything can be.
This has implications. Massive implications. We need to think about what the world is like when, in general, there is no longer a secrecy moat around almost any software at all.
1/2