@jamesh@aus.social

James Henstridge @jamesh@aus.social · Jul 29, 2026

Replying to @janl@narrativ.es

@janl@narrativ.es @sil@mastodon.social if you're running an OS with that kind of feature then they can prosecute you for not providing all the passwords, even if you did.

0

James Henstridge @jamesh@aus.social · Jul 29, 2026

Replying to @swearyanthony@mastodon.social

@swearyanthony@mastodon.social you'd certainly think the "we just did a crime" press releases would be reason to start an investigation, even if Hugging Face seems to be okay with it. It's not a civil matter, so they could just do it. Maybe figure out how they had prompted the model before the crime happened, and what they thought it was doing during the crime.

2

1

2

0

James Henstridge @jamesh@aus.social · Jul 23, 2026

The Alien comic books have been pretty good since Disney took over.

5

0

3

0

James Henstridge @jamesh@aus.social · Jul 23, 2026

Replying to @NanoRaptor@bitbang.social

@NanoRaptor@bitbang.social BUNNINGS is the one where he kills a guy by serving him a sausage sizzle with the onions on the top, right?

8

0

3

0

James Henstridge @jamesh@aus.social · Jul 22, 2026

Replying to @evanspw@aus.social

@evanspw@aus.social @decryption@aus.social @aj@gts.sadauskas.id.au We are much more enlightened now: cities should be built around the needs of data centres.

2

0

James Henstridge @jamesh@aus.social · Jul 22, 2026

Replying to @decryption@aus.social

@decryption@aus.social No argument about it being shit planning. It looks like the rail line was privatised from 1993-2004, which probably didn't help matters. If there was no indication that stations would be built, then you've just got the downside of the track acting as a wall.

0

1

0

James Henstridge @jamesh@aus.social · Jul 22, 2026

Replying to @decryption@aus.social

@decryption@aus.social Looking at Wikipedia, one of the stations opened in 2005, and the other in 2014: https://en.wikipedia.org/wiki/Marshall_railway_station https://en.wikipedia.org/wiki/Waurn_Ponds_railway_station There was an older station at the Marshall site, but it closed in 1957. With no nearby stations, there wouldn't have been an incentive to centre the services near the rail line during that 50 year period.

0

1

0

James Henstridge @jamesh@aus.social · Jul 22, 2026

Replying to @decryption@aus.social

@decryption@aus.social What order were things built in? You see this sort of thing in Perth for the new train lines, where they've built where land was available rather than where it would make sense if it had been integrated from the start. Maybe more services will be built closer to the train stations over the next 20-30 years, but maybe not.

0

1

0

James Henstridge @jamesh@aus.social · Jul 16, 2026

Replying to @pjf@cloudisland.nz

@pjf@cloudisland.nz clang-tidy or clang-check is probably what you are after. It also helps if you've got a build system that generates a compile_commands.json file: without this, it won't know how to how to preprocess the file and you'll likely have broken include directives. If you're using meson, it'll generate this for you automatically. If you're using CMake, you can turn it on via CMAKE_EXPORT_COMPILE_COMMANDS.

1

0

James Henstridge @jamesh@aus.social · Jul 09, 2026

swear words Hover or focus to reveal Sensitive

I was listening to an ABC podcast, which included an ad for one of their other podcasts. I was kind of surprised they'd publish one named "The Dead Cunts Who". But it turns out it's actually "The Dead Can't Sue".

3

1

0

James Henstridge @jamesh@aus.social · Jul 08, 2026

Replying to @jamesh@aus.social

@zygoon@fosstodon.org Also, people have tried the pirate data center idea before in international waters: https://en.wikipedia.org/wiki/HavenCo That business was far more feasible, but never built a successful business. One of the downsides of being outside of any country's jurisdiction is that you don't have the protection of any country.

1

0

James Henstridge @jamesh@aus.social · Jul 08, 2026

Replying to @zygoon@fosstodon.org

@zygoon@fosstodon.org I think it is meant to make the company look forward looking and worth investing in, rather than something that will actually happen. Or possibly trick competitors into thinking this is a good idea: could be useful for a company selling space launch services.

0

1

0

James Henstridge @jamesh@aus.social · Jul 07, 2026

Replying to @davidgerard@circumstances.run

@davidgerard@circumstances.run Back when I was maintainer of a GNU package, it was made clear to me that the GNU project leadership would decide who was named maintainer, and that I could be removed and replaced unilaterally. So I guess we need to assume they're okay with this behaviour. There's a previous release that appears to be named after the terrorist mass shooting at Bondi Beach, so there's an existing pattern of inappropriate release names. They could have stopped this at any time.

23

0

6

0

James Henstridge @jamesh@aus.social · Jul 02, 2026

Replying to @mjg59@nondeterministic.computer

@mjg59@nondeterministic.computer I imagine some of the pushback on TLS based solutions is that it is that getting it to work if you've e.g. decided to let Cloudflare MITM your connections or use some other service to terminate the TLS connections. If that frontend doesn't support the feature or doesn't pass through the relevant info, you're screwed. I also wonder if the difficulties with OAuth 1.0 tilted people towards simple bearer tokens. I remember having a lot of difficulty with Apache normalising requests in ways that would break signatures by the time the application saw the request. It was bad enough to just recomend people use PLAINTEXT mode. That feels like it directly leads to OAuth 2.0 only defining bearer tokens at launch.

1

0

James Henstridge @jamesh@aus.social · May 27, 2026

Replying to @barefootliam@floss.social

@barefootliam@floss.social It sucks that a website doing any non-trivial work for anonymous clients is now such a liability. It also annoying that the client side option requires a fairly different skill set to implement.

1

0

James Henstridge @jamesh@aus.social · May 26, 2026

Replying to @barefootliam@floss.social

@barefootliam@floss.social could you do that kind of thing client side? You can access the pixel data of images from JavaScript now, and draw custom pixel data to a canvas element. The browser will let the user right click save the canvas contents, or you can ask for a PNG of the canvas contents. That would remove all the server side image editing overhead of the website feature.

0

1

0

James Henstridge @jamesh@aus.social · May 09, 2026

On board for the first leg of my journey. It's longer and less direct than I'd like, but beats dodging missiles.

5

1

0

James Henstridge @jamesh@aus.social · May 07, 2026

Replying to @paulbiggar@hachyderm.io

@paulbiggar@hachyderm.io The domains listed in the Content-Security-Policy response header are also a pretty strong signal that they're related. Also points to a bunch of other domains they're operating under.

2

1

0

James Henstridge @jamesh@aus.social · May 07, 2026

Replying to @NewtonMark@eigenmagic.net

@NewtonMark@eigenmagic.net For this particular case, it also seems like part of the "finding out" phase of Brexit. Before hand, travel from Europe would not have been covered by the UK's new travel authorisation system, and other European nations wouldn't care which passport was used.

0

James Henstridge @jamesh@aus.social · May 07, 2026

Replying to @jamesh@aus.social

@NewtonMark@eigenmagic.net And on re-reading the story, I realise I've misread Austria as Australia.

0

James Henstridge @jamesh@aus.social · May 07, 2026

Replying to @NewtonMark@eigenmagic.net

@NewtonMark@eigenmagic.net We've got similar rules in place for dual citizens: https://immi.homeaffairs.gov.au/entering-and-leaving-australia/traveling-as-a-dual-citizen So prior to this rule change, the only way these dual nationals could have done trips like this on a single passport would have been to use an Australian passport (since Australia cared and the UK didn't). With the rule change, they must have two passports. It seems like a lot of the problems come down to the speed with which the rule change is being implemented.

0

3

0

James Henstridge @jamesh@aus.social · May 07, 2026

Replying to @jaffathecake@mastodon.social

@jaffathecake While I think the pushback against this API is worthwhile, haven't we already crossed the "encumbered web APIs" bridge with things like Encrypted Media Extensions?

0

2

0

James Henstridge @jamesh@aus.social · May 05, 2026

Replying to @Pepijn@mastodon.online

@Pepijn I've counted the current Parliament House and Old Parliament House in Canberra, Australia. They're about half a kilometre apart, with the old one now set up as a museum. It wasn't as part of a school trip, since it's a 4 hour flight from home. I've visited Washington DC, but I didn't visit the Capitol building. I saw the outside of the White House, but it wasn't clear how to book a tour as a non-resident.

0

James Henstridge @jamesh@aus.social · May 04, 2026

Replying to @zeenix@toot.cat

@zeenix @pid_eins You could argue that representing open files as simple integer file descriptors, since all the kernel syscalls produce well defined errors. But there are obvious benefits in wrapping the descriptor in a type that extends Rust's lifetime and memory access restrictions to those descriptors. If all code is using that abstraction, you don't have to worry about file descriptor reuse bugs, or other threads accidentally manipulating your descriptor. Is it that outlandish to want similar lifetime guarantees for files themselves? And the usual reason for wanting this kind of thing in the standard library is that if the default way to access files avoids race conditions, then third party code built on top is more likely to do the same.

0

1

0

James Henstridge @jamesh@aus.social · May 04, 2026

Replying to @NewtonMark@eigenmagic.net

@NewtonMark@eigenmagic.net I guess one difference these days is that a lot of people who would not have had access to the merchant side of the credit card processing system now do via intermediaries like PayPal, Shopify, etc. And those intermediaries don't really have the same incentive to fight chargebacks on behalf of the businesses the same way those businesses would if they were acting as merchant directly. That's probably also made it easier for banks to issue chargebacks without asking for evidence themselves, since they're less likely to be contested. We've basically got a system where the companies collecting most of the transaction fee have pushed the liability on to others.

0

2

0

James Henstridge @jamesh@aus.social · May 01, 2026

Replying to @jwz@mastodon.social

@jwz I'm not saying it's a good thing if the best thing you can say about a film is that the effects were good. I think I ended up sympathising with the villain more than I was supposed to. If you ignore the child kidnapping bit, she has quite a tragic story.

0

James Henstridge @jamesh@aus.social · May 01, 2026

Replying to @jwz@mastodon.social

@jwz@mastodon.social The effects are pretty good. It would have been better if they cut the last 5 minutes, but even that wouldn't have fixed it. I get the feeling Cronin wanted to make another Evil Dead film.

0

2

0

James Henstridge @jamesh@aus.social · Apr 29, 2026

Replying to @ebassi@mastodon.social

@ebassi@mastodon.social @iain@kolektiva.social Publishing a Code of Conduct before building the community was essentially doing this on easy mode. Everyone joined the community with knowledge of what was expected of them. There's definitely a few aspects that seem quaint, such as getting people to PGP sign the code to show they agreed to it. It kind of made sense to a group who was majority Debian developers.

1

0

James Henstridge @jamesh@aus.social · Apr 29, 2026

Replying to @gregeganSF@mathstodon.xyz

@gregeganSF That seems like the kind of thing that would damage the future career of their staff. I guess the university is lucky the videos probably aren't covered by moral rights in the US.

1

0

James Henstridge @jamesh@aus.social · Apr 29, 2026

Replying to @decryption@aus.social

@decryption@aus.social I wouldn't be surprised if a bunch of things the ABC cares about would break if they stopped publishing those feeds. Either that, or modifying the CMS to stop publishing the feeds was more trouble than it was worth, and unlinking them was satisfied management.

0

James Henstridge @jamesh@aus.social · Apr 29, 2026

Replying to @decryption@aus.social

@decryption@aus.social The feeds mentioned in this blog post seem to work still: https://james.cridland.net/blog/2025/abc-news-australia-rss-feeds/

3

1

0

James Henstridge @jamesh@aus.social · Apr 29, 2026

Replying to @iain@kolektiva.social

@iain@kolektiva.social I don't remember any other examples when Ubuntu was drafting it's code back in 2004. In that case the goal was to assert some values for a community that didn't exist yet, so it wouldn't just adopt those of whoever joined first. @mako@social.coop was the main person drafting that document, so perhaps he has some insight? Here's a blog post he wrote that describes some of the process: https://mako.cc/copyrighteous/updating-the-ubuntu-code-of-conduct

1

7

0

James Henstridge @jamesh@aus.social · Apr 24, 2026

Replying to @JdeBP@mastodonapp.uk

@JdeBP @swick openat2() with the RESOLVE_IN_ROOT would seem to cover that? Or RESOLVE_BENEATH if you just want to make sure the opened file is below dirfd without changing the meaning of absolute symlinks.

0

1

0

James Henstridge @jamesh@aus.social · Apr 24, 2026

Replying to @swick@hachyderm.io

@swick For securely using path based APIs like the old mount syscall, passing "/proc/self/fd/NNN" paths is an option. While they look like symlinks from user space, they're treated specially by the kernel and will resolve to whatever the file descriptor points to race free. I've used that to do bind mounts between possibly hostile locations after resolving the paths similar to how you describe.

10

1

0

James Henstridge @jamesh@aus.social · Apr 23, 2026

Replying to @sil@mastodon.social

@sil on the bright side, you don't need to deal with this time zone any more: https://github.com/eggert/tz/blob/d13040f09fcc32d018722363865a18aa1f5c0f7f/solar89

0

James Henstridge @jamesh@aus.social · Apr 20, 2026

Replying to @davidgerard@circumstances.run

@davidgerard @dcoderlt the article seems to overstate the dangers a bit. The json config files are essentially inert until you install one of the matching browser extensions, which should mention the "nativeMessaging" permission when installing. It is inaccessible to extensions not listed in the config file, and not available in website context. It's not clear the user should be surprised that if they install the Claude web browser extension and desktop app that they communicate with each other. And whether it is spyware would depend on how that access is surfaced in the extension.

1

0

1

0

James Henstridge @jamesh@aus.social · Apr 15, 2026

Replying to @dmakovec@theblower.au

@dmakovec It looks like the company behind that website has other trading names, including some selling sex toys: https://abr.business.gov.au/AbnHistory/View?id=80137519932

1

0

James Henstridge @jamesh@aus.social · Apr 15, 2026

Replying to @munin@infosec.exchange

@munin This is something that has concerned me with the seatbelt cameras that have been rolled out where I live. They have cameras set up to take photos through the windscreen of passing cars, then use image recognition to decide whether the people inside the car are wearing their seatbelts correctly. They then have a human review the flagged photos before issuing fines. It seems like the human reviewers would be more likely to accept unclear photos if most of the photos presented to them are violations, as compared to if they were shown all photos.

1

0

James Henstridge @jamesh@aus.social · Apr 14, 2026

Replying to @notjustbikes@social.notjustbikes.com

@notjustbikes@social.notjustbikes.com The main centre-right political party was pushing nuclear power at the last election. So it also has some support as a culture war issue. Both of the major parties accept large donations from the mining and resource extraction industries, so it is not just a fossil fuel thing.

8

0

1

0

James Henstridge @jamesh@aus.social · Apr 13, 2026

Replying to @benno@eigenmagic.net

@benno It took The West Australian an hour or so to decide how to frame the Ben Roberts-Smith arrest story compared to other media companies. I'm sure Sky will get around to this one eventually.

1

0

James Henstridge @jamesh@aus.social · Apr 07, 2026

Replying to @jamesh@aus.social

Unsurprisingly, The West has a different spin on this: https://archive.md/tG5qE

In particular:

Describing BRS as a "decorated army veteran" in the title.
No mention of his failed defamation lawsuit.
The only unblurred photo of BRS is a 2010 photo in his army uniform.
That photo has been doctored to remove the crusader cross patch he was wearing.

2

0

1

0

James Henstridge @jamesh@aus.social · Apr 07, 2026

Replying to @kauer@aus.social

@kauer@aus.social It's over 15 years since one of the deaths he's accused of. The Brereton Report outlining the allegations was tabled 5 years ago. It seems like more than enough time to begin a prosecution.

1

0

James Henstridge @jamesh@aus.social · Apr 07, 2026

About time: https://www.abc.net.au/news/2026-04-07/ben-roberts-smith-war-crimes-allegations-arrest/106537668

2

4

2

0

James Henstridge @jamesh@aus.social · Apr 06, 2026

Replying to @sil@mastodon.social

@sil I remember back when any website could enumerate all the Philips Hue bridges on your local network. The bridges would ping their cloud servers, and then they offered a REST API that would provide the self-reported local IP address of every bridge that appeared to share your public IP address. That API used CORS headers to make it usable from any website.

1

0

James Henstridge @jamesh@aus.social · Apr 05, 2026

Replying to @decryption@aus.social

@decryption It wouldn't be an authentic Bethesda game if it was bug free though. I played through all the main game and most of the DLC, but gave up when I realised one of the collectibles needed for a quest had probably fallen through the ground and wouldn't be coming back.

0

James Henstridge @jamesh@aus.social · Apr 02, 2026

Replying to @Natuwu@mastodon.hermitcollective.net

@Natuwu @0xabad1dea that might be the traditional method, but making half the digits nines must count for something. If the reliability figure was rounded to five digits, it might even be more than half.

1

0

James Henstridge @jamesh@aus.social · Apr 02, 2026

Replying to @0xabad1dea@infosec.exchange

@0xabad1dea sure, if you're going to be a stick in the mud and only count nines at the start of the number. If you get rid of that restriction, they've still got two nines.

10

1

0

James Henstridge @jamesh@aus.social · Mar 16, 2026

Replying to @NanoRaptor__dup_1737@bitbang.social

@NanoRaptor@bitbang.social If it just absorbs visible light and reflects UV, it's probably not too bad...

0

James Henstridge @jamesh@aus.social · Mar 09, 2026

Replying to @NewtonMark@eigenmagic.net

@NewtonMark It was only 2015 when the Minister for Communications was suggesting Australians use VPNs to circumvent geo-blocking by streaming services: https://web.archive.org/web/20150304100850/https://www.malcolmturnbull.com.au/policy-faqs/online-copyright-infringement-faqs#VPN

2

0

James Henstridge @jamesh@aus.social · Mar 05, 2026

Replying to @corduroy@aus.social

@corduroy Perth's petrol price fixing cycle is very regular, and it looks like something is up: https://www.fuelwatch.wa.gov.au/retail/price-trends

1

0

James Henstridge

Posts

Remote instance

Media