stream · october 2026

“You cannot step twice into the same river; for fresh waters are flowing in upon you.” —Heraclitus of Ephesus, c. 535 – c. 475 BCE

another day, another diss track released by the Vulnerability Apocalypse[^1].

the technicalities around CVE-2026-111497 go way over my head—if Google’s reference C implementation of the Brotli decompression library makes perfect sense to you, then you're probably not here on my site, reading this 🙃

what’s relevant here’s why serving a site as static files—built by static site generators (SSGs)—removes one route for yucky attacks like this[^2]

TL;DR an SSG builds your pages before anyone visits. your hosting serves the finished files instead of running your site’s application code to assemble a page whenever someone requests it.

this vulnerability needs a particular piece of software to decompress malicious data. so if there’s no site application doing that when visitors send requests, there’s nothing at that layer for this exploit to target 🔐

fewer moving parts, fewer things to exploit, less tech drama, happy life[^3]. SSGs for the win! 👇

• HTML + CSS + JavaScript + images sit ready to serve in the Great Big File Cloud in the Sky 🌐💨
• a purely static site needs no application database / runtime secrets on the serving side, so there's less backend baggage to compromise

naturally, build tools + hosting infra still need patching, and compromised hosting could still alter what visitors receive. static files aren’t a force field, though by comparison it sure feels like it! 🦸‍♀️

[^1]: The Patch Apocalypse: Why Traditional Vulnerability Management is Breaking Under AI‑Driven Discovery

[^2]: or on a peripherally related note, [[why I built my website with two static site generators]]

[^3]: SSGs are the key to happiness, right?

a previously undocumented constellation has appeared in the night sky. astronomers have yet to explain the sticky feet 🦎

contemplating stuff with my thinking sleeping partner.

As traditions and legends could be written out on papyrus, people were freed from the burden of remembering the past and were increasingly able to devote more of their cognitive energies to forming new ideas.

Literacy also enables thinking to become more analytical, more complex and more critical. Difficult and abstract ideas are harder to pursue without writing. Just try doing formal logic in your head. Unless you are a savant it is not possible. But once people had a means of setting thoughts down on the page to interrogate them and build on them, a whole new revolutionary way of thinking was born, one that would go on to shape our entire civilisation.

When we write our ideas down we externalise part of our minds. We can look at our thoughts from the outside. And that means we can walk around them: adding to them, criticising them and refining them.

Writing meant that traditions and received ways of thinking could not only be passed on but also pinned down where they could be analysed, challenged and improved. This was our species’ cognitive liberation.

—James Marriott, The New Dark Ages: The End of Reading and the Dawn of a Post-Literate Society

trompe l'œil pâtisserie: mastering the art of camouflage just to end up on a wooden skewer

no amount of chocolate or cream can beat real mangosteen or raspberries tho 🤤

we're all just waiting for the storm to pass 🌧️

missed a shot of the Hunter's Moon by a literal second before a cloud photobombed the scene—not everything is meant to be memorialised! 🏹🌕

hard to imagine that this pretty bubblegum-pink egg cluster is so-coloured to warn off predators until it can manage to unleash yet more members of an invasive species.

first time spotting golden apple snail (Pomacea canaliculata) eggs in the wild! let's see if I'm lucky enough to catch any hatchlings live as they emerge sometime over the next two weeks 😍🐌

came over from the lake to rack up some more frequent swimmer miles 🦎🏊‍♀️

… writing was born only fifty-four hundred years ago in the Fertile Crescent, and the alphabet itself is only thirty-eight hundred years old. These time spans are a mere trifle in evolutionary terms. Evolution thus did not have the time to develop specialized reading circuits in Homo sapiens. Our brain is built on the genetic blueprint that allowed our hunter-gatherer ancestors to survive. We take delight in reading Nabokov and Shakespeare using a primate brain originally designed for life in the African savanna. Nothing in our evolution could have prepared us to absorb language through vision. Yet brain imaging demonstrates that the adult brain contains fixed circuitry exquisitely attuned to reading. —Stanislas Dehaene, Reading in the Brain: The New Science of How We Read

journal therapy 🐈

Harvard Business Review (HBR), defining AI slop's professional cousin, workslop, as "AI-generated work content that masquerades as good work but lacks the substance to meaningfully advance a given task," highlights that workslop uniquely passes on cognitive offloading to another human (the 'my LLM created this for me, now you make sense of it' practice we're all painfully familiar with at this point).

HBR estimates an invisible workslop tax of $186/month/employee. for a 10k strong workforce, at an estimated prevalence of 41% of office workers—moat notably in tech + professional services—engaged in this practice, that's upwards of $9 million an organisation of that size will lose annually to workslop productivity.

this is excluding the social + emotional costs that join in as second-order effects of receiving workslop (eg how to formulate a diplomatic response, asking someone to redo it or just do it yourself, etc.)

What a sender perceives as a loophole becomes a hole the recipient needs to dig out of." —HBR, Year in Tech 2027

it's also eroding professional trust; lessening people's perception and views of the workslop sender: less creative, less capable, less reliable, less trustworthy, and less intelligent—aka the competence penalty.

I'm not seeing this yet in companies I'm working with, but it's so incredibly imperative that employees be trained in how to use AI discriminately (eg BetterUp's differentiation between Pilot + Passenger AI users), including in the form of company standards, policies, and best practice guides. AI that replaces thinking rather than augment it, is a cancer not only to any org but a cancer of the mind 🤕

so this is what it feels like to die and go to heaven 🤩

I'm in loooooooooove with my new interstitial reading heatmap!!! this is what happens when a book junkie and a data junkie go on a website building bender and make a baby 📚📊

it ended up being a lot more complex than I thought lol (ain't it always). heatmap was the easy part. it was getting it to auto-update that was a LOT more involved than I could've ever imagined. as in, had I known, there's no way I even would've started this (I BUILT MY OWN OBSIDIAN PLUGIN, PEOPLE!)

all this just to watch my reading habits change colour 😂😂😂

def more data features to add (weekly + monthly stats come to mind); for now, the job is simply to READ 🤓

moon's doing that almost-full thing again 🌕 meeting dinner for a date on the beach to celebrate this week's goodness 🏖️

when you haven't quite figured out if it's a good morning or just morning… only coffee will tell ☕🙃

been thinking about how to visually represent my daily interstitial reading in a reading log. since I do a lot of topic-hopping, I'm curious about how often I revisit certain topics—and also, how my overall reading intensity differs day-to-day.

since I already use a book note template in Obsidian populated with various YAML properties, I'm thinking to use a single log page to update each time I read from a particular book. the plan is to process the reading log alongside the relevant booknote metadata using JavaScript (gray-matter for YAML parsing), generate a JSON dataset containing only the genres/topics/tags + daily reading counts, then have 11ty render the heatmap using a Nunjucks template.

tricky bit will be integrating this into my existing Quartz Syncer publishing flow while keeping the booknotes themselves private.

excited!!! hope it works without injuring my grey matter in the process 🧠😆 cos publishing that way will be sweeeeet!

The life given us by nature is short, but the memory of a life well spent is eternal. —Marcus Tullius Cicero, 106–43 BCE

I REALLY enjoyed this discussion (this is what a podcast interview should be!) between journalist Mary Harrington + columnist/author James Marriott, on his new book, The New Dark Ages: The Death of Reading and the Dawn of the Post-Literate Society which argues that we’re shifting towards a post-literate culture.

they get into the decline of reading (as someone who was recent-old when I read the stats on how few people read and how how few weekly sales can put a book on the NYT bestseller list, this no longer shocks me… I did used to think it was a LOT higher!); why literacy and democracy go hand-in-hand, You Know Who presidents using visual imagery to evoke larger-than-life iconography that harkens back to Europe's pre-modern monarchies; and what all this means for our collective future.

what I hadn't really considered at length before is how literacy (and actually reading) facilitates critical thinking. I guess that when you work a muscle long enough, you come to see it as independently strong.

I do hope we manage to turn all the brain rot virus around somehow, but I'm preaching to the choir here cos all this has made me want to do is go on an even bigger book shopping spree than I already engage in near-daily 😆

reading is an act of defiance in service of our humanity!

▶play YouTube video

reading Juha-Matti Santala's post on notebooking (one of my happily addicted-interests), it occurred to me that his approach of keeping a digital Mega Index note has a) for some reason just never occurred to me??? and b) is literally the extended mind answer to my physical vs. digital notes conflict.

this definitely deserves its own blog post, but for now I'm parking it here so I won't forget to put it on my Want To Do list! 📑

there are already 74 billion reasons and counting to break up with (or stay away from) WordPress (which around 40% of all websites run on), but you can officially add PHP2Shell to the list.

PHP enables nearly 70% of all websites on the internet with an identifiable server-side programming language. WordPress relies on it, but PHP's massive footprint extends also to other giants (think Drupal + Joomla + Magento + Laravel, etc)

22 years ago in 2004, security pioneer Stefan Esser identified a critical PHP memory-limit vulnerability. now, two newly disclosed vulnerabilities show how dangerous PHP’s memory-handling flaws remain. these affect unpatched PHP releases dating back to 5.4 (released March 2012), including the current 8.5 series (released Nov 2025): an unauthenticated attacker can execute code remotely on a vulnerable PHP server, potentially taking over the site 😱 (Nick Rogers does a detailed, albeit highly technical, roundup of the issue.)

portfolio sites, blogs, and business websites that don't require user login systems, complex shopping carts, real-time databases, or personalised user dashboards can avoid this whole category of PHP risk by using a static site generator (SSG). a purely static deployment needs no live application database / server-side page generation. so, with no PHP handling web requests, a vulnerability like PHP2Shell has nothing to hijack.

want a sense of how serious this is? Even Japanese PM Sanae Takaichi tweeted out urging PHP website owners to apply the patch ASAP or take their websites down temporarily if they couldn't. (governments around the world have been doing just that; even parts of Wikimedia went offline while they patched up!)

also known as the fan-shaped, this gorgeous lil' thing that grows on rotting wood can help keep drinks from spoiling 🤯

a master at decomposing wood (as a brown-rot fungus, it breaks down the cellulose and hemicellulose in rotting wood), Dacryopinax spathularia is also cultivated commercially to produce natural antimicrobial compounds (long-chain glycolipids) used as a preservative in beverages (eg Nagardo®).

its yellow-orange pigmentation comes from carotenoids that protects it against ultraviolet radiation, and it's actually an edible species! known in Chinese cuisine as sweet osmanthus ear, including Buddha's delight.

early lab + animal studies indicate interesting medicinal potential: acetylcholinesterase inhibition (the same enzyme targeted by the Alzheimer's medication donepezil), antioxidant activity, inhibition of enzymes associated with inflammation and starch digestion, and improvements in liver injury markers (ALT, AST, ALP, and bilirubin) in rats.

no demonstrated medicinal benefits in humans just yet, but what a biochemical resume for this beautiful little orange fungus! 🍄

Merops orientalis (Asian green bee-eater) in our frangipani tree 🦜

found everywhere from coastal Iran to the Indian subcontinent and as far east as Viet Nam; in the Himalayas, they can be found as high up as 2,000m!

fun fact: members of the bee-eater family (31 species' worth) nest in tunnelled burrows in sandy banks ⛱️

"…what is so wonderful about being big? It is often said that the world is suffering from the ills of bigness, and we now have some clinical examples in our large cities. Many cities are probably past the point of good government because too many things are wrong. Should we not rather ask whether we need cities? With modern systems of communication and transportation, businesses do not need to be within walking or taxicab distances of each other, and how many people must one be near in order to live a happy life? People who flock to cities looking for jobs and more interesting lives will flock back again if jobs and more interesting lives are to be found where they came from. It has been suggested that, with modern systems of communication, the America of the future may be simply a network of small towns."

—B.F. Skinner, Walden Two Revisited (1976)

starting Skinner’s Walden Two (1948). by this 1976 preface, he was already predicting comms would dismantle mega-cities into a network of small towns. (he sure did get remote-work logistics right decades early 😅)

since his work is known for out-engineering friction + trading human messiness for predictability, I'm curious to see if his behavioural utopia misunderstood why people still crave the chaos of the city, as I sometimes do/often don't 🤹‍♀️

Eric C. So in his recently released book, The Collision: What AI Does to Us, uses a great analogy to describe AI.

So, a Professor of Global Economics and Behavioral Science at MIT’s Sloan School of Management, draws from Steve Jobs' 1980 analogy that technology is "a bicycle for the mind" (itself based on Stuart S. Wilson's 1973 Scientific American study, Bicycle Technology—a fascinating read!—on the energy efficiency of movement between different species and machines that put the salmon in first place, topped only by a human on a bicycle).

▶play YouTube video

AI, So argues, is a motorcycle for the mind, stating, "…motorcycles come with warnings that bicycles don’t. When power increases, so does risk. They’re harder to hold steady and require more skill to operate safely. You wouldn’t hand one to a child without serious training. When things go wrong on a motorcycle, they go wrong at speeds that multiply the consequences."

AI, he reminds us, comes with important caveats:

"An amplifier of human intention, one so powerful that it qualitatively changes the relationship between human and machine. A tool that can take you places you couldn’t reach before. But one that can also take you off a cliff if you don’t know what you’re doing. Like a motorcycle, AI isn’t inherently good or bad. It depends entirely on how you use it."

copies of popular WordPress plugin, Rank Math SEO PRO v3.0.123, downloaded between Oct 15 (20:02 UTC) + Oct 16 (07:12 UTC), 2026, shipped with active malware that created backdoors connecting to rank1cdn[.]com (via Wordfence)

⚠️ deactivating/updating alone won't clean the Trojan injection ⚠️

handing total site execution privileges to opaque, multi-megabyte plugin suites just to output <head> tags is a massive supply-chain risk ☠️

full-blown SEO suites install persistent background processes + scheduled cron tasks + external API hooks + custom auto-updaters… all for basic markup you can write directly in your theme

👎 fragile, proprietary mega-plugins controlling your site

👍 lightweight, auditable templates for Microformats (h-entry, h-card), OpenGraph, and JSON-LD

outputting basic HTML meta tags should NOT be compromising your entire website!

ngl, been fantasising about this ever since (I didn't even mention it in) James' Food Questions challenge.

so today I had me some north Indian curry with button mushrooms, green peas, onion-and-tomato masala, and fenugreek 🇮🇳👌

wonder what my taste buds will compel me to revisit next on my foodie list… 🍴

how does a photographer's personal perspectives and preconceptions influence their presentation of their subject?

I hate having my photo taken, yet seeing myself through my partner's lens almost always makes me feel like a work of art. witchcraft? or another example of applied quantum physics in the form of the observer effect?

Canon did a fascinating experiment that drives this point home. THE LAB: DECOY tasked six different photographers with different (fabricated) back stories on the same man and given ten mins to capture the "essence" of their subject.

ranging from self-made millionaire, ex-convict, commercial fisherman, psychic, recovering alcoholic, and a lifesaver, each portrait then goes on to eerily capture the proposed identity as if that narrative were indeed the case. great demonstration of a self-fulfilling prophecy, aka the Pygmalion effect!

▶play YouTube video

one of the many fascinating cognitive gymnastics about humans is our ability to see the collective future (macro issues like economic decline, war, climate crisis, etc.) as disastrous while simultaneously excluding expectations of our own individual futures from that projected reality.

this mental time travel differentiates between personal future thinking and a related optimism bias, and collective future thinking (chronic pessimism bias).

interesting new research paper in the Applied Cognitive Psychology journal studied the breakdown of this psychological firewall and how temporal distance acts as a psychological buffer against collective pessimism:

• near-term vulnerability (0–5 years):

  • reality check works; we lose our rose-coloured glasses once we realise global problems will spill into our everyday lives, impacting our optimism for the future.

• distant-future insulation (10–15 years):

  • optimism bounces back; we imagine our far-off lives will be fine and feel little emotional distress about it (it does, though, dial it down a notch from "amazing" to "good"); our brain turns it into a movie of sorts, able to suspend disbelief long enough to imagine grim consequences for others while believing ourselves shielded from it.

paper: Exposure to Negative Information About the Collective Future Eliminates the Positivity Bias for the Personal Events in the Near Future by Şule Gülpınar Çiftkaya, Esra Konan Ay, and Simay Ikier.

the sky's being wizardy again

and we're LIIIIIIVE! 'tis one giant leap for Nadjakind 🌐🌕

small post-social test from my phone: writing here, publishing on my site to /stream 💪

update: round-trip woooorks! 🥳

hello world from the other side of the social media hell-hole :)