@movq@www.uninformativ.de The vast majority, yes. However, I know it’s hard to believe, I have seen black sheep that actually improved the code base. Sometimes. Much more often, it’s not the case and I’m far from really understanding the merge request that I’m supposed to review.

One really looses the feeling for the software quickly. Those who think this is a bad thing are in the minority, unsurprisingly.

@movq@www.uninformativ.de That’s weird… I’d dropped off Clownflare’s proxy ever since it started blocking @david@daiwei.me’s requests. That should’ve fixed any problems of that kind (unless traffic is coming from GCloud or Microslop servers, then sorry, not sorry) 😄 … my WAF (Crowdsec) isn’t blocking you either.

I’ve checked my logs, and can see your requests being handled successfully, although, the last one so far dates from 2026-10-15T18:47:32 is that normal? are you getting any error messages?

Eu tinha um script pra baixar imagens das minhas notas no #hackmd como backup (tenho esse hack que é adaptação de uma lib abandonada que eu usava pra acessar o conteúdo das notas https://gist.github.com/villares/177c2323d424d5b2b0de49570fb4e2fd) usando #requests, e não funcionava direito para algumas imagens, usando #curl funciona perfeitamente.

Oh, and only 29 clients have requested the actual image:

29 movq.de/blog/postings/2026-09-25/0/bine-initial.png

Assuming that that’s an actual human being who’s interested in the content, then it’d be less than 1% of the hits that I get.

I’d estimate that ~90% of the traffic I get is some kind of non-human / non-browser thing.

Here are some numbers on the recent blog post:

3804 movq.de/blog/postings/2026-09-25/0/POSTING-en.html
 404 movq.de/blog/postings/2026-09-25/0/t/bine-initial.png.jpg

The HTML page is obviously the blog post itself. The image is the thumbnail of the “opener” image: That’s the thing that you’re pretty much guaranteed to see when you open the post in a browser.

But out of the 3800 hits on the HTML page, only 400 (~10%) are also requesting that image.

So … it’s ~90% noise, right?

@david@daiwei.me I’ve added in a little exception to the WAF, if it doesn’t work (at least until I figure why the hell are twtxt-app requests getting caught up in my Known Bad Actors rule in the first place), then I’ll have to tear the whole thing down and redo it from scratch.

@aelaraji@aelaraji.com Haha 🤣 I’ve found the only effective defense is to make the request(s) cost you nothing or very little. Trying to defeat all this en-mass scraping/crawling and defective bots is such a PITA 🤦‍♂️

@prologic@twtxt.net Hmm. 🤔

Okay, suppose you host a project using this new forge, and I want to send a pull request. What do I have to do?

Real tired of doing these, but here’s another Android developers vs Google update, this time there’s both good and bad news.

The good:
-Users will be able to enable “sideloading” for all current and future devices, attached to their Google account, rather than having to undergo the tedious 24 hour wait including process, on each device.

-Rather than these changes to “sideloading” and “advanced workflows” being implemented at random different dates, in different countries, we’ll all get them come 2027.

The bad:
As GrapheneOS developers recently mentioned “Google replaced pushing Git tags for certain source code with obtaining source code via Google Drive after making a request through Google Forms. It’s completely ridiculous and they’ve gradually become very slow at handling requests. They’re in clear violation of the GPLv2 now.”

whole thread: https://grapheneos.social/@GrapheneOS/117057099753905023

Gonna recreate the classic [Break out](https://en.wikipedia.org/wiki/Breakout_(video_game) game this weekend for the Mills Games Cabinet – Anyone else got any ideas, requests? 🤔 #games #ebitengine

@lyse@lyse.isobeef.org

How many tickets and merge requests did you get before moving to your own server?

Hm, these were probably some of the more active projects:

• https://github.com/vain/lariza/issues?q=is%3Aissue%20state%3Aclosed
  
• https://github.com/vain/pdfPres/issues?q=is%3Aissue%20state%3Aclosed
  
• https://github.com/vain/xiate/issues?q=is%3Aissue%20state%3Aclosed
  

So it’s not a ton of stuff and there are many “issues” I opened myself, but it’s certainly more than these days.

Haven’t used git send-email even once. I definitely have to look into that soon. Wanted to do that for several years. I typically upload the patch to my server and send a link via IRC.

git send-email is good for sending patches to a mailing list (because then the individual patches can be discussed easily), but since those are dying out as well, it loses its appeal. If you want to send patches to a single person, just sending the link to your repo is far easier. 🤔

@movq@www.uninformativ.de Finally, your software is just perfect and finished by now, no need to report non-existing bugs or send in code changes. :-) How many tickets and merge requests did you get before moving to your own server?

I have to admit that I use git format-patch so rarely, I always have to pull it up from my shell history. Haven’t used git send-email even once. I definitely have to look into that soon. Wanted to do that for several years. I typically upload the patch to my server and send a link via IRC.

Maybe I was just very unlucky, but my experience is that you can perfectly ignore people and their work who only do it for the “fame”. It’s almost always been from inferior quality to say the least.

The only place where this would be an issue is the Twtxt Search Engine – But as the GDPR also points out:

Art. 17

The one place the “it propagated and I can’t recall it” problem is legally acknowledged is Art. 17(2), and it explicitly scales to what’s technically feasible:

“…the controller, taking account of available technology and the cost of implementation, shall take reasonable steps, including technical measures, to inform controllers which are processing the personal data that the data subject has requested the erasure…”

Best-effort, given the technology. A decentralised, append-only, content-addressed feed is the available technology, and its limits are baked into the standard the law applies. Nobody — not the user, not you — is obliged to guarantee every cached copy vanishes.

@lyse@lyse.isobeef.org None. I rejected ithe invite request 🤣

@david@daiwei.me that was literally one of the messages I got this morning with an invite request to join this pod 😱

And if we can compile a list and file issues for feeds, twtxt.app and anything else as issues for when i get back 🙏 feature requests, bug reports. etc 🤞

Great news, thank you! I can confirm, it looks good so far. After your change, the crawler requests every hour and five minutes: :-)

2026-07-04T14:03:09+02:00 200
2026-07-04T15:08:07+02:00 304
2026-07-04T16:13:08+02:00 304
2026-07-04T17:18:07+02:00 304
2026-07-04T18:23:07+02:00 304
2026-07-04T19:28:07+02:00 304

@prologic@twtxt.net That’s cool to hear!

Looking at my access logs, something seems to be off, though:

2026-07-04T04:11:26+02:00 200
2026-07-04T05:16:09+02:00 304
2026-07-04T06:33:34+02:00 304
2026-07-04T06:37:46+02:00 304 # just four minutes since last crawl
2026-07-04T06:41:55+02:00 304 # another four minutes
2026-07-04T07:11:33+02:00 304
2026-07-04T07:11:40+02:00 200 # no conditional request just seven seconds later
2026-07-04T07:43:25+02:00 304
2026-07-04T07:43:33+02:00 200 # just eight seconds since last crawl
2026-07-04T09:18:06+02:00 304
2026-07-04T09:22:53+02:00 304 # just four minutes since last crawl
2026-07-04T09:27:03+02:00 304 # another four minutes

Oh boy, I absolutely hate this stupid trend of not writing changelogs anymore! Why the fuck would one seriously consider it to be a viable option to just let some shitty bot spew all merge requests on a goddamn GitHub release?! First of all, these merge request titles suck balls. The order of the changes in this “changelog” is completely random (well, probably merge time, which is as useless as the dick on the Pope). They are not grouped by anything at all. Additions, changes, removals, deprecations, etc. randomly mixed up in one giant list. And then “Add feature X”, seventeen kilometers further down “Revert ‘Add feature X’”. Fuck you! Don’t include this shit in the first place!

Fits absolutely perfect in the pattern of rapid decline.

I must rip out all dependencies as soon as possible whose maintainers just don’t give a shit.

GitHub Authentication issues related to API requests
Article URL: https://www.githubstatus.com/incidents/fcj3088jg1wx

Comments URL: https://news.ycombinator.com/item?id=48477851

Points: 13

# Comments: 5 ⌘ Read more

Drinking Water Facilities Hit by Strikes in Iran, State Media Reports
Two water tanks serving thousands of people were damaged, the local authorities said. The U.S. military did not respond to a request for comment. ⌘ Read more

Drinking Water Facilities Hit by Strikes in Iran, State Media Reports
The state broadcaster said two water tanks serving thousands of people were damaged. The U.S. military did not respond to a request for comment. ⌘ Read more

Apple decided not to roll out Siri in EU after denied request for exemption
Article URL: https://www.reuters.com/business/apple-failed-make-its-ai-tool-comply-eu-regulations-eu-commission-says-2026-06-09/

Comments URL: https://news.ycombinator.com/item?id=48463024

Points: 20

# Comment … ⌘ Read more

@prologic@twtxt.net As have I. 🤔 I mean, since I left GitHub, I got basically 0 pull requests anyway.

Even during my time using GitHub, I noticed that “drive-by PRs” are rarely a good idea. People don’t really know/understand the code or the design principles/goals, so I often turned down PRs. Or I accepted them and was grumpy afterwards. 😅

What does work is having a team of maintainers/devs. The only question is: How do you build such a team if you don’t accept PRs? That’s going to be the interesting part.

@itsericwoordward@itsericwoodward.com Haven’t noticed anything either. These request numbers are well below some other software. :-)

Alert agents foil Yanchep property scam attempt
The alleged scammer told the agents they are overseas and requested a name change on the land title and assistance to sell the block for around $900,000. ⌘ Read more

@prologic@twtxt.net Ahh, I see. Okay, I’m with you there. On this high level, I can understand how the thing works.

Maybe my wording isn’t good. 🤔 Let’s take a real life example from what we do at work.

There’s this AI chatbot. It gets support requests from users, so the user says something like “I need access to a particular system”. This triggers the bot to “run” the instructions stored in a large Markdown file, like “check if the user is authorized to do this, then issue the following API requests”, and so on. This is essentially like running a little script, except it’s written in natural language (German) and there’s no “script interpreter” but just the AI.

Now, suppose that the AI doesn’t quite do what was intended. There’s some subtle bug. How do you debug this? How do you find out how the AI came to the “conclusion” to run step A instead of step B? And how do you find out how exactly you have to change your prompt so this doesn’t happen again next time?

If this was an actual script/program instead of AI, you could repeat the request and attach a debugger or throw in some printf() or whatever. How do you do that kind of thing with AI? How do you pinpoint exactly what the problem was?

(Or is this just a stupid idea? Do we have to give up that way of thinking when using AI? Is the era of debuggability over?)

Real-time LLM Inference on Standard GPUs: 3k tokens/s per request
Article URL: https://blog.kog.ai/real-time-llm-inference-on-standard-gpus-3-000-tokens-s-per-request/

Comments URL: https://news.ycombinator.com/item?id=48321076

Points: 13

# Comments: 4 ⌘ Read more

Incident with Pull Requests, Issues, Git Operations and API Requests
Article URL: https://www.githubstatus.com/incidents/xy1tt3hs572m

Comments URL: https://news.ycombinator.com/item?id=48293080

Points: 18

# Comments: 8 ⌘ Read more

4chan’s Misogynist ‘Wizards’ Are Nudifying Women by Request
As nonconsensual explicit deepfakes continue to proliferate online, entire communities are now collaborating on this digital form of sexual abuse. ⌘ Read more

‘Reservation Hijacking’ Scams Target Travelers. Here’s How to Stay Safe
The hotel staffer who calls you with an urgent request for payment isn’t necessarily who they say they are. ⌘ Read more

@movq@www.uninformativ.de that’s the way large language models work, with a prompt. Rather than entering the prompt, most inference providers allow for specific files to be created that define the scope of what’s been requested, the skills the model is supposedly to posses, the stuff to “remember”, etc. Some will “learn” and add that “knowledge” to the proper files.

My first pull request to Perl has been merged! https://github.com/Perl/perl5/commit/2aea97bf3f5c2ea62cf5e701858694b7378ed58c

When I receive all the new requests from the sales team ⌘ Read more

Fuck me dead! I accidentally confused an HTML file for a YAML file and manually opened it in my browser. Unfortunately, I clicked on the OK button of the popped up dialog a bit too fast, it just caught me off guard. It asked which program to open the YAML file in. Of course Firefox thought that it could handle that and suggested itself by default. Conveniently, the “don’t prompt me again and always use this selection from now on” checkbox was enabled.

And then the endless loop of death started. Turns out, this fucking browser can’t do shit with YAML files and delegated to what had been just configured. Oh, would you look at that!? Firefox! Empty tabs after empty tabs appeared. Killing and restarting Firefox just loaded the last session with all the tabs and the loop continued.

Some bloody snakeoil on my work machine slows down link openening requests by two, three seconds. It’s always absolutely anoying, but luckily, it actually limited the rate of new tabs popping up. I still could not close the many tabs fast enough that had accumulated before I noticed what was going on in the background.

Going to the settings to change them was always interrupted with a new tab opening in the foreground.

Finally, killing Firefox and renaming the file on disk before restarting Firefox did the trick and broke the loop. I was still holding down Ctrl+W for a minute or so to get rid of the useless tabs. I didn’t want to loose the important tabs, so just ditching the session wasn’t an option.

@prologic@twtxt.net (While browsing through that, I noticed that https://mu-lang.dev/ itself doesn’t really mention the source code repo, does it? 🤔 Like, the quickstart guide begins with “Build the host: go build ./cmd/mu”, but where’s the git clone … command? 😅)

I’m not really sure what the goal is. 🤔 Do you want to get pull requests for the docs? Or bug reports for mu itself? 🤔

When the request isn’t exactly clear but I still manage to deliver what was expected ⌘ Read more

When I see all the requests the sales guy sent out on Christmas Eve ⌘ Read more

When the boss interrupts my presentation while I’m still waiting for an answer about my raise request ⌘ Read more

@prologic@twtxt.net I dunno if it’s me or the bridge, but my pleroma instance didn’t pull any of your notes + a follow request got stuck as Request Sent

Image

When I try to understand the new request from the business ⌘ Read more

@aelaraji@aelaraji.com Thanks for the account! I figured out one thing at least so far, my WAF was blocking some of the AP requests. Fixed that. Anyway, holiday time 🤣 Back in ~2 weeks.

@prologic@twtxt.net yeah, I’ve had even requested access to it in order to give it a try and report whatever I can but, Sorry I never got to do any of it. 2025 slam dunked a massive pile of 💩 over my life (hence the disappearance, trying to avoid talking about any of it) and I’m just starting to recover (or at least trying to).

@prologic@twtxt.net The main thing that I tought of is that whomever is abusing your services must be a well known actor (by range/set of IPs) that got reported by other Crowdsec users. So to my simpleton’s understanding, your reverse-proxy/web server passes the requests by crowdsec for processing, they get banned for $N hours if the source has already been blacklisted by the community or violates any of a set of behavior base rules (and even more hours for repeat offenders); otherwise the requests/responses go as per usual. Not sure if I got things right but this might help paint a better picture of the process.

When I realize I reviewed the wrong pull request ⌘ Read more

@lyse@lyse.isobeef.org Probably wouldn’t help, since almost every request comes from a different IP address. These are the hits on those weird /projects URLs since Sunday:

    1 IP  has  5 hits
    1 IP  has  4 hits
   13 IPs have 3 hits
  280 IPs have 2 hits
25543 IPs have 1 hit

The total number of hits has decreased now. Maybe the botnet has moved on …

Fark me 🤦‍♂️ I woke up quite late today (after a long night helping/assisting with a Mainframe migration last night fork work) to abusive traffic and my alerts going off. The impact? My pod (twtxt.net) was being hammered by something at a request rate of 30 req/s (there are global rate limits in place, but still…). The culprit? Turned out to be a particular IP 43.134.51.191 and after looking into who own s that IP I discovered it was yet-another-bad-customer-or-whatever from Tencent, so that entire network (ASN) is now blocked from my Edge:

+# Who: Tentcent
+# Why: Bad Bots
+132203

Total damage?

$ caddy-log-formatter twtxt.net.log | cut -f 1 -d  ' ' | sort | uniq -c | sort -r -n -k 1 | head -n 5
  61371 43.134.51.191
    402 159.196.9.199
    121 45.77.238.240
      8 106.200.1.116
      6 104.250.53.138

61k reqs over an hour or so (before I noticed), bunch of CPU time burned, and useless waste of my fucking time.

And regarding those broken URLs: I once speculated that these bots operate on an old dataset, because I thought that my redirect rules actually were broken once and produced loops. But a) I cannot reproduce this today, and b) I cannot find anything related to that in my Git history, either. But it’s hard to tell, because I switched operating systems and webservers since then …

But the thing is that I’m seeing new URLs constructed in this pattern. So this can’t just be an old crawling dataset.

I am now wondering if those broken URLs are bot bugs as well.

They look like this (zalgo is a new project):

https://www.uninformativ.de/projects/slinp/zalgo/scksums/bevelbar/

When you request that URL, you get redirected to /git/:

$ curl -sI https://www.uninformativ.de/projects/slinp/zalgo/scksums/bevelbar/
HTTP/1.0 301 Moved Permanently
Date: Sat, 22 Nov 2025 06:13:51 GMT
Server: OpenBSD httpd
Connection: close
Content-Type: text/html
Content-Length: 510
Location: /git/

And on /git/, there are links to my repos. So if a broken client requests https://www.uninformativ.de/projects/slinp/zalgo/scksums/bevelbar/, then sees a bunch of links and simply appends them, you’ll end up with an infinite loop.

Is that what’s going on here or are my redirects actually still broken … ?

I just noticed this pattern:

uninformativ.de 201.218.xxx.xxx - - [22/Nov/2025:06:53:27 +0100] "GET /projects/lariza/multipass/xiate/padme/gophcatch HTTP/1.1" 301 0 "" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.0.0 Safari/537.36"
www.uninformativ.de 103.10.xxx.xxx  - - [22/Nov/2025:06:53:28 +0100] "GET http://uninformativ.de/projects/lariza/multipass/xiate/padme/gophcatch HTTP/1.1" 400 0 "" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.0.0 Safari/537.36"

Let me add some spaces to make it more clear:

    uninformativ.de 201.218.xxx.xxx - - [22/Nov/2025:06:53:27 +0100] "GET                       /projects/lariza/multipass/xiate/padme/gophcatch HTTP/1.1" 301 0 "" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.0.0 Safari/537.36"
www.uninformativ.de 103.10.xxx.xxx  - - [22/Nov/2025:06:53:28 +0100] "GET http://uninformativ.de/projects/lariza/multipass/xiate/padme/gophcatch HTTP/1.1" 400 0 "" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.0.0 Safari/537.36"

Some IP (from Brazil) requests some (non-existing, completely broken) URL from my webserver. But they use the hostname uninformativ.de, so they get redirected to www.uninformativ.de.

In the next step, just a second later, some other IP (from Nepal) issues an HTTP proxy request for the same URL.

Clearly, someone has no idea how HTTP redirects work. And clearly, they’re running their broken code on some kind of botnet all over the world.

Someone, on the Bridge, this is meant to have sent @manton@bridge.twtxt.net a “Follow Request” via Activity Pub hmmm 🧐

For those curious, the new Twtxt <-> ActivityPub bridge I’m building (bidirectional) simply requires three things:

1. You register your Twtxt feed to the bridge: https://bridge.twtxt.net
   
2. You verify that you in fact own/control the feed by putting the verification code somewhere on/in your feed (doesn’t matter where or how)
   
3. You proxy/forward requests for /.well-known/webfinger to the Bridge bridge.twtxt.net.
   

I’m still testing through and ironing out bugs 🐛 Please be patient! 🙏

@bender@twtxt.net Hmm, didn’t find anything. But you mean a giant bucketload of access_log /home/$USER/logs/access.log if=… where the condition matches the requested path for said user? Yeah, that gets annoying very quickly. :-D

This looks like a botnet, to be honest. The IPs are all over the place. Ethopia, Brazil, Kenya, Lebanon, Netherlands, … I mean, that’s the logical thing to do, isn’t it? Do your web crawling on infected PCs. Nobody will block those, because those are the same IP ranges as legitimate requests. And obviously you don’t have to pay for computing time.

… and they all send invalid HTTP requests, all answered with HTTP 400 … How silly.

My goodness, a new level of stupidity.

The bots are now doing things like this:

GET http://uninformativ.de/projects/lariza/feednotify/datenstrahler/slinp/countty HTTP/1.1

1. That URL does not exist.
   
2. By including http://uninformativ.de in that request, this instructs the webserver to do an HTTP proxy request. Of course, this isn’t allowed on my webserver (and shouldn’t by allowed on any normal webserver), resulting in HTTP 400. And even if it were, the target would be the exact same server, making a proxy request unnecessary.
   

And of course, it’s not just 50 hits like this or 100 or 1’000 or 10’000. No, it’s over 150’000 in the last 2 days. All from vastly different IP ranges of different cloud hosters.

This almost looks like a DDoS attack, but it’s just completely stupid. This feels more like some idiot vibe coded a crawler.

@movq@www.uninformativ.de Actually, @threatcat@tilde.club popped up in my own access log first. That’s how I discovered the feed. :-) So I figured that this feed author actually sees my reply. The hope is that with the next mention of my feed in threatcat’s feed, the other tilde users, who are following threatcat, are then also informed of my existence. :-)

I don’t know how tilde.club is set up. But it should be relatively easy to give all users access to their nginx access logs. Not sure if somebody already requested that or not. But I’d encourage tilde users to ask for that. Maybe also just for twtxt.txt and/or in a custom, reduced log format.

@bender@twtxt.net I think that’s where it sends the capture verification requests. It’s based on PoW, so it has to perform validation somehow. It actually looks pretty decent as far as a way to prevent spam/abuse of forms on the open web (e.g: Waitlist on SnipMail).

When I realize I reviewed the wrong pull request ⌘ Read more

@prologic@twtxt.net I requested an invitation. There are many like this, so it will be interesting to see how it develops. I also hope you are not hosting this on your infrastructure, at least not once you decide to monetise. I know self hosting is fun and all, but it also introduces variables that directly collide with a business model.

Trump Says He Rejected Orbán’s Request for Exemption From US Sanctions on Russian Oil ⌘ Read more

Bypass 403 Response Code by Adding Creative String | IRSYADSEC

Image

HTTP 403 is a response code indicating that access to the requested resource is forbidden. This can happen due to various reasons, such as…

[Continue reading on Inf … ⌘ Read more

Calls for Grenadians to reject US request to set up radar station ⌘ Read more

Banana industry opposes overseas imports of Australia’s most popular fruit
The federal government will review its quarantine rules after a formal request by the Philippines to import its bananas, but the industry is pushing back. ⌘ Read more

Banana industry opposes overseas imports of Australia’s most popular fruit
The federal government will review its quarantine rules after a formal request by the Philippines to import its bananas, but the industry is pushing back. ⌘ Read more

Future of Australia’s last paper mill hangs in balance ahead of key energy talks
Aurora Energy is seeking a $7 million bank guarantee to cover energy costs for the Boyer Mill in southern Tasmania, but the paper mill’s owner says the request is “obscene”. ⌘ Read more

Hospital allegedly failed to diagnose ‘flesh eating’ bacteria that nearly killed this patient
A young father who lost his eye after contracting a rare infection is suing the hospital who treated him, alleging they ignored his requests to investigate his condition properly. ⌘ Read more

@zvava@twtxt.net No HEAD requests, but regular GETs with If-Modified-Since request headers if possible: https://git.mills.io/yarnsocial/yarn/src/branch/main/internal/fetcher.go#L270

@prologic@twtxt.net i’m guessing then a HEAD request is sent every 5m, and then the feed is fetched if the headers are different?

also what would be the cases where a feed would be fetched more than every five minutes? :o

@itsericwoodward@itsericwoodward.com No worries, all good, mate! We all have to start somewhere. Other software requests my feed several orders of magnitude more often.

I can confirm, the User-Agent header appears to be fixed. \o/

Two other things I noticed, though:

1. There’s now an OPTIONS request for my feed coming from something that claims to be Firefox, pointing to your feed URL in the query. No clue what this is about. In any case, it’s rejected with a 405 Method Not Allowed.

2. Not that these few requests bother me at all, but you might wanna implement caching next with either the If-Modified-Since or If-None-Match request headers. This way, if the feed hasn’t changed, the web server can reply with a 304 Not Modified and no body at all, saving unnecessary traffic. But again, this is really not an issue for me at all. I just wanted to make sure you’re aware of it, that’s all. It might be even already on your agenda. Or you might decide to never do anything about it, which is also fine for me. :-)

Dear dev.alessandrocutolo.it, do you really need to fetch my twtxt feed every 20-30 seconds? 😅 Not that it’s posing a problem, but I feel like this could be optimized. For example, how about using the if-modified-since request header: https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/If-Modified-Since

@movq@www.uninformativ.de getting:

3Invalid request.       Error   Error   0 

On that address.

@movq@www.uninformativ.de Now, you can automatically ban everybody requesting these old URLs.

The bots have begun to access my website way more often. I’m getting about 120k hits on https://www.uninformativ.de/git/ now in a couple of hours.

They don’t cache anything, probably on purpose.

It comes in waves. I get about 100 hits (all at once) on that /git endpoint, all from different IPs. Then it takes a moment until I get another wave of about 500-1000 requests (all at once) where they do HEAD requests on some of the paths below /git. I assume they did a GET earlier and are now checking if something has changed.

So 429: Too Many Requests on my GitHub hosted images, breaking my tutorials etc… Not good!

July will be gone and my escape to Codeberg.org has not even started (I have to finish my PhD…)

The stock OS on mine was Manjaro. I didn’t request it. Now it has PostmarketOS. You can request a default OS.

I wasn’t really aware until recently that programs can’t choose their own window’s position on Wayland. This is very weird to me, because this was not an issue on X11 to begin with: X11 programs can request a certain position and size, but the X11 WM ultimately decides if that request is being honored or not. And users can configure that.

But apparently, this whole thing is a heated debate in the Wayland world. 🤔

Since Fastly acquired and recently shut down glitch.com, some of my ancient webapps are no longer available, nor do I have any plans to make them available again - all had either zero, or very few monthly visits, used outdated libraries and would be a waste of money, to continue hosting and updating elsewhere.

All art archives remain unaffected and all projects shut down before 2025, were already permanently deleted, but if there’s someone out there, still relying on the recently discontinued projects, somehow - you can reach out and request their source code.

These requests will only be honoured, until the end of this year, when we plan to permanently delete, all of this data (both webapps and files only hosted on Amazons CDN).

Canine out °_°

@lyse@lyse.isobeef.org I know web server which reject request with Referrer header

@movq@www.uninformativ.de That’s an interesting idea. For privacy, I’d just omit the Referer altogether. But maybe this helps talking to misconfigured HTTP servers that reject requests without such a header. No clue.

@lyse@lyse.isobeef.org Hm, I don’t think so, the requested page was a Linux-specific post. 🤔 I sometimes wonder if privacy-oriented browsers might do this on purpose, to create garbage data? 🤔 No idea.

As the US reacts to burrito-now, pay later, Australia regulates BNPL
Consumer protections that apply to credit products such as hardship requests will now apply to BNPL providers such as Afterpay and Zip. ⌘ Read more

Red Hat & FreeDesktop Go Into Mass Censorship Mode over Xorg Fork, Bans Dev
Immediately following news of the Xorg fork (Libre), the developer was banned by FreeDesktop and Red Hat mass closed hundreds of past Xorg merge requests. ⌘ Read more

在 Go 中爲什麼推薦使用空結構體作爲 Context 的 key
使用 Context 進行傳值我們知道 Context 主要有兩種用法，控制鏈路和安全傳值。在此我來演示下如何使用 Context 進行安全傳值：package mainimport (    ”context”    ”fmt”)const requestIdKey = ”request-id”func main() {    ctx := context.Background()    // ⌘ Read more

在 Go 中爲什麼推薦使用空結構體作爲 Context 的 key
使用 Context 進行傳值我們知道 Context 主要有兩種用法，控制鏈路和安全傳值。在此我來演示下如何使用 Context 進行安全傳值：package mainimport (    ”context”    ”fmt”)const requestIdKey = ”request-id”func main() {    ctx := context.Background()    // ⌘ Read more

Kernel prepatch 6.16-rc1
Linus has released 6.16-rc1 and closed the
merge window for this release.

I think we had a fairly normal merge window, although I did get the
feeling that there were a few more “late straggler” pull requests
than usual. Not to a huge degree, but there was definitely an
upward bump at the end of the second week.

But on the whole, all the stats look pretty normal. ⌘ Read more

Zelenskyy says US has not answered Ukraine’s request to buy air defense ⌘ Read more

Weaponizing Dependabot: Pwn Request at its finest
Comments ⌘ Read more

How to create issues and pull requests in record time on GitHub
Learn how to spin up a GitHub Issue, hand it to Copilot, and get a draft pull request in the same workflow you already know.

The post How to create issues and pull requests in record time on GitHub appeared first on The GitHub Blog. ⌘ Read more

[$] Hardening fixes lead to hard questions
Kees Cook’s “hardening\
fixes” pull request for the 6.16 merge window looked like a
straightforward exercise; it only contained four commits. So just about
everybody was surprised when it resulted in Cook being temporarily blocked
from his kernel.org account among fears of malicious activity. When the
dust settled, though, the red alert was canceled. It turns out,
surprisingly, that Git is a tool with which one can inflict substantial … ⌘ Read more

hey @prologic@twtxt.net heads up - my pod is suddenly having weird 400 bad request errors on things like posting twts, new user registration, following, and more. it’s not just me because a friend is also having these issues as a new user and can’t post. i saw one exception in the logs but i’m not sure if it’s related, i’ll link it in a reply to this

[$] Block-layer bounce buffering bounces out of the kernel
As the end of the 1990s approached, a lot of kernel-development effort was
going into improving support for 32-bit systems
with shockingly large amounts of memory installed. This being the 1990s,
having more than 1GB of memory in such a system was deemed to be shocking.
Many of the compromises made to support such inconceivably large systems
have remained in the kernel to this day. One of those compromises —
bounce buffering of I/O requests in the block layer — has finally be … ⌘ Read more

‘Mar-a-Lago face’ now the most in-demand plastic surgery — doctor reveals who everyone is requesting to look like
Adriana Diaz,  Reporter  -  New York Post

Stephan: This is a trend, and it is one of the sickest, weirdest in American history.

Image

Politicians are leading more than the government — they … ⌘ Read more

Pakistan Rejected IndiGo Delhi-Srinagar Flight Pilot’s Request To Use Its Airspace To Avoid Turbulence: Report ⌘ Read more

Fedora Council overturns FESCo provenpackager decision
The Fedora Council has ruled on the Fedora Engineering Steering
Council’s (FESCo) decision last year to revoke Peter Robinson’s
provenpackager status. In a statement
published to the fedora-devel-announce mailing list, the council has
announced that it has overturned FESCo’s decision:

FESCo didn’t have a specific policy for dealing with a request to remove
Proven Packager rights. In addition, the FESCo process wa … ⌘ Read more

GitHub Copilot: Meet the new coding agent
Implementing features has never been easier: Just assign a task or issue to Copilot. It runs in the background with GitHub Actions and submits its work as a pull request.

The post GitHub Copilot: Meet the new coding agent appeared first on The GitHub Blog. ⌘ Read more

$750 Bounty: for HTTP Request Smuggling on Data.gov

Image

How a cleverly crafted desync attack revealed a hidden path to client-side compromise, JS injection and potential cookie theft

[Continue reading on InfoSec Write-ups »](https://infosecwriteups.com/ … ⌘ Read more

DHS requests 20,000 National Guard troops to help with mass deportations
Ellen Mitchell,  Senior Defense Reporter  -  The Hill

_Stephan: I have been waiting for this development in the Trump MAGAt coup, and now it is openly here. Trump is trying to create a militarized Gestapo so that civil resistance ostensibly about immigrants, just as Hitler made it about Jews, can use the military to eliminate people who oppose him. That’s why Hegseth has been firin … ⌘ Read more

@bender@twtxt.net basically because we don’t readily use or support range hunters when requesting feeds it’s ideal to keep feed small for the time being at least until we think about writing up a formal specification for this, but it’s also only for Http hosted feeds

@movq@www.uninformativ.de, “60 requests per hour”, eh? Was that a thing (that is, unauthenticated access to GitHub)?! I know I am on the minority, perhaps, as I rarely (or never) access GitHub unauthenticated.

RIP GitHub https://github.blog/changelog/2025-05-08-updated-rate-limits-for-unauthenticated-requests/

Good thing I left long ago.

Kernel prepatch 6.15-rc6
Linus has released 6.15-rc6 for testing.

Everything still looks fairly normal - we’ve got a bit more commits
than we did in rc5, which isn’t the trend I want to see as the
release progresses, but the difference isn’t all that big and it
feels more like just the normal noise in timing fluctuation in pull
requests of fixes than any real signal.

So I won’t worry about it. We’ve got another two weeks to go in the
normal release schedule, and it still feels … ⌘ Read more