i love seeing creative qr code designs, so i made this guide explaining what tricks you can (and can't!) do with qr codes while still keeping them very much readable

have fun and make cool stuff!!

Alt...

(ADVANCED) Guide to (not) fucking up qr codes ...while still making them look cool asf! by Lyra Rebane (1) Just have the QR code as-is, works the best! (2) But leave some white padding, otherwise some scanners can't scan the code! (3) Recolor the code using a light and dark color! (4) But don't invert the colors, some scanners can't handle this. Everything tested with: GrapheneOS, Samsung, iOS, Binary Eye Page 1/4

Alt...

(1) Depending on the error correction you can cover up to 30% of the data in the QR code. This will make the QR harder to scan, but it should still work on all scanners. (2) But this only applies to the data and ec (green). You can also cover one of the format info parts (yellow) (3) Counter-intuitively, it also only applies to entire codewords (bytes) at once. Therefore you should make sure to never mess up over 30% of the codewords, even by a single pixel! (4) For example, I added a sneaky one pixel thick worm onto this QR code, which makes it unscannable! (5) But this QR code I added that chonky snake with a pride scarf onto remains perfectly readable! Page 2/4

Alt...

(1) To scan QR codes, scanners will first find the three locators (blue) and then use the zebras (red) to create a grid over the code. (2) This means that you can stretch, skew, or rotate your codes because the grid still stays intact! Don't go too overboard with this, as some scanners can't handle extreme transformations. Pretty much just make sure that straight lines can still be drawn! (3) However, transformations that don't retain the grid - such as bends - can make the QR code unreadable. Keep this in mind when putting your QR codes on curved real world objects, such as posts and pipes. (4) If you need to draw curved lines for a grid, the code cannot be scanned. Note: the GrapheneOS stock Camera app might struggle with certain skews/rotations Page 3/4

Alt...

(1) QR code scanners use the grid to pinpoint the center parts of pixels, which means that the rest of the pixel does not matter! (2) This means that you can shape your pixels however you want, provided that the middle stays unchanged. (3) Or you can fill the rest of the QR code with a different image or even pure noise! Note that a QR code like this could break after resizing or image compression, so use with caution! (4) As with the other tricks, this reduces scannability, so make sure to test it with multiple devices, especially if you’re combining all of the tricks into one ultra QR code! (5) This example still scans, but may not work properly or reliably everywhere! Page 4/4

Good morning Mastodon ☕

Friendly reminder:

Alt...

the boots you lick will stomp you too

#artwork

Alt...

A surrealistic doodle by Ángel Ortega with bloody horns, a raven, a pile of skulls, a catwalk and other debris

ADDRESSING THE ALLEGATIONS

if you enjoy my art, please consider supporting it financially.

https://liberapay.com/analognowhere
https://analognowhere.redbubble.com

Thank you!

#unix_surrealism

Alt...

LIST OF ENEMIES: qrstuv

THEODORE ROOSEVELT SHOT BY CRANK IN MILWAUKEE STREET

#content_review #unix_surrealism #fediverse #loops #mastodon #lemmy #art #mastoart #javascript #cats #snac

Alt...

Funhole Content Review FEDIVERSE I HAVE A DREAM 'you need to enable javascript to run this this app.' How to make it big? You don't @mmtmm pls sponsor me How to get more boosts? Cats. so many rabbits LOOPY CONSPIRACY - Who is behind the manufactured fame of a tiktok clone nobody asked for? THE C BANSHEE: What is snac and should you be worried? FEDIVERSE MENACE: HAVE YOU SEEN THIS MAN? hackers.town: Is nowhere safe? ONE FREE ANTI-SLOP KITTO THE LIST: 50.000 mastodon addresses to avoid if you don't like illegal content.

CC: @occult@ominous.net

The following is a valid DOS COM executable that prints "HELLO" in the lower right corner of the screen.

You can copy these emoji into a text editor, and save it as EMOJI.COM. it should be 141 bytes.

It will run in DosBox-X, with the following options:

cpu cputype=8086
machine cga

🐸☺️🐰🐎♐🗃️🧯🧯🧯🐮💗🦮🪏♐🐰🐹🗃️🧯🧯🧯🧯💗🪗🧯😗🧮🫪😗🧮😗🐮😪😔⭐

may god have mercy on my soul.

@juergen_hubert

By the bubble, or by the bubble bursting? 'AI' has had little impact on most industries, which is one of the major signs that it's a bubble: if it were significantly improving productivity outside of a handful of niche cases there would be some possible justification for the $3T sunk into it.

The bubble bursting is a very different story. My back of the envelope calculation on the US stock market was that about $30T was overexposed to the AI bubble. I've seen people who actually know what they're talking about with numbers between $15T and $40T, the consensus seems to be around $20T.

That's somewhere between a quarter and a half of the total value of the US stock market that has a significant chance of evaporating when the bubble bursts. Even if it's 'only' $15T, that's going to cause an enormous liquidity crunch. Any business that's dependent on being able to get loans to grow or on customers having free cash to spend is likely to be affected.

For reference, the Wall Street Crash, which triggered The Great Depression, involved around 50% of the value of the stock market being wiped out in the first crash and a total of 89% over a bit more than two years, but that was in an economy where far less was linked to the stock market (for example, few people had pensions that were linked to the stock market).

My question is not how bad the crash is going to be, it's whether the rest of the world can sufficiently firewall the USA so that the crash is mostly contained there. Preventing contagion when there's a massive liquidity crunch requires international cooperation. Trump is incapable of cooperating for the common good, or even for the good of the USA: he'd happily let the US economy burn if it made him and his friends a few billion.

@briankrebs The amazing thing is: none of this is even slightly hidden. Everyone investing in it knows it's a bubble. None of his warnings are even slightly surprising to anyone who has been paying attention for the last two or three years.

But that doesn't matter because you can make money in a bubble as long as you get out soon enough. I posted about this in another thread, but a lot of 'investors' are 'gambling with the house's money':

They jumped in early. When things in the bubble doubled in value, or maybe a bit more, they cashed out their initial investment. After this point, there is no way that they can lose money. Maybe they invested $10 M in NVIDIA in early 2016 and sold $10 M of NVIDIA in late 2016, still holding $10 M. By 2024, it was an obvious bubble. If they sold half of their stock then, they'd be $350 M up. No matter what happens with the bubble, they've made $350 M in eight years with $10 M in seed capital. That's over a 45% average annual RoI. If the bubble continues to grow and they cash out at the right time, they may make another half billion or more, but if the bubble pops so badly that NVIDIA goes bankrupt, they still made $350 M.

This is the opposite of the 'betting on the margin' that smaller investors do before catastrophic crashes (the Wall Street Crash in the 1920s and Korea last week), where you borrow against your existing investment and invest more based on that, but often both are happening at the same time and these are the people funding the big payouts to the former category.

@junesim63 There are a few things I disagree with in this:

First, a couple of small nits, it says:

The big tech companies have spent $1 trillion on capital investment since the start of the AI boom

That's a very low estimate, most estimates are closer to $3 T.

First, there’s too much competition among US LLM providers. It’s not just ChatGPT and Claude now – Gemini and Copilot are nipping at their heels

There's some conflation of models and end-user products here, which is important because it hides the shape of the supply chain.

But then we get to:

And the world will be left with hundreds of massive data centres without enough customers. Compute will become extremely cheap – just like accessing the internet did after the telecoms companies spent billions competing to lay fibre optic cables in the 1990s.

Accessing the Internet didn't immediately get cheap. Companies laid a lot of fibre. This was very expensive to do and had low returns. These assets became available cheaply. Those assets were useful because it's easy to light up dark fibre. The equipment at the ends that you need to provide (and which can be a newer technology than was available when the fibre was laid) is much cheaper than digging up streets or laying very long runs of fibre between cities. And most of that fibre is still useful 20+ years later, with an expected lifespan of 25-50 years.

'AI' datacentres are not like this, for several reasons:

First, they are very expensive to operate. They're measured in GWs: even if all of the capital is a sunk cost that you can write off, the cost of simply turning them on is enormous. That sets an absolute lower bound on the price. And, because they're such massive grid consumers, they're likely to be blocked from that much consumption as soon as the hype wave's marketing shield wears off.

Second, the GPUs wear out. The average lifetime for NVIDIA GPUs in these things is estimated at three years. So even if you buy one for pennies on the dollar and can afford the electricity, it won't stat working at maximum capacity for long. And those GPUs are aggressively tailored for specific kinds of ML workload. Even if they're basically free, they are unlikely to be the most cost effective way of running any other kind of workload.

Finally, these datacentre designs are very specialised. These kinds of machine-learning workloads are incredibly memory-sensitive. This means that you need to put very fast memory next to very dense floating-point compute to get performance. This, in turn, means that it isn't just enough to have a lot of power, you need a a lot of power per rack. That places a lot of strain on cooling and makes it very expensive to cool. If you're building a datacentre for any other workload, that's unnecessary. Land is not that expensive in the places where they're built, so you build at a much lower power density, which reduces your cooling costs.

It's not at all clear that refitting an 'AI' datacentre to be a useful datacentre will be cheaper than building a new datacentre from scratch. If you visit the outside of Taipei, you can see the history of semiconductor fabrication because it's always been cheaper to build a new factory than refurbish an old one. 'AI' datacentres may well end up like this.

The boom will get going again after the bust – with valuations returning to more sensible levels. A few of the massive tech companies will buy up the remnants of the others, leaving the market even more concentrated.

There are a lot of assumptions here. Currently, we are seeing that the market for these things is around 1% of the cost of building and running them. Training an LLM costs an enormous amount. Companies are basically eating those costs because they expect to be able to make it up by charging for access to the models. And they're also losing money providing the models as a service because they're expensive to operate.

After the bubble bursts who will fund training of new models? Old models gradually use utility (people are already complaining about LLMs that don't know about anything that happened after 2024 because that's the end of their training data set). If inference is not bringing in as much money as it costs to operate the systems, who will continue doing it?

And, when the 'it will massively improve your economic competitiveness' claims are proven to be lies, will governments keep giving companies a free pass from massive copyright infringement?

If you want to claim that companies will keep selling these things after the bubble bursts, you need to answer these questions.

The economics of LLMs are terrible. They have high costs to train (capex) and high costs for inference (opex). The most successful things in the market generally have a different mix:

High capex and low opex means ahigh barrier to entry for new competitors but then increasing profits the larger you are. Microsoft, Google, and Amazon's core products all look like this. The best products in this case have per-unit opex that drops as you increase the number of units, because even a new company with the same amount of up-front capital as you isn't able to match your price without losing money until they have as many customers as you.

Low capex and low opex means things become cheap commodities. They will often become ubiquitous, but generic. It's hard to gain a dominant market position because it's trivial for a new competitor to pop up. A lot of consumer goods look like this.

Low capex and high opex often survives as boutique services. Things like Michelin-starred restaurants: easy to create (lease a building), expensive to operate (hire some very expensive staff).

But there are very, very few examples of things where the capex and opex are both high becoming major parts of an economy. Private jets, for example, are in this class and they're a tiny niche in the corner of travel.

Wealth and power will become even more concentrated, as the largest tech companies buy up their defunct competitors, before leveraging their control over the technological infrastructure that most other businesses require to function

I suspect the latter part of this is misdiagnosed. Big tech firms are massively over leveraged at the moment. NVIDIA has loans that amount to more than its pre-bubble valuation and its current valuation is predicated on completely unattainable growth. It makes sense only if you imagine that it's a company that will, over the long term, be able to sell more than 10x as many chips as Intel at its peak. When these companies' stock prices collapse, they're going to find it very hard to raise money for anything and they won't be able to buy companies with their stock (that's partly why they're on a buying spree now).

The people who will make money are the people who have other liquid assets. Either cash, or things like real estate that they can borrow against as safe assets when the bubble bursts.

would you like to play a game?

Alt...

Anna Karina and Jean-Paul Belmond in 'Une Femme est Une Femme' (1961) dir. Jean-Luc Godard caption reads FUCK SOCIAL MEDIA MARRY FRENCH NEW WAVE CINEMA KILL AI

my fellow european sibs, here is my unbiased review of w.eu, i mean w.social, i mean wsocial.eu 👍

#eu #wsocial #w #unix_surrealism #mobilek #phone_bad_book_good

Alt...

it's a bluesky instance that you can't use without a mobilek mister mobilek is in a pokit

Entropy’s Rotoscope Issue I; new page everyday starting today: https://kamiokan.de/entropysrotoscope/issue1

RSS: https://kamiokan.de/entropysrotoscope/rss.xml

Support me on ko-fi: https://ko-fi.com/j_g00da

CC0 / Public Domain

#unix_surrealism #comic #art #entropysrotoscope #kamiokande

Alt...

Comic cover, text: Entropy's Rotoscope Issue I, kamiokan.de/entropysrotoscope CC/0 2026. A girl with a laptop looks at a humanoid computo, it talks to her but she can't hear it, she has headphones on!

CC: @yassie_j@transfem.social

@RootMoose snac is great. Mastodon is good, but yeah, it's big. littleFedi will be added to the list as soon as it'll be ready 😉

A Jump in My Chair

https://my-notes.dragas.net/2026/07/27/a-jump-in-my-chair/

#MyNotes #Blogging #Memories

There are nice things in this "timeline", so let's find opportunities to be grateful!

#snac2 #fediAdmin #mentalHealth

Storage has grown to 1.7gb, memory and cpu utilization are still negligible.

This is easily the lightest weight fedi host I have run to-date, and I've run just about all of them.

I'm still hestitant to move to it full time, but it is pretty appealing.

"We took a little time away from the Nazi Bar, but we noticed there's less pushback now for partying with the fash. So, back inside we go. Something-something, aren't-we-virtuous."

#firefox #twitter #mozilla

Alt...

A tweet from the official Firefox account on Twitter/X: We took time off of X, but we're back. The internet is changing again, so we're here as an independent voice for our users and the open internet.

Conclusion: people will adapt to whatever timezone they like, as absurd as it may sound.

Today is Artificial Intelligence Appreciation Day for some reason, so everyone please celebrate appropriately.

Happy World Snake Day

Alt...

Kurt Russell as Snake Plisskin in Escape From New York (1981). He’s seated in a leather wingback chair wearing a very weathered leather jacket with his signature eye patch and fantastic hair saying ‘I don't give a fuck about your war or your president.’

CC: @bpl@snac.bsd.cafe

On 10 March 2021, I had only just fallen asleep when my phone started buzzing. Then another notification, and another. In a matter of minutes, 142 of my servers went up in the clouds. And not the cloud-computing kind.

Most of them were physically going up in a column of smoke in Strasbourg.

My wife looked at me and asked if I wanted a coffee. I nodded. It was going to be a very long day.

At EuroBSDCon 2026, I won't be giving a theoretical lecture on high availability. Instead, I’m going to tell the raw story of that night: the emergency recovery, the architectural choices that actually saved us, and the ones that crumbled under pressure (because we rarely talk about what fails).

Most of all, I’ll explain why that night changed my perspective, and why I’ve come to see BSD systems not just as operating systems, but as essential, practical tools for building simpler, more resilient infrastructure.

The official schedule is now live. If you want to hear a real-world post-mortem, join me on Saturday, 12 Sept at 11:15 (Room D.0.02).

EuroBSDCon Full schedule: https://events.eurobsdcon.org/2026/schedule/
See you there! ☕️

#FreeBSD #NetBSD #OpenBSD #DragonFlyBSD #RunBSD #EuroBSDCon #SysAdmin #SelfHosted #IT #EuroBSDCon2026 #BSDCon

Mister Mobilek Wallpaper MEGAPACK

#mobilek #phone_bad_book_good

Alt...

mister mobilek

Alt...

smiling mister mobilek

Alt...

happy mister mobilek

Alt...

sleepy mister mobilek

#artwork

Alt...

A drawing by Ángel Ortega of falling, decomposing objects and body parts and the text above

How many instances must an admin spin up before you can call it a fediverse?

I Did Not Kill Stanley Lieber: How to draw (with 9front)

The penultimate paper on paint(1) and the 9front art machine.

https://triapul.cz/automa/i_did_not_kill_stanley_lieber

#unix_surrealism #plan9 #9front #art #guide #computers #oldcomputerchallenge

Alt...

poster for "I Did Not Kill Stanley Lieber: How to draw (with 9front)" there's some characters or something, I can't tell

A rough analogy:

Threads → Fox News
Bluesky → The Atlantic
The fediverse → zines stapled to a lamppost outside your favorite queer and/or communist bookstore

It’s not Tuesday yet, but it will be soon.
And I want to thank @grunfink for creating and maintaining snac. Tomorrow I’ll talk about FediMeteo at DevConf, and it would never have come to be if it weren’t for snac and for the help the author gave me in fixing some things to optimize its use.

True Open Source, made with passion, by people who do things for the love of the things themselves.

#ThankYouTuesday #snac #FediMeteo #Fediverse

CC: @gutenberg_org@mastodon.social

[MANGA][FREE DOWNLOAD] JAPANESE JESUS

https://triapul.cz/files/pmjv-japanese_jesus.cbz

I hereby announce the release of Japanese Jesus e-book. Enjoy!

If you want, you can buy something or put a dollar in the hat.
https://analognowhere.com/support

stay prayed up

https://analognowhere.com/jj

#unix_surrealism #comic #japanese_jesus #art #foss #linux #stayprayedup

Alt...

japanese jesus

wireguard for 9front in ~1300 lines of C

LittleFedi: light, yet complete

I'm writing this post from a Raspberry Pi Zero W - 512 MB RAM, single-core ARMv6 - running NetBSD, powered by littleFedi. The process sits at 33 MB RSS, CPU basically asleep:

load averages:  0.05,  0.08,  0.09
CPU states:  0.0% user,  0.0% nice,  0.0% system,  1.0% interrupt, 99.0% idle
Memory: 301M Free
  PID COMMAND             RES STATE
 2082 littlefedi-armv6    33M kqueue

No Redis. No PostgreSQL (but optional). No Sidekiq. No Node.js build pipeline. One statically-linked binary, one SQLite file, and the full fediverse experience. And this is the part people tend to miss: the same binary that runs happily on a Pi Zero scales, on the right hardware, to numbers that have nothing to do with "lightweight". It's not a toy that stays a toy. It's built to grow when you need it to.

What LittleFedi actually ships

Federation - Full ActivityPub S2S: WebFinger, NodeInfo 2.1, host-meta, HTTP Signatures with anti-impersonation checks. Per-user and shared inboxes, outbox, followers, following, featured collections. Thread completion with bounded on-demand fetching of missing ancestors/replies (separate sync and background budgets, all hard-capped). Quote posts via FEP-044f with the full approval handshake (QuoteRequest -> QuoteAuthorization), matching Mastodon 4.4 semantics, plus _misskey_quote and Fedibird quoteUri aliases. Account migration (Move), both outgoing and incoming, with alsoKnownAs linking, automatic follower migration, follow import from AP collections, and CSV export/import. Remote interaction discovery - async like/boost resolution from origin servers with REST fallback.

Mastodon API - Broad coverage: timelines (home, public, local, hashtag, bubble, direct), status CRUD with edits, scheduled posts, polls, bookmarks, lists (with replies_policy and exclusive), filters v2 (keyword CRUD), featured tags, followed hashtags (posts appear in home), markers, conversations, notifications with type exclusion, follow requests, blocks (federated Block/Undo), mutes with duration/expiry and hide_notifications, per-user domain blocks. OAuth2 with app registration, authorization code, client credentials and refresh_token flows, PKCE, consent screen, and scope enforcement (read/write/admin:read/admin:write). It talks fine to Elk, Tusky, Ivory, Phanpy, Semaphore and MastoBlaster.

Streaming - WebSocket and SSE. In-process pub/sub hub with per-connection send buffers, zero cost when no client is connected. Broadcast streams for public, local, remote, hashtags and lists. Per-account streams for user timeline, notifications and direct messages. Optional PostgreSQL LISTEN/NOTIFY backend for cross-process fan-out. Mastodon-compatible event serialization.

Push notifications - Full Web Push / VAPID (RFC 8030/8291) with aes128gcm encryption. Per-type alert toggles (mention, follow, reblog, favourite, poll, follow_request, status). Notify-bell support on followed accounts. Subscription expiry detection, rate-limit handling, 5-retry delivery.

Media pipeline - Upload processing: thumbnail generation (600x600), blurhash computation, EXIF stripping, magic-byte validation, SVG rejection, MIME mismatch detection, UUID-based file renaming. Size limits (40 MB default), pixel caps (16 MP default, tunable down to 4 MP for SBCs).

Media privacy proxy - This is the part I actually care about most. All remote media streams through the instance via HMAC-signed URLs (/proxy/media?url=...&sig=...), so local users never expose their IP address to remote servers. SSRF-guarded: DNS resolution check, private/CGNAT IP rejection, redirect re-validation. Pure io.Copy pass-through, no disk, no decode, ~32 KB buffer. Forwards HTTP Range requests for audio/video seeking. Configure a proxy_secret for stable URLs across restarts. On low-RAM devices, set cache_remote = "off" and you still see every image on the fediverse, the instance just doesn't store or process them.

Remote media caching - Three modes: off, eager (background sweep caches all remote attachments, avatars, headers and emoji, backfills existing on mode switch), lazy (cache on first access). Content-addressed, deduplicated by origin URL. Age-based pruning with file GC. Negative-cache for permanently dead URLs. Transparent origin fallback on cache miss. Open Graph preview cards stored durably with posts.

S3-compatible storage - A separate build tag (-tags s3), deliberately excluded from the default binary to keep it small. Supports AWS S3, MinIO, SeaweedFS, Ceph, Backblaze B2, Wasabi, DigitalOcean Spaces. Native media migration CLI: littlefedi admin media storage-migrate between local and S3 (DB-queue-backed, resumable, bounded batches). storage-status, storage-cancel, storage-resume commands. storage-manifest for rclone JSONL integration.

Markdown posts - Powered by goldmark with GFM extensions: tables, strikethrough, bare URL autolinking, hard wraps. Raw HTML deliberately not rendered. Output sanitized through bluemonday (defense-in-depth). Composer toggle in the web UI. Federates source.mediaType: text/markdown (Pleroma/GTS convention). Inbound Markdown source is rendered to HTML.

Visibility modes - The standard four (public, unlisted, private, direct) plus local-only (local, instance timeline only, never federates) and local unlisted (local_unlisted, followers only, no federation). Useful for notes to your own instance community.

Bubble timeline - Curated set of instances whose posts appear alongside local posts in a special timeline. Akkoma-compatible extension. Admin panel for adding/removing bubble instances. API endpoint at /api/v1/timelines/bubble.

Moderation - Account states: suspended (tombstone, federates Delete(Person)), silenced (visible to followers only, dropped from public timelines), quiet (like silenced plus it downgrades federation to followers-only, a middle ground I haven't seen anywhere else), disabled (cannot log in, content stays visible). Self-suspend prevention, last-admin-demotion guard. Blocks (bidirectional, federated), mutes (local-only, with duration and hide_notifications), per-user domain blocks (distinct from admin instance-wide blocks). Reports pipeline: user submissions plus inbound/forwarded Flag into an admin triage UI with resolution actions. Admin notification on new reports. Domain blocks with severity (noop/silence/suspend) plus Mastodon-parity options (reject_media enforced in the proxy, reject_reports, obfuscate, public). A moderation audit log records every admin action.

Web UI - Server-rendered HTML with html/template, templates embedded via //go:embed. Inline CSS (dark mode, Inter font, gradients). htmx 2.x and Alpine.js for progressive enhancement. No build step, no Webpack, no Tailwind, no npm. Every action works as a plain form POST without JavaScript. Works in Lynx, eLinks, text-only browsers, and on mobile.

Full feature set: home/public/local/bubble timelines with infinite scroll, profile pages with follow/unfollow/bell toggle, status threads with reply composer and background thread completion, post creation with CW, visibility selector (6 modes), media upload with alt text, Markdown toggle, quote posts (pre-loads composer with the quoted post as an inline card), post editing, composer autocomplete for @mentions and #hashtags, settings (display name, bio, password, sessions, moderation, pruning, account move, timeline preferences), report form, search page, tag management.

Admin panel - Dashboard (user counts, pending approvals, unreachable instances, open reports), accounts (with suspend/silence/quiet/disable/approve/reject actions), invites (CRUD), domain blocks (with severity and options), reports (triage and resolution), audit log, instance health (per-instance status with follower/following counts, reachability tracking, purge with typed-domain confirmation), bubble instances, settings, housekeeping (on-demand pruning), queue console (ready/scheduled/running/failed by job kind), media storage (S3 migration controls in S3 builds).

Background jobs - DB-backed queue that survives restarts, 8 job kinds: inbox, delivery (16 attempts over roughly 26h with capped exponential backoff and equal jitter), push_notification, actor_refresh, poll_close, scheduled_status, media_cache, media_migration. Per-instance circuit breaker suspends delivery at backoff_count >= 10. Actor refresh dispatcher with stale-while-revalidate, crash-safe leases, and per-actor exponential backoff.

Backups - Periodic or on-demand, server-side, no external tooling required. Each run produces a timestamped directory with config.toml, a portable database dump (VACUUM INTO for SQLite, pg_dump for PostgreSQL), an optional copy of owned media, and a manifest. Toggle it on, set an interval (24h, 7d, whatever fits), decide whether to include owned media (the remote cache is always excluded, no point backing up other people's content), and set a retention count so old backups get pruned automatically. Off by default, one line to turn on.

Housekeeping - Automated pruning: remote statuses by age, own low-interaction statuses (per-user or server thresholds, min likes/boosts caps), tombstones, expired mutes, stale media (>24h unattached), orphaned media (deleted posts), unreferenced media files (disk files with no DB record), cached media by age, cache file GC. On-demand controls in the admin UI.

Security - Token-bucket rate limiting per IP. Security headers: X-Content-Type-Options, X-Frame-Options, Referrer-Policy, Strict-Transport-Security. Content-Security-Policy with nonce-based script/style. CORS. CSRF on all cookie-authenticated POSTs. Session fixation protection. Password reset token in a cookie, not the URL. OAuth consent screen (not auto-issuing). SSRF protection (DNS, IP and redirect re-validation) on all outbound HTTP. HTTP Signature algorithm enforcement (rsa-sha256 only). Inbox body size limit (1 MB). Backfill goroutine cap. Thread-fetch amplification limits. File upload validation (magic bytes, SVG rejection, MIME mismatch). Username enumeration hardening.

Operational - Prometheus metrics at /metrics (counters for API/inbox/fed/web requests, statuses, deliveries, thread fetches, queue depth; gauges for workers, pending follows, uptime). Health checks (/health, /readyz). CLI: admin create-user, admin set-admin, admin list-users, admin suspend/unsuspend, admin invite generate/list/revoke, admin media prune/prune-orphans/prune-files, admin media storage-migrate/status/cancel/resume/manifest, post (publish from stdin/file with Markdown, visibility, CW, media, reply, quote), migrate (run migrations only). SMTP for password reset and notifications (falls back to stdout). Config via TOML file plus environment variables (LITTLEFEDI_{SECTION}_{KEY}).

Platform support - CGO-free, compiles with CGO_ENABLED=0. 23+ GOOS/GOARCH combos via the modernc SQLite driver: macOS (amd64, arm64), Linux (386, amd64, arm, arm64, loong64, ppc64le, riscv64, s390x), FreeBSD (386, amd64, arm, arm64), Windows (386, amd64, arm64), OpenBSD (amd64, arm64). NetBSD (amd64, arm, arm64) via a WASM-based fallback SQLite driver, I don't think anything else in the fediverse space explicitly targets NetBSD. PostgreSQL is a separate build tag (-tags postgres), S3 is another (-tags s3). The default binary carries neither, keeping it small. ARMv6 (GOARM=6) gets special treatment in the release naming, that's the Pi Zero target.

Why it matters

The fediverse shouldn't demand a beefy VPS. It shouldn't require Docker, 2 GB of RAM, Redis, Sidekiq, or a JS toolchain that pulls in 800 packages. A 10 euro Raspberry Pi Zero W running NetBSD, sitting on a shelf, drawing less than 2 watts, can be a fully functional fediverse instance with a web UI, mobile app compatibility, streaming, push notifications, quote posts, account migration, and a moderation toolkit. That's not hypothetical, that's what this post is running on.

But don't mistake "runs on a Pi Zero" for "only runs on a Pi Zero". Point the same binary at real hardware and it scales to numbers that have nothing to do with hobby-instance territory. Low power is the floor, not the ceiling.

One binary, one config file, one SQLite database. Light, yet complete.

I've been involved in this project for a while now, though I can't say much more about it at the moment, there are other people involved besides me and it's not entirely my call to talk about it publicly yet.

#Fediverse #littleFedi #OwnYourData #NetBSD

examine the newly collected #phonebadbookgood series

https://triapul.cz/phone_bad_book_good

#comic #art #mastoart #fediart #mobilek #unix_surrealism

Alt...

phone bad book good poster chid and red surrounded by many mobileks

You know this, I know this, it's still nice to have a comic about it.

#AI

Alt...

A black and white comic in 4 panels : - a man standing to a large machine twice his size, announcing in a microphone : "My GENIUS machine will find SOLUTIONS to ALL the world's PROBLEMS !" - the machine starts slightly vibrating while the man looks at it : "Thinking", says the machine in a different font. - The machine continues in the same font : "You ALREADY HAVE all the solutions. You just REFUSE TO IMPLEMENT them to protect the financial interest of the wealthiest 0.0001%". The man doesn't look pleased. - The screen of the machine has gone dark as the man unplugs it. Sweating bullets, he goes : "It just needs some tweaking".

#artwork

Alt...

A drawing by Ángel Ortega depicting a bunch of objects and photos

CC: @prahou@merveilles.town

GARFIELD DEAD!

After Bluesky, Threads, and so on, the whole #WSocial thing is another reminder that it was never about the #Fediverse being "too complicated" or "just for nerds".

A bafflingly large amount of people genuinely only act on a gut feeling telling them that only commercial products with fancy marketing owned by a for-profit corporation can be trustworthy, 'official' and 'legal', for the lack of a better word.

If something is a commercial offering by a competent-looking, rich family man in a suit, it's clearly an official, legal, trustworthy product. You can be proud of using such a fancy-looking service.

When they see a community-run open-source project or a grassroots initiative, their first instinct is that it must be shady, illegal, complicated, broken or predatory in some way. It's probably some aftermarket grey area bootleg made by weird tech nerds, political groups with an ulterior motive, conspiracy theorists or some naive teenage hackers. They'd also be embarrassed for using it in front of their peers and neighbours; who uses some free back-alley software, are you poor or something?

The same people are the reason why Google is using the word 'sideloading', why scammers love wearing fancy suits, why people suddenly act childishly helpless in front of LibreOffice, or why DIY HRT is so demonised.

They trust any kind of 'official approval' over their own senses. If someone does something that isn't 'approved', they're a bad person or clearly endangering themselves and others. No idea why exactly, but psh, it must be wrong somehow, or everyone would do it, right?

If people on the Fediverse understood that the whole "it's all so complicated and clunky" thing is just a thinly veiled excuse for a general disdain for non-commercial software, we could finally stop making all our software imitate their corporate equivalents in a futile attempt to appease people who never gave us a chance in the first place.

You'll never convince them to treat it in good faith no matter how much effort or money you put into UX or 'ease of use'. All you're doing is making the software worse, e. g. through things like dot-social, verified accounts or begging brands, corporations and politicians to join and give your product some kind of 'official' validation.

#mastodon #openSource #linux

I'll keep an eye on them in the coming days before rolling them out to other countries. In the meantime, you'll find the links in each city's bio.

Let me know if it works for you!

#FediMeteo #FediMeteoAnnouncements #DeltaChat #Italy #Italia #Germany #Deutschland

CC: @thisemailfindsyou@mastodon.social

CC: @bpl@snac.bsd.cafe @stefano@bsd.cafe

#artwork #fahrenheit451 #RayBradbury

Alt...

A drawing by Ángel Ortega of a burning pile of books

Secret Panel HERE 😱 https://tinyview.com/mrlovenstein/2026/06/11/living-nightmare

CC: @vbabka@mastodon.social @ldvsoft@fosstodon.org @vitaut@mastodon.social @pmjv@snac.lab8.cz

CC: @bauchhaus@c.im

CC: @stefano@bsd.cafe

CC: @qrstuv@hj.9fs.net @prahou@merveilles.town

As a reminder, the app will remain free for all friends of BSD Cafe, illumos Cafe, or anyone using it to connect to snac instances.

More details once I've worked out a few specifics.

Stay tuned!

#MastoBlaster #MastoBlasterUpdates

#artwork #nineteeneightyfour #GeorgeOrwell

Alt...

A drawing by Ángel Ortega of a rat with a skeleton head, the text DO IT TO JULIA superimposed

CC: @stefano@bsd.cafe

CC: @stefano@bsd.cafe

why content negotiation will eventually betray you

CC: @stefano@bsd.cafe

mount: (hint) your fstab has been modified, but systemd still uses the old version; use 'systemctl daemon-reload' to reload.

CC: @stefano@bsd.cafe

The at daemon is a great piece of ancient art. The now is just one of the multiple options of specifying when the batch is to be run; depending on the tool flavour, you can use a timespec like 17:45 or a date or midnight or teatime (whatever that means, I'm from Spain and mostly a coffee man).

CC: @js@bsd.cafe

My bank emailed me "AI is changing check fraud. Here's what you can do to protect yourself."

Nonono, Mr. Banky-bank. Tell me what YOU are doing to protect me against check fraud. This is a you problem, caused by a system you designed and run. How about you don't externalize that cost onto me?

I have, since the 1980s, DESPISED any excuse like "oh sorry we got a new computer system" or "we can't do X anymore because of the computer". How you do business isn't my fucking problem. Don't give me excuses for not having your shit together.

This is the same as "we are experiencing unexpectedly high call volume." Well, that's pretty fucking poor planning on your part, then, innit? Hold times aren't long because of the forces of nature, they are because you're too fucking cheap to pay sufficient staff.

For added benefit, it immediately detaches from my shell session.

CC: @js@bsd.cafe

CC: @hoolis@oldbytes.space

You gave a stranger with no soul and no skin in the game the keys to everything you own.

Alt...

Tweet by @EscanorReloaded CEOs are quietly realizing the Al replacement plan has a problem. Two problems, actually. One: the token costs for running Al agents are now exceeding what they were paying the employees they fired. Two: when the tokens run out, the Al stops. Just stops. No continuity. No workaround. Just a spinning wheel where your workforce used to be. You fired humans to save money and bought a subscription that bills you into a corner. The employees you let go knew what to do when things broke. The Al just invoices you for the outage. And then there's the permission problem nobody wants to talk about. To do its job, the Al agent needs access. Full access. Your systems, your patents, your contracts, your future plans. Everything you spent years building, handed over to a process that has no loyalty, no discretion, and no skin in the game. You didn't hire a replacement. You gave a stranger with no soul the keys to everything you own.

CC: @NanoRaptor@bitbang.social

Fediverse account recommendations (may, 2026)

essentials

for the views

for the laughs

for the tech

en español

#FollowFriday yea i know it's thursday or whatever

CC: @prahou@merveilles.town

please share my art to help me achieve my dream of having 4 million dollars

#unix_surrealism #art

Alt...

it has been ten thousand lifetimes since i had spoken to a computer and all this time i never stopped hearing its voice not for a minute

CC: @FilmNoirPosters@zirk.us

What a piece of technology this snac is.

"When you can buy your way out of any mistake, when you can fire anyone who disagrees with you, when your social circle consists entirely of people who need something from you, the basic mechanism by which humans learn that other people are real goes dark."

https://www.theatlantic.com/magazine/2026/05/billionaire-consequence-free-reality/686588/?gift=fXb4ymsFcV2ntAzqIpmYvZ5SHmVudSgCCvY8EbJPC2Q

Tal día como hoy, en 1865, nacía en Brooklyn Robert William Chambers. Para recordarle a él y a su maravilloso ciclo de El Rey de Amarillo, os proponemos nuestra versión de uno de los relatos que lo componen.

«En la corte del dragón», de Robert W. Chambers
https://go.ivoox.com/rf/85510314

(* Por cierto, para nuestro bochorno, hay una error en la lectura del relato. como os daréis cuenta fácilmente: es "púlpito", no "pálpito". Nuestras disculpas... 😓 *)

phone bad book good

#funhole #pornography #mobilek #phonebadbookgood #comic

Alt...

mister mobilek, how can i use my dad's drivers license to access pornography?