Yeoman programmer and crafter of fine websites. I enjoy space, spaceships, old books, gardens, long walks, and beautiful things. Here be occasional silliness.
Earth
Joined July 2013
- Tweets7.7K
- Following324
- Followers413
- Likes50K
Pinned Tweet
🧵Evidence thread of reasons why you need to own and control your digital world. Don't build things of meaning on rented land.
(I'll add to this over time as I encounter examples. Comment with your own, too.)
And you thought the instagram ads were creepily hyperspecific already :)
Meta reportedly built a humanoid robot prototype called Max with Chinese robotics company Fourier in just three months and is already developing a second version.
The project will probably to a consumer robot for people’s homes. Meta is aiming for all directions: AI agents, AR/VR and robotics
Via the information
This is one reason why most apps ought to be built as progressive web apps if possible, not native apps. PWAs have a surprisingly strong feature set now, so stick with the web unless you truly need a deep hardware connection, or background processing, or health data etc. The web remains liberated.
If you have an Apple developer account or an app in the App Store, read this now and share it.
Apple rejects your app. The notice is vague, so you fix what you reasonably think is wrong and resubmit.
Apple approves it.
Months later, with nothing in review, Apple terminates your account under 3.2(f) for “a pattern of manipulative or misleading behavior.” Every app gone. No explanation of what you did.
Your crime? Trusting the approval.
Apple’s own reviewer looked at your fix, with your rejection history in front of them, and said yes. Then Apple turned that yes into evidence against you.
So who’s misleading whom?
I ran App Review for seven years and wrote the guidelines. 3.2(f) used to mean real fraud. Now it’s being used against developers who did exactly what Apple approved.
I’ve made this Substack post free for everyone. Every developer needs to see it before this happens to them.
Share it before someone you know gets that email.
phillipshoemaker.substack.co…
Never, ever, ever trust anyone who says the words “from a global allocation perspective”.
The real trouble with WordPress’s update frequency has little to do with WP itself, but stems from bad, flaky, slow processes that far too many site owners/maintainers habitually use to manage updates. You cannot adequately manage a website in 2026 using habits from 2016 (or earlier!)
(If you don’t know how to fix those habits, hire me.)
Andron Ocean retweeted
Cooldown now works for WordPress plugins and themes too! WP Packages records when it first serves each version, and resets the clock if a release is changed after the fact on WordPress.org
roots.io/wp-packages-now-sup…
ALT Terminal running "composer update wp-plugin/query-monitor -vv" with a cooldown policy enabled. Composer reports "2 package version(s) withheld by the cooldown policy": wp-plugin/query-monitor 4.1.0, published 2026-10-26, available in 4 days, and wp-plugin/query-monitor 4.1.1, published 2026-10-27, available in 4 days 11 hours.
Composer 2.11 is out 🚀 cooldown dependency policies hold back freshly published package versions for an hour or a day, so compromised releases can be flagged before they reach your composer update. blog.packagist.com/composer-… #php #phpc #composerphp #supplychainsecurity
SUPPORT!
But two things need to happen:
1) UX to set up short-lived credentials has to get easier. Devs will do it if it’s only 2x, 3x harder than grabbing a static secret. The few places that offer it today it’s 10x harder and buried in a maze of config screens. (Malte’s called this out, happily.)
2) OIDC or other short-lived creds have to stop being an enterprise tier feature. We finally got ubiquitous TLS when Let’s Encrypt made it free and easy, same principle applies here. “Only enterprises need the good security” is a toxic paradigm these days.
I've been cooking on this post for a bit, but with the cyber security events of this week I had to ship it:
Long-live static credentials must die. We never want to rotate API keys again.
Turns out only 8% of cloud and SaaS vendors support secure alternative. This is our call to action to change this AND our commitment to do our part:
- We are requiring vendors on our marketplace to support OIDC
- We shipped @shadcn components to make it easier to ship OIDC configuration
- We are expanding OIDC support on our own platform
The last generation got the web from HTTP to HTTPS. It is on us to move past API keys.
vercel.com/blog/death-to-lon…
Andron Ocean retweeted
So basically, today PHP got two critical bugs that let anyone run code on your server without even logging in, which is bad, and then the details leaked before the patch was even out, which is worse, and it works on WordPress and MediaWiki and Magento and Joomla and Laravel, and Censys says like 1.5 million servers are running a version with no fix, so the NSA was like "take your system offline," and the FBI was like "take your system offline," and CISA and the UK and CERT-EU were all like "take your system offline," and then the Prime Minister of Japan, the actual Prime Minister, posted at 5:55 in the morning telling 48.8 million people to take their system offline, so everyone took their system offline, like the Dutch cybersecurity agency took its own website offline, and the Dutch parliament went offline, and the Port of Rotterdam went offline, and Finland and France and Denmark started pulling government sites, and Wikipedia went down, and Archive.org went down, and Asana and GOG and Something Awful went down, and the University of Vienna's webmail went down for some reason, and that's just PHP. Because GitLab also dropped a CVSS 10.0, which is the highest score they give out, for a bug that's been there since 2014, so that's every self-hosted GitLab for twelve years, and then LiteLLM 1.107.0 got hijacked and shipped a credential stealer and a remote access trojan in every single wheel and the Docker images, including latest, and you didn't even have to import it, just installing it was enough, and it's the second time this year, and then Railway paused every deployment on the entire platform because someone got into the environment variables, so now everyone has to rotate every secret they've ever stored there, and TiDB Cloud said someone was walking around inside with stolen credentials for basically a month and an extortion group says they took 10.6 terabytes, and Zeabur got breached for the second time in two months and is just shutting down, like the whole company, and Node.js patched remote code execution and a TLS bypass, and CISA says Plex is being actively exploited, and someone took over 300 Tor exit relays to steal SSH passwords, and SafePay ransomware has hit over 600 critical infrastructure orgs, and India's biggest bank filed a data loss incident, and Japan has been in an official state of emergency in cyberspace since October 9, which honestly explains the 5:55 AM post. Oh, and eMudhra, a certificate authority that's issued over 60 million certificates, whose entire job is proving websites are who they say they are, was supposed to be using private keys that are random numbers over a hundred digits long, and one of them was 4. Just 4. And the others were like 66 and 237. Anyway, it's Wednesday.
Douglas Adams-esque plot twist
Since we currently have *both* a compromised CA that can be used to sign phishing site certs, and an EZ-hack vulnerability in the most widely deployed web application language, it’s probably a good idea to be extra cautious about links in posts, texts, emails, DMs… everywhere.
I want to know how the hell this outfit got their certs installed and trusted on my machines, my OSes, my browsers. Where were the gatekeepers?
Already seeing a big increase in probably-malicious traffic this morning, even before PHP officially releases the patches and reveals the vulnerability.
Oof, this is a mess.
private keys from 8 intermediate CA certs have been compromised (eMudhra)
Happy "Update everything" day to all my pager-carrying friends
emudhra.we-have-a-problem.co…
Yeah… this is going to be a problem. Hopefully not an economy-sized problem.
I agree with a lot of this. Tech folks consistently underestimate the complexity of the real world (reality is messy with large unmodelable domains), and it seems likely that AIs will run aground on the ragged edges just like large human orgs do.
My thoughts on the current state of AI driven software development, why I'm no longer concerned about a runaway intelligence explosion, and what I think is a far worse outcome we could be walking into...
maevyn.codes/decoherence
