JapanBlogList retweeted
So basically, today PHP got two critical bugs that let anyone run code on your server without even logging in, which is bad, and then the details leaked before the patch was even out, which is worse, and it works on WordPress and MediaWiki and Magento and Joomla and Laravel, and Censys says like 1.5 million servers are running a version with no fix, so the NSA was like "take your system offline," and the FBI was like "take your system offline," and CISA and the UK and CERT-EU were all like "take your system offline," and then the Prime Minister of Japan, the actual Prime Minister, posted at 5:55 in the morning telling 48.8 million people to take their system offline, so everyone took their system offline, like the Dutch cybersecurity agency took its own website offline, and the Dutch parliament went offline, and the Port of Rotterdam went offline, and Finland and France and Denmark started pulling government sites, and Wikipedia went down, and Archive.org went down, and Asana and GOG and Something Awful went down, and the University of Vienna's webmail went down for some reason, and that's just PHP. Because GitLab also dropped a CVSS 10.0, which is the highest score they give out, for a bug that's been there since 2014, so that's every self-hosted GitLab for twelve years, and then LiteLLM 1.107.0 got hijacked and shipped a credential stealer and a remote access trojan in every single wheel and the Docker images, including latest, and you didn't even have to import it, just installing it was enough, and it's the second time this year, and then Railway paused every deployment on the entire platform because someone got into the environment variables, so now everyone has to rotate every secret they've ever stored there, and TiDB Cloud said someone was walking around inside with stolen credentials for basically a month and an extortion group says they took 10.6 terabytes, and Zeabur got breached for the second time in two months and is just shutting down, like the whole company, and Node.js patched remote code execution and a TLS bypass, and CISA says Plex is being actively exploited, and someone took over 300 Tor exit relays to steal SSH passwords, and SafePay ransomware has hit over 600 critical infrastructure orgs, and India's biggest bank filed a data loss incident, and Japan has been in an official state of emergency in cyberspace since October 9, which honestly explains the 5:55 AM post. Oh, and eMudhra, a certificate authority that's issued over 60 million certificates, whose entire job is proving websites are who they say they are, was supposed to be using private keys that are random numbers over a hundred digits long, and one of them was 4. Just 4. And the others were like 66 and 237. Anyway, it's Wednesday.
If you are not following along with @PaprikaGirl_JP on her quest to get a Japanese driver license, I highly recommend it. The observations and comedy descriptions are wonderful!
Day 4: Media Literacy
There is nothing wrong with the hotel, but I am having a hard time sleeping. I tried the heated eye masks, and taking a bath before bed, but I only seem to fall into a state of lucid dreaming. Last night I imagined myself in an impossible situation where I was trying to get out of a parking space in front of which was one of those yellow and white safety zone markings. Is this an expression of repressed stress?
Though yesterday's classes were light, today's were back-to-back, leaving only a little time to study before my first theory class at 8:00. There are ten theory classes, and as of the end of today I have finished seven.
It was interesting to note that, on the first day of class the other foreign students did not have an English textbook, but by today they did. They must have grown tired of leaning over my shoulder.
During each lesson, the teacher will give a short, quick lecture about what from any given topic will most likely be on the exams, and focus on key words and phrases that are deliberately designed to trip you up.
THEN come the videos.
These are the doofiest, most cringey possible Driving for Dummies videos on the planet. They feature a wannabe-D-list announcer teaching an unfortunate girlfriend-of-the-producer heavily makeuped "boke" (ボケ) character student, and a cloud-looking grandpa 3D-character loop which is obviously a copy of Hige-ji (ヒゲじい) from NHK's Darwin-ga-kita (ダーウィンが来た / Darwin Has Come) show.
The entire series is littered with poorly animated art using every terrible, eye-wateringly garish color combination on the planet, loops taken from 90's AOL gifs, and unbalanced, inconsistent sound. There can be no possible way the same videography team filmed all of it.
But the best part of this mess are the in-show VTRs.
Every VTR is cast with different actors, but every character combination is exactly the same. It features 1) badly-dressed, wimpy, bad driving soshoku danshi (草食男子 soy boy) and 2) MarySue backseat driver, dressed to the nines bearing trowel-lathered makeup, snapping at the wimp.
I am tired, so I will not write what I really think of Mary Sue and how I would love to slingshot her out the top of a moving cabriolet while on a bridge over the Grand Canyon, false eyelashes and all.
The videos are an admittedly useful edition to the class, despite their cringey nature, because they can be subtitled. The teacher chooses two languages based on what the students need, and the show begins.
I saw at least three of those videos today.
This afternoon I was delighted to have GTO as my driving practice teacher!
The fun started as soon as we met up in front of the cars, as I tossed all of the jokes he had made the other day right back at him. During class he had said “I am the nicest teacher at this school. You can tell just by looking at my face, right?” So naturally I said, “I’m lucky to have the nicest teacher in school as my driving teacher,” to which he replied, “you better know it!” And I said, “I could tell just by looking at your face.” He gave me an astonished look. “You were paying attention to me? I thought no one payed any attention.”
The entire hour was like that. Making jokes, talking about why we love cars. Turns out Mr. GTO not only has a license in every category, but that they are all gold. He bragged about it and showed what a “gold license in all categories use of the break” looks like. It is now my standard.
The best part came when he said he used to be a professional motorbike racer back in the day, and had plenty of sponsors, a bit of a star. I delighted and replied to this, “just like Yogoreta Eiyu (汚れた英雄),” referencing an old Toho film.
A bomb could have dropped.
His jaw agape, he looked at me big-eyed and said, “how do you know about that!!” He went on to say excitedly how he had the same exact helmet, the same riding suit, and even secured the same sponsors the character of “Kitano Akio” had in the film. He went on and on about how car movies were so much cooler back in the day.
And so the two of us had a lovely hour chit chatting and driving at 30kph around and around the lot, while I trained my muscle memory to not just “check the mirror,” but physically point at it and turn my head around so that I will finally be able to pass the test when it comes on Friday.
JapanBlogList retweeted
The end of software secrecy is almost upon us. The death of closed source, and the final triumph of open source.
I should have realized this a few months ago when I successfully decompiled the game of Firefighter from an ancient DOS shareware binary. My robot friend was able to tell it had been written in Borland Pascal from looking at the data layout; it gave me back very readable Pascal code with sensibly chosen function and variable names. I transpiled it to Rust and now ship it as part of my heritage games collection.
The thing is, I thought of this as a fun stunt but didn't have any confidence that the technique would scale up to large, real programs. I have since learned that people are now doing this sort of thing with entire AAA games, which are among the most complex software artifacts ever to be shipped as a binary. If they can be decompiled, anything can be.
This has implications. Massive implications. We need to think about what the world is like when, in general, there is no longer a secrecy moat around almost any software at all.
1/2
JapanBlogList retweeted
Experience gives perspective. Programming is not dead, and never will be.
It's late September 2026. Sometime in September 1976, just after I entered college, I wrote and ran my first serious program. I have now been a programmer for literally 50 years.
And man, I have seen it *all*. Punched cards to glass ttys on minicomputers to workstations to the earliest micros. I've written business software, communication programs, development tools, games, language implementations, kernel device drivers, graphics libraries, a few critical pieces of infrastructure, and all manner of odd programs for which there is no taxonomy. Coded in a score of languages some of which are now forgotten. I've run over 70 open-source projects and contributed to at least as many more.
Along the way I noticed a few things, and wrote about them, and that made me famous. But I'm not here to write about that today. I'm here to write about what it means to be a programmer and a technologist with the Singularity upon us.
I have lost count of the number of times I have been told "programming is over". You kids may think this is a new claim that came into the world with LLMs. Hah! There's been that kind of talk at every step function in the quality of our programming tools. I first heard it when compilers were replacing hand-hacked assembler in the early 1980s, and I wouldn't be a bit surprised if somebody said it earlier when in-memory code replaced plugboards.
One constant amidst all this change is that the intentions in a user's head do not magically turn into executable instructions that a computer can run. Another constant is the mindset of the people who specialize in bridging the gap between wish and algorithm. A programmer is a programmer is a programmer - the tools are secondary.
"But it's different this time!" some people will say, "AIs are superhuman now!" So? What did you think the optimization stage of a compiler was, chopped liver? We've been relying on tools that exceeded human capabilities all along - we built them precisely because our meatbrains could not otherwise keep up with the demands of the job.
It's been a hell of a ride, that 50 years. I've succeeded and failed and succeeded again. Done a lot of work I'm proud of. Built at least a few things that look like they're going to last. None of that goes away because, hypothetically, an AI might have made me faster.
The work is never done, even if the tools can talk to us now. Because intentions still have to be communicated; people who specialize in that and develop right mindset to do it still have a major advantage over people who don't.
If you're feeling depressed because you spent years or decades developing hand-coding skills that are obsolete now? Buck up. You still have the most important asset - a mind that knows how to think that way.
I'm facing the winds of the Singularity with a smile. Because 50 years and I'm still standing - still shipping code that people can use, still learning, still refusing to be paralyzed by the pace of change.
The best therapy for your uncertainty? Get to work on something.
JapanBlogList retweeted
A Japanese engineer invented the QR code for one job, tracking car parts on a Toyota line, then his company chose to give the patent away for free, which is the only reason it ended up on every restaurant table on Earth.
His name is Masahiro Hara. The company was Denso Wave, a parts supplier owned by Toyota.
In 1992 the problem landed on his desk, and it was not glamorous. Workers on the factory floor were drowning.
Every car part had a barcode, but a barcode can only hold about twenty characters, so to track one component they had to stick five or ten barcodes on it.
A worker would stand there scanning a single part ten times in a row. Some of them were scanning close to a thousand barcodes a day. The job had stopped being about building cars and turned into pointing a scanner at stickers all day long.
And there was a second problem nobody upstairs cared about. This was a factory. Oil got on everything. A smudge of grease across a barcode and the whole thing became unreadable, and the line stopped.
Hara was asked to make the scanner faster. He looked at it for a while and realized the scanner was not the problem. The barcode itself was the ceiling. A line of black bars can only hold information going one direction, left to right.
He decided to build something that held information in two directions, up and down as well as across, so it could store hundreds of times more in the same little square.
Then came the part that sounds made up but is not.
Hara played Go on his lunch breaks, the old board game with black and white stones sitting on a grid. He was staring at the board one day and it clicked.
The grid of black and white stones was already a way to store information in two directions. That was the shape of his code.
But building the code was the easy half. The hard problem was speed, because the whole point was to be fast, and a scanner wastes most of its time just trying to figure out where the code is and which way it is turned.
The fix came to him on a train. He was looking out the window at buildings, and one building stood out from all the others because of its shape against the sky. That was the idea.
He put three little square targets in three corners of the code. The moment a scanner sees those three squares, it knows instantly where the code is and how it is rotated, even upside down, even at an angle.
Now here is the detail that shows how far he was willing to go. Those three corner squares only work if nothing else on the page looks like them.
If a magazine ad or a cardboard box happened to have the same black and white pattern nearby, the scanner would get confused and grab the wrong thing.
So Hara and his tiny two-person team went and surveyed printed material. Magazines. Flyers. Cardboard boxes. Piles of it, for days, reducing every picture down to its ratio of black to white area, hunting for the one ratio that almost never shows up in print anywhere. They found it. One to one to three to one to one.
That exact rhythm of black and white is baked into every corner square of every QR code on Earth, and it is there because it is the pattern the printed world almost never produces by accident.
Then he solved the oil.
He built the code so it carries a backup of its own information, spread mathematically across the whole square. You can tear off, smudge, or scratch out up to thirty percent of a QR code and it still scans perfectly, because the code rebuilds the missing piece from the copy it kept of itself.
A worker could get grease on a third of the label and the line would keep moving. This is the same math that lets a scratched CD still play and lets a spacecraft send data back across the solar system without asking to repeat itself.
He finished in 1994. He named it Quick Response, after what it does for the person using it, not after what it is.
And then Denso made the decision that actually mattered.
They held the patent. They could have charged a fee on every single scan, and given how many billions happen now, that would have made someone unimaginably rich.
Instead they announced they would not enforce their rights to collect royalties, and they published the specification openly so anyone could use it. Hara later said it was not even a big argument inside the company.
That one choice is the whole story. A code that costs nothing to use is a code everyone builds on. Airlines put it on tickets. Phone makers built readers into cameras.
Then a pandemic hit and the world needed a way to hand someone information without touching anything, and the free little square that a Toyota engineer built for greasy factory workers was suddenly on every menu, every payment, every door.
Hara still works there. He has said, more than once, that he never imagined it would spread this far, and that the part he is proudest of is that it got used to keep people safe.
The man built it to survive oil on a factory floor. It ended up surviving everything else too.
You have scanned his work a hundred times this year. Now you know whose it was.
JapanBlogList retweeted
A woman had Netflix for 6 years.
She opened the app. She scrolled. She picked something after 25 minutes. She fell asleep during episode 2. She repeated this every night.
Her friend, a former Netflix UI engineer, sat on her couch one evening and opened Settings on her account. He changed 9 things in under 15 minutes.
Her homepage transformed overnight. The autoplay trailers stopped. The "continue watching" list cleaned itself up. The recommendations got sharper. The buffering on her 4K TV disappeared. The categories multiplied from 30 to 2,200.
She said "it feels like a completely different app."
He said "it is. You've been using the factory settings for 6 years. Netflix ships the version that keeps you scrolling longest, not the version that helps you find something fastest."
Here's every setting he changed 🧵
Empty seats on the Mita line this morning at 8:40. It’s unheard of! Where is everyone did I miss a bank holiday announcement?
3
8
925
JapanBlogList retweeted
japan rail ridership map!
see how many people ride each segment of rail. includes almost all japanese rail operators.
anita.garden/japanrail/
#chiyoda line stopped due to power outage. Not a good start to the week!
Japan has 4M+ vending machines, called jihanki.
In Tokyo they’re everywhere, but the interesting ones are weirdly hard to find.
So I made Jihanki Atlas, a map where people can discover, submit, and help verify Tokyo vending machines.
Current favorites: Pokémon plushies, sriracha sauce, wagyu beef, edible insects, fresh-squeezed orange juice.
What’s the coolest one you’ve seen?
jihankiatlas.com
JapanBlogList retweeted
THIS GUY BUILT AN ENTIRE WIKIPEDIA THAT IS 100% AI HALLUCINATIONS AND IT'S OPEN SOURCE ON GITHUB
it's called Halupedia.
nothing on the site existed before you clicked. every article was generated the second you arrived.
the site has one rule: the universe only exists when you visit it.
it looks exactly like wikipedia. same fonts. same layout. same scholarly citations. same "stumble" button for random articles.
the only difference is none of it is real.
here are some actual articles currently in the encyclopedia:
> the great pigeon census of 1887
> the ministry of slightly wrong maps
> chaldic arithmetic — a branch of mathematics where subtraction is forbidden
> armund the river mapper — a cartographer who mapped 14,000 leagues of river without leaving his chair
> the society for the prevention of unnecessary tuesdays
every article page also tells you how many people are reading it right now. it says: "you alone are consulting this folio at present."
the creator's own tagline for the site is the most unhinged sentence i've read this year:
"an encyclopedia of a universe that does not exist until you visit it"
the entire backend is a single open source repo called vibeserver. one guy. one description on github: "a little webserver making things up just in time."
we built the largest knowledge base in human history and the very first thing a guy did with it was make a hallucinated mirror universe and put it on the open web.
the internet is healing.
JapanBlogList retweeted
March 11, 2011. 2:46 PM.
33 Shinkansen bullet trains were running through northern Japan.
Several were moving at 300 km/h.
Then the earthquake hit.
Magnitude 9.1. The 4th largest ever recorded.
Epicenter: off the Sanriku coast, 130 km ESE of the Oshika Peninsula.
Every single train stopped safely.
Zero passenger injuries.
Here's what happened.
12 to 22 seconds before the violent shaking reached the tracks,
a seismometer on Kinkazan — a small island off Japan's Pacific coast —
detected the quake and sent a signal inland.
The signal traveled faster than the earthquake itself.
Power to the tracks was cut.
Every train in the zone automatically braked.
By the time the ground started shaking violently,
the trains were already slowing down.
One empty test train derailed at Sendai Station.
Not a single train in service derailed.
The Shinkansen has been running since 1964.
In 60 years, it has killed zero passengers —
not in a collision, not in a derailment.
Zero.
Most people stop reading here.
The real story starts now.
Japan built this safety system in two layers, for two different problems.
First: UrEDAS — the Urgent Earthquake Detection and Alarm System.
Invented in the early 1980s, deployed on the Tokaido Shinkansen in 1992.
The world's first operational P-wave warning system for trains.
Its seismometers sit along the coast, listening for earthquakes out at sea.
When one hits, the system reads the first 3 seconds of P-wave motion,
estimates the magnitude and location,
and sends a warning inland to the tracks.
Second: Compact UrEDAS.
Built after the 1995 Kobe earthquake,
which struck directly beneath a city with almost no warning.
When the earthquake happens directly under the train,
there's no time to calculate anything.
So Compact UrEDAS asks one question:
"Is this shaking dangerous?"
It answers in about 1 second.
Both systems end the same way.
They cut the power.
The Shinkansen is built so that the moment it loses power,
emergency brakes engage automatically.
The driver makes no decision.
There's no time to.
A 300 km/h Shinkansen takes about 90 seconds to stop.
No warning system in the world buys you 90 seconds.
The goal isn't to stop the train before the earthquake arrives.
The goal is for the train to be slowing down when it does.
This is the part foreign coverage misses.
The goal isn't to prevent the accident.
The goal is to make the accident survivable.
In-service Shinkansen have derailed twice in 60 years.
2004. Niigata Chuetsu earthquake.
A trackside Compact UrEDAS detected the P-wave.
Power was cut one second later. Emergency brakes engaged 1.5 seconds after that.
But the earthquake was directly beneath the train,
which was moving at 204 km/h.
8 of 10 cars derailed.
The train skidded 1.6 km before stopping.
154 passengers on board.
Zero injuries.
2022. M7.4 off Fukushima.
A Shinkansen traveling at 320 km/h detected the first tremor and began braking.
As the train decelerated toward a stop,
a second, stronger quake (M7.4) hit.
16 of the 17 cars derailed.
75 passengers. 3 crew.
Zero deaths. No serious injuries.
Two other derailments involved empty trains.
2011, Sendai Station, a test train.
2016, Kumamoto earthquake, a transit train.
In every case, the warning system had already cut the power
before the shaking reached its peak.
The system does not stop earthquakes.
It does not always stop derailments.
It just makes sure the earthquake arrives after the train is already slow.
Japan's earthquakes and Japan's trains grew up in the same country,
watching the same ground.
Somewhere in Japan right now,
a Shinkansen is moving at 300 kilometers per hour.
Far away, on a quiet coast,
a sensor is listening to the rock beneath it.
It has been listening since 1992.
Every time it was needed, it worked.
JapanBlogList retweeted
🇯🇵 Kansai International Airport in Japan reached its 30th year of service without having ever lost a single piece of luggage.
JapanBlogList retweeted
maybe some of you internationals in Japan are familiar with fantastic website project Atlas Obscura. community editor is in Tokyo (sadly not the "rest of Japan" :-)) looking for tips for unique/hidden/odd/ obviously obscure places. So far pretty pedestrian list so lend a hand
Timelapse of Trains in the snow going into and out of Tokyo station youtu.be/9y7Iywg-sdo?si=gc92… via @YouTube
2
2
200




























