LGBT+ History Month

It’s February, which means that (here in the UK) it’s LGBT+ History Month.1 And it feels like this year, it’s more important than ever to remember our country’s queer history.

In 2015, the UK was ranked first place in ILGA Europe‘s annual “Rainbow Map” study of LGBT rights in 50 countries of Europe. By 2025, the UK had fallen to 22nd place. That’s the fastest drop of any country in the list, tied with Hungary2 and Georgia3.

'Rainbow Map' of Europe. In general, the trend is that the further East you go, the weaker LGBT+ rights are, with Russia and Turkey being the worst, and the further West the better they get (with Belgium and Iceland excelling). There are a few exceptions, like Italy (less rights than you'd expect) and Greece (more rights than you'd expect), as well as standout Malta (topping the charts), but otherwise the trend is solid... except for the UK, which stands out as a weak performer in Western Europe, even compared to traditionally socially-conservative countries like Ireland and Switzerland.
By the time Western European countries traditionally seen as ‘socially conservative’ like Ireland and Switzerland are outranking the UK in LGBT+ rights rankings… it’s a clue that something’s gone wrong, right?

Knowing your history is important. I’ve talked before about my personal experience of growing up under Section 28, and I don’t think that the UK’s backsliding is, by any means, harmless4. In case the reasons for the UK’s drop in the rankings aren’t obvious, it’s pretty much entirely to do with the UK’s increasingly restrictive gender identity laws (thanks, Supreme Court)5.

This stuff affects everybody. When you build a community that is a safe space for queer people, and trans people,6 everybody benefits7. So even if you’re somehow not compelled by the argument that we should treat everybody fairly and with compassion, you should at least accept that it helps you, too, when we do.

In many ways, queer rights in the UK have been a success story in recent decades. Within my lifetime, we’ve seen the harmonisation of the age of consent (2001), civil partnerships (2004), the Gender Recognition Act (2004), the Equality Act (2010), same-sex marriage (2013; I was genuinely surprised this bill passed!) and the mass-pardoning of people previously convicted under discriminatory sex act laws (2017). These are enormous and important steps and it’s little wonder that the UK topped ILGA Europe’s scoreboard for a while there.

But as recent developments have shown: we can’t rest on our laurels. There’s more to do. History shows us what’s possible; it’s up to us to decide whether we keep moving forward or let it unravel.

So this LGBT+ History Month, don’t just remember the past: pay attention to the present, and push back where it’s slipping.

Footnotes

1 We celebrate it in February; I’ve never truly understood why. The Independent claims the month was chosen to coincide with the 2003 abolition of Section 28 in England and Wales, but that wouldn’t happen until later in the year; it doesn’t really coincide with the Employment Equality (Sexual Orientation) Regulations 2003 (made June, commencing December) either. So if anybody knows the real reason the UK marks LGBT+ History month in February, I’ve love to hear it.

2 Hungary banned same-sex couples from adopting five years ago and banned Pride parades last year, in an incredible backslide for an EU country.

3 Georgia’s backslide is superficially similar to Hungary’s except that one can’t help but feel the influence of partial occupier Russia – a frequent bottom-scorer in ILGA’s list – in that.

4 By the way: I just looked back at my own blog posts tagged ‘sexuality’, and man, that shit is on fire! Some fun things there if you’re new to my blog and just catching-up, if I may toot my own horn a little! (Is “toots own horn” a protected identity? ‘Cos I do it a lot.)

5 It’s also aggravated by established but regressive problems like the fact that the UK still doesn’t outlaw “conversion therapy”, gender identity is not a recognised justification for seeking asylum, and protections for intersex people are basically nonexistent.

6 And, it turns out, furries, who’ve ‘gone from “ew cringe” to “they’re the lichens of a healthy social ecosystem”‘.

7 Everybody benefits… except, perhaps, nazis.

×

Reducing Phantom Obligation in FreshRSS

A week or so ago, Terry Godier – who’s been thinking a lot about UX assumptions lately – argued that the design of most feed readers produces an effect called “phantom obligation”.

He observes that the design of feed readers – which still lean on the design of the earliest feed readers, which adopted the design of email software to minimise the learning curve  – makes us feel obligated to stay on top of all our incoming content with its “unread counts”.

Phantom obligation

Email’s unread count means something specific: these are messages from real people who wrote to you and are, in some cases, actively waiting for your response. The number isn’t neutral information. It’s a measure of social debt.

But when we applied that same visual language to RSS (the unread counts, the bold text for new items, the sense of a backlog accumulating) we imported the anxiety without the cause.

RSS isn’t people writing to you. It’s people writing, period. You opted to be notified of their existence. The interface implied debt where none existed. The obligation became phantom.

For a while now I’ve been encouraging people to see their feed reader as something distinct from email, and Terry’s expertly summarised exactly why. When people think of RSS as being like email, they’re encouraged to idolise “inbox zero” for both. But that’s not the right metaphor for RSS at all.

Screenshot of Terry's animation showing different kinds of media and the relative match or mismatch between (a) how guilty their notification interface makes you feel and (b) the actual amount of obligation that exists.
Seriously, if you haven’t read Terry’s article yet, you should read it now!1

From where I’m sitting

I use FreshRSS as my feed reader, and I love it. But here’s the thing: I use the same application for two different kinds of feeds. I call them slow content and fast content.2

Illustration showing 'slow content' going to FreshRSS, 'immediate content' going to email, Slack, and WhatsApp, and 'fast content' being eligible to be routed to either destination.
It’s an idealised interpretation of how I subscribe to different kinds of incoming messages, but it works for me. The lesson is that slowing down your consumption is not an antifeature, it’s a deliberate choice about how you prioritise your life. For me: humans come first – what about you?

Slow content

Blogs, news, podcasts, webcomics, vlogs, etc. I want to know that there is unread content, but I don’t need to know how much.

In some cases, I configure my reader to throw away stuff that’s gotten old and stale; in other cases, I want it to retain it indefinitely so that I can dip in when I want to. There are some categories in which I’ll achieve “inbox zero” most days3… but many more categories where the purpose of my feed reader is to gather and retain a library of things I’m likely to be interested in, so that I can enjoy them at my leisure.

I also use my RSS reader to subscribe to a few mailing lists (where an RSS feed isn’t available for some reason). These – like blogs – are often “people writing, period” content and shouldn’t have been sent by email in the first place!4

Fast content

Some of the things I subscribe to, though, I do want to know about. Not necessarily immediately, but “same day” for sure! This includes things like when it’s a friend’s birthday (via the Abnib Birthdays feed) or when there’s an important update to some software I selfhost.

This is… things I want to know about promptly, but that I don’t want to be interrupted for! I appreciate that this kind of subscription isn’t an ideal use for a feed reader… but I use my feed reader with an appropriate frequency that it’s the best way for me to put these notifications in front of my eyeballs.

I agree with Terry that unread counts and notification badges are generally a UX antipattern in feed readers… but I’d like to keep them for some purposes. So that’s exactly what I do.

How I use FreshRSS (to differentiate slow and fast content)

FreshRSS already provides categories. But what I do is simply… not show unread counts except for designated feeds and categories. To do that, I use the CustomCSS extension for FreshRSS  (which nowadays comes as-standard!), giving it the following code (note that I want to retain unread count badges only for feed #1 and categories #6 and #8 and their feeds):

.aside.aside_feed {
  /* Hide all 'unread counts' */
  .category, .feed {
    .title:not([data-unread="0"])::after,
    .item-title:not([data-unread="0"])::after {
      display: none;
    }
  }
  
  /* Re-show unread counts only within:
   * - certain numbered feeds (#f_*) and
   * - categories (#c_*)
   */
  #f_1, #c_6, #c_8 {
    &, .feed {
    .title:not([data-unread="0"])::after,
    .item-title:not([data-unread="0"])::after {
      display: block;
    }
  }
}

That’s how I, personally, make my feed reader feel less like an inbox and more like a… I don’t know… a little like a library, a little like a newsstand, a little like a calendar… and a lot like a tool that serves me, instead of another oppressive “unread” count.

Screenshot showing the sidebar of a FreshRSS installation but with most of the 'unread counts' missing. Those that remain are labelled 'these are the only categories that get to nag!'
I just wish I could persuade my mobile reader Capyreader to follow suit.

Maybe it’ll help you too.

Footnotes

1 Or whenever you like. It’s ‘slow content’. I’m not the boss of you.

2 A third category, immediate content, is stuff where I might need to take action as soon as I see it, usually because there’s another human involved – things like this come to me by email, Slack, WhatsApp, or similar. It doesn’t belong in a feed reader.

3 It’s still slow content even if I inbox-zero it most days… because I don’t inbox-zero it every day! I don’t feel bad ignoring or skipping it if I’m, for example, not feeling the politics news right now (and can you blame me?). This is fundamentally different than ignoring an incoming phone call or a knock at the door (although you’re absolutely within your rights to do that too, if you don’t have the spoons for it).

4 I’m yet to see a mailing list that wouldn’t be better as either a blog (for few-to-many communication) or a forum (for many-to-many communication), frankly. But some people are very wedded to their email accounts as “the way” to communicate!

× ×

OpenBenches reaches Tenerife

Since 2018 I’ve been a fan of OpenBenches, a community-driven effort to catalogue memorial benches. Co-creator Terence Eden just wrote a blog post about the cost of running the service, which was pretty-much in the region of what I expected but (as an on-again, off-again financial backer, depending on my own financial health!) I appreciated the transparency anyway!

The news came at about the same time as I logged the first bench of the Canary Islands while I was waiting (in vain) to log an obstructed geocache during my recent trip to Tenerife.

On a tiled patio, a wooden bench stands, bearing a plaque that reads: THIS MEMORIAL GARDEN IS DEDICATED TO THE MEMORY OF THOSE WHO LOST THEIR LIVES IN THE AIR DISASTER IN TENERIFE ON 25TH APRIL 1980.
This bench – and the garden it stands in – is a memorial to the victims of the Dan-Air Flight 1008 disaster.

OpenBenches’ dataset is still very UK-centric. I like that I’ve helped broaden its borders! (I’m currently the 83rd-from-top photo contributor, apparently.)

If you’re not already helping collect benches, you should give it a look. You can install the site to your mobile device as a progressive web app and start snapping benches.

Gamified… Pornography?

This article is probably “safe for work” (depending on your workplace).

It makes reference to a popular pornographic website and the features of that website. It contains screenshots, but the porny bits are blurred. The links are all safe.


Verify your age

After Pornhub introduced age check to comply with the Online Safety Act1, I figured that I’d make an account to see how arduous and privacy-destroying the process of verifying that I was old enough to see naked people2. I thought it would make an amusing blog post.

I felt confident that my stupid name, if nothing else, would guarantee me a hard time with this kind of automated system.

Screenshot from Pornhub, asking the user to 'verify your age'.
Of course, if you didn’t already do this then it’s too late.

Unfortunately3, it turned out to be super-easy for me to pass the age verification.

I just hit “verify by email” with the third-party age verification tool they use, entered an email address that’s associated with a few online accounts (not even the one I gave Pornhub!), and… everything just worked.

Screenshot from 'AllpassTrust', offering to verify my age either by 'credit card', 'email address', 'mobile phone', or 'online banking'.
Sure, I’ve told some random company in Cyprus that I’d like to see nudes, and – based on the Ts&Cs, allowed them to ask Google whether my email address looks like it belongs to an adult – but I didn’t have to share a photo or banking details or anything, and the whole thing took about 30 seconds, so it could’ve been worse.

Sooo… this isn’t a blog post about how insurmountable age verification is. This is a blog post about something else I discovered as a result of doing this research: Pornhub has “achievements”!

Achievement unlocked

I was slightly surprised to see how many “social networking”-like features Pornhub accounts have. You can upload a profile photo… you have a “wall” that you can post to, and you can post to other people’s. Your profile (unless you tell it not to) shares which channels you’ve subscribed to, which videos you’ve favourited, and so on.

Who on Earth wants those features? I mean: really? 😅 I consider myself pretty sex-positive, but I’m not sure I’d want there to be a web page with my name, photo, and a list of all my favourite dirty vids!4

Anyway… the other thing a Pornhub profile seems to provide is… achievements:

Screenshot showing a popover notification reading 'You just unlocked a new achievement: The Virgin'
Hurrah, I guess? The Virgin was easy, at least (snerk), unlike most of the things on my Steam profile.

I’ve only got the one achievement right now, of course, and it’s the one that you get “for free”. So it didn’t feel like I’d earned it.

I suppose I was an actual virgin, once. And I had to prove that I’m a real human to get an account. So… maybe I earned it?

Screenshot from Pornhub showing Dan Q's profile (0 subscribers, 69 [nice!] videos watched)'s achievements page, showing only one achievement: The Virgin.
Your profile page encourages you to ‘earn and show off more achievements’. Because, yes, your ‘achievements’ are on your public profile too!

But just stop and think about what this means for a moment. At some point, in some conference room at Pornhub HQ, there was a meeting in which somebody said something like:

“You know what we need? Public profile pages for all Pornhub accounts. And they should show, like, ‘achievements’ like you get for videogames. Except the achievements are for things like how much porn you’ve watched and how often. You can show it off to your friends!”

And then somebody else in the meeting said:

“Yes. That is a good idea.”5

Screenshot from Pornhub showing Dan Q's profile (0 subscribers, 1,000,000,000 videos watched)'s 'all achievements' page, listing all available achievements.
If it weren’t for the time-based achievements like ’10 year-old account’, I’ll bet there’d be people competing to speedrun Pornhub.

Complete list of Pornhub Achievements

I’ve reverse-engineered the complete6 collection of Pornhub Achievements for you. Y’know, in case you’re trying to finish your collection:

The Virgin Congrats! You have accessed your account for the first time! Enjoy the ride on Many Faps Road.
The Freshman
You have accessed your account for the 10th time! I take it you’ve enjoyed the 9 last times?
The Sophomore
You have accessed your account for the 100th time! Maximus Fappitus, you’re a true Pornhub warrior!
The Junior
You have accessed your account for the 500th time! If only you could get air miles for this.
The Senior
You have accessed your account for the 1000th time! If only you could get air miles for this.
The Porn Buff
You’ve watched 10 videos – This is just the beginning, trust me.
The Two Thumbs
You’ve watched 500 videos – Lotion or no lotion, that is the question.
The Cinephile
You’ve watched 5,000 videos – Be careful, carpal tunnel is a thing.
The Connoisseur
You’ve watched 50,000 videos – you are a veritable porn expert now.
1 Year Old Account
Our very first anniversary, I wish us many more!
2 Year Old Account
Two years of pleasure!
3 Year Old Account
Three years… Ah! The memories!
4 Year Old Account
Most relationships don’t even last this long #funfact
5 Year Old Account
That’s half a decade of watching porn.. woah… that’s impressive.
6 Year Old Account
I guess we were a match made in heaven. Who would’ve known that 6 years later, you would still be fapping on me.
7 Year Old Account
No 7 year itch here! Thanks for 7 fappy years
8 Year Old Account
The Outlook is good: you’ve had 8 magical years on Pornhub!
9 Year Old Account
In 9 more years, your account will be old enough to view itself.
10 Year Old Account
You were really ahead of the wave – here’s to a decade on Pornhub!

I have no idea who this feature is “for”. I’d feel the same way if YouTube had achievements, too7, but the fact that you can, and by default do, showcase your achievements on a porn site is what really blows my mind.

But maybe they ought to double-down and add more achievements. If they’re going to have them, they might as well make the most of them! How about achievements for watching a particular video a certain number of times? Or for watching videos in each of many different hour segments of the day? Or for logging in to your account and out again without consuming any pornography (hey, that’s one that I would have earned!)? If they’re going to have this bizarre feature, they might as well double-down on it!

I also have no idea who this blog post is “for”. If it turned out to be for you (maybe you wanted to know how to unlock all the achievements… or maybe you just found this as amusing as I did), leave me a comment!

Footnotes

1 Don’t get me started with everything that’s wrong with the so-called Online Safety Act. Just… don’t. The tl;dr would be that it’s about 60% good ideas, 20% good implementation.

2 Obviously if I were actually trying to use Pornhub I’d just use a VPN with an endpoint outside of the UK. Y’know, like a sensible person.

3 I mean: it’s probably pretty fortunate that – based on my experience at least – it seems to be easy for adults to verify that they’re adults in order to access services that are restricted to adults as a result of the OSA. But it’s unfortunate in that I’d hoped to make a spicy blog post about all the hoops I had to jump through and ultimately it turned out that there was only one hoop and it was pretty easy.

4 Of course, the Indieweb fan within me also says that if I did want such a page to exist, I’d want it to be on my own domain. Should there be an Indieweb post kind for “fap” for people who want to publicly track their masturbatory activities as an exercise in the quantified self?

Or should there be a “sex” kind that works a bit like “invitation” in that you can optionally tag other people who were involved? Or is sex a kind of “exercise”? Could it be considered “game play”? What about when it’s a “performance”? Of course, the irony is that anybody who puts a significant amount of effort into standardising the way that a person might publicly catalogue their sex life… is probably rendering themselves less-likely to have one.

I think I got off-topic in this footnote.

5 To be fair, I’ve worked places where committee groupthink has made worse decisions. Want a topical example? My former employer The Bodleian Libraries decided to call a podcast series “BodCast” without first performing a search… which would have revealed that Playboy were already using that name for a series of titillating vlogs. Curiously, it was Playboy who caved and renamed their service first. Presumably the strippers didn’t want to be associated with librarians?

6 It’s possible there are achievements I’ve missed – their spriteset file looks like it contains others! – that are only available to content creators on the platform. But if that’s the case, it further reinforces that these achievements are for the purpose of consumers who want to show off how many videos they’ve watched, or whatever! Weird, right?

7 “Congratulations: you watched your 500th YouTube ‘short’ – look how much of your life you’ve wasted!”

× × × × ×

Postcard from San Diego

I got another postcard. This one’s from Joe Crawford, all the way over in San Diego.

Both sides of a postcard. The text reads: I enjoy your blog. I enjoy books. I enjoy using the mails. I love the idea of using proper mail to internet aquaintances. I acquired this postcard last year in San Francisco. I hope you enjoy it. Best. - Joe (ARTLUNG.COM). The front shows a photograph from a San Francisco street, showing City Lights Booksellers & Publishers' shop front.
Cute card, too. I appreciate the “stop the deportations” banner on this San Fancisco bookshop!

I first started soliciting Internet strangers to send me postcards three months ago and I’m still loving it.

It adds a layer of humanity and personality to the Web. It introduces me to cool new people, and re-introduces me to cool people whom I’d crossed paths with at a distance: Joe’s one of the latter, but I’ve now taken the time to ensure he’s in my RSS reader… and, by proxy, in my blogroll.

I don’t have a return address for anybody who posted anything to me, yet (obviously I’d have masked it out from the postcard if I had!), but I feel like I ought to buy some postcards now too. It’s only a matter of time.

And hey, maybe there’s mileage in starting an Personal Web Postcards Club or something…

Without Bloganuary

In January 2024 I participated in Bloganuary, a “write a blog post every day for a month” challenge organised by Automattic. I wasn’t 100% impressed by the prompts made available and was – as an employee of Automattic – shuffling towards trying to help make them better in a future year. To be part of the solution!

I didn’t participate in January 2025, because I was on sabbatical and – as well as it feeling a little “close” to work! – Bloganuary intersected with a winter-sun trip to Trinidad & Tobago, where – despite a state of emergency being declared – Ruth and I unlocked a geohashing graticule, experienced small-world serendipity, and generally explored beautiful and remote places.1

View of waves crashing into a bay on a rugged island coastline.
There’s definitely something in this ‘winter sun’ thing that seems to help me stay sane in the cold dark months. This morning, I’m blogging from a hotel balcony in Peurtro de la Cruz, Tenerife.

Of course, two significant things changed since then:

  • As part of a sweeping range of redundancies, I was let go from my position at Automattic2, and
  • Automattic ceased running Bloganuary: I’m guessing that the folks responsible for making it happen were among the many that Automattic decided to axe, or else their shifting priorities – reflected by their waves of layoffs – are no longer compatible with providing that service to bloggers.

Ah well, I figured. I’d just do my own thing. I can write something for every day in January 2026, can’t I?

Generating a chart...
If this message doesn't go away, the JavaScript that makes this magic work probably isn't doing its job right: please tell Dan so he can fix it.

Turns out that yes, I can. 53 posts over 31 consecutive days, so far this year. This year might be my fastest run at 100 Days To Offload yet.

In general, I suppose I’ve been blogging more-frequently lately. Why is that? I guess it’s been a realisation that a blog post doesn’t always have to be polished to perfection. I still write long-form posts which require research and planning, like setting up a network of Windows 3.x VMs just to get screenshots of what programming then looked like or making that podcast episode with the music in it… but I’m also feeling more-free to just express myself in the moment. To share things I see that look interesting or funny or pretty, or just whatever I’m thinking. I’ve been using “kinds” to categorise my posts so it’s easy for people to avoid my more-inane stuff if they like, but that’s a secondary consideration because ultimately… I blog for me.

I’ve also been trying to make blogging more social. Over the last year I’ve made an effort to (visibly) “follow” more personal bloggers and correspond with them (including in new – by which I mean old – ways like exchanging postcards!).

Anyway… all of which is to say that I’ve been writing more and I’ve been loving it. The best way to read more of what I’m writing, if you’d like to, remains: by subscribing via RSS.

But regardless of how and why you’ve come to find this post – thanks for dropping be: drop me a message and say hi and let’s be friends.

Footnotes

1 I’d anticipated having a lack of Internet access, but in fact 4G was widespread throughout both islands and overall I managed to post something on every day except three in January 2025.

2 Based on friends I’ve spoken to, there seem to have been a lot more folks let go since; the company seems to be shrinking quite a lot, which might go some way to explaining my second observation too.

×

How an RM Nimbus Taught Me a Hacker Mentality

What can I make it do?

It’s been said that when faced with a new piece of technology, a normal person asks “what does it do?”, but a hacker asks “what can I make it do?”.

This kind of curiosity is integral to a hacker mindset.

A 'glider', a highly-recognisable self-replicating pattern from Conway's Game of Life, sometimes used in hacker symbolism.
An RM Nimbus was not the first computer on which I played Game of Life1. But this glider is here symbolically, anyway.

I can trace my hacker roots back further than my first experience of using an RM Nimbus M-Series in circa 19922. But there was something particular about my experience of this popular piece of British edutech kit which provided me with a seminal experience that shaped my “hacker identity”. And it’s that experience about which I’d like to tell you:

Shortly after I started secondary school, they managed to upgrade their computer lab from a handful of Nimbus PC-186s to a fancy new network of M-Series PC-386s. The school were clearly very proud of this cutting-edge new acquisition, and we watched the teachers lay out the manuals and worksheets which smelled fresh and new and didn’t yet have their corners frayed nor their covers daubed in graffiti.

An RM Nimbus PC-186 at its launch menu; a DOS-based function key list menu to run a variety of different programs, alongside RM manuals.
I only got to use the schools’ older computers – this kind! – once or twice before the new ones were delivered.

Program Manager

The new ones ran Windows 3 (how fancy!). Well… kind-of. They’d been patched with a carefully-modified copy of Program Manager that imposed a variety of limitations. For example, they had removed the File > Run… menu item, along with an icon for File Manager, in order to restrict access to only the applications approved by the network administrator.

A special program was made available to copy files between floppy disks and the user’s network home directory. This allowed a student to take their work home with them if they wanted. The copying application – whose interface was vastly inferior to File Manager‘s – was limited to only copying files with extensions in its allowlist. This meant that (given that no tool was available that could rename files) the network was protected from anybody introducing any illicit file types.

Bring a .doc on a floppy? You can copy it to your home directory. Bring a .exe? You can’t even see it.

To young-teen-Dan, this felt like a challenge. What I had in front of me was a general-purpose computer with a limited selection of software but a floppy drive through which media could be introduced. What could I make it do?

This isn’t my school’s computer lab circa mid-1990s (it’s this school) but it has absolutely the same energy. Except that I think Solitaire was one of the applications that had been carefully removed from Program Manager.

Spoiler: eventually I ended up being able to execute pretty much anything I wanted, but we’ll get to that. The journey is the important part of the story. I didn’t start by asking “can I trick this locked-down computer lab into letting my friends and I play Doom deathmatches on it?” I started by asking “what can I make it do?”; everything else built up over time.

I started by playing with macros. Windows used to come with a tool called Recorder,3 which you could use to “record” your mouse clicks and keypresses and play them back.

Recorder + Paintbrush made for an interesting way to use these basic and limited tools to produce animations. Like this one, except at school I’d have put more effort in4.

Microsoft Word

Then I noticed that Microsoft Word also had a macro recorder, but this one was scriptable using a programming language called WordBasic (a predecessor to Visual Basic for Applications). So I pulled up the help and started exploring what it could do.

And as soon as I discovered the Shell function, I realised that the limitations that were being enforced on the network could be completely sidestepped.

Screenshot showing Microsoft Word's 'Macro Editor' on Windows 3.1. The subroutine being defined contains the code 'Shell("WINFILE.EXE")'; the 'Shell' command is described in the WordBasic Help file, which is also visible.
A Windows 3 computer that runs Word… can run any other executable it has access to. Thanks, macro editor.

Now that I could run any program I liked, I started poking the edges of what was possible.

  • Could I get a MS-DOS prompt/command shell? Yes, absolutely5.
  • Could I write to the hard disk drive? Yes, but any changes got wiped when the computer performed its network boot.
  • Could I store arbitrary files in my personal network storage? Yes, anything I could bring in on floppy disks6 could be persisted on the network server.

I didn’t have a proper LAN at home7 So I really enjoyed the opportunity to explore, unfettered, what I could get up to with Windows’ network stack.

Screenshot from Windows 3.11; a Microsoft Paint window is partially-concealed behind a WinChat conversation with 'RMNET013'. The other participant is warning the user to look busy and stop drawing dicks in Paint because the teacher is coming. The user is responding with confusion.
The “WinNuke” NetBIOS remote-crash vulnerability was a briefly-entertaining way to troll classmates, but unlocking WinPopup/Windows Chat capability was ultimately more-rewarding.

File Manager

I started to explore the resources on the network. Each pupil had their own networked storage space, but couldn’t access one another’s. But among the directories shared between all students, I found a directory to which I had read-write access.

I created myself a subdirectory and set the hidden bit on it, and started dumping into it things that I wanted to keep on the network8.

By now my classmates were interested in what I was achieving, and I wanted in the benefits of my success. So I went back to Word and made a document template that looked superficially like a piece of coursework, but which contained macro code that would connect to the shared network drive and allow the user to select from a series of programs that they’d like to run.

Gradually, compressed over a series of floppy disks, I brought in a handful of games: Commander Keen, Prince of Persia, Wing Commander, Civilization, Wolfenstein 3D, even Dune II. I got increasingly proficient at modding games to strip out unnecessary content, e.g. the sound and music files9, minimising the number of floppy disks I needed to ZIP (or ARJ!) content to before smuggling it in via my shirt pocket, always sure not to be carrying so many floppies that it’d look suspicious.

Screenshot of Windows 3.11 File Manager connected to a network with shares rmnet, shared, and students. Shared contains a hidden directory called 'dan'.
The goldmine moment – for my friends, at least – was the point at which I found a way to persistently store files in a secret shared location, allowing me to help them run whatever they liked without passing floppy disks around the classroom (which had been my previous approach).

In a particularly bold move, I implemented a simulated login screen which wrote the entered credentials into the shared space before crashing the computer. I left it running, unattended, on computers that I thought most-likely to be used by school staff, and eventually bagged myself the network administrator’s password. I only used it twice: the first time, to validate my hypothesis about the access levels it granted; the second, right before I finished school, to confirm my suspicion that it wouldn’t have been changed during my entire time there10.

Are you sure you want to quit?

My single biggest mistake was sharing my new-found power with my classmates. When I made that Word template that let others run the software I’d introduced to the network, the game changed.

When it was just me, asking the question what can I make it do?, everything was fun and exciting.

But now half a dozen other teens were nagging me and asking “can you make it do X?”

This wasn’t exploration. This wasn’t innovation. This wasn’t using my curiosity to push at the edges of a system and its restrictions! I didn’t want to find the exploitable boundaries of computer systems so I could help make it easier for other people to do so… no: I wanted the challenge of finding more (and weirder) exploits!

I wanted out. But I didn’t want to say to my friends that I didn’t want to do something “for” them any more11.

I figured: I needed to get “caught”.

16-bit Windows screenshot with a background image from WarGames. A dialog box asks 'Are you sure you want to quit? If you quit, you will lose the ability to: (a) use network chat tools, (b) play videogames awhen you should be doing coursework, (c) impress your friends and raise your otherwise-pathetic social status'; the cursor hovers over a 'Yes, I'm out' button.
I considered just using graphics software to make these screenshots… but it turned out to be faster to spin up a network of virtual machines running Windows 3.11 and some basic tools. I actually made the stupid imaginary dialog box you’re seeing.12

I chose… to get sloppy.

I took a copy of some of the software that I’d put onto the shared network drive and put it in my own home directory, this time un-hidden. Clearly our teacher was already suspicious and investigating, because within a few days, this was all that was needed for me to get caught and disciplined13.

I was disappointed not to be asked how I did it, because I was sufficiently proud of my approach that I’d hoped to be able to brag about it to somebody who’d understand… but I guess our teacher just wanted to brush it under the carpet and move on.

Aftermath

The school’s IT admin certainly never worked-out the true scope of my work. My “hidden” files remained undiscovered, and my friends were able to continue to use my special Word template to play games that I’d introduced to the network14. I checked, and the hidden files were still there when I graduated.

The warning worked: I kept my nose clean in computing classes for the remainder of secondary school. But I would’ve been happy to, anyway: I already felt like I’d “solved” the challenge of turning the school computer network to my interests and by now I’d moved on to other things… learning how to reverse-engineer phone networks… and credit card processors… and copy-protection systems. Oh, the stories I could tell15.

Old photograph of Dan, then a teenager, with other teenagers. Dan is labelled 'young hacker, a.k.a. bellend', while another young man is captioned 'classmate who just wanted to play lemmings'.
I “get” it that some of my classmates – including some of those pictured – were mostly interested in the results of my hacking efforts. But for me it always was – and still is – about the journey of discovery.

But I’ll tell you what: 13-ish year-old me ought to be grateful to the RM Nimbus network at my school for providing an interesting system about which my developing “hacker brain” could ask: what can I make it do?

Which remains one of the most useful questions with which to foster a hacker mentality.

Footnotes

1 I first played Game of Life on an Amstrad CPC464, or possibly a PC1512.

2 What is the earliest experience to which I can credit my “hacker mindset”? Tron and WarGames might have played a part, as might have the “hacking” sequence in Ferris Bueller’s Day Off. And there was the videogame Hacker and its sequel (it’s funny to see their influence in modern games). Teaching myself to program so that I could make text-based adventures was another. Dissecting countless obfuscated systems to see how they worked… that’s yet another one: something I did perhaps initially to cheat at games by poking their memory addresses or hexediting their save games… before I moved onto reverse-engineering copy protection systems and working out how they could be circumvented… and then later still when I began building hardware that made it possible for me to run interesting experiments on telephone networks.

Any of all of these datapoints, which took place over a decade, could be interpreted as “the moment” that I became a hacker! But they’re not the ones I’m talking about today. Today… is the story of the RM Nimbus.

3 Whatever happened to Recorder? After it disappeared in Windows 95 I occasionally had occasion to think to myself “hey, this would be easier if I could just have the computer watch me and copy what I do a few times.” But it was not to be: Microsoft decided that this level of easy automation wasn’t for everyday folks. Strangely, it wasn’t long after Microsoft dropped macro recording as a standard OS feature that Apple decided that MacOS did need a feature like this. Clearly it’s still got value as a concept!

4 Just to clarify: I put more effort in to making animations, which were not part of my schoolwork back when I was a kid. I certainly didn’t put more effort into my education.

5 The computers had been configured to make DOS access challenging: a boot menu let you select between DOS and Windows, but both were effectively nerfed. Booting into DOS loaded an RM-provided menu that couldn’t be killed; the MS-DOS prompt icon was absent from Program Manager and quitting Windows triggered an immediate shutdown.

6 My secondary school didn’t get Internet access during the time I was enrolled there. I was recently trying to explain to one of my kids the difference between “being on a network” and “having Internet access”, and how often I found myself on a network that wasn’t internetworked, back in the day. I fear they didn’t get it.

7 I was in the habit of occasionally hooking up PCs together with null modem cables, but only much later on would I end up acquiring sufficient “thinnet” 10BASE2 kit that I could throw together a network for a LAN party.

8 Initially I was looking to sidestep the space limitation enforcement on my “home” directory, and also to put the illicit software I was bringing in somewhere that could not be trivially-easily traced back to me! But later on this “shared” directory became the repository from which I’d distribute software to my friends, too.

9 The school computer didn’t have soundcards and nobody would have wanted PC speakers beeping away in the classroom while they were trying to play a clandestine videogame anyway.

10 The admin password was concepts. For at least four years.

11 Please remember that at this point I was a young teenager and so was pretty well over-fixated on what my peers thought of me! A big part of the persona I presented was of somebody who didn’t care what others thought of him, I’m sure, but a mask that doesn’t look like a mask… is still a mask. But yeah: I had a shortage of self-confidence and didn’t feel able to say no.

12 Art is weird when your medium is software.

13 I was briefly alarmed when there was talk of banning me from the computer lab for the remainder of my time at secondary school, which scared me because I was by now half-way through my boring childhood “life plan” to become a computer programmer by what seemed to be the appropriate route, and I feared that not being able to do a GCSE in a CS-adjacent subject could jeopardise that (it wouldn’t have).

14 That is, at least, my friends who were brave enough to carry on doing so after the teacher publicly (but inaccurately) described my alleged offences, seemingly as a warning to others.

15 Oh, the stories I probably shouldn’t tell! But here’s a teaser: when I built my first “beige box” (analogue phone tap hardware) I experimented with tapping into the phone line at my dad’s house from the outside. I carefully shaved off some of the outer insulation of the phone line that snaked down the wall from the telegraph pole and into the house through the wall to expose the wires inside, identified each, and then croc-clipped my box onto it and was delighted to discovered that I could make and receive calls “for” the house. And then, just out of curiosity to see what kinds of protections were in place to prevent short-circuiting, I experimented with introducing one to the ringer line… and took out all the phones on the street. Presumably I threw a circuit breaker in the roadside utility cabinet. Anyway, I patched-up my damage and – fearing that my dad would be furious on his return at the non-functioning telecomms – walked to the nearest functioning payphone to call the operator and claim that the phone had stopped working and I had no idea why. It was fixed within three hours. Phew!

× × × ×

That’s Not How Email Works, HSBC

I have a credit card with HSBC1. It doesn’t see much use2, but I still get a monthly statement from them, and an email to say it’s available.

Not long ago I received a letter from them telling me that emails to me were being “returned undelivered” and they needed me to update the email address on my account.

“What’s happening?”

Posted letter from HSBC saying that emails to me have been returned undelivered, held in front of a screen showing a recent email from HSBC sitting in my Inbox.
I don’t know what emails are being “returned undelivered” to HSBC, but it isn’t any of the ones sitting, read, in my email client.

I logged into my account, per the instructions in the letter, and discovered my correct email address already right there, much to my… lack of surprise3.

So I kicked off a live chat via their app, with an agent called Ankitha. Over the course of a drawn-out hour-long conversation, they repeatedly told to tell me how to update my email address (which was never my question). Eventually, when they understood that my email address was already correct, then they concluded the call, saying (emphasis mine):

I can understand your frustration, but if the bank has sent the letter, you will have to update the e-mail address.

This is the point at which a normal person would probably just change the email address in their online banking to a “spare” email address.

But aside from the fact that I’d rather not4, by this point I’d caught the scent of a deeper underlying issue. After all, didn’t I have a conversation a little like this one but with a different bank, about four years ago?

Phone screen showing a live chat interface. The other party says "I can understand your frustration, but if the bank has sent the letter, you will have to update the e-mail address." and then "Thank you for being so understanding and patiently waiting. Thank you for contacting HSBC, if there is anything else you need please feel free to come back to us. Have a pleasant rest of the day.", before ending the conversation.
Perhaps I should be grateful that they didn’t say that I have to change my name, which can sometimes  be significantly more awkward than my email address…

So I called Customer Services directly5, who told me that if my email address is already correct then I can ignore their letter.

I suggested that perhaps their letter template might need updating so it doesn’t say “action required” if action is not required. Or that perhaps what they mean to say is “action required: check your email address is correct”.

Edited version of the letter, now saying 'What's happening? We need to ensure that the email address we're using for you is correct' and 'Action required: Please check that you've been receiving our emails and that the address in your account is correct'.
Say what you mean, HSBC! I’ve suggested an improvement to your letter template.

So anyway, apparently everything’s fine… although I reserved final judgement until I’d seen that they were still sending me emails!

“Action required”

I think I can place a solid guess about what went wrong here. But it makes me feel like we’re living in the Darkest Timeline.

Scene from Community episode 'Remedial Chaos Theory'. Pierce lies injured on the floor, tended to by Annie and Abed, while Jeff swings a flaming blanket around his head. Troy stands in shock at the door, holding a pile of pizza boxes.
You know the one I mean. Somebody rolled a ‘1’, didn’t they…

I dissected HSBC’s latest email to me: it was of the “your latest statement is available” variety. Deep within the email, down at the bottom, is this code:

<img src="http://www.email1.hsbc.co.uk:8080/Tm90IHRoZSByZWFsIEhTQkMgcGF5bG9hZA=="
   width="1"
  height="1"
     alt="">

<img src="http://www.email1.hsbc.co.uk:8080/QWxzbyBub3QgcmVhbCBIU0JDIHBheWxvYWQ="
   width="1"
  height="1"
     alt="">

What you’re seeing are two tracking pixels: tiny 1×1 pixel images, usually transparent or white-on-white to make them even-more invisible, used to surreptitiously track when somebody reads an email. When you open an email from HSBC – potentially every time you open an email from them – your email client connects to those web addresses to get the necessary images. The code at the end of each identifies the email they were contained within, which in turn can be linked back to the recipient.

You know how invasive a read-receipt feels? Tracking pixels are like those… but turned up to eleven. While a read-receipt only says “the recipient read this email” (usually only after the recipient gives consent for it to do so), a tracking pixel can often track when and how often you refer to an email6.

If I re-read a year-old email from HSBC, they’re saying that they want to know about it.

But it gets worse. Because HSBC are using http://, rather than https:// URLs for their tracking pixels, they’re also saying that every time you read an email from them, they’d like everybody on the same network as you to be able to know that you did so, too. If you’re at my house, on my WiFi, and you open an email from HSBC, not only might HSBC know about it, but I might know about it too.

An easily-avoidable security failure there, HSBC… which isn’t the kind of thing one hopes to hear about a bank!

Zoom-in animation showing two tracking pixels at the bottom of an email, rendered visible in red and blue.
Tracking pixels are usually invisible, so I turned these ones visible so you can see where they hide.

But… tracking pixels don’t actually work. At least, they doesn’t work on me. Like many privacy-conscious individuals, my devices are configured to block tracking pixels (and a variety of other instruments of surveillance capitalism) right out of the gate.

This means that even though I do read most of the non-spam email that lands in my Inbox, the sender doesn’t get to know that I did so unless I choose to tell them. This is the way that email was designed to work, and is the only way that a sender can be confident that it will work.

But we’re in the Darkest Timeline. Tracking pixels have become so endemic that HSBC have clearly come to the opinion that if they can’t track when I open their emails, I must not be receiving their emails. So they wrote me a letter to tell me that my emails have been “returned undelivered” (which seems to be an outright lie).

Surveillance capitalism has become so ubiquitous that it’s become transparent. Transparent like the invisible spies at the bottom of your bank’s emails.

The letter from HSBC again, but this time corrected to say 'We cannot conceive that there's anybody left who hasn't given up on trying to fight back against surveillance capitalism. Action required: turn off your privacy software so we can watch you read our emails. (We'll be letting anybody you live with read them too.)
I’ve changed my mind. Maybe this is what HSBC’s letter should have said.

So in summary, with only a little speculation:

  1. Surveillance capitalism became widespread enough that HSBC came to assume that tracking pixels have bulletproof reliability.
  2. HSBC started using tracking pixels them to check whether emails are being received (even though that’s not what they do when they are reliable, which they’re not).
    • (Oh, and their tracking pixels are badly-implemented, if they worked they’d “leak” data to other people on my network7.)
  3. Eventually, HSBC assumed their tracking was bulletproof. Because HSBC couldn’t track how often, when, and where I was reading their emails… they posted me a letter to tell me I needed to change my email address.

What do I think HSBC should do?

Instead of sending me a misleading letter about undelivered emails, perhaps a better approach for HSBC could be:

  1. At an absolute minimum, stop using unencrypted connections for tracking pixels. I do not want to open a bank email on a cafe’s public WiFi and have everybody in the cafe potentially know who I bank with… and that I just opened an email from them! I certainly don’t want attackers injecting content into the bottom of legitimate emails.
  2. Stop assuming that if somebody blocks your attempts to spy on them via your emails, it means they’re not getting your emails. It doesn’t mean that. It’s never meant that. There are all kinds of reasons that your tracking pixels might not work, and they’re not even all privacy-related reasons!
  3. Or, better yet: just stop trying to surveil your customers’ email habits in the first place? You already sit on a wealth of personal and financial information which you can, and probably do, data-mine for your own benefit. Can you at least try to pay lip service to your own published principles on the ethical use of data and, if I may quote them, “use only that data which is appropriate for the purpose” and “embed privacy considerations into design and approval processes”.
  4. If you need to check that an email address is valid, do that, not an unreliable proxy for it. Instead of this letter, you could have sent an email that said “We need to check that you’re receiving our emails. Please click this link to confirm that you are.” This not only achieves informed consent for your tracking, but it can be more-secure too because you can authenticate the user during the process.

Also, to quote your own principles once more: when you make a mistake like assuming your spying is a flawless way to detect the validity of email addresses, perhaps you should “be transparent with our customers and other stakeholders about how we use their data”.

Wouldn’t that be better than writing to a customer to say that their emails are being returned undelivered (when they’re not)… and then having your staff tell them that having received such an email they have no choice but to change the email address they use (which is then disputed by your other staff)?

</rant>

Footnotes

1 You know, the bank with virtue-signalling multiculturalism that we used to joke about.

2 Long, long ago I also had a current account with HSBC which I forgot to close when I switched banks… 20 years ago… and I possibly still owe them for the six pence the account was in debt at the time.

3 After all, I’d been reading their emails!

4 After all, as I’ll stress again: the email address HSBC have for me, and are using, is already correct.

5 In future, I’ll just do this in the first instance. The benefits of live chat being able to be done “in the background” while one gets on with some work are totally outweighed when the entire exchange takes an hour only to reach an unsatisfactory conclusion, whereas a telephone call got things sorted (well hopefully…) within 10 minutes.

6 A tracking pixel can also collect additional personal information about you, such as your IP address at the time that you opened the email, which might disclose your location.

7 It could be even worse still, actually! A sophisticated attacker could “inject” images into the bottom of a HSBC email; those images could, for example, be pictures of text saying things like “You need to urgently call HSBC on [attacker’s phone number].” This would allow a scammer to hijack a legitimate HSBC email by injecting their own content into the bottom of it. Seriously, HSBC, you ought to fix this.

× × × × × ×

PHP 8.4 on Caddy on Debian 13… in Three Minutes

I just needed to spin up a new PHP webserver and I was amazed how fast and easy it was, nowadays. I mean: Caddy already makes it pretty easy, but I was delighted to see that, since the last time I did this, the default package repositories had 100% of what I needed!

Apart from setting the hostname, creating myself a user and adding them to the sudo group, and reconfiguring sshd to my preference, I’d done nothing on this new server. And then to set up a fully-functioning PHP-powered webserver, all I needed to run (for a domain “example.com”) was:

sudo apt update && sudo apt upgrade -y
sudo apt install -y caddy php8.4-fpm
sudo mkdir -p /var/www/example.com
printf "example.com {\n"                               | sudo tee    /etc/caddy/Caddyfile
printf "  root * /var/www/example.com\n"               | sudo tee -a /etc/caddy/Caddyfile
printf "  encode zstd gzip\n"                          | sudo tee -a /etc/caddy/Caddyfile
printf "  php_fastcgi unix//run/php/php8.4-fpm.sock\n" | sudo tee -a /etc/caddy/Caddyfile
printf "  file_server\n"                               | sudo tee -a /etc/caddy/Caddyfile
printf "}\n"                                           | sudo tee -a /etc/caddy/Caddyfile
sudo service caddy restart

After that, I was able to put an index.php file into /var/www/example.com and it just worked.

And when I say “just worked”, I mean with all the bells and whistles you ought to expect from Caddy. HTTPS came as standard (with a solid QualSys grade). HTTP/3 was supported with a 0-RTT handshake.

Mind blown.

Peripheral Vision

As I lay in bed the other night, I became aware of an unusually-bright LED, glowing in the corner of my room1. Lying still in the dark, I noticed that as I looked directly at the light meant that I couldn’t see it… but when I looked straight ahead – not at it – I could make it out.

Animated illustration showing how an eyeball that rotates to face a light source can have that light obstructed by an intermediary obstacle, but when it looks "away" some of the light can hit the pupil as a consequence of its curved shape now appearing "above the horizon" of the obstacle.
In my bedroom the obstruction was the corner of my pillow, not a nondescript black rectangle. Also: my eyeball was firmly within my skull and not floating freely in a white void.

This phenomenon seems to be most-pronounced when the thing you’re using a single eye to looking at something small and pointlike (like an LED), and where there’s an obstacle closer to your eye than to the thing you’re looking at. But it’s still a little spooky2.

It’s strange how sometimes you might be less-able to see something that you’re looking directly at… than something that’s only in your peripheral vision.

I’m now at six months since I started working for Firstup.3 And as I continue to narrow my focus on the specifics of the company’s technology, processes, and customers… I’m beginning to lose a sight of some of the things that were in my peripheral vision.

Dan, a white man with blue hair, wears headphones and a grey 'Firstup' hoodie, holding a 'Firstup'-branded shoebox.
I’ve not received quite so many articles of branded clothing and other swap from my new employer as I did from my previous, but getting useful ‘swag’ still feels cool.

I’m a big believer in the idea that folks who are new to your group (team, organisation, whatever) have a strange superpower that fades over time: the ability to look at “how you work” as an outsider and bring new ideas. It requires a certain boldness to not just accept the status quo but to ask “but why do we do things this way?”. Sure, the answer will often be legitimate and unchallengeable, but by using your superpower and raising the question you bring a chance of bringing valuable change.

That superpower has a sweet spot. A point at which a person knows enough about your new role that they can answer the easy questions, but not so late that they’ve become accustomed to the “quirks” that they can’t see them any longer. The point at which your peripheral vision still reveals where there’s room for improvement, because you’re not yet so-focussed on the routine that you overlook the objectively-unusual.

I feel like I’m close to that sweet spot, right now, and I’m enjoying the opportunity to challenge some of Firstup’s established patterns. Maybe there are things I’ve learned or realised over the course of my career that might help make my new employer stronger and better? Whether not not that turns out to be the case, I’m enjoying poking at the edges to find out!

Footnotes

1 The LED turned out to be attached to a laptop charger that was normally connected in such a way that it wasn’t visible from my bed.

2 Like the first time you realise that you have a retinal blind spot and that your brain is “filling in” the gaps based on what’s around it, like Photoshop’s “smart remove” tool is running within your head.

3 You might recall that I wrote about my incredibly-efficient experience of the recruitment process at Firstup.

× ×

Nostalgia, Music, and Computers

Duration

Podcast Version

This post is also available as a podcast. Listen here, download for later, or subscribe wherever you consume podcasts.

This is a blog post about things that make me nostalgic for other things that, objectively, aren’t very similar…

When I hear Dawnbreaker, I feel like I’m nine years old…

…and I’ve been allowed to play OutRun on the arcade cabinet at West View Leisure Centre. My swimming lesson has finished, and normally I should go directly home.

On those rare occasions I could get away1 with a quick pause in the lobby for a game, I’d gravitate towards the Wonderboy machine. But there was something about the tactile controls of OutRun‘s steering wheel and pedals that gave it a physicality that the “joystick and two buttons” systems couldn’t replicate.

The other thing about OutRun was that it always felt… fast. Like, eye-wateringly fast. This was part of what gave it such appeal2.

OutRun‘s main theme, Magical Sound Shower, doesn’t actually sound much like Dawnbreaker. But both tracks somehow feel like… “driving music”?

(It should, I suppose: Metrik wrote Dawnbreaker explicitly for that purpose in the first place, for use in a videogame I haven’t played3.)

But somehow when I’m driving or cycling and it this song comes on, I’m instantly transported back to those occasionally-permitted childhood games of OutRun4.

When I start a new Ruby project, I feel like I’m eleven years old…

…and I’m writing Locomotive BASIC on the family’s Amstrad CPC. Like many self-taught coders in the 1980s, my journey as a programmer begin with BASIC. When I transitioned from that to more “grown-up” languages5 I missed the feeling of programming in an environment where every line brought me joy.

Animation of an Amstrad CPC 6128 on which a program is typed and then executed. The program clears the screen and then prints the message 'Thanks for visiting DANQ.ME".
It’s not quite a HELLO WORLD, but it’s pretty-similar.

At first I assumed that the tedious bits and the administrative overhead (linking, compiling, syntactical surprises, arcane naming conventions…) was just what “real”, “grown-up” programming was supposed to feel like. But Ruby helped remind me that programming can be fun for its own sake. Not just because of the problems you’re solving or the product you’re creating, but just for the love of programming.

The experience of starting a new Ruby project feels just like booting up my Amstrad CPC and being able to joyfully write code that will just work.

I still learn new programming languages because, well, I love doing so. But I’m yet to find one that makes me want to write poetry in it in the way that Ruby does.

When I hear In Yer Face, I feel like I’m thirteen years old…

…and I’m painting Advanced HeroQuest miniatures6 in the attic at my dad’s house.

I’ve cobbled together a stereo system of my very own, mostly from other people’s castoffs, and set it up in “The Den”, our recently-converted attic7, and my friends and I would make and trade mixtapes with one another. One tape began with 808 State’s In Yer Face8, and it was often the tape that I would put on when I’d sit down to paint.

Several jigsaw-edged board game pieces lay out a dungeon map, with painted plastic minatures representing doors and characters. A party of four adventurers have just opened a door into a chamber containing five skaven (ratmen), guarding a treasure chest.
Advanced HeroQuest came with some fabulously ornate secondary components, like the doors that were hinged so their their open/closed state could be toggled, and I spent way too long painting almost the entirety of my base set.

In a world before CD audio took off, “shuffle” wasn’t a thing, and we’d often listen to all of the tracks on a medium in sequence9.

That was doubly true for tapes, where rewinding and fast-forwarding took time and seeking for a particular track was challenging compared to e.g. vinyl. Any given song would loop around a lot if I couldn’t be bothered to change tapes, instead just flipping again and again10. But somehow it’s whenever I hear In Yer Face11 that I’m transported right back to that time, in a reverie so corporeal that I can almost smell the paint thinner.

When I see a personal Web page, I (still) feel like I’m fifteen years old…

…and the Web is on the cusp of becoming the hot “killer application” for the Internet. I’ve been lucky enough to be “online” for a few years by now12, and basic ISP-provided hosting would very soon be competing with cheap, free, and ad-supported services like Geocities to be “the place” to keep your homepage.

Since its early days, the Web has always been an expressive medium. Open a Web browser, and you’re seeing a blank canvas of potential. And with modern browser debug tools, you don’t even have to reach for your text editor to begin to create in that medium.

Fresh web browser, semitransparent, on an artistic 'airy' background, with a caption to say 'The entire potential of the Web, and by proxy, the World, exists within this newly-opened window.
I don’t often see a browser with no tabs open13. But a fresh tab still gives me a tingle when I remember that it might take me anywhere!

The limitations of that medium in the pre-CSS era were a cause for inspiration, not confinement: web pages of the mid-1990s would use all kinds of imaginative tricks to lay out and style their content!

Nowadays, even with a hugely-expanded toolbox, virtually every corporate homepage fundamentally looks the same:

  • Logo in the top left
  • Search and login in the top right, if applicable
  • A cookie/privacy notice covering everything until you work out the right incantation to make it go away without surrendering your firstborn child
  • A “hero banner
  • Some “below the fold” content that most people skip over
  • A fat footer with several columns of links, to ensure that all the keywords are there so that people never have to see this page and the search engine will drop them off at relevant child page and not one of their competitors
  • Finally, a line of icons representing various centralised social networks: at least one is out-of-date, either because (a) it’s been renamed, (b) it’s changed its branding, or (c) nobody with any moral fortitude uses that network any more14

But before the corporate Web became the default, personal home pages brought a level of personality that for a while I worried was forever dead.

But… personal home pages didn’t die: everybody is free to write websites, so they’re still out there15, and they’re amazing. Look at this magic:

A handful of the personal home pages I visited while writing this article16. Don’t they just make you want to give the Web an enormous hug?

Last year, I wrote:

Writing HTML is punk rock. A “platform” is the tool of the establishment.

That still feels right to me. 🤘


So… it turns out that I get nostalgic about technology in the same way as I get nostalgic about music.

Footnotes

1 My dad in particular considered arcade games financially wasteful when we, y’know, had a microcomputer at home that could load a text-based adventure from an audiotape and be ready to play in “only” about 3-5 minutes.

2 Have you played Sonic Racing: CrossWorlds? The first time I played it I was overwhelmed by the speed and colours of the game: it’s such a high-octane visual feast. Well that’s what OutRun felt like to those of us who, in the 1980s, were used to much-simpler and slower arcade games.

3 Also, how cool is it that Metrik has a blog, in this day and age? Max props.

4 Did you hear, by the way, that there’s talk of a movie adaptation of OutRun, which could turn out to be the worst videogame-to-movie concept that I’ll ever definitely-watch.

5 In very-approximate order: C, Assembly, Pascal, HTML, Perl, Visual Basic (does that even count as a “grown-up” language?), Java, Delphi, JavaScript, PHP, SQL, ASP (classic, pre-.NET), CSS, Lisp, C#, Ruby, Python (though I didn’t get on with it so well), Go, Elixir… plus many others I’m sure!

6 Or possibly they were Warhammer Quest miniatures by this point; probably this memory spans one, and also the other, blended together.

7 Eventually my dad and I gave up on using the partially-boarded loft to intermittently build a model railway layout, mostly using second-hand/trade-in parts from “Trains & Transport”, which was exactly the nerdy kind of model shop you’re imagining right now: underlit and occupied by a parade of shuffling neckbeards, between whom young-me would squeeze to see if the mix-and-match bin had any good condition HO-gauge flexitrack. We converted the attic and it became “The Den”, a secondary space principally for my use. This was, in the most part, a concession for my vacating of a large bedroom and instead switching to the smallest-imaginable bedroom in the house (barely big enough to hold a single bed!), which in turn enabled my baby sister to have a bedroom of her own.

8 My copy of In Yer Face was possibly recorded from the radio by my friend ScGary, who always had a tape deck set up with his finger primed close to the record key when the singles chart came on.

9 I soon learned to recognise “my” copy of tracks by their particular cut-in and -out points, static and noise – some of which, amazingly, survived into the MP3 era – and of course the tracks that came before or after them, and there are still pieces of music where, when I hear them, I “expect” them to be followed by something that they used to some mixtape I listened to a lot 30+ years ago!

10 How amazing a user interface affordance was it that playing one side of an audio cassette was mechanically-equivalent to (slowly) rewinding the other side? Contrast other tape formats, like VHS, which were one-sided and so while rewinding there was literally nothing else your player could be doing. A “full” audio cassette was a marvellous thing, and I especially loved the serendipity where a recognisable “gap” on one side of the tape might approximately line-up with one on the other side, meaning that you could, say, flip the tape after the opening intro to one song and know that you’d be pretty-much at the start of a different one, on the other side. Does any other medium have anything quite analogous to that?

11 Which is pretty rare, unless I choose to put it on… although I did overhear it “organically” last summer: it was coming out of a Bluetooth speaker in a narrowboat moored in the Oxford Canal near Cropredy, where I was using the towpath to return from a long walk to nearby Northamptonshire where I’d been searching for a geocache. This was a particularly surprising place to overhear such a song, given that many of the boats moored here probably belonged to attendees of Fairport’s Cropredy Convention, at which – being a folk music festival – one might not expect to see significant overlap of musical taste with “Madchester”-era acid house music!

12 My first online experiences were on BBS systems, of which my very first was on a mid-80s PC1512 using a 2800-baud acoustic coupler! I got onto the Internet at a point in the early 90s at which the Web existed… but hadn’t yet demonstrated that it would eventually come to usurp the services that existed before it: so I got to use Usenet, Gopher, Telnet and IRC before I saw my first Web browser (it was Cello, but I switched to Netscape Navigator soon after it was released).

13 On the rare occasion I close my browser, these days, it re-opens with whatever hundred or so tabs I was last using right back where I left them. Gosh, I’m a slob for tabs.

14 Or, if it’s a Twitter icon: all three of these.

15 Of course, they’re harder to find. SEO-manipulating behemoths dominate the search results while social networks push their “apps” and walled gardens to try to keep us off the bigger, wider Web… and the more you cut both our of your online life, the calmer and happier you’ll be.

16 The sites featured in the video are: praze, elle’s homepage, sctech, Konfetti Explorations (Marisabel), Frills (check her character sheet “about” page!), mrkod, Raven Winters, Cobb, ajazz, Yusuf Ertan, Alvin Bryan, Armando Cordova, Ens/DepartedGlories, and Jamie Tanna.

× × ×

Imajica by Clive Barker

Cover for Imajica by Clive Barker. In a dark cosmos, the planet Earth is encircled by an approaching ribbon of gold, filled with various magical shapes: leaves, stars, spiders, birds, an ouroboros, etc.Clive Barker’s Imajica has long been one of my favourite fantasy novels. The heft of the single-volume edition renders it both unwieldy and intimidating, which is probably why my most recent reading of it was only the fourth time I’ve enjoyed it from cover-to-cover. But enjoyed it I did, and I’m sure I’ll pick it up again in a further decade or so for another adventure.

I’m aware that it draws comparison to his perhaps more-widely-read Weaveworld, but somehow that never did it for me in the same way. Perhaps my mistake was reading Imajica first, way back when I was a teenager, and so satiating my appetite for “curious flawed everyman explores adjacent reality alongside magical woman, faces horrors”; just an unfortunate coincidence that I picked up Weaveworld right after!

I also fully accept the critics who observe that it’s exceptionally drawn-out, at times. But where it does seem to drag, it does so with a certain gravity; an inertia: the slower parts of the story are full of intention, and meaning, and – frequently – foreshadowing. I still find new expressions of its themes in it, each time I read it. This time around, for example, I found myself finding a plethora of reflections of protagonist Gentle’s role as a forger: unable to create anything novel as an artist (for reasons that become apparent in the long run) but only able to copy beautiful things belonging to others. This self-inflicted curse shows up again and again in innumerable subtle ways before the truth of it is (finally, eventually – did I mention how weighty this fat book is?) exposed… and with such an epic tale it’s little wonder that it’s impossible to remember all of the indications that preceded it!

I’ve long appreciated how Imajica plays with gender and, to a lesser-extent, relationships and sexuality, in a way that was revelatory for me on a first reading and which with the benefit of hindsight I can see is incredibly progressive for its age. Gentle and Judith exist each to further the plot in their own ways, not as romantic “goals” for one another… despite not only tropes in the genre but also the ways in which their characters are presented within their world – by which I mean: this isn’t a story about how they “get together at the end”, and that subverts both the expectation of how they’re introduced in the writing and also the destinies with which their characters seem to be imbued. Pie’o’pah presents, depending on the circumstance, as either male or female but also as some other gender entirely. Gender is a huge overarching theme, with a oppressive patriarchal power that’s threatened by a mysterious feminine energy playing a key role that, like everything else, is quietly echoed throughout the novel.

But perhaps my favourite part of this wonderful book is its world-building, which – through the eyes of an outsider – paints a rich picture of each of several fantastical dominions. Over the course of the adventure a character draws a map to chart the wonders of the story’s universe, but it’s ultimately incomplete (and perhaps impossible to complete). That’s what it feels like to me as a reader, too: like being given a glimpse of a wider and even-more-wonderful world just beyond the horizon: a fantastical creation too large to ever fully comprehend. While retaining a focus on the story of three-or-so core characters, Barker teases us with the idea that there’s “something more” just beyond our peripheral vision. And that’s flipping amazing.

×

Why I Am So Tired

Duration

Podcast Version

This post is also available as a podcast. Listen here, download for later, or subscribe wherever you consume podcasts.

This post is also available as a video. If you'd prefer to watch/listen to me talk about this topic, give it a look.

I am tired. For a couple of years I’ve been blaming it on iron-poor blood, lack of vitamins, diet, and a dozen other maladies. But now I’ve found out the real reason: I’m tired because I’m overworked.

The population of the UK is 69 million1, of which the latest census has 37 million “of working age”2.

According to the latest statistics, 4,215,913 are unemployed3, leaving 32,784,087 people to do all the work.

19.2 million are in full time education4, 856,211 in the armed forces5, and collectively central, regional, and local government employs 4.987 million6. This leaves just 12,727,876 to do all of the real work.

Long term disabilities affect 6.9 million7. 393,000 are on visas that prohibit them from working8, and 108,0859 are working their way through the asylum process.

Of the remaining 339,791 people, a hundred thousand are in prison10 and 239,789 are in hospital11.

That leaves just two people to do all the work that keeps this country on its feet.

You and me.

And you’re sitting reading this.

This joke originally appeared aeons ago. I first saw it in a chain email in around 199612, when I adapted it from a US-centric version to a more British one and re-circulated it among some friends… taking the same kinds of liberties with the numbers that are required to make the gag work.

And now I’ve updated it with some updated population statistics13.

Footnotes

1 Source: Provisional population estimate for the UK: mid-2025, Office for National Statistics.

2 Source: Working age population, gov.uk.

3 Source: Unemployment, Office for National Statistics.

4 Source: Statistica for all the children, plus FE students from Education and training statistics for the UK, gov.uk, with some rounding.

5 Source: Hansard, here, plus other sources from the same time period.

6 Source: this informative article.

7 Source: UK disability statistics: Prevalence and life experiences, House of Commons Library.

8 Source: Reason for international migration, international students update: May 2025, Office for National Statistics.

9 Source: How many people claim asylum in the UK?, gov.uk.

10 Source: Prison population: weekly estate figures 2025, gov.uk.

11 Source: Bed Availability and Occupancy, Hansard Library.

12 In fact, I rediscovered it while looking through an old email backup from 1997, which inspired this blog post.

13 Using the same dodgy arithmetic, cherry-picking, double-counting, wild over-estimations, and hand-waving nonsense. Obviously this is a joke. Oh god, is somebody on the satire-blind Internet of 2026 going to assume any of these numbers are believable? (They’re not.) Or think I’m making some kind of political point? (I’m not.) What a minefield we live in, nowadays.

Visualising Forged In The Dark probabilities

I was having trouble visualising the dice probabilities for some Forged in the Dark-based1 RPGs2, so I drew myself a diagram. I don’t know who, if anybody, would be interested in such a thing other than me… but that’s why we put these things online, right?

Pie charts approximating the probability of rolling 1-3, 4-5, 6, or 'multiple 6s' when rolling 1 through 8 six-sided dice.

The general idea for Forged in the Dark action resolution is that you throw a number of six-sided dice representative of your chance of success3. You look at the highest value rolled in your dice pool, typically with most or all of the following effects:

  • 1-3: Failure – depending on the circumstances you might be able to try again (with greater risk) and/or suffer some kind of consequence (a “harm” or “complication”).
  • 4-5: Limited success – you succeed, but with come kind of consequence.
  • 6: Success – you succeed!
  • Multiple 6s: Critical – you succeed, and it’s more-effective than you’d hoped or you gain some other benefit4.

If you’re playing Blades in the Dark or another Forged in the Dark-based game and find it useful to visualise how likely you are to get screwed-over by the dice… you’re welcome!

Footnotes

1 Forged in the Dark is the name of the permissively-licensed SRD originally used for fantasy RPG Blades in the Dark, but it’s been used in plenty of other places too where its relatively fast-and-loose mechanics are best-suited. Sharp-eyed readers might have noticed this come up in a repost from last week, too…

2 I may or may not be considering Forged in the Dark as the engine for a prototype RPG environment I’ve been half-heartedly constructing this winter…

3 A task for which you’ve prepared and have trained, in an area in which you’re skilled, and for which you’re well-equipped (e.g. an accomplished thief takes the time to carefully pick a basic lock using fine tools) is likely to involve rolling more dice than a less-fortunate individual.

4 I’m hugely grateful to AnyDice for helping with these calculations. Did you know that you need to be rolling ten six-sided dice before it becomes more-likely-than-not that there’ll be a double-six somewhere in there?

×

Roomscale VR Still Rocks

Over the Christmas break I dug out my old HTC Vive VR gear, which I got way back in the Spring of 2016. Graphics card technology having come a long way1, it was now relatively simple to set up a fully-working “holodeck” in our living room with only a slight risk to the baubles on the Christmas tree.

For our younger child, this was his first experience of “roomscale VR”, which I maintain is the most magical thing about this specific kind of augmented reality. Six degrees of freedom for your head and each of your hands provides the critical level of immersion, for me.

And you know what: this ten-year-old hardware of mine still holds up and is still awesome!2

The kids and I have spent a few days dipping in and out of classics like theBlu, Beat Saber, Job Simulator, Vacation Simulator, Raw Data, and (in my case3) Half-Life: Alyx.

A tweenage girl in a black 'Hazbin Hotel' hoodie wears a VR headset; the screen behind her shows that she's drawn a picture featuring a rainbow background and the word 'CAR', while playing Job Simulator.
It doesn’t feel too heavy, but this first edition Vive sure is a big beast, isn’t it?

I’m moderately excited by the upcoming Steam Frame with its skinny headset, balanced weight, high-bandwidth wireless connectivity, foveated streaming, and built-in PC for basic gaming… but what’s with those controllers? Using AA batteries instead of a built-in rechargeable one feels like a step backwards, and the lack of a thumb “trackpad” seems a little limiting too. I’ll be waiting to see the reviews, thanks.

When I looked back at my blog to double-check that my Vive really is a decade old, I was reminded that I got it in the same month at Three Rings2016 hackathon, then called “DevCamp”, near Tintern4. This amused me, because I’m returning to Tintern this year, too, although on family holiday rather than Three Rings business. Maybe I’ll visit on a third occasion in another decade’s time, following another round of VR gaming?

Footnotes

1 The then-high-end graphics card I used to use to drive this rig got replaced many years ago… and then that replacement card in turn got replaced recently, at which point it became a hand-me-down for our media centre PC in the living room.

2 I’ve had the Vive hooked-up in the office since our house move in 2020, but there’s rarely been space for roomscale play there: just an occasional bit of Elite: Dangerous at my desk… which is still a good application of VR, but not remotely the same thing as being able to stand up and move around!

3 I figure Alyx be a little scary/intense for the kids, but I could be wrong. I think the biggest demonstration of how immersive the game can be in VR is the moment when you see how somebody can watch it played on the big screen and be fine but as soon as they’re in the headset and a combine zombie has you pinned-down in a railway carriage and it’s suddenly way too much!

4 Where, while doing a little geocaching, I messed-up a bonus cache’s coordinate calculation, realised my mistake, brute-forced the possible answers, narrowed it down to two… and then picked the wrong one and fell off a cliff.

×