Chameth.com - posts not debugging-beyond-the-debugger, finding-an-awkward-bug-with-claude-code, migrating-from-github-to-forgejo, modern-css-is-fun, tracking-pbs-without-the-dark-patterns, why-you-should-be-using-https

Monthly Meanderings: June 2026

2026-07-01T00:00:00Z

Writing these monthly posts is making me very aware of how quickly the year is going. I’m not sure I like that at all. June saw some truly horrible hot weather in the UK; it’s almost like murdering the planet with CO₂ emissions was a terrible, terrible idea.

My dodgy knee that I mentioned way back in the April post feels like it’s finally back to normal. I had low expectations of the physio service, and I’m glad to find I was utterly wrong. When I self-referred I got an e-mail the same day with some tailored exercise suggestions, and I’ve had two in-person sessions since. I managed to get some longer walks and a jog in this month, when I wasn’t camped in front of a fan to try and keep cool.

Website updates

Another month with no new posts. I’m just in one of those slumps where nothing quite takes my fancy. It’s a bit upsetting that the three most recent posts are all going to be monthly meanderings, though.

I did spend some time adding standard.site metadata and records for blog posts. In theory that means it’ll show up a bit nicer when presented on Bluesky, but I’ve not actually tested it in anger yet. As well as pretty embeds, having a standard schema for describing publications and posts feels like it could enable a lot of cool discovery/directory uses.

Other projects

Centauri, my reverse proxy, got a whole bunch of new features in response to some requests and problem reports from a friend. Mostly the changes were exposing more options for finer control over how certificates are obtained. Providers other than Let’s Encrypt require extra account details, have different rate limits, and so on.

The only other project of note this month is a new World of Warcraft addon called Who’s Got the Keys? that shows on-screen who has a keystone for the dungeon you’re currently waiting to start. I really like being able to scratch itches like that.

Entertainment

I mentioned my wax-and-wane hobby cycle last month. This month apparently films are back in for me:

There were some big surprises for me in both directions: films I expected to like such as Disclosure Day and Good Luck, Have Fun, Don’t Die absolutely missed the mark; meanwhile Midsommar I didn’t have any particular expectations of and it ended up stealing the top spot on my watched films ranked list.

Most of my other entertainment is still coming from World of Warcraft. I’m now reasonably comfortable with my spec, and my regular group of friends is well on the way to reaching a Mythic+ score of 3400 before the end of the season. Amusingly I’m currently in the top 20 for my spec on my realm, but that says more about the low population of the server than it does about my skill, I think!

My character is now about as fully geared as they’re going to get this season. There are some minor upgrades I could make but it’s not really worth it with only weeks remaining. I now also don’t get any real benefit from doing the standard open world weekly activities, so I’ve been spending a bit more time farming mounts and transmog in old content. I’ve also levelled a whole bunch of alts, but I’ve failed to find a single DPS spec I actually like. I’m now trying alternative healers just to get some variety when we do runs where we’re not pushing keys.

Around the web

Suspicious discontinuities

An old article by Dan Luu that recently resurfaced on Hacker News. It’s an interesting look at various series that have discontinuities and the reasons for those. I’m easily won over by cool graphs, so it’s not a surprise I saved this link.

Incident Report: CVE-2026-LGTM

A very funny spoof vulnerability disclosure that pokes fun at all the failure modes of LLM security tooling and the possible consequences of that.

Help I accidentally a wigglegram

Fun article where the author describes how they automatically made a bunch of “wigglegrams” (stereoscopic animated gifs) from their iCloud photo library. It’s interesting how just taking multiple versions of a photo can result in something novel like this.

Finding the Best Dog Treat with Statistics

I’m pretty sure this is actually some devious attempt to make me learn statistics, but it features a dog called Bebop, so I’m going to allow it.

Monthly Meanderings: May 2026

2026-06-01T00:00:00Z

Another month, another wrap-up post. This is the first one I’ve felt reluctant to write, and I think it’s because I feel like I didn’t really do anything last month. Other than play a lot of World of Warcraft.

Website updates

No new posts this month, but I finished off the refactoring I mentioned in the last update. It’s been a very satisfying process, and working on the site feels a lot less like a chore now. Features are now entirely self-contained, instead of having bits and pieces scattered everywhere, and everything is wired up together with some automatically generated code. I’ll probably write a longer post about the architecture and the refactoring process at some point.

My World of Warcraft page got some updates, now showing achievements and stats about Mythic+ runs. It’s always nice to take a break from the game… and code things relating to it instead.

Other projects

I finished off glauncher, my native alternative to ulauncher and am now using it day-to-day, which is nice. I’ve never really liked making native user interfaces, but having an LLM generate code for Gio UI was pretty much pain-free. I’m now toying with replacing a few other simple apps I currently rely on that use Electron or Webkit with Go versions.

Entertainment

Let’s start with the non-World of Warcraft updates. I seem to be on a one-film-a-month cadence recently. This month’s was fine but not earth shattering:

This Is Spinal Tap

2026-05-30

Quite funny, and it’s interesting to watch something that’s become such a cultural touchstone, but coming to it 40 years on I find it a bit slow and meandering.

SNL UK wrapped up this month, but has thankfully been picked up for another season. I really enjoyed it, despite my initial misgivings about it. I’m now back down to exactly zero TV programmes I care about.

A few board game plays this month, but overall still in the “wane” phase of my wax-and-wane hobby cycle:

4 plays
3 plays

Then, finally, there’s World of Warcraft. I started playing a new class:

Level 90

Female Night Elf

Mistweaver Monk

308 average item level

Miraceth-Terenas

Professions

Midnight Leatherworking		100/100
Midnight Skinning		100/100
Midnight Cooking		100/100
Midnight Fishing		110/300

Mythic+

Altar of Fangs	+9	~~31:31~~	273
Den of Nalorakk	+10	27:22	325
Kings' Rest	+8	25:34	283
Murder Row	+10	32:00	322
Ruby Life Pools	+10	26:39	322
Temple of Sethraliss	+10	27:08	326
The Blinding Vale	+9	~~33:10~~	271
Voidscar Arena	+10	24:28	327
Total M+ rating	2450

View on blizzard.com View on raider.io

I’m still mostly playing as a healer, but this one is a melee fighter who heals while doing damage. I previously shied away from melee classes as being right on top of the enemies always felt too chaotic compared to parking at the back of the room, but I’m actually really liking it. Once you get used to it, it’s a lot easier to keep track of the fight when you’re in the middle of things instead of hanging out at the back. This spec is currently one of the flavours of the month, it’ll be interesting to see if I still enjoy it as much when it falls out of favour.

Around the web

Making an original Jubilee line door button into a Hue light switch

A really cool electronics project, that does exactly what it says in the title. The finished product looks stunning, though.

llama.ttf

“llama.ttf is a font file which is also a large language model and an inference engine for that model.”

Departure mono

This is a really nice looking pixel font, and the web page demonstrating it is well done as well. Definitely going to be using it next time I need to render text in a small space.

Mitigating floods of posts in Artemis

James has been documenting his development of Artemis, a ‘calm web reader’, and I’ve been enjoying reading along. This particular post is interesting to me as it deals with a common problem with RSS readers (“the website has altered their feed in a bad way, now there are 50 ’new’ posts that you’ve already seen”) in a novel way that just seems so obvious in hindsight.

The longest way to represent a date

2026-03-14T00:00:00Z

The other day, someone on IRC posed this question: “What is the longest way to represent a date using any means possible that isn’t just repeated filler?”

Some people jumped for writing the date out in languages that had longer translations. My immediate reaction was instead to suggest an obnoxious string-based representation of a unix timestamp: “one second after one second after one second after … midnight on January 1st 1970”. It’s very repetitive, but it’s not filler: taking out any of the repetitions would change the value. Effectively it’s a successor function for unix timestamps, writ long. Some quick napkin maths suggests the full string representation would be around 30GiB¹.

An obvious approach to make it bigger is to make it more precise. If we do the same sort of successor function for milliseconds it’d be a bit over 1000x longer². It actually ends up being just over 35TiB³.

There’s no reason to stop there, though. You can step down to microseconds, nanoseconds, and so on… or… we can just skip right to the end. How about: “one oscillation of the caesium-133 hyperfine transition frequency after one oscillation of the caesium-133 hyperfine transition frequency after … midnight on January 1st 1970”? There are over 9 billion of those every second, and the phrasing is wordy. That comes out to almost 1ZiB⁴. If we pooled all the data storage on the planet together we could save a couple hundred of these timestamps.

One final step, then: why use the unix epoch when we could use the universe’s own⁵? We’re something around 4×10^17 seconds past the big bang, so… hold on, I need to look up some units… that’d be over 200,000 yobibytes⁶. There’s not actually a standard prefix for that order of magnitude, according to Wikipedia. I think it should be 200 robibytes. Does anyone have a contact at the IEC?

That is a big number. Is it impossibly big? If we wanted to track our current time, we’d need to write around 600GiB/s⁷ to disk. That’s a bit more than we can manage at the minute, but isn’t completely outrageous. What about storage? Apparently hard drives require around a million atoms to store a bit of data. There’s some research showing it’s possible to use as few as 12, but I don’t think it’s anything that can be used at scale anytime soon⁸. So just for the direct data storage, not counting all the other infrastructure you need for a disk drive to work we’d need around 10^36 atoms. If we sourced our atoms for our local paperclip maximiser we’d need around 200 trillion paperclips. For just one timestamp.

On the plus side, this timestamp format would compress wonderfully.

17 bytes of repetition * 1773528583 seconds ~= 3×10^10. ↩︎
There’d be a thousand times more repetitions, and each one would have the extra five bytes from the “milli” prefix. ↩︎
22 bytes of repetition * 1773528583000 milliseconds ~= 3×10^13. ↩︎
72 bytes of repetition * 1773528583 seconds * 9192631770 oscillations per second ~= 1×10^21. ↩︎
Other than it being impractical, not known to a decent accuracy, and the myriad other problems, of course. ↩︎
72 bytes of repetition * 4×10^17 seconds * 9192631770 oscillations per second ~= 3×10^29. ↩︎
72 bytes of repetition * 9192631770 oscillations per second ~= 6×10^11. ↩︎
Not that we could scale conventional drives up this much, either. ↩︎

Just a nod

2026-02-11T00:00:00Z

Last month I added a new feature to the bottom of almost all pages on this site: a “nod” button. It’s a bit like the upvote buttons you see on bear blog posts, or the ubiquitous like button you get on social media, with one key difference: it doesn’t track or count anything. Before I get into the whys and hows, this is what it currently looks like:

The nod button in all its glory. If you want a clickable version you’ll need to scroll a bit more.

So why bother? I like hearing from people who have looked at my website. I have a contact form that’s also embedded at the bottom of all my blog posts; it’s always a delight when people reach out. Actually writing a message is a pretty high bar that most visitors won’t clear, though. A like/upvote/whatever-you-want-to-call-it is a much less demanding interaction.

And why no counting? I’d been thinking about some kind of upvote button for a while, and counting was always the thing that put me off. Having a number attached to a post like that feels like I’d end up invoking Goodhart’s law and start aiming for a certain number of upvotes or likes or whatever. I don’t want to be anxiously watching numbers, or feel pressured to make a post “good enough” (I already self-filter too much…).

As for not tracking people, that feels like table stakes to me: I’m an individual concerned about privacy, not a giant mega-corporation who wants to slurp up all the data to serve ads or engagement bait feeds. I don’t really need to know someone’s identity to receive a message from them. In the olden days of the internet, you just knew everyone by screen names which could change on a whim and didn’t reveal anything about the real you. On the internet, nobody knows you’re a dog, as Peter Steiner said.

All these constraints felt insurmountable for a while. I considered just making a button that sent a contact form submission with a pre-filled message, but those end up in my e-mail inbox. I don’t really want to have to process them, especially if there’s a big traffic spike like when Hacker News notices one of my posts. I could store the button presses in a database, but then how would I actually know they happened, especially if I didn’t want to watch a number go up?

An Amazon Dash button

So I did what I usually do with these types of problems: ignored it for a bit. The idea rattles around at the back of my head, and sometimes I’ll come up with an answer. I’ve seen this called diffuse thinking. Eventually the idea bounced to the forefront of my head while I was looking at my IRC client, and the solution suddenly clicked. If you’ve not heard of it, IRC is a chat protocol that’s almost as old as I am. Daniel Stenberg has compiled a nice history of IRC that I won’t repeat here. I use IRC to stay in touch with friends, hang around the channels for some open source projects, and I also run a private server with just me and some notification bots.

The notifications I have on IRC are all “transient”: they’re handy to see in the moment, but it doesn’t matter if I miss them. I have some high-volume news feeds, log messages from some self-hosted services, details about git commits, and so on. Basically just background noise of things that are happening that don’t need action. Perfect for the kind of interaction I want!

Now that I’d finally figured out that the transient-notification-shape goes in the transient-notification-hole, I just needed to actually implement it. As part of that private IRC setup I already have a bot that accepts messages over HTTP and sends them to a channel, so the backend was pretty simple. For the frontend I was imagining something like the ill-fated Amazon Dash buttons. My first attempt was… underwhelming:

Flat UIs are in right now, right?… Right?

I guess I shouldn’t give up the day job to become a graphic designer. Fortunately, I came across this codepen from Thierry Michel with some very fun skeuomorphic arcade buttons. I spent some time and LLM tokens on converting the SCSS to CSS, changing the colour, and making a few other tweaks. I really love how this looks and feels.

This is what it looks like in my IRC client when someone nods (and when containers get pushed to the GitHub Container Registry for my projects…):

Receiving some nods on IRC via a bot

When I added the button I wasn’t sure if I’d keep it, but I’ve very much enjoyed seeing the “nods” come in every now and then. I’ve been surprised by how many come in for the various snippets and other non-blog pages on the site. It’s a nice reminder that people are out there browsing the site, without all the baggage of monitoring analytics or tracking likes.

An interesting Tailscale + Docker gotcha

2026-01-29T00:00:00Z

As I’ve written about before, I use Tailscale for a lot of things. I thought I had it set up in a reasonably secure manner, but I recently noticed a problem.

I use Tailscale’s ACLs to limit what each node can access, based on the tags I apply to it. So an app node can’t access anything via Tailscale, while an integration or server node can access things tagged with either app or integration. This is expressed pretty simply in the Tailscale ACL JSON:

{
	"tagOwners": {
		// Servers that can be SSH'd into
		"tag:server": [],
		// Applications that are exposed on tailscale but never connect out
		"tag:app": [],
		// Things which talk to other services over tailscale (connecting to apps etc)
		"tag:integration": [],
	},
	"grants": [
		{
			// Users can access everything
			"src": ["autogroup:member"],
			"dst": ["*"],
			"ip":  ["*"],
		},
		{
			// Servers and integrations can access integrations and apps
			"src": ["tag:server", "tag:integration"],
			"dst": ["tag:integration", "tag:app"],
			"ip":  ["*"],
		},
	],
}

Over the past week I’ve been setting up a private Forgejo instance behind Tailscale, complete with an actions runner that runs things using a docker-in-docker container. I didn’t want the runner knowing anything about Tailscale, so I had it configured to speak to Forgejo direct over HTTP (forgejo:3000) instead of using full Tailscale HTTPS URL that I use when accessing it (http://git.example-net.ts.net/)¹.

Everything was going fine, until I forgot to do that translation… and it worked. My Forgejo action runners could access anything on my tailnet. I run several things on Tailscale that just have authentication turned off, on the basis that only authorised devices can access them. Things like the admin interface for this website. I definitely didn’t intend for any workflow I run on my git server to have access to edit my website!

This wasn’t just limited to Forgejo, either. Any docker container I was running could access the tailnet. In hindsight it’s fairly obvious why: the host is running Tailscale, connected as a node tagged with my server tag. That creates a tailscale0 interface, and automagically sets up iptables rules to route Tailscale traffic over the interface. Docker also automagically sets up iptables rules to bridge traffic, and apparently these two sets of rules interact in such a way that traffic from Docker containers is allowed to route via the tailscale0 interface.

I say it’s fairly obvious in hindsight — there’s no reason why Docker would special case any particular host interface after all — but it still feels pretty surprising. Because both bits of software inject their own iptables rules, I never really had a good mental model for how they interact. The host Tailscale node was a completely separate building block to Docker. It would be a pain to use either of them if they didn’t do these rules, but it’s also one of the reasons I don’t really like “magical” things².

There are lots of ways to fix this, but none of them feel particularly great. You can configure both Tailscale and Docker to not automatically fiddle with iptables and handle the rules yourself, but I really hate dealing with iptables³. As a stopgap I did hold my nose and add some iptables rules to drop traffic to the tailscale0 interface if it originated from the IP ranges that Docker was configured to use:

iptables -I DOCKER-USER -s 192.168.0.0/16 -o tailscale0 -j DROP
iptables -I DOCKER-USER -s 172.17.0.0/12 -o tailscale0 -j DROP

The DOCKER-USER chain is a nice little escape hatch; it comes before the main auto-generated DOCKER chain, and Docker leaves the rules in it alone.

So I added these rules, and felt pretty good about myself, and then… everything started breaking in weird ways. After some debugging I realised the problem was DNS⁴. The server’s DNS resolver is 100.100.100.100, a special Tailscale address. This is so that it can resolve tailnet hostnames via MagicDNS (and so I don’t have to configure my custom DNS servers manually on each device; Tailscale does it for me). My new iptables rules inadvertently dropped all the DNS packets coming from docker containers. D’oh.

Obviously the solution here is to double down and add MORE iptables rules:

iptables -I DOCKER-USER -s 192.168.0.0/16 -d 100.100.100.100 -o tailscale0 -j ACCEPT
iptables -I DOCKER-USER -s 172.17.0.0/12 -d 100.100.100.100 -o tailscale0 -j ACCEPT

This got DNS working again, but it all feels a bit gross. Not least because to actually make these persist you need to use iptables-save, and then you also get all the rules that both Docker and Tailscale have inserted. I came across a script to filter out the Docker ones, but… yuck⁵.

I realised a cleaner idea might just be to lock down what server tagged nodes could access within Tailscale itself. That way I can avoid touching iptables at all. It’s handy to be able to curl services from the host when debugging, but it’s not really necessary. So I removed that access, and… stuff broke again. I’m using my Forgejo instance as a registry for some of the docker images I run, so the docker daemon needs to be able to reach it. I ended up making a new tag for infrastructure, which can be accessed from server devices. This does still allow all the docker containers to reach Forgejo, but I already have it set up with appropriate access controls and public/private repository splits. Forgejo is a service designed to run publicly, so this seems a reasonable trade-off for convenience. I used the tests feature of Tailscale’s ACL config to make sure I’d got the rules right:

{
	"tests": [
		{
			// Servers can only access infrastructure
			"src":   "tag:server",
			"proto": "tcp",
			"allow": [
				"tag:infrastructure:8080",
			],
			"deny": [
				"100.84.16.43:8080",
				"me@example.com:8080",
				"tag:server:8080",
				"tag:app:8080",
				"tag:integration:8080",
			],
		},
	],
}

The whole situation still feels a bit messy. If I ever get around to switching to nftables I might loop back and manually craft some rules for routing traffic, instead of leaving Tailscale and Docker to do their own thing.

I discovered later on that logging into the container registry at forgejo:3000 actually issued a redirect to https://git.example-net.ts.net/ so this was all basically for naught… ↩︎
I didn’t use Tailscale’s MagicDNS for a long time just because the word “magic” put me off. Only when I eventually got around to learning how it worked, and seeing that it wasn’t really that magical under the hood, did I change my mind. ↩︎
nftables seems far better in lots of ways, but I can’t really be bothered migrating. Maybe next time I reimage the server for whatever reason… ↩︎
It’s always DNS… ↩︎
Again, nftables would almost certainly help here. It actually has (gasp) configuration files. But again, I really didn’t want to spend the time migrating. ↩︎