jwz

Here are my most popular blog posts from 2025, with the caveat that this might all be bullshit from bots.

For example, this year the number one hit was a blog post from 2022, that never had a large number of hits in any previous year, and also wasn't particularly interesting or controversial. An absolutely "mid" post, as the kids say. It had more than twice as many hits as the number two post. 99.5% of those hits came from the user agent:

Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko)

which is what all modern Apple Safari browsers now claim to be. (Yes, they all claim to be Intel.) So either these hits are from lying Apple browsers, or from lying AI bots repeating Apple's lie, and there's no way to tell.

"Popularity" here is based on page loads, not on comments or likes or boosts or whatever.

50: Blade Runners needed 49: jwz mixtape 254 48: Sax, possibly violence 47: Great moments in the internet service industry 46: Four way stop versus $100 billion valuation 45: Gavin Newsom Actually Sucks 44: Pi 4 SPI lossage 43: Poopin' Putin 42: Atomic Keyboard 41: Tempest, Pac-Man 40: Fucking Python 39: The Cringeocracy 38: CIA 37: Waiting For The Worms 36: RTMP / HLS segment corruption 35: Perennial "Fuck the Blue Angels" post 34: Qualifying Conditions 33: Wayland and screen savers (2023) 32: Under Attack, Please Stand By 31: 0xACAB8647 30: Werewolf Futures 29: Crosswalks hacked to imitate Musk, Zuckerberg 28: XScreenSaver 6.12 27: "An off switch? She'll get years for that." 26: Today in "Google broke email" 25: Basecamp alternative 24: Cube 23: XScreenSaver, Wayland and locking 22: Marc Andreessen, Murder Enthusiast 21: E-bikes 20: User agent blocking 19: Motherfucking Wind Farms 18: Now I have two problems 17: The Mothership Vortex 16: Fucking Python 15: "I prefer to meet people where they are" 14: On Blocking, Mastodon HOA Edition 13: Pro Tip 12: Exterminate all rational AI scrapers 11: You MUST listen to RFC 2119 10: The original Mozilla "Dinosaur" logo artwork 9: Today in Email Hegemony 8: Ambient age verification 7: Unpopularity Contest 6: Under Attack, Please Stand By 5: Wayland screenshots 4: Signal 3: Netscape Navigator 2.0 was released 30 years ago today 2: DMARC and SPF 1: Mosaic Netscape 0.9 was released 30 years ago today (2024)

Previously, previously, previously, previously, previously, previously, previously, previously.

I don't like to talk in absolutes about security, but... my headphones are 100% immune from the latest exploit, via this One Weird Trick!

Now hear me out...

I call it "eargapping". I learned about it in my Intro to Antique Coding class.

quat:

vendor of bluetooth chip used in sony, bose, and everyone else's headphones leaves debugging protocol completely open with no authentication over bluetooth low energy:

uh oh:

• remotely connect to headphones over thus protocol without needing a pairing interaction
• dump "now playing" data
• connect audio stream and eavesdrop
• dump your phone number
• brick the headphones
• dump the pairing key used to make your phone recognize your headphones as your headphones, and then impersonate your headphones

and that's when the REAL fun starts:

• talk to your voice assistant remotely
• make and manage calls while your phone is in your pocket
• eavesdrop from your phone microphone (by making you call them and then dropping the bluetooth connection so your phone switches to builtin mic)
• steal your whatsapp from 10ft away (since they have your phone #, the ability to accept the "we'll call and verify it's you" phone call before your phone starts vibrating, and the ability to listen and hear the code)
• steal your amazon (since you can login thru a phone number and a whatsapp confirmation code)

Previously, previously, previously, previously, previously.

Once again it feels like I read more books than this, but the teetering tower of OSHA violations does not lie. Here are the books that I enjoyed this year, in desk-stack order:

• Damned -- Genevieve Cogman
• Piranesi -- Susanna Clarke
• When We Were Real -- Daryl Gregory
• Ghost Station, Dead Silence, Cold Eternity -- SA Barnes
• Foundryside, Shorefall, Locklands -- Robert Jackson Bennett
• Letters from the Dead -- Isabella Valeri
• w0rldtr33 -- James Tynion IV
• City of Darkness: Life in Kowloon Walled City -- Ian Lambot & Greg Girard
• Kowloon Large Illustrated -- Kazumi Terazawa
• The Regicide Report -- Charles Stross
• The Adventures of Mary Darling -- Pat Murphy
• Descender Compendium -- Jeff Lemire & Dustin Nguyen
• Mr. Wilson's Cabinet of Wonder -- Lawrence Weschler
• Strandbeest, The Dream Machines of Theo Jansen -- Lawrence Weschler & Lena Herzog
• Howard The Duck, The Complete Collection Vol 1-5 -- Steve Gerber, etc.
• The Essential Ellison -- Harlan Ellison (I skimmed; he's much more uneven than I remembered)
• The Ghost Hunters Guide to the Alphabet -- Violet Blue
• Visual Experiments Lain -- Acura Honda & Takahiro Kishida
• An Omnipresence In Wired -- Yoshitoshi Abe
• The Art of Robert E. Mcginnis
• The Long Way to a Small, Angry Planet, Record of a Spaceborn Few, A Closed and Common Orbit, The Galaxy and the Ground Within, To Be Taught If Fortunate, Monk and Robot -- Becky Chambers
• Blue Champagne -- John Varley
• Come Closer -- Sara Gran
• Negative Space -- BR Yeager
• Vurt -- Jeff Noon
• We Are Legion, We Are Bob -- Dennis E. Taylor
• Time Windows -- Kathryn Reiss
• Rebel Girl: My Life As a Feminist Punk -- Kathleen Hanna
• The Secret History -- Donna Tartt
• The Night Circus -- Erin Morgenstern

But! I now have a strong theory as to why my book reading has been down. This was the year that I finally stopped living in denial and bought reading glasses. After doing that I came to realize that I had been following all kinds of stupid rules that I hadn't even noticed, like, "I only read books in direct sunlight".

Dammit.

(Yes, I read books on paper, no, I don't want to hear about your Kindle.)

Previously.

Here is some new music that I enjoyed in 2025. Despite the absolute shitshow of everything about this year, it was a pretty decent year for music!

In only vague and fickle order of favoriteness:

• Emika - Vega & Frames
• Ela Minus - Acts of Rebellion & Día
• Marie Davidson - City of Clowns
• Lou Hayter - Unfamiliar Skin
• Vanbot - How Could I Prepare For This
• The Knocks & Dragonette - Revelation
• Garbage - Let All That We Imagine Be The Light
• Scratch Massive - Nox Anima
• Screensaver - Three Lens Approach
• Black Honey - Soak
• Witch Fever - Congregation
• Pudéndüm - Øne
• Zanias - Cataclysm
• Chloe Qisha - Chloe Qisha & Modern Romance
• Au/Ra - Soundtrack to an Existential Crisis
• Wet Leg - Moisturizer
• Gloomy June - Gloomy June
• Lydia Night - Parody of Pleasure
• Scowl - Are We All Angels
• Shriekback - Monument
• Vowws - I'll Fill Your House With an Army
• Just Mustard - We Were Just Here
• Al1ce - As Above, So Below
• Catherine Moan - Chain-Reaction
• Causeway - Anywhere
• Llynks - Time Reborn
• Bootblacks - Paradise
• Immortal Girlfriend - Sojourner
• Ovrgrwn - Chasing The Good Dreams
• Momma - Welcome To My Blue Sky
• Sally Shapiro - Ready to Live a Lie
• Vague Lanes - Divergence And Declaration
• Winona Fighter - My Apologies to the Chef
• Guerilla Toss - You're Weird Now
• Magic Wands - Cascades
• Rocket - R is for Rocket
• Lambrini Girls - Who Let The Dogs Out
• Die Spitz - Something To Consume

Please enjoy jwz mixtape 256 -- a nice round number.

Previously.

I have just learned that, beginning in 3 days, my employees will no longer be able to receive their work email.

Apparently Google is dropping support for Gmail accounts being able to fetch mail from outside accounts. At all. And they announced this change less than 60 days ago. (The announcement was in the basement, stairs, leopard, etc.)

What I want to accomplish is simple:

1. When email arrives for [email protected], have it delivered to the inbox of [email protected].
2. When that employee is logged into that gmail account, have them able to send email with [email protected] in the From: header.

This cannot be accomplished by simply having mail.dnalounge.com forward messages for [email protected] to [email protected] because SPF destroyed email forwarding. Specifically:

1. [email protected] sends mail to [email protected].
2. The SPF record of example.com includes "-all" (strict) as is now common.
3. mail.dnalounge.com forwards that messages to [email protected].
4. Gmail says, "example.com does not permit dnalounge.com to send email on their behalf" and rejects it with "550 SPF hard fail".

My current email flow is this:

1. Inbound mail:
   1. Email for [email protected] arrives at my server.
   2. Message is stored in my server's Dovecot/Maildir.
   3. [email protected] has "Import emails from my other account (POP3)" selected, and Gmail has a saved plaintext copy of their mail.dnalounge.com email password to accomplish this.
   4. Gmail polls and downloads their email over POP3 every 30-90 minutes, sometimes longer. ← This is the thing that is going away.
   5. Gmail runs their aggressive spam filtering on that, and puts some subset of it into their Gmail inbox.

2. Outbound mail:
   1. [email protected] has its outgoing From address configured as [email protected] (via "Add another email address").
   2. When they use Gmail to send mail from their [email protected] address, Gmail delivers it to mail.dnalounge.com, authenticating with the saved plaintext copy of the employee's mail.dnalounge.com password.
   3. mail.dnalounge.com delivers it to [email protected], so the SPF record matches mail.dnalounge.com as the origin (and I don't have to have my SPF record say "any spammer on gmail.com is allowed to send mail pretending to be any dnalounge.com address.").

The linked article says "Gmail will continue to support IMAP" which sounds like: "Gmail can still poll your server to download email, you just have to switch from POP to IMAP". That would be fine if it were true, but it is not. Gmail does not and has never supported importing email via IMAP into the Gmail MDA/MTA. It only supports adding an IMAP server as a second account in the MUA, which is not the same thing at all.

Now that Google is removing the ability to have Gmail poll my server to download messages, what are my options?

Here are some things that people will suggest that are unacceptable:

1. Have the dnalounge.com MX record point to some Google thing and let them take over 100% of my company's email. Fuck no. Also it wouldn't integrate with our internal systems, store, transactional emails, bounce processing, etc.

2. Have my employees' official business email addresses end in @gmail.com. Obviously no. (Maybe @aol.com though.)

3. Use "Sender Rewriting Scheme" to have dnalounge.com rewrite [email protected] to customer%[email protected] before forwarding it to [email protected], which is insane, but also will cause any forwarded spam to be tallied against dnalounge.com and Google will just stop delivering them. At some point, Google's "best practices for forwarding" document specifically dis-recommended SRS.

4. Find some other third-party email provider that still offers the POP3-download service that Gmail used to, and tell my staff, "Great news everybody! You have to switch from Gmail to Hotmail now."

So the only options that I think I have left are:

1. Self-host IMAP.
   1. Every employee gets their own IMAP account, hosted on my own server.
   2. They can add that account to the Gmail mobile app or whatever, as a second IMAP account that is not Gmail. Which is apparently still supported. For now.
   3. My server is now responsible for storing all of their messages, including all of their spam. It is a vast amount of data. I will have to implement quotas.
   4. My employees will be wasting a bunch of time trying to find and delete emails with the same giant attachment in each of the 30 messages in the same thread, and if they don't, mail to them will bounce.
   5. "I can't find that old email any more" is a conversation that we will be having all the time.
   6. My employees will be receiving way more spam, since Gmail's spam filtering is (presumably?) still more effective than what I can accomplish with some stock set of spamassassin rules.

2. Walk North until I reach the nearest fjord, board an ice floe, lie down, and wait for my bones to turn to dust. The ocean will sequester my carbon. I hope this email does not find you.

Do I have other options?

In summary, everything is terrible.

Previously, previously, previously, previously, previously, previously, previously.

$400K lobster shipment hijacked en route to Illinois Costco locations

Dylan Rexing, CEO of Rexing Companies, said the shipment was picked up in Taunton, Massachusetts, but never reached its destination. He said the theft appears to be part of an organized cargo theft ring targeting high-value goods.

Previously, previously, previously, previously, previously, previously, previously, previously, previously.

It was ten years ago today that I decorated the Christmas tree in my building's heavily-surveilled lobby. Simpler times.

Happy Surveillmas!

Previously, previously.

Reminder that in 2022, the elves did their work in one night and gave us two perfect Christmas movies. In case you're looking for something to watch with mom.

Previously, previously.

Previously, previously, previously, previously, previously, previously.

tl;dr PG&E has been a criminal enterprise operating illegally in San Francisco for well over a century. Eminent Domain PG&E.

"Forget it, Jake. It's Chinatown."

The great PG&E debacle: A timeline 1898-1997: A deep dive into the scandalous history of the power company, including the Raker Act and Hetch Hetchy dam deal:

The more I got into the story, the more I wondered: How could this have happened? How could a private company, with the city's assent, break federal law for so long? So at one point, about 30 years ago, I flew to Washington DC and spent two weeks in the National Archives, reading and copying documents that relate to the PG&E Raker Act scandal. I carried home two big boxes full of records, and over the next few months, put together a detailed chronology of the Raker Act, the construction of the city's water and power dam at Hetch Hetchy, and the politics of how this all happened. [...]

1912: With Spring Valley's private water rates continuing to rise, and service as poor as ever, city officials press Congress to give San Francisco a radical and unprecedented federal grant: the right to construct a municipal water dam inside a national park. John Muir is furious, and rages: "Dam Hetch Hetchy? As well dam for water tanks the people's cathedrals and churches; for no holier temple has ever been consecrated to the heart of man." He has founded the Sierra Club to fight the proposal, and congressional preservationists line up against it. [...]

1925: Transmission lines are strung all the way to the South Bay, when suddenly the city announces that it has run out of money and can't do any more construction. The city's power line ends just a few hundred yards from a PG&E substation in Newark -- which conveniently connects to a new high-voltage cable PG&E has just completed from Newark to San Francisco.

On July 1, 1925, since the city lacks not only a final transmission line but the local facilities to distribute its own power, city officials agree, as another temporary measure, to sell the Hetch Hetchy electricity at wholesale rates to PG&E, which then sells it to local customers at retail. The city makes a few million dollars off the deal; PG&E makes a fortune. The remaining copper wire is stashed in a warehouse and eventually sold for scrap. Every supervisor who votes to approve the contract is thrown out of office in the next election. [...]

1935: Ickes issues a detailed opinion concluding that the city's contract with PG&E is a clear violation of the Raker Act. He urges the city to revoke the contract and move with all dispatch to establish a municipal power system. Mayor Rossi acknowledges receipt of the ruling and tells Ickes he's referring the matter to the city's Public Utilities Commission. [...]

1988: On New Year's Eve, the newly elected mayor, Art Agnos, is summoned to PG&E headquarters to meet with Dick Clarke, who tells him the facts of life: PG&E controls enough votes on the Board of Supervisors to block any effort at promoting public power. The contracts can't be changed and will never be stopped. And if Agnos doesn't want to play ball, PG&E will crush his political career. The city's budget analyst reports that the contracts are a bad deal and a violation of standard city procedures and takes the unusual step of recommending that the supervisors not approve the deal. A Guardian analysis shows that San Francisco is losing more than $150 million a year to PG&E by failing to comply with the Raker Act and establish a municipal utility. But the board votes 8-3 to go along with PG&E for another 37 and 1/2 years, and Agnos, the onetime public-power advocate who campaigned as an alternative to the pro-downtown politics of the Feinstein era, signs the contracts into law.

Previously, previously, previously, previously, previously, previously.