Quality Ostrich

@aphyr@woof.group @nanobri@woof.group I'm okay here too1. Helping any respected, reputable queer organization (or queer person in need!) will likely do more good than tipping me. :) Though, if someone really wants, I'm not going to say no. My linktree has tip jar links. ↩︎

@aphyr@woof.group :neodog_aww:

@doctormo@floss.social I can't help with Anubis, but I created iocaine to keep the crawlers away from my systems. It can even be told to firewall off the worst offenders, and unlike Anubis, generally stays out of the way of legit visitors. If you're interested, I'm happy to help setting it up, or applying other (nginx-only) measures to help keep the crawlers at bay. @diemkay@hachyderm.io

Tabstack1 emailed me that they see I have an account2, but made no API requests3, and they would like to talk about why, to understand. Do I tell them? Should I tell them I only signed up to figure out how to block them, did that in two requests, thankyougoodbye? Mozilla's scraping platform. ↩︎ Correct. ↩︎ Incorrect, I made two. They both errored out, and revealed internals to the user, me. ↩︎

Okay. I'm at the PC now. Lets get down to business. I'll move OJF to the iocaine org first, will tweak my postfix config a little, then open up the port forwarding on Eru, so I can receive mail from outside - so I have something I can test with under production circumstances. Then I can get down and start writing the milter. There's an indiemilter crate I've been eyeing that looks like a good foundation to build on.

0.5 score for low nesting depth (average 1.5), a direct consequence of having small functions - I don't need to nest deep! Big Nesting is evil. Not liking Big Nesting makes me an AI, allegedly.

Also, a few more incredible opinions in this tool: Consistent use of ? is an AI smell, because why the fuck wouldn't human authors prefer consistent error propagation.Preferring exhausting matching in match expressions is an AI smell, because following best practices is now a thing only AI do.Long method chaining is also an AI smell, because composability and the builder pattern are inherently inhuman or something.Relying on type inference is also an AI smell, because a human will always write annotations, because their language server can't tell them the underlying type or something.

But now I need a name!

@alice@lgbtqia.space tits would definitely be on the Fediverse, and they'd all be lining up to model for @babe@glitterkitten.co.uk Ducks would be all over fedi too, butting into random threads with buttpics.

Also 0.8 points because I consistently use Self instead of naming the struct/enum. We're an AI, clippy and I.

There's one annoying problem with the current setup: I'm using haproxy to proxy the connections to Luggage. So postfix sees the external IP as Eru's IP. I suppose... I suppose I should run postfix (and ryoms) on Eru, much like I run Caddy and iocaine there too. Thus, only Aerogramme (and Garage) would be in the homelab. The downside of this is that postfix's queue will take space on Eru, but... there's ~13GiB free. A mail queue will fit there fine.

Received: from telchar.local (unknown [10.69.0.1]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature ECDSA (prime256v1) server-digest SHA256) (No client certificate requested) by fax-machine.174070135.xyz (Postfix) with ESMTPSA id E5FE610E7C65 for ; Sun, 19 Jul 2026 13:58:09 +0200 (CEST) From: Gergely Nagy To: Gergely Nagy Subject: Test message, whee! x-ryoms-been-here: yes Hello world. Baby steps! Can't do anything yet, but wired up all the callbacks, printing all the info they receive, and I can inject a header.

I received 0.5 points for zero trailing space and machine-perfect formatting. I mean, this is Rust code. I run cargo fmt as a pre-commit hook. It is going to have no trailing space and will be machine-perfect formatting! Because I ran cargo fmt on it. I can do that without an AI, surprising as it may be.

Last night I described an idea for a JavaScript-less theme switcher for my static blog, using a cookie and a little help from Caddy. Today, I implemented both parts. If you visit Chronicae Novis Rebus, you'll find a new menu item: theme. You can select your theme, it'll be stuffed into a cookie, and the site will remember it. No JavaScript, no localStorage, still a static site, with a tiny bit of help from the reverse proxy. I'm pretty darn happy with how it turned out. This will also allow me to add other kinds of themes in the future, too! I have some ideas.

Strict no LLM / no AI policyHosted on CodebergGood governance Much to like. Gotta find a good project to learn the language with.

In summary, this tool attributed pretty much all code quality improving properties to AI, and works under the assumption that human-written code is imperfect, and does not use any kind of automated, non-AI tooling for formatting and quality control and whatnot, and that documentation is something humans do not write. Short, simple functions? AI! Thorough documentation? AI! Low nesting depth? AI! Consistent formatting? AI! Meanwhile, most AI code I saw were the exact opposite.

Named the project nullvad, and CI will run the gather & publish stuff daily. There's a package overview, and you can grab the tarball directly too: curl -OJ https://git.madhouse-project.org/api/packages/algernon/generic/nullvad/latest/mullvad-servers.tar.zst Tarball includes the extracted JSON, the IPv4 and IPv6 addresses as plain text list, and a date -Is timestamp. Have fun, fuck Mullvad.

1.5 score for all public functions being documented is apparently an AI signal. Because a human can't obsessively document their APIs. I do not have enough facepalms.

Eh, it doesn't matter.

@tyler@typing.ink @aphyr@woof.group The reason iocaine serves garbage is that it can serve poisoned (and later recognizable) URLs, to overload the crawler's queue. This way, when they come back riding remote controlled chromes, they'll hit poisoned URLs, and will end up in an infinite maze of garbage too. It's also possible to configure iocaine to block certain requests (temporarily firewalling the IP off for a time) - for example, when they hit a poisoned URL. This firewalling bit got my incoming dily requests down from ~100m/day to ~2.8m/day. So iocaine is perfectly capable of blocking these. But blocking them prevents poisoning the crawling queue, which reduces the effectiveness of poisoned URLs, so by default, poison's served. Said poison is also extremely cheap to generate (and will be even cheaper in the not too distant future), cheaper than serving a small static file from a filesystem even. Every crawler trapped in the maze is a crawler that isn't hitting your backend. With that said, I see two major differences between Anubis and iocaine: Anubis - usually - presents a proof of work, which both crawlers and humans need to bypass. Crawlers have more money to burn, and if they really want to, can bypass it (like they did against Codeberg). If a proof of work is presented, a crawler has a chance to get through. iocaine is passive, and uses various heuristics to catch crawlers. If it traps a bot, there is no way out. There's also no proof of work challenge for the human visitor, either. They both aim to do the same thing: reduce the load on services behind them. Their approach is wildly different, even if the goal's similar.

@rl_dane@polymaths.social @ariadne@social.treehouse.systems @whitequark@social.treehouse.systems 'tis not very hard, because the bots are dumb. Serve identifiable bots garbage, with poisoned urlsAnything that hits a poisoned url gets 12 hours on the firewall. TVs gone! You see, most bots follow a crawling queue. Fill it with urls you can identify, and you can IP ban them on first hit, regardless of how well they try to hide. This got me down from 100mill requests/day to 3mill (could go below 1m, if I blocked more aggressively, but I want to keep their queues poisoned). Poisoning a model is hard. But poisoning crawler queues is trivial, and makes 'em easy to block. Fuck Blright Data & its ilk though.

If you're someone who wishes to block Mullvad VPN servers from acessing your stuff, on grounds that one of their founders is responsible for financing 70+% of a Swedish far-right party, I have some good news for you! I wrote a little script that grabs Mullvad's server list, from their own website, extracts the server list as JSON, and generates a few useful renderings of the data. My CI runs the collection nightly, there's a nice package overview, and you can grab the tarball with curl, too: curl -OJ https://git.madhouse-project.org/api/packages/algernon/generic/nullvad/latest/mullvad-servers.tar.zst The tarball includes the extracted JSON, a flat plain text list of IPs, an nft script to block them, and a $(date -Is) timestamp file for good measure. You can use nft -f mullvad-block.nft to firewall all of those IPs off.

@bagder@mastodon.social No. Even less so when it's slop.

Still only a vague idea about how I want the actual Roto program to look, mind you. There's plenty to figure out there. Like, I want to have a library of convenience functions, which are not in Rust, but in Roto. And I'd like to let the system load any number of arbitrary modules before the main script, so the main script can then make use of them.

Now, the scores posted at the start of this thread are scores for one file only. This thing can't score the entire directory, only individual files. But similar distribution applies to most other files. Human signals seem to be: Short variable names (<= 3 chars), because why the fuck would I write for i in 0..100 differently, for a very short for loop in a very short function? Do you want me to write for index_of_some_bullshit in 0..100? Why?allow/cfg pragma directives. Ok, fine, I guess that's a human thing  to do.Ticket/issue references, because we never saw an AI hallucinate a ticket/issue id, so any such references is a human signal. Surely.

Can We Understand How Large Language Models Reason? No, we cannot. LLMs would have to start reasoning first, otherwise there's nothing for us to understand. #algernonReviewsHackerNews

Google copied our open-source code, removed engineers' names without credit Yeah, they do that from time to time. It doesn't help that codegooners normalize "AI"-washing copyright and credits away with "I can rewrite chardet with an LLM and change its license, past contributors and copyright holders be damned", and "zomg it's just fair use, the LLM spit it out, we didn't know it's bit for bit stolen!!1". But yeah, when the Google steals your shit, that hurts. We wanted to build the best agent in the world to control any mobile interface with natural language. Oh never mind. Fuck you both! #algernonReviewsHackerNews

Looks like smtp2go can deliver to it fine too. Cool, cool. We can start working on the milter then!

Also, with lunch out of the way, it's time to put on some fine techno, and hack away on my milter.

...I'll deal with that later. My mail on the experimental domain is kinda disfunctional at the moment, but... noone should be sending mail there to begin with.

I got 0.4 score for all lines being under 100 chars. Thanks cargo fmt. I got 1.0 for compact functions (14 lines average), because I prefer small, composable functions. I'm coming from a functional programming background (kinda), small composable functions are awesome. Clippy also complains about long functions, so if it yells at me, I oblige, and split shit up. Because I prefer understandable code. Unlike an LLM.

testssl.sh reports A+, I get some lower score on cipher strength, because the server doesn't present an order. I wonder if I can fix that.

0.8 score for diverse, descriptive names - mostly because clippy yells at me if my identifiers are too similar. Thanks clippy, we're AI now.

I think my postfix config is fine. Lets see what ports I need to open. Looks like I need 25 for SMTP, 465 for submission over tls. That's the only two ports postfix has open in the current config anyway. My old server has 587 open too, but I don't think I need that.

I woke up somewhat annoyed, looked at lobsters, hid 4 threads without looking at them. On one hand, go me, I don't need more annoyances in my life. On the other hand, there's a possibility my blocklist will be missing a few accounts. Chances are, though... I'll block the same accounts based on other threads later.

Funny historical tidbit: way back in the early 2000s, I wrote a POP3 server, and was halfway through implementing an IMAP server too before I got disctracted1. When testing Aerogramme, I telnet'd to the imap port, and all of the protocol knowledge came right back. 25+ years later, I still remember how to speak it. But I can't remember the bedtime story I told last night. I changed jobs, and no longer needed an IMAP server. ↩︎

I was awarded 0.8 score for having no .unwrap() calls. Because I have unwrap_used = "deny" in my clippy lints, and I run cargo clippy religiously. Pretty standard best practice is not an AI smell, my dude.

Someone else is still fast asleep, though. #DogsOfMastodon

Just laying out here in plain: iocaine does not rely on proof of work, stays out of the way most of the time, has no AI code (nor assets, or anything), will never have any AI code, and its author is unapologetically very much anti-AI. It still takes care of the crawlers, and can even automatically firewall them off for even lower load.

I've got 1.5 score for documentation comments. Apparently, thoroughly documenting my code is an AI smell. Like, dude... LOOK AT MY LITERATE PROGRAMMED REPOS! I write more documentation than code, if I'm left to my own devices.

Death of the Status Update: Why 55% of Americans Stopped Posting on Social Media Let me guess: because corporate social media is horrible? Who would have thought?! Now, if they'd join the Fediverse, followed hashtags like #Mosstodon, or #DogsOfMastodon, or any of the other delightful ones, they'd have a much better time! #algernonReviewsHackerNews

@grumpybozo@toad.social @alan@lighthouse.co.im @jwildeboer@social.wildeboer.net FWIW, you can still mitigate most of them if you look at headers other than the user agent. Many of the crawlers that try to disguise themselves as real browsers utterly fail at sending headers those browsers would, like sec-fetch-mode on any HTTPS request. With few exceptions, if the UA contains Chrome/ or Firefox/, and the request doesn't have a sec-fetch-mode header, the chance of it being a crawler is almost certain. I've been successfully mitigating pretty much all of them for about a year now (from ~100 million requests/day down to 3 million, the majority of which is served garbage).

I'm not in a computer touching mood today, it looks like. We also seem to have half1 the dogs and kids of our little town in our living room, so... I guess I'll go play. Counted 9 kids and 6 dogs, but there are two more rooms some could be hiding in. ↩︎