esmevane, sorry

gotta pass the weeb check

man that fit is outrageous, hell yeah

a lot of people don't know this but the proper pronunciation of "vibe" is "weeb"

Heeey, look, it's me!

I'm super hyped to announce that @bsky.app have given me a grant to work on the standards for the Federated Credential Management API (or FedCM) to make them really work for all decentralized web applications.

atproto question: is there anything in atproto docs about users collaborating on a document? whose pds should it live on? how is this supposed to work? if its data that is not "personal" but shared, where is it supposed to live?

When I was modeling out how I'd do it on one of my (now tabled) pet projects, my thoughts were:

- CRDT / operational exchange, invitations/etc were app only, because of protocol pollution / privacy
- Meta details about the docs, "publication" lifecycle stuff, and social stuff were lexicon-friendly

That's funny! I think the best case scenario is vanilla: it's seen as average but it's actually exotic. It winds up being "optimal" and not average, because it actually is tasty and goes in lots of stuff, and offends virtually no one. So, popular, works in most things, and inoffensive vs. average

Security Like It's 1977: Capabilities for the Modern Agentic Web Explore how capability negotiation for A2A improves AI security by enforcing least privilege, reducing prompt injection risk, and strengthening MCP-style agent architectures and AI SAST controls.

I've had these two articles in my queue for a while for this exact reason:

semgrep.dev/blog/2026/se...

niyikiza.com/posts/capabi...

It just kinda seems like there's still some holes, I guess. They bring up the confused deputy thing and it feels like a valid problem, here. Reduced, but not gone?

I've been clocking this too. Hexagonal / functional core things, basically, with a design eye on supporting a versatile set of adapters.

A lot of folks have been pointing out that docs, tests, specs, etc., all have far more value now. I'd put the functional core principles in there too.

yeup.

the problem being solved here is non-trivial. it's basically IR (intermediate representation) and picking what that means for you.

if you use JSON, the IR is javascript objects. if you use html, your IR is fragments. if you use both, now you have to speak two IRs.

it's been my experience that every single "we're not really js, trust us!" is good up to a point and then if you hit a wall, you have to rethink just about everything that uses it or accept Multiple Approaches For The Same Thing, which carries a huge tech debt obligation with it

As just kind of a random tip, you can get like 80% of what hypermedia / restful design promises, with DIY code, because it's all about modeling your data structure so that it can be extended and linkable. jsonapi.org was the first time I saw someone do it, and it's similar to how I do things today

yeah... I always get uncomfortable when people's choice marketing tactic is to tear down other devs. It's no good.

You _can_ create hypermedia style extensibility with a lot of different mechanics. HTML is one, and it's broadly adopted already, and it has a huge edge because of that. But they're not doing anyone except a very special type of dev any favors by insisting its the only way.

I think pretty highly of hypermedia but I think you're right. They're being mean about JS and JSON to the extent that they're being dishonest about what they can offer.

in my case adopting htmx meant adding a completely redundant chain of rendering tools and output to everything, and an extensive redesign of some extremely simple handlers, in a way that didn't fit with anything else i was making - even though i leaned hard into restful structures. not a great fit.

as a way to get stock async behavior on stuff, htmx is great. fantastic even. but it has the same flaw that a lot of "you don't have to use icky js!" stuff does - maybe you can ditch js but you can't ditch the work it does. so that has to be done somewhere else. you're just moving the logic.

strong opinions about htmx forming after using it on some tools the last week or so.

the basic bottom line is: I understand that htmx needed to evangelize to get people's attention, and I agree with restful design, but I object to any tool that claims it gets rid of work, when it just moves it.

lol i was just thinking this morning "I need to just put this in commands"

I'll have to do a full read later, I just did a quick skim and it looks useful! I like that you mention having it explain its output. I've been doing that: draft code, ask it to do an explainer of everything it changed / why, then I read that while I review. Time consuming but incredibly useful.

I'd probably see if `satisfies Trait` were feasible. Like, permit any inbound thing that satisfies a trait I define but don't necessarily need to export outside of a package.

Then I'd look for hint language like "This type needs to satisfy TraitName to be used here, which has these required..."

I've been banging this drum for a few days now but: beginners can look at the docs we give the models. Skills, commands, almost all of it is process documentation. Like the Superpowers repo would be an effective playbook to give new hires to your org. Etc.

I tried. I expected some kind of... not redemption, exactly, but an angle to him that worked like a punchline, delivering a relatable motivation. The first episode was structured like that. Nope. Every reveal about him just made it clearer and clearer how horrible he was. I gave up.

My god if I just get to see her take down one bsky dweeb like this every few weeks my time here will be so, so worth it

I think there's a middle ground where we get better educational tools, by making better AI support harnesses. Like if you look at the Superpowers plugin, it's mostly incredibly thoroughly documented processes, practices, etc. Humans can read it too.

bsky.app/profile/esme...

Yeah I still don't have any luck, long-term, without passing all the code through my own implementation. Short term, yes, but then it grinds to a halt. Eventually I'll find things like data encoding in the db layer, etc. Sure it works, but once I move it to the right spot, both Claude and I benefit.

"Dark mode is a farce," I smugly announce as I draft and release yet another flashbang html page into the wild where it can assault yet more migraine sufferers. "There's no science to support it," my face shrinks slightly from the weight of my self-assurance. I'm so good at this, I speak only truth.

I guess the only upside is that if we can shift gears by 2028 we'd still be in the mess we're in now, yes, but we'd also be looking at ridiculous class and economic mobility for the kids in elementary school today. Worth believing in. Better things are possible.

This feels a lot like browser extensions to me. It seems so obvious now that I think about it to just provide a format w/ prepackaged host tags as a way to enable stuff like this.

Same! Really. And I'm also aggravated about our former consultancy repeatedly abandoning all of its apprenticeship training inventory work, for entirely human-related reasons, but in light of all this it seems even more preternaturally short-sighted and naive of them.