Cloudflare just published a vibe coded blog post claiming they implemented Matrix on cloudflare workers. They didn't, their post and README is AI generated and the code doesn't do any of the core parts of matrix that make it secure and interoperable. Instead it's littered with 'TODO: Check authorisation' and similar
As a proof of concept, we built a Matrix homeserver to Cloudflare Workers — delivering encrypted messaging at the edge with automatic post-quantum cryptography.
Rather than implementing the critical state resolution algorithm that's the core of Matrix, they just directly insert the latest state into the database. That'll instantly lead to diverging views of the room and incompatibility with every other implementation - and it's also a massive security hole.
Honestly this is almost insulting to me, as someone who has spent a nontrivial amount of effort developing a Matrix homeserver, with how low effort it is. And what’s the point? Marketing? I’m not gonna be trusting anything Cloudflare after this.
The pricing comparisons are stupid, by the way, too - a bunch of us in the matrix chatrooms got out how many HTTP requests per day we were serving and the per-request cost of Workers would be more expensive than dedicated VPSs - not even counting CPU time or storage costs!
For those of you that don't know, I develop continuwuity.org - a Rust based Matrix homeserver that actually works, and that you can run on a Raspberry Pi, rather than someone else's centralized cloud infrastructure
I'm really happy to share I'll be at #FOSDEM - I'll be giving a talk with @nex@fedi.transgender.ing about Continuwuity on Sunday. I'll also be at the @matrix@mastodon.matrix.
Tomorrow night join @Liz, for Full Circle from 7 P.M. eastern (US time). This week, the showcase returns for 2026, and in the third hour, Chickenman also returns. So tune in tomorrow night, and see who is hiding in the first showcase for 2026. HKCRadio.com
Franz-Josef Strauß, 25.01.1957: „Atomenergie wird eines Tages elektrische Energie in so großen Mengen und zu so niedrigen Kosten liefern, daß sie praktisch nichts mehr kostet.“
Friedrich #Merz, 27.01.2026: Deutschland solle „den ersten #Fusionsreaktor der Welt ans Netz nehmen“. Dann werde Strom so günstig, „dass es keine anderen Erzeugungsmethoden mehr brauche“.
Deutsches Schulbuch, 2095: „Jahrzehntelang hielten konservative Politiker an teuren Technologien fest und verursachten hohe Kosten“
Ich bin definitiv pro Fusion. Das sollte massiv ausgebaut werden! Auf jedem Dach, an den Balkonen, und überhaupt. Wir können diesen riesigen Fusionsreaktor, den wer-auch-immer vor Milliarden Jahren da ins Zentrum unseres Sonnensystems gesetzt hat, doch nicht auf ewig halb im Leerlauf belassen! Der liefert so viel, dass wir eigentlich keine anderen Erzeu… oh, der wird doch nicht etwa DAS gemeint haben? 🤪
Okay, so our generator's doing the weird thing again. We've all diagnosed it as a partially frozen regulator on our propane tank. What you're about to hear is AC hum recorded while this is going on. UPS's do not like what you're about to hear, almost certainly because the AC frequency is wobbling back and forth all the time. This is *not* normal!
"Die Regierung in Spanien will den Aufenthaltsstatus hunderttausenden Migranten ohne Papiere legalisieren - und verfolgt damit einen deutlich anderen Kurs als viele EU-Staaten. (...) begründet die migrationsfreundliche Politik seiner Koalition mit der Gefährdung des Sozialstaats und der Rentensicherung aufgrund fehlender Arbeitskräfte und einer überalterten Bevölkerung."
Driving my kid to school today, we passed a crowd on a street corner. She asked what they were doing. I said my guess was that it’s observers conferring about ICE.
That wasn’t really a guess What I knew that she didn’t know is that they were gathering because somebody was just abducted there.
Faltblatt zum Digital Independance Day (englischsprachige Ausgabe)
Hier: XMPP / Jabber
Dieses Faltblatt wurde von Freiwilligen ausgearbeitet, um auf das gute freie ...
#HardenedBSD applies the following compiler flags to #OpenSSL in the base operating system:
-ftrivial-var-auto-init=zero
-fsanitize=safe-stack
-fzero-call-used-regs=used
The OpenSSL port (in the HardenedBSD ports tree exclusively) only enables the first option.
I wonder if the combination of these features would mitigate the OpenSSL stack-based buffer overflow vulnerability announced today. I hope to answer that question this evening unless someone else beats me to it.
"about a week before his death, he suffered a broken rib when a group of federal officers tackled him while he was protesting their attempt to detain other individuals."
In a statement, the Department of Homeland Security said that “DHS law enforcement has no record of this incident.”
It sure looks like they knew who he was, but don't want to reveal it was an #ICE #execution
** 2025 Wrapped - the traditional summary of my year. which also serves as an award eligibility post.
(Spoiler - I'm elibible for the Best Fan Writer Hugo Award. I have been a finalist every year since 2023, and I hope you will consider nominating me this year too.)
** If you're not familiar with how the Hugo Award nomination and voting works, Reactor Magazine has a good write-up. reactormag.com/anyone-can-vote… **
It sounds like there was another ICE shooting today but there's almost nothing known about what happened.
"The individual, who has not been identified, was shot in southern Pima County near milepost 15 of West Arivaca Road at around 7:30 a.m., according to a news release from the Santa Rita Fire District. The fire department said it transported the person in critical condition."
One thing I love about being involved in my College is I get a direct line on what young people are thinking.
In my circle of 30-50-somethings, it's taken for granted that "AI" is changing everything. Some people express caution that we shouldn't even take any position on software engineering education because it will be out of date within a week.
Meanwhile, my students are telling me that in their cohort, everyone is tired of AI and wants to learn proper software engineering.
One lesson here is: do you remember how clueless your boss was about everything? Recognise when you are in the "boss" demographic, and that your breathless enthusiasm and concern may be equally misinformed.
yes to an add-on updater, yes to a "reset Language settings to defaults" button. But all after work. Yes to Russian support. If people wait about 4 or 5 hours I'll see what I can get started towards the end of the day when I'm done with reviewing things and working on things that have well, actual deadlines.
I manually added a few coarticulation settings to pt-br.yaml in a text editor, with values different from the defaults. It seemed to have no effect, so I went to the language settings in the phoneme editor. Instead of the values I added manually to the file, the values in the phoneme editor settings were the default ones, so I needed to change them inside the settings dialog. Why is this? Can't the phoneme editor detect when I change the values and save the file in a text editor?
@clv1 oh hmm, you have to manually hit "save language" from the file menu in the phoneme editor to get it to re-write it. Should probably do a confirmation dialog though if you try to exit it without first hitting the save options and changed something, that's good catch there.
OK, now to another issue: the synth is adding a schwa after an r when it comes before consonants like f, m, r, s. this caused words like "permite, personalizado, interface, irmão" to sound strange, so I stripped off the schwa for testing, but then the r became too weak. One solution I found is to change the schwa to the other schwa, that's ᵊ can it be done with a single rule, or I have to normalize for every consonant?
@clv1 hm, you shouldn't. you can try it this way: normalization: classes: R_SCHWA_FOLLOW_CONS: # consonants that were causing the full-schwa to sound too syllabic # (you can expand this later if needed) - "f" - "m" - "r" - "s"
replacements: # If we have r + schwa and the next phoneme is one of the consonants above, # swap schwa to the reduced schwa ᵊ so /r/ stays audible without adding a full syllable. - from: "rə" to: "rᵊ" when: beforeClass: R_SCHWA_FOLLOW_CONS
One more detail: I did the following steps: 1. Add a rule using a text editor and save the file; 2. Go to the phoneme editor and save the file; 3. Now when I command the editor to speak something, it successfully takes into account the rule I've just added. However, the normalization rules list view is not updated accordingly. This issue applies to other lists like language settings as well.
@clv1 oh yeah that's tricky since we'd have to check whether you made manual changes outside the editor for that one, like every minute, read the file or something. I'm not sure if we can do it without you needing to quit and reload the editor, though I can do a "reload language" option in the menu that can help this. Otherwise it becomes a mess with syncing whether the file was modified or not and more like the auto-save features in word haha. Not impossible, but right now yes, it only checks it once when you arrow to the language. So actually just up/down arrowing again will reload the new one.
I'm trying to add voicing to the phoneme whose key is x. Is it enough to change _isVoiced to true? I did it, but I cannot notice difference. Is the difference really subtle?
@clv1 Setting _isVoiced: true on a phoneme does not actually add voicing. It’s metadata. It just says “this sound may carry voicing”, but it doesn’t generate any buzz by itself. It also allows for timing rules on that phoneme (voiced things are allowed to be longer) If voiceAmplitude is still zero, the DSP has nothing periodic to work with, so your ears hear… nothing new. That’s why changing _isVoiced on x feels like it does nothing, it kind of does nothing. To hear a difference, you must give the phoneme a voiced source and mark it voiced. For example: "x": _isVoiced: true voiceAmplitude: 0.18 fricationAmplitude: 0.55 Now you’re actually mixing voicing + noise, which is how voiced fricatives work in Klatt. The effect will still be subtle (that’s normal), especially at fast speech rates, but it’s there.
@clv1 I hope you do find out something interesting! We can always tune the main phonemes based on it. I'll be updating the Phoneme editor as well; It now supports F5 command to refresh from the text file in the editor.
Philip Glass has withdrawn his symphony based on Abraham Lincoln from the Kennedy Center, with the award-winning composer writing to the board of the arts institution that its values conflict with the work.
What we pay for electricity should cover proper replacement and scheduled maintenance... so, why doesn't it?
Documents show the utility has long identified Hampstead substation as a weak link in the local grid... but f*ck the anglophones—let them freeze, let their pipes burst, let their food go bad—they have insurance, so STFU, eh
they're not going to crack Signal's encryption, they absolutely have infiltrated these group chats a long time ago posing as concerned citizens trying to collect data on ICE agents and ICE activities
but I guarantee the majority of Signal users in that chat aren't using usernames, but still their phone numbers. So now you have all these contacts on Signal who have exposed their phone numbers to you, and you can look up who owns the number and start terrorizing those citizens for conspiring against ICE
oooh I guess the usernames don't protect you at all anyway
> If Signal receives a subpoena demanding that they hand over all account data related to a user with a specific username that is currently active at the time that Signal looks it up, they would be able to link it to an account. That means Signal would turn over that user’s phone number, along with the account creation date and the last connection date. Whittaker stressed that this is “a pretty narrow pipeline that is guarded viciously by ACLU lawyers,” just to obtain a phone number based on a username.
so they'll just get your identity anyway, because we know they won't be able to guard this from the government no matter how "vicious" these ACLU lawyers think they are
If you write about the messy reality behind "free" internet services: we're seeing #OpenStreetMap hammered by scrapers hiding behind residential proxy/embedded-SDK networks. We're a volunteer-run service and the costs are real. We'd love to talk to a journalist about what we're seeing + how we're responding. #AI #Bots #Abuse
@pietervdvn Because that would involve a human using their brains or having a shred of conscience and those both go against the basic principles of the companies doing this.
I am halfway tempted to create a new mastodon account, and only follow people with a very common name, like James, John, or whatever. Not really sure why this popped into my head, or what I would actually do with it.
Fun fact: over here in Germany, at least a few years ago, there were more Michael's and Thomas' in leading positions of companies than actual women. So I guess, for german accounts those names would be Thomas and Michael. Then again, I just ran into some very bad conversations with a Michael about accessibility lately, and I don't think i'm not going to give them a second chance so soon.
This is a reminder that Apple’s entire executive team and Board of Directors actively support Tim Cook, friend to convicted sexual offenders, and destroyers of democracy.
Well done to the person in Philadelphia government who sent an emergency text to everybody in area with a link to chubbyparade.com, a porn site, instead of a weather site
When I did the promotion for the Firefly movie back in 2005, Universal gave the website and Browncoats stuff to me (unpaid) and instead spent the marketing money on merchandise to give out.
Unfortunately they got the website name wrong and printed a porn site name on everything, so it had to be destroyed.
Cloudflare just published a vibe coded blog post claiming they implemented Matrix on cloudflare workers. They didn't, their post and README is AI generated and the code doesn't do any of the core parts of matrix that make it secure and interoperable.
That is certainly up to you. But I don't see anything wrong with asking for donations. To me, it doesn't matter what kind of a job you have. If I like what you produce and can afford to do so, I certainly will donate.
For what it's worth: I'm not personally opposed to donating to projects operated by people with full time jobs. Not all work pays well or is secure, after all, and a lot of open source work goes on outside of office hours.
In your particular case, though, you have recently very publically talked about spending $22,000 on braille displays. Now I don't know if you split that with your partner, put it on credit cards, remortgaged your house, paid it outright, sent them a suspitious briefcase full of cash, or what. And I don't actually care; it's your money.
But, that sort of outlay does suggest you're not financially struggling, so I might be more likely to donate to a project maintained by someone for whom the funds might go further.
Just some thoughts. No judgment intended in any way.
@jscholes yeah, I think my feeling more is, it's not a full-time job, just something I (mostly) do after work or during my lunch when I can, else I'd risk jepordizing my job by shirking responsibilities and that isn't the way to live. So it really can't become my full-time gig unless I purposefully made it that and asked for donations, and people may carry that as an expectation on the project itself because they did so. That can get quite ugly too. Haha and thankfully we did split the displays, but I mean, both of us have full-time work so definitely not struggling with paying the house ETC. So, with that obligation burden, probably no donate button. xD
I wonder, if I'm nominated for something and two people need to second, then there's a second second required, so is a second second really a third? Anyway, I'll try to be patient and wait more than a second for people to second.
And feel welcome in the Droidiverse 😜
Jade
in reply to Jade • • •Jade
in reply to Jade • • •This is a core part of the protocol, that's not exactly simple (spec.matrix.org/v1.17/server-s…)
They just have TODO comments, and happily accept anything, even if it's blatantly forged
Server-Server API
Matrix SpecificationJade
in reply to Jade • • •Jade
in reply to Jade • • •Jade
in reply to Jade • • •Jade
in reply to Jade • • •Jade
in reply to Jade • • •Continuwuity
continuwuity.orgJade
in reply to Jade • • •I'm also giving a talk about some of the actual work that goes into building this software in a few days at FOSDEM, if you want to learn more:
tech.lgbt/@JadedBlueEyes/11595…
Jade (@JadedBlueEyes@tech.lgbt)
Jade (LGBTQIA+ and Tech)Jade
in reply to Jade • • •Oh look, they’re trying to cover up what they did too
github.com/nkuntz1934/matrix-w…
Archive link for posterity:
web.archive.org/web/*/github.c…
Clean up code comments · nkuntz1934/matrix-workers@2d3969d
GitHubThe Matrix.org Foundation
in reply to Jade • • •Matrix on Cloudflare Workers
Matthew Hodgson (matrix.org)