Dan

Dan

@danknauss.com

Cripping from the margins on maintenance, repair, disability, and conviviality. Blogging about the work of keeping things going (software, bodies, communities. and the commons) — and the things we have to refuse or do without so our work can stay humane.

131 followers317 following162 posts

Dan reposted

have you ever tried to learn Git branches and gotten stuck? I'm working on a new tutorial on Git branching for total beginners to branching and I'd love your feedback! Sign up here and I'll email it to you: forms.gle/dbZn4WRi31vs...

The mysterious case of five corrupt databases Five of my six local WordPress databases turned out to be corrupt, three of them untouched for a week. The disk was innocent, my tools were only accomplices, and the most likely culprit was a command-line tool I'd forgotten I installed....

badsector.blogThe mysterious case of five corrupt databasesFive of my six local WordPress databases turned out to be corrupt, three of them untouched for a week. The disk was innocent, my tools were only accomplices, and the most likely culprit was a command-line tool I'd forgotten I installed.

Keel 0.9.0 is better at detecting and warning you about conflicts affecting the key defaults it covers, especially autoupdate policies. It also gives you a heads-up and manual install option for the latest secure update on your branch if you're not on it.

To build semi-automated research and clinical trial watch tools for CMT.blog, I had to decide what terms to use to find and filter the likely most relevant "CMT" information. I'm a lumper, which is useful in cases like this, but without significant splitting you get only the haystack and no needles.

cmt.blogCMT BlogIndependent patient advocacy on Charcot-Marie-Tooth and other neuromuscular diseases: the science, accountability reporting on charities and drug developers, and Canadian resources.

A follow-up to my post on the WordPress Abilities API's public flag, prompted by questions from Nimesh Patel and Andrey Ovsiannikov. On a test WooCommerce store, a customer account was enough to get into the MCP Adapter. On any site, whichever permission filter runs last decides who can run an…

badsector.blogWith Abilities, the last filter decides who gets inAbilities don't give a plugin one new attack surface. They give it several, and some belong to other plugins. Which doors are left open depends on whichever filter runs last.

Books have been rich in metadata, good at social media, and made by many hands — scribes, printers, editors, readers in the margins. The lone author is the odd exception, not the rule.

Dan reposted

When I started with #ActivityPub for #WordPress, it was a small experiment. Now almost 4 out of 10 #Fediverse servers are WordPress sites, and it is still growing, slowly but steadily. Come and join us @activitypub.blog 🎉 https://fedidb.com/software?st=servers

fedidb.comFediverse Software | FediDBEvery software project on the fediverse, ranked by servers, accounts and monthly activity. Compare Mastodon, Pixelfed, Misskey, PeerTube, Lemmy and more on FediDB.

Dan reposted

You can’t always see what someone is going through. 💙 Invisible disabilities are real, even when they aren’t obvious to others. Listening, believing people, and letting go of assumptions matter. globalnews.ca/news/1002645... #InvisibleDisabilities

globalnews.caA decade of disability awareness: Invisible Disability Association marks anniversary | Globalnews.caThe Invisible Disability Association marked the third week in October as Invisible Disability Awareness week.

Dan reposted

Plain-Language Research Summary: A Blood Test for Nerve-Fibre Loss in CMT A 2025 study found the nerve-damage protein NfL more than twice as high in the blood of people with CMT, and loosely linked to severity. What it shows, what it can't, and how it fits with earlier studies....

cmt.blogPlain-Language Research Summary: A Blood Test for Nerve-Fibre Loss in CMTA 2025 study found the nerve-damage protein NfL more than twice as high in the blood of people with CMT, and loosely linked to severity. What it shows, what it can't, and how it fits with earlier studies.
View full thread

Unfortunately, nerve conduction velocity and amplitude don't map to clinical, physical symptoms, they don't track mobility loss, and they don't have much to do with the lived experience.

Hopefully that limited NCV data will increasingly be supplemented with the results of other test methods, like muscle biopsies and blood tests. Diagnostic tech for CMT is due for big updates and reform.

Plain-Language Research Summary: A Blood Test for Nerve-Fibre Loss in CMT A 2025 study found the nerve-damage protein NfL more than twice as high in the blood of people with CMT, and loosely linked to severity. What it shows, what it can't, and how it fits with earlier studies....

cmt.blogPlain-Language Research Summary: A Blood Test for Nerve-Fibre Loss in CMTA 2025 study found the nerve-damage protein NfL more than twice as high in the blood of people with CMT, and loosely linked to severity. What it shows, what it can't, and how it fits with earlier studies.

Nerve conduction studies are still the most common (and often poorly understood) diagnostic tech for CMT and related neuromuscular diseases. They date back to the 1960s-70s. I've had one done annually for quite some time, never on a machine with an edition of Windows newer than Windows ME!

In WordPress 7.1, a “public” ability is not a permitted one WordPress 7.1 adds a public flag to the Abilities API. It decides whether an ability can be seen and reached from outside, not whether a caller is allowed to run it. I checked the dev notes against the 7.1.3 code, WP-CLI, and the MCP…

badsector.blogIn WordPress 7.1, a “public” ability is not a permitted oneWordPress 7.1 adds a public flag to the Abilities API. It decides whether an ability can be seen and reached from outside, not whether a caller is allowed to run it. I checked the dev notes against the 7.1.3 code, WP-CLI, and the MCP Adapter: each channel has its own exposure rule, and one filter can let an anonymous request run an exposed ability.

My tech catalogue at counterfoil.org might be seen as a Techno-Skepticism Archive, but it actually aims at finding a middle ground, so I am absolutely going to integrate it with the Techno-Optimism Archive's data. Really happy to find this, thanks to Dense Discovery.

counterfoil.orgCounterfoilCounterfoil studies the point where a tool stops serving the people who use it. A catalogue of convivial tools, research notes, and a few tools of our own.
Techno-Optimism Archive@technooptimismarch.bsky.social

The data paper for Techno-Optimism Archive is now published! All the data from the archive are publicly available on Zenodo, regularly updated, and open for research and other uses. For anyone interested in the methodological nerdy details, the paper explains everything. (all links in the comment)

I didn’t build a 2FA plugin. I filed bugs, then built around the best one. WordPress's Two Factor plugin already checks the codes. Instead of writing yet another 2FA plugin, I filed bugs against it, fixed some, and built two small add-ons beside it: one for policy, one for onboarding. Here's why…

badsector.blogI didn’t build a 2FA plugin. I filed bugs, then built around the best one.WordPress's Two Factor plugin already checks the codes. Instead of writing yet another 2FA plugin, I filed bugs against it, fixed some, and built two small add-ons beside it: one for policy, one for onboarding. Here's why separating mechanism from policy works.

Name Games: Why CMT Type Names Are a Mess, and How to Find Reliable Information CMT's type names grew out of nerve tests and a run of lettered genes. They no longer line up. Here is how the naming got this messy, where it is heading, and which sources to trust....

cmt.blogName Games: Why CMT Type Names Are a Mess, and How to Find Reliable InformationCMT's type names grew out of nerve tests and a run of lettered genes. They no longer line up. Here is how the naming got this messy, where it is heading, and which sources to trust.

Sudo’s tests agreed with Sudo. WordPress didn’t. Sudo passed 1,663 tests while missing seven ways around its password prompt. Its code and tests shared the same mistaken model of WordPress requests. The lesson: check the assumptions against core, use independent review, and prove that tests fail…

badsector.blogSudo’s tests agreed with Sudo. WordPress didn’t.Sudo passed 1,663 tests while missing seven ways around its password prompt. Its code and tests shared the same mistaken model of WordPress requests. The lesson: check the assumptions against core, use independent review, and prove that tests fail when the guard is removed.

Trial Watch #1: CMT Clinical Trials, October 2026 The first Trial Watch: the CMT drug trials under way or changed since 2024, from a Novartis CMT1A study recruiting only in Canada to a cancelled govorestat trial, with a plain-English note on each....

cmt.blogTrial Watch #1: CMT Clinical Trials, October 2026The first Trial Watch: the CMT drug trials under way or changed since 2024, from a Novartis CMT1A study recruiting only in Canada to a cancelled govorestat trial, with a plain-English note on each.
View full thread

Thankful this week for public health care and publicly funded research. They need protecting. Canada's National Research Council co-funds a CMT1A study with a US charity and the startup it holds a stake in, run by one of its own directors. Public science deserves public accountability.

cmt.blogShark Tooth: The CMTA's Stake in a Director's BiotechIn 2025 the CMTA held a $248,763 stake in a for-profit CMT1A company controlled by one of its own directors, built from donations earmarked for it.

The CMT and disability researchers, clinicians and advocates I most want to follow are on Bluesky, but can't be followed from the fediverse or from this blog. One follow of @ap.brid.gy would change that. Here's who I'm asking, and why it matters:

cmt.blogAn Open Invitation to CMT and Disability Voices on Bluesky: Please Bridge to the FediverseThe people CMTers most need to hear from are on Bluesky but invisible to the fediverse. One follow fixes that. Here's why it matters, and who I'm asking.

Updated today with the results of a rescan of the same sample two days later.

Dan@danknauss.com

Who actually gets WordPress security backports? WordPress sends security fixes back to the 4.7 branch, and they install by default unless blocked. Ten hours after 7.1.3, 93% of sampled 7.1 sites showed the latest patch or the one before it. On… https://badsector.blog/who-gets-wordpress-backports/

Before the second watershed Illich asked counterfoil research to detect a tool’s harm in its first stages. Where that beginning lies on the road to his second watershed, and why it is so hard to see.... https://counterfoil.org/2026/10/09/before-the-second-watershed/

counterfoil.orgBefore the second watershedIllich asked counterfoil research to detect a tool’s harm in its first stages. Where that beginning lies on the road to his second watershed, and why it is so hard to see.

Why I retired my own security plugin Sudo was a plugin that asked WordPress administrators for their password before they did something dangerous. An AI audit found seven ways around it with an active admin session. That points to a fundamental architectural problem that only WordPress core can…

badsector.blogWhy I retired my own security pluginSudo was a plugin that asked WordPress administrators for their password before they did something dangerous. An AI audit found seven ways around it with an active admin session. That points to a fundamental architectural problem that only WordPress core can address.