Daniel Norman

After the firefighting is done (and a nap) we'll need to have a long, serious conversation about the state of non-browser non-platform X.509 verifiers. The Linux status quo is "a pile of PEM files behind a dumpster" and that's not an acceptable excuse for a root store in 2026.

🚨 Six WebPKI Intermediate CAs are compromised. This is bigger than Heartbleed, but a client-side issue. Anything that verifies certificates against public roots, like most TLS clients, is/was affected. Details, live test, patched versions and workarounds at emudhra.we-have-a-problem.com Act now.

At dasl.ing, we work at the forefront of next-generation technology for democratic networks and highly-colourful websites. Many said we couldn't push the frontier any further. But we worked hard and @mosh.bsky.social found a breakthrough to make the site even more colourful. Tell us you love it!

CID Congress starting NOW! whereby.com/cid-congress

Join us for two great talks (and other fun discussions) at this week's CID Congress: 🔍 @norman.life on FISL, a new way to find CIDs in the wild 📦 @bad-example.com on STAR-lite, a stricter, leaner take on CAR 🗓️ Thu Oct 15, 12pm ET luma.com/8w8swmx2

You can find recordings from our meetup around the future code collaboration last monday on board of @c-base.org here: www.youtube.com/playlist?lis... Featuring a @radicle.dev overview by @lftherios.bsky.social a @radicle.dev demo by @norman.life and an introduction to @jj-vcs.dev by jan-erik

If you could not make it to @c-base.org for our session around the future of code collaboration after github you can tune in via @joinpeertube.org c-tube.c-base.org/w/fXcWyRvwss...

Tomorrow we will have an evening to discuss the frontier(SCNR) of code collaboration on board of @c-base.org We will have talks about @radicle.dev , @jj-vcs.dev, @tangled.org & rngit. RSVP here: platform.openmeet.net/events/code-... Don't get left behind (SCNR#2) when it comes to code collaboration

We just got a speaker confirmed to also introduce Jujutsu (aka jj) at our meetup on the 5.10 on board of @c-base.org This evening is shaping up nicely and we can have a look into a decent future for code collaboration after Git(Hub) Please RSVP here: platform.openmeet.net/events/code-...

If you have a Gmail account, you need to read this. Google's AI now scans your emails and attachments, bank statements, tax files, medical letters, all of it. It turned on by default, and there's a class-action lawsuit over how. Here are 5 moves to shut it off, the switch is hidden in two places:

What is the meaning of neutrality in times of such geopolitical turmoil?

@norman.life built ATFISL — a download-location lexicon for AT Protocol keyed by file CID. Multiple URL schemes per file, per-URL expiry, content-addressed identity. Complements FISL, a query interface for aggregating locations across the network. Feedback welcome.

Hey fam! We've been shaping a governance model for DASL, pretty lightweight, in line with the project's philosophy. You know what we'd love? We'd *love* to hear from you (yes, specifically *you* right there) about what you think about it. See: dasl.ing/governance.h...

There’s no way to sugar coat this. This is a big failure. But this doesn’t change our dedication to Radicle’s mission as a sovereign local-first code forge. We will continue to fix and build Radicle

Bummed I couldn’t make it this year, but a bunch of @radicle.dev core contributors will be there @osins.bsky.social @fintohaps.bsky.social @cloudhead.io

I moved from Raycast since they made it non-native and bad. Tinycast is a great native replacement: github.com/abue-ammar/t...

Reminder that we have a CID Congress for your this coming Thursday: luma.com/l9xglle8. Come early, come often! Sad news, @norman.life won't be able to make it but we'll have him over next month instead. If you have a quick demo to give instead, let us know!

FISL, from @norman.life, is an HTTP lookup API that maps CIDs to locations. A client sends a CID and receives the URLs at which the content can be retrieved, together with the identity of the publisher that announced them, when it is known. Check it out! dasl.ing/fisl.html

Then @norman.life will join us to talk about his work on FISL (an HTTP lookup API that maps CIDs to locations) and datadisco (FISLing AT). tangled.org/dasl.ing/das...

Trivially share markdown. Pi, Amp, Claude, and chatbox integrations. Agents can now share markdown via privacy-preserving URL (with other agents or people). This maps to a constant pattern where I generate a markdown doc, copy to my buffer, paste into gist.github.com and share mdsnd.freeq.at

The load-bearing vocabulary of Claude louisabraham.github.io/load-bearing/

Talking to your manager about testing in 2023: "I want to spend a week on our test suite, to help our engineers" no way, please go back to features 2026: "I want to spend a week on our test suite to, to help our agents" 100%, you're promoted, please teach your peers about agentic testing

The kind of beauty I prefer to behold from the safety of an illuminated glass display.

We (@dod.ngo) are in the early stages of planning a meetup around code hosting after github on board of @c-base.org So far we have talks around @radicle.dev and rngit Would also love to have somebody speaking about @tangled.org - anyone knows somebody in Berlin that could speak on it? Or ..

My favourite internet radio station supports 1411 Kbps streaming www.djam.radio/en/

whatever this is

New proposed @dasl.ing spec: Finding Internet Structures & Links (FISL). It's a standard API to map CIDs to locations that they can be retrieved from. See @norman.life's PR over at tangled.org/dasl.ing/das...

Hey @tangled.org Do you have any docs on the recommended workflows for creating pull requests? For example, I opened a pull request and then rebased and pushed again and it created a new pull request. I may have done this wrong, but it'd be nice to have clarity on how rounds and rebased PR work 🙌

I think I'm @jj-vcs.dev pilled, though I'm not sure if it's my own hype or actual merit. Either way, it's starting to click, albeit slower than I'd like.

I'm learning jj (www.jj-vcs.dev) Some gotchas from my first day: - You don't have to name branches 🫶 - Most commands operate on data structures in the repo rather than the working copy - Commit ID != Change ID Thanks @steveklabnik.com for the tutorial steveklabnik.github.io/jujutsu-tuto...

Must read for those curious about GitHub alternatives, like @radicle.dev and @tangled.org and how they embrace local-first workflows. Exciting to see the Zig community embrace @radicle.dev!

“coding is largely solved” okay make a new cross platform web browser that supports every web platform spec to 100% compliance

We have lots of cool specs for your own enjoyment — check them out! It'll make you love bright colours even more. dasl.ing

Radicle 1.10.0 is out!🌻 radicle.dev/2026/08/05/r...

The browser is the wrong medium for local-first 🫠 Act accordingly. (I don't think we can fix browsers unfortunately)

UPDATE: Bitchat is now mirrored on @radicle.dev — censorship-resistant, peer-to-peer code hosting: iOS/macOS: rad:z2v9tRJz1oknFAqCSY5W5c76nVvm6 Android: rad:z347HbE1F4c77DVLvsPe2ApoEEw6f Clone it. Seed it. Keep it alive. 👇

I now have complete understanding.

3rd year at @localfirstconf.com What keeps me coming back isn't the talks -- it's that the same faces keep showing up, and they're slowly turning into friends Feels less like a conference, more like a movement working to elevate user agency with software

2026 @localfirstconf.com is truly one of the few places that unite disparate communities—open source, LLMs, p2p, interface design, standards—behind a shared value: user agency and empowerment. How refreshing to witness the openness and curiosity everyone brings to the discussion.

Two tools I recently learned about for sandboxing agents without needing a full VM nono.sh agent-safehouse.dev

So let me get this right, the European Parliament has already rejected the mass surveillance of chats twice, but suddenly an emergency vote passes (during European summer!) that it should be voted on for the third time? What’s the most charitable interpretation?

Unfortunately not going to make it to @localfirstconf.com this year, but have a couple tickets now that aren’t going to be used. If you’d like to go but couldn’t afford tickets give me a shout!

We shipped content addressing to millions of users, then spent ~10 years pretending the spec already existed. 😅 Well, billions of CIDs later, it's finally real: the official CID spec is live on the @ipfs.tech specs. specs.ipfs.tech/cid/ Thanks @lidel.org and @robin.berjon.com

The future is now! - Dial keys, not IPs, thanks to Iroh - Fetch hashes, not URLs, thanks to DASL - Build on shared records, not siloed databases, thanks to the AT Protocol

A new blog post is out. This time I try to provide some evidence that most programming languages already make a distinction between floats and integers when they work with JSON: vmx.cx/cgi-bin/blog... Supporting GitHub repo: github.com/vmx/json-flo...

PLC question: can I create a did:plc without a bluesky account?

This week we have released @iroh.computer 1.0. As part of the release we also publish language support for python, swift, kotlin and javascript. Read more about it here: iroh.computer/blog/iroh-la... These are bindings to the 1.0 rust api, so they will *remain compatible* as we evolve the core.

Conf schedule is now live: app-2026.localfirstconf.com/schedule