Roastidio.us Tagged with web

Mastodon 5

Sat, 24 Oct 2026 11:09:47 +0000

We’re moving away from the embedded composer and adopting a pop-out composer with new controls for visibility and other post settings. Navigation is simplified and organised in a more intuitive way and create space for future new features.
[…]
In your feeds, the posts themselves have been rebuilt from the ground up, giving a fresh look to the places we all spend the most time. We’re also excited to roll out a few new colour themes, which took a truly monumental effort from our engineering team since the start of the year to tokenise our design system.
[…]
The new design includes many small affordances, such as hiding a user’s boosts directly from the post menu, following and unfollowing hashtags right from the post, and hiding your own posts and boosts in your home feed.

Via Jeff Johnson:

Incredibly, Mastodon’s own announcement shows the massive amount of wasted space in the new UI, and they’re fine with it!

Joe Fabisevich:

The Mastodon 5.0 design looks more Tumblr than Twitter, and I really dig it! Nice to see them take an approach to social media that is more differentiated than just “it’s tweeting but federated”.

To me it looks more like Twitter than before. Stars are now hearts. The layout is basically the same down to the empty right column where Twitter’s algorithmic features would be.

CM Harrington:

[The] toot button (the one that makes the toot window appear in the first place) is at the bottom of a list of everything else, including all your saved/followed hashtags.
It’s all such a mess. From what I can see (limited) they’re ‘just trying things’ that other sites have done — but without a reason or goal — so it’s all just a mash of disparate concepts.

The new composer slides up on top of the bottom post/message, so I can’t see what I’m replying to.

Matt Birchler:

There’s some interesting data here, but at a high level, you see a social network that gained over 2 million new active users in the 31 days after Musk closed on buying Twitter. A lot of those users bounced and we dropped to about 1.1 million active users by the following summer, when we saw a second spike as Twitter started to require logins to see anything and that rate limits were being applied. Since then, we’ve seen a slow but steady decline in number of people using Mastodon.
[…]
As a fan of Mastodon, these numbers are hard to look at. Not because I think a social network must have hundreds of millions of users to be valuable, but because it paints a picture where many people have tried Mastodon, but almost none of them stick around. Also, while infinite growth isn’t a requirement, constant decline isn’t what you want to see in a social network either.

Jeff Johnson:

To be honest, I’m not sure I want Mastodon to grow. I actually never wanted Twitter to grow. I originally joined Twitter in 2008 for a developer conference (C4 in Chicago) to network with other software developers. As far as I’m concerned, Twitter was ruined by the influx of celebrities and celebrity worshippers. Thankfully the celebrities have mostly ignored Mastodon. A crucial difference between the two social networks is that Twitter needed masses of people to join, because Twitter was a publicly-traded, for-profit corporation, financed by advertising. The goal of Twitter, like other such social networks—Facebook, Instagram, Threads, TikTok—was to maximize attention and thus eyeballs on ads.
[…]
This raises an important question: should you give your attention to social media? Is social media use healthy? […] In other words, Mastodon respects its users, doesn’t intend to waste their time. If Mastodon users decide to leave, I say good for them!

John Gruber:

Just after writing the preceding paragraph, I took a break to pick up some sandwiches for lunch. Get out of the house, enjoy at least a few minutes of a beautiful autumn afternoon, and stretch my legs. Waiting for the sandwiches to be prepared at the bagel joint, I took the Duo out of my pocket and checked NetNewsWire. First article up was a good one. Started reading. Screen’s too small. Do I want to open the Duo? Sandwiches aren’t going to take long. I clicked the side button to sleep the Duo and put it back into my jeans pocket (where it sank like the brick that it is). I spent the rest of the wait alone with my thoughts, pondering how to finish this review.
Apple isn’t going to start an ad campaign with a slogan like “So cumbersome you’ll keep it in your pocket”, but that’s part of my experience.

That’s kind of how I feel about Mastodon. It works OK, at least for the Mac/iOS community, without being very addictive. I wish the discovery and search were better, but that’s sort of antithetical to the federated model.

Rob Shearer:

Mastodon isn’t, and won’t ever be, a good platform for “asynchronous ephemeral notifications of any kind”. I’d also argue (more controversially) that it’s simply not good infrastructure for social networking of any kind. There are lots of interesting people using Mastodon, and I’m sure it will live on as a good-enough space for certain niche groups. But there is no question that it will never offer the fun of early Twitter, let alone the vibrancy of Twitter during its growth phase. I’ve long since dropped Mastodon from my home screen, and have switched to Bluesky for text-centric social media.
[…]
I’m not saying federation “won’t” work or “can’t” work. Merely that in 2025, nine years after deployment, federation does not work for the Mastodon use case. […] Crucially, the posts did not exist even if I visited the profile page of the account: even after weeks of daily posts, the profile page displayed by mastodon.social claimed the account had never posted, and the posts would only begin appearing after someone on mastodon.social began following the account.
[…]
When you “private mention” someone, only you and they can see the post. And they can reply with a “private mention” of their own. But if anyone in that “private” thread accidentally mentions any other Mastodon account by name, that is itself considered a “private mention”, and that person is invited into the thread. It is an absolutely insane UI design that makes it extremely easy to share private conversations with exactly the people you don’t want reading them.
[…]
The problem that did manifest is that all of this moderation is entirely opaque to users. If you explicitly follow a particular account, you may not see posts from that account because its instance doesn’t like its content, because your instance doesn’t like its content, or simply because one of the two instances doesn’t like the other.

Dave Winer:

The only way for the others to compete with Twitter is to start innovating. Get rid of the limits. The funny thing is Twitter, the dominant leader, is moving forward and getting rid of character limits, and introducing styles and links. They’re acting like the little guy while the others, Bluesky, Mastodon, Threads, aren’t doing anything to be more useful. That whole market is stuck in 2006 and the myth that 140 chars somehow was magic. It wasn’t. It killed the web as a writer’s platform.
[…]
Inbound and outbound RSS 2.0, is the way to go. And Markdown is the way you do text. This is what matters, you all are making something that’s really simple so unbearably complicated.

My first choice would be to see more people blogging on their own sites. But having longer and richer posts on Mastodon would be preferable to many of the alternatives. I still wish it supported RSS for my timeline and replies.

Previously:

Putting this blog on ATProto with standard.site | Redowan's Reflections

Sat, 24 Oct 2026 03:23:10 +0000

I put this blog on standard.site. Every post now also lives as a record on ATProto (the protocol behind Bluesky), and new ones publish themselves whenever I push to main.

What it is #

standard.site is a set of shared ATProto lexicons. The two that matter here are site.standard.publication and site.standard.document. The publication record describes the blog: name, URL, icon. Each post becomes a document record that lives in my own data repository on a PDS and points back at the publication. To prove the records are actually mine, there’s a /.well-known/site.standard.publication file on my domain and a link-rel tag in every post’s HTML pointing at the matching record. The two ends point at each other, with no central registry in between.

sequenceDiagram participant R as Reader participant S as rednafi.com participant P as PDS R->>S: GET /zephyr/carry-the-pager/ S-->>R: HTML + a site.standard.document link tag R->>P: resolve that document record P-->>R: site = publication URI, path = /zephyr/carry-the-pager/ R->>S: GET /.well-known/site.standard.publication S-->>R: the same publication URI Note over R: URIs match, so it's provably rednafi.com's

Why bother #

Mostly the previews. Share one of my posts on Bluesky and the link turns into a card with the title, description, and image instead of a bare URL. That works because the post is a real record the network can read. Bluesky shows richer previews for standard.site links.

It goes past Bluesky, though. The records sit in my own PDS, so any reader can pick them up on its own. docs.surf already lists my posts, and a search on pckt turns them up too:

It’s cheap POSSE on top of that: rednafi.com stays the canonical copy while a copy syndicates out into the ATmosphere.

Setting it up with Sequoia #

I didn’t hand-roll any of the ATProto plumbing. Sequoia is a CLI by Steve Simkins that does the whole thing for static sites. It doesn’t much care what built yours (Hugo, Astro, Eleventy) as long as it’s Markdown. If you want to put your own blog on standard.site, it goes roughly like this.

First, you need an ATProto identity, and a Bluesky account is the easy way to get one. The records live in your own PDS. Ownership is checked against a domain, so set your site’s domain as your handle (mine is rednafi.com) and mint an app password for the CLI.

Then run sequoia init in the repo. It authenticates against your PDS, creates a site.standard.publication record describing the blog (name, URL, icon), and scaffolds a sequoia.json. That config is small: it points at your content directory and maps the frontmatter fields it reads, like the publish date and the slug.

That publicationUri is the at:// address of the publication record init just made. The same URI also lands in static/.well-known/site.standard.publication, so the domain and the record name each other and the ownership check holds.

Each post’s HTML also needs a <link rel="site.standard.document"> pointing at that post’s record. sequoia inject can patch the tags into your built HTML; I emit them from my Hugo head partial instead.

With that wired up, sequoia publish walks the content, creates a site.standard.document record per post, and writes the resulting atUri back into each post’s frontmatter. State lives in .sequoia-state.json, so reruns only touch what actually changed.

Making it hands-free #

I didn’t want to run sequoia publish by hand, so it happens in CI. The job does a few things before the Hugo build:

checks that every post has the same frontmatter keys in the same order
sets slug and atprotoPath from the filename
stops the build if a post has extra fields, missing fields, or a wrong path
copies the posts to a temporary Sequoia directory and adds the shared cover there
asks Sequoia to publish only posts whose content changed
writes Sequoia’s returned atUri values and .sequoia-state.json back
commits only those generated metadata changes with [skip ci]
builds and deploys the Hugo site

My routine didn’t change: write Markdown and push to main. CI fills in the atUri, commits it back, and lets the deploy continue. This post turned into a site.standard.document the moment the deploy ran.

Seeing it work #

The previews are what I actually wanted. The card is just the record rendered, so I can put a live, clickable one right here instead of a screenshot:

If you won't carry the pager, maybe don't push to mainline

Drive-by AI changes break the shared model a team builds around its code, and the ICs end up cleaning up the mess. Why pushing to mainline should come with the pager.

May 30, 2026·8m read

Redowan's Reflections rednafi.com · by @rednafi.com View publication

That same post also exists as a record on pdsls. It has the title, description, path, tags, and the full body.

If you want to copy the setup, it’s all in the repo: config, script, and the ci workflow.

Decorative Images… — Adrian Roselli

Fri, 23 Oct 2026 20:10:43 +0000

Decorative Images…

…aren’t a thing.

At least not as far as people are concerned. Yes, this is an absolutist take, but sometimes it’s necessary to take the absolutist position to force someone to justify their own reasoning. Make them argue for something they’ve not considered. Revisit their own decision-making process.

Broadly, I’m talking about images in narrative content that are not also iconography nor used as part of interactive controls.

Adding an image to a design, email, document, page, app, etc. is done for a reason. Maybe the author wants to convey a mood or connect it to a theme. In which case, the person who can’t see the image would likely benefit from knowing that mood, having that connection made.

Sometimes the reason is far more pedestrian. Maybe the author wants to fill white space. In which case, that’s a design gap. It should be addressed in layout, otherwise the author is unintentionally sending a message to those who can see it.

I’m not discussing every possible scenario. That’s been done. Instead, I’m providing you some over-simplified questions to ask when evaluating an image:

If the decorative image was removed completely, would any readers care?
- No? Then remove the image.
- Yes? Then it’s not decorative.
If the decorative image was replaced with a picture of poo, would you as the author care?
- No? Then remove the image.
- Yes? Then it’s not decorative.

Decision Tree

To hopefully make this a bit easier on all of us, I’ve adapted the WAI alt text decision tree to include more steps.

Does the image contain text? No Yes

If yes, the image contains text…

… and the text has a specific function, for example is an icon. Use the alt attribute to communicate the function of the image. See Functional Images.
… and the text in the image is not present otherwise. Use the alt attribute to include the text of the image. See Images of Text.

If no, the image contains no text…

Is the image used in a link or a button, and would it be hard or impossible to understand what the link or the button does, if the image wasn’t there? No Yes

If yes, the image is contained in a control…

Use the alt attribute to communicate the destination of the link or action taken. See Functional Images.

If no, the image is not contained in a control…

Does the image contribute meaning to the current page or context? No Yes

If yes, the image contributes meaning…

… and it’s a simple graphic or photograph. Use a brief description of the image in a way that conveys that meaning in the alt attribute. See Informative Images.
… and it’s a graph or complex piece of information. Include the information contained in the image elsewhere on the page. See Complex Images.
… and it shows content that is redundant to real text nearby. Use an empty alt attribute. See (redundant) Functional Images.

If no, the image contributes no meaning…

Is the image purely decorative or not intended for the user? No Yes

If no, the image is not purely decorative or is intended for the user…

Then probably start over to better identify how to give it a text alternative.

If yes, the image is purely decorative or not intended for the user…

If the image was removed completely, would any readers care? No Yes

If yes, users would care if the image went away…

Users will think it’s not decorative. I suggest you start over.

If no, users wouldn’t care if the image went away…

If the image was replaced with a picture of poo, would you as the author care? No Yes

If no, the author wouldn’t care if the image was replaced by poo…

You should care. Poo is not decorative. I suggest you start over.

If yes, the author would care if the image was replaced by poo…

We agree that poo is not decorative. Remove the picture and save yourself the hassle.

Your Image Is Probably Not Decorative, by Eric Bailey, 17 June 2021
An alt Decision Tree Using Only :has(), by me, 13 August 2023
Long Alt, by me, 20 April 2024
My Approach to Alt Text, by me, 28 May 2024
It’s time to retire the concept of decorative images. by Nicolas Steenhout, 28 September 2026
WCAG 3 issue #878 Definition of decorative images update, 29 September 2026
On the Decision Underlying Decorative Images, by Jens Oliver Meiert, 8 October 2026

3 Comments

Reply

Hi! I guess this depends on the definition of “decorative”. If we think of actual images hanging on the wall in an apartment are these questions still valid? If abstract art someone has on the wall is not decorative then what is it?
“Maybe the author wants to fill white space” isn’t it one of the functions of decorative images?
I have a feeling that sometimes alt would add just noice, as images that are intended to speed up browsing for sighter users would do the opposite for ones using SR

Michal; 19 October 2026 at 11:06 am. Permalink

In response to Michal. Reply

Hi! I guess this depends on the definition of “decorative”. If we think of actual images hanging on the wall in an apartment are these questions still valid?

Ask the host how they would feel about removing them if they weren’t prepared to answer questions about each one, including they they are hung. I think you’ll find most hosts are delighted to talk about the photos they’ve hung showing them holding fish or trophies or babies or posing in front of people or buildings or babies.

If abstract art someone has on the wall is not decorative then what is it?

Insight into the taste and style of the host, and maybe a signal about how much money they want you to know they have.

“Maybe the author wants to fill white space” isn’t it one of the functions of decorative images?

For a transparent 1990s-era spacer.gif, sure. For all others, see my second question in the post.

I have a feeling that sometimes alt would add just noice, as images that are intended to speed up browsing for sighter users would do the opposite for ones using SR

In some contexts, alt text can add noise. See my linked posts Long Alt and My Approach to Alt Text for more context.

But if you aren’t a daily screen reader user and / or you haven’t checked with your audience, then you need more than a feeling to decide on their behalf.

Adrian Roselli; 19 October 2026 at 12:05 pm. Permalink

In response to Adrian Roselli. Reply

Thanks for the response, I still would argue that some images are simply decorative and it’s pretty shallow to assume people hang something on the wall just to brag from time to time or have a conversation starter, won’t you agree?
Even on your homepage images serve only as decorative image to blog post anchors, they have empty alt and it’s of course correct, only inside the article the image is properly labeled. Will you remove them then? ;)

Michal; 20 October 2026 at 9:13 am. Permalink

Réseaux sociaux, streams, rencontres : le jeu vidéo, une pratique communautaire pour la Gen Z

Fri, 23 Oct 2026 14:11:00 +0000

Selon l'enquête annuelle du SELL et de Médiamétrie, la Gen Z vit le jeu vidéo comme une culture partagée, qui passe autant par les réseaux sociaux et le streaming que par les rencontres physiques.

43 % des pros du SEO font du GEO une priorité pour 2027, alors que sa mesure reste floue

Fri, 23 Oct 2026 14:11:00 +0000

Seuls 14 % des professionnels interrogés par SEJ citent le GEO parmi leurs leviers les plus efficaces cette année, mais 43 % en font une priorité pour les 12 prochains mois. Pourtant, la mesure de la visibilité dans les IA reste à construire.

Google veut rendre les liens plus visibles dans les AI Overviews

Fri, 23 Oct 2026 14:11:00 +0000

Google déploie plusieurs mises à jour pour rendre les sources plus cliquables dans ses réponses IA. Des ajustements qui interviennent alors que les éditeurs voient ces fonctionnalités capter leur trafic.

Please don't mess with links:

Fri, 23 Oct 2026 07:14:53 +0000

Please don't mess with links:

2026-05-31

A link is just a button that takes you somewhere when you click it right?

100% legit link

Except that's a pale, shallow imitation of a link. A real link can be:

Opened in a new tab. (ctrl)
... or a fresh window. (shift)
... or saved as a file (alt).
Copied as a URL (right click)
Used with the keyboard (tab + enter)
Seen by tools like search engines and screen readers.
Hovered over to see the URL.

... none of which work with a button.

Another common offense is to use a real link, but hook the click event to open a popup. However, with a real <a target="_blank"> link, I can:

See the loading progress...
... or/and cancel it.
... see descriptive error pages and retry if needed.
Open multiple at once.
Read the original page while it loads.
Use my browser's tabs or/and window manager to organize them.
Bookmark the page.
Copy the URL and send it to a friend.

... and above all, they are consistent:

I've long lost count of how many times I've accidentally closed the whole site while trying to close a popup that was a little too convincing.

It's also extremely common to click a link with a slow connection, only to be greeted with perpetual spinner. I have no idea if anything is actually happening or how long it will take. Worse, it usually covers up the original page so I can't even read that!

Browsers are good at links and loading pages: It's the whole point.

Don't use javascript buttons as links.
Don't build your own loading animations.
Link previews should open and close on hover, not on click.
Don't open links in javascript popups: Use target="_blank" instead.

Episodio 107. SEO Local ¿Cómo se hace, pero bien?

Fri, 23 Oct 2026 04:08:36 +0000

La estrategia SEO local es básico para nuestro negocio y para hacernos visibles cuando ése cliente/a busca un negocio o servicio en un mapa por proximidad a su ubicación.

Ya hemos comentado en otras ocasiones, que el posicionamiento Web es el conjunto de técnicas dirigidas a mejorar la posición de un sitio web en los resultados orgánicos de los diferentes buscadores existentes.

¿Pero qué pasa con el SEO local?

Cada vez más, Google se convierte en un asistente personal para cualquier problema, incluso, para encontrar rápidamente un restaurante que quede cerca, para ver su menú o para reservar una mesa para más tarde.

Si tienes un negocio físico o digital o si tienes un e-commerce este episodio te interesa y mucho

Dale al play y escúchalo ahora.

Otros episodios que van directamente enlazados al tema de hoy son los siguientes:

▶ Episodio 74. SEO para posicionar tu web

▶ Episodio 52: La Inteligencia Artificial aplicada al Social Selling y Marketing digital

▶ Episodio 102. SEO de contenidos o como escoger tu keyword

¿Qué es el SEO Local?

El SEO Local es el conjunto de técnicas dirigidas a aumentar la visibilidad de una página web o eCommerce en las búsquedas de información que hacen los usuarios en función de la ubicación geográfica actual de los mismos.

O lo que es más o menos lo mismo, hacer que el sitio web de una empresa que tenga un local comercial físico o preste un servicio en un área geográfica específica sea encontrado por los potenciales clientes que se encuentran en esa zona y realicen búsquedas relacionadas con ese negocio.

Ahora es el momento de escuchar nuestro Episodio 107. SEO Local ¿Cómo se hace?

SEO Local: Beneficios

Según Google:

- El 30% de todas las búsquedas móviles tienen relación con la ubicación.
- El 78% de las personas que buscan algo cercano en sus teléfonos visitan el negocio durante el día.
- El 28% de las búsquedas de algo cercano se convierte en una compra.
- Y en períodos como la Navidad, el 78% de los consumidores que visitaron una tienda, hicieron búsquedas online previamente.

Así que queda claro lo importante que es que te encuentren cuando los usuarios hacen cualquiera de las acciones anteriores ¿No te parece?

Pero más allá de estos datos los beneficios del SEO local son muy claros:

🔎Aumenta la visibilidad en una región geográfica

🔎Incentiva la acción

🔎Aumenta tu autoridad local

🔎Atrae nuevos tipos de público

🔎Ayuda a potenciar tu marca

¿Cómo hacer SEO Local en mi negocio?

Para el posicionamiento de negocios en Local Pack y en Local Finder, Google se basa en diferentes criterios, resumidos en proximidad, prestigio y relevancia.

🎯 Proximidad: Se refiere a la distancia del negocio en relación al usuario o al término de ubicación que escribe en el buscador. Google entiende que los resultados más relevantes para ellos son esos que están más cerca.

De ahí la importancia de rellenar bien la ficha de Google my business para tener los datos de tu negocio actualizados además de geolocalizar todas las fotos que pongamos.

💎 Prestigio: Se trata del nivel de popularidad de un negocio en su región. Para garantizar ese criterio, Google analiza no solo la fama de la marca en la web, también en todo el mundo offline. Y en este punto las reseñas de calidad, con las palabras clave adecuadas, son muy importantes para tu negocio.

🎆 Relevancia: El criterio de relevancia considera la correspondencia entre el negocio y el término que el usuario usa durante la búsqueda. Para ello, Google analiza los datos de la empresa en GBP.

Es importante tener las palabras clave en la descripción de tu negocio para que respondan a las búsquedas de los usuarios.

Como puedes ver el SEO local es un tipo de seo que debes tener en cuenta en tu negocio para ganar visibilidad, sin olvidar tu SEO web o tu SEO técnico.

Hay herramientas que te ayudan en la configuración del SEO local, pero si quieres un consejo, “zapatero a tus zapatos” es decir contrata a un externo para hacer consultorías esporádicas sobre este tema.

Y si no tienes web, lo mejor es que formes a alguien en tu equipo con un buen consultor, para que se encargue de mantener actualizada tu ficha de negocio y todo lo necesario para posicionar tu negocio localmente.

Si te ha quedado alguna duda, escríbenos a sonia@leaderselling.com y te la resolvemos.

En nuestro próximo episodio del martes, discutiremos sobre ¿Por qué nos volvemos locos/as cuando llega el Black Friday?

¡Agéndalo para el próximo martes!

No te lo pierdas y continúa avanzando en tu estrategia de Digital Selling para ¡Vender más en internet!

Recuerda…

Somos tu agencia y consultora que trabaja para que vendas más en Internet, integrando la fuerza de tu equipo y convirtiéndolos en Embajadores de Marca.

Síguenos en Ivoox

Te invitamos a seguir el podcast "Digital Selling para empresas del siglo XXI" en Ivoox.

Síguenos en Spotify

Te invitamos a seguir el podcast "Digital Selling para empresas del siglo XXI" en Spotify.

Síguenos en Google Podcast

Te invitamos a seguir el podcast "Digital Selling para empresas del siglo XXI" en Google Podcast.

Síguenos en Linkedin

Si quieres encontrar oportunidades profesionales que te ayudan a vender más, síguenos en LinkedIn. Allí seguimos dándote consejos de Social Selling y Digital Selling.

Déjanos tus dudas, comentarios y sugerencias.

Este post es para ti queremos hablar de lo que tú quieres y necesitas saber.

Comparte Episodio 107. SEO Local ¿Cómo se hace, pero bien? en tus Redes Sociales

Oracle Cloud Free Tier 2026: Ainda Vale a Pena? Guia Completo + Alternativas | Home

Fri, 23 Oct 2026 01:57:54 +0000

O problema

Esta semana, tenho procurado soluções para usar domínios com minhas aplicações rodando em contêineres no meu servidor MacBook Pro. Sim, converti meu MacBook Pro em um servidor, pelo menos por enquanto. A primeira solução foi usar um Pi-Hole como DNS local e funciona bem, mas o problema é que tenho que especificar portas para acessar as aplicações e isso se torna irritante. A solução parecia simples o suficiente: criar um contêiner Nginx Proxy Manager (NPM), usá-lo para apontar para os contêineres na rede local e isso deveria resolver o problema. Bem, foi o que pensei.

Isso me levou a uma busca de três dias por uma solução porque tudo o que eu fazia não conseguia fazer o NPM direcionar o tráfego corretamente. Eventualmente, descobri que o problema estava com meu provedor de internet (ISP) e possivelmente com a configuração padrão de CG-NAT. Portanto, este texto é para o leitor que tentou o seguinte e não funcionou.

Redirecionamento de Portas no Roteador

Esta parecia ser a solução no início. Basta configurar o tráfego de entrada das portas 80 e 443 para ser redirecionado para as portas relacionadas no contêiner NPM, e então o NPM distribuiria o tráfego de acordo. Mas isso não funcionou.

DMZ para o host executando NPM

Esta é outra possível solução que também tentei e não funcionou. Eu vi isso em algum lugar, com um usuário explicando que usar a DMZ era essencialmente o mesmo que redirecionar portas para este host específico. Tentei e não funcionou.

Configurar domínios e endereços IP

Pensei que o principal problema poderia ser o fato de eu estar usando um subdomínio onde o domínio principal apontava para outros servidores e, por causa disso, não conseguia chegar ao host correto. Então configurei outro domínio (barato) para testar essa hipótese e também não funcionou.

Cloud VPS

Eventualmente, cheguei a este vídeo de Raid Owl no YouTube que me abriu os olhos para a solução definitiva para este problema. Veja bem, eu poderia ter ligado para o ISP e verificado com eles o que estava acontecendo e se eles poderiam arranjar algo do lado deles, mas bem, isso é cansativo. Em vez disso, esta solução parecia óbvia depois de tantas tentativas e erros. O ISP está bloqueando as conexões de entrada para a rede, não sei como. Não consegui descobrir. O Cloudflare estava dando um erro 522, o que basicamente significa que não havia resposta do servidor. O servidor não estava recebendo tráfego. Então, significa que com a configuração de rede normal eu não conseguiria fazer isso funcionar.

A solução proposta por Raid Owl é usar um Cloud VPS como forma de obter acesso a outro endereço público, fora da minha rede local, e então tunelar o tráfego deste Cloud VPS para a máquina host executando contêineres na minha rede local. A solução, à primeira vista, parece funcionar, mas há custos potenciais envolvidos. Como tenho alguma experiência com Azure, sabia que não poderia executar uma máquina virtual lá 24 horas por dia, 7 dias por semana para este fim, talvez eu precisasse iniciar e desligar as máquinas automaticamente todos os dias… Após alguma pesquisa, encontrei a solução perfeita para este problema: Oracle Cloud.

Oracle Cloud Free Tier

O Oracle Cloud Free Tier é uma maneira de obter acesso a máquinas virtuais com Linux que são sempre gratuitas para usar. Para este uso específico é perfeito, já que a quantidade de tráfego é limitada.

A configuração é direta, e como Raid Owl faz um trabalho perfeito ao explicar todos os passos para isso, serei breve.

Primeiro, depois de criar uma instância no Oracle Cloud, você precisa redirecionar as portas 80, 81 e 443. Essas são as portas que precisam estar abertas para que o tráfego chegue ao contêiner NPM. Após configurar isso, vá para a instância e instale o Docker e todos os outros pacotes relacionados, como o Docker Compose. Para os detalhes sobre esses passos, estou deixando os links nas referências. Além disso, configure o Tailscale dentro da instância (também nos links abaixo). Então, depois que tudo estiver configurado, o que você quer ter é uma conexão Tailscale dentro desta nova instância. A conexão Tailscale dará acesso à máquina host dentro da sua rede local porque essa máquina também estará executando um daemon Tailscale.

O NPM será configurado como o proxy reverso da sua rede local enquanto ele está fisicamente em um datacenter da Oracle em algum lugar. Todo o tráfego de entrada que é direcionado para o endereço público desta instância no Oracle Cloud será canalizado para o NPM, que terá proxies para serviços que estão sendo executados dentro da sua rede local. Como o Tailscale está dentro desta instância Oracle, ele será configurado para --accept-routes, o que significa que receberá o tráfego de entrada e o enviará para o que estiver na rede que é --advertise-routes=<ip-adress>. Todo esse tráfego será enviado usando a sua tailnet para a sua rede local. No meu caso, decidi usar um contêiner Tailscaled como host para anunciar as rotas para sub-redes específicas.

Esta é uma visão geral deste problema e como o resolvi. Existem muitos pequenos passos para fazê-lo funcionar, mas se você quiser testar suas habilidades ou simplesmente não quiser verificar com o ISP se este é o problema deles, você pode usar esta estratégia.

Links de referência

Conclusão

Espero que este artigo tenha sido útil para alguns de vocês que estão tentando expor alguma aplicação interna ao tráfego externo, mas não conseguem devido a algumas configurações do provedor de internet (ISP).

iPhone Duo and Safari

Thu, 22 Oct 2026 20:09:00 +0000

Mike Piontek (Mastodon):

A year ago I wrote that Safari 26 and Liquid Glass have little respect for web sites and unfortunately this hasn’t changed.
[…]
It’s unclear to me why Apple is not opting to treat the iPhone Duo toolbar as a safe area. I have not come across anything discussing their reasons nor educating web developers on the best way to design for this device.
[…]
Apple has decided to examine my web page and pick out a color to use for their toolbar. The process they use to determine this color is complex and not documented.

Previously:

La Turquie ferme les réseaux sociaux aux moins de 15 ans, et sa méthode change tout

Thu, 22 Oct 2026 12:52:47 +0000

C’est voté, c’est publié, ça s’applique. La Turquie vient de poser au Journal officiel, le 10 octobre, le règlement qui interdit les réseaux sociaux aux moins de 15 ans. Entrée en vigueur le 1er novembre. La loi, elle, avait été adoptée dès avril, dans la foulée d’une fusillade dans une école, et le pays passe maintenant à l’exécution.

Le périmètre est large. Instagram, Facebook, X, TikTok, Snapchat, YouTube, WhatsApp, Telegram, Discord, Reddit : à peu près tout ce que votre ado ouvre dans une journée tombe sous le coup du texte. Les plateformes ont l’obligation de vérifier l’âge à l’inscription et de refouler les moins de 15 ans. Pour les comptes déjà créés, le ménage devra être terminé avant le 31 mars 2027.

Le vrai sujet, c’est la manière. Plutôt que de demander à TikTok ou Meta de scanner une pièce d’identité, Ankara passe par e-Devlet, son portail administratif officiel. L’internaute récupère un jeton qui confirme simplement qu’il a l’âge requis, 15 ou 18 ans selon les cas, sans livrer son nom ni sa date de naissance exacte à la plateforme. Une façon de faire respecter la règle sans transformer chaque réseau social en guichet de papiers d’identité. Sur le principe, c’est plutôt bien pensé.

Pour les 15-17 ans, l’accès reste ouvert mais sérieusement bridé. Comptes privés obligatoires, impossible de repasser en public, pas de messages venus de comptes non suivis. Le scroll infini saute, la publicité ciblée aussi, tout comme le profilage comportemental et le direct. Même les captures d’écran sont bloquées. On garde les réseaux, mais on retire les ressorts qui scotchent.

Si la question du temps d’écran des ados vous travaille, ce guide propose une méthode concrète pour reprendre la main à la maison.

Doser les écrans en famille→ voir sur Amazon

Lien affilié Amazon. En tant que Partenaire Amazon, je réalise un bénéfice sur les achats remplissant les conditions requises.

Côté bâton, la Turquie ne plaisante pas : jusqu’à 3 % du chiffre d’affaires mondial d’amende, interdictions publicitaires et bridage de la bande passante pour les récalcitrants. De quoi faire réfléchir même un géant américain.

Et nous, dans tout ça ? La France avait tenté un texte voisin, mais le Conseil constitutionnel l’a censuré le 14 août, lui reprochant de ne pas distinguer les services et d’oublier le rôle des parents. L’Australie, elle, interdit l’accès aux moins de 16 ans depuis décembre 2025 et peine toujours à le faire appliquer. Le Danemark prépare un seuil à 13 ans avec feu vert parental.

Reste la vraie question, celle que personne ne tranche vraiment : un ado motivé contourne un blocage en quelques minutes. Le jeton e-Devlet tiendra-t-il la route ? On verra au 1er novembre.

Crédit photo : Illustration générée par IA

L’article La Turquie ferme les réseaux sociaux aux moins de 15 ans, et sa méthode change tout est apparu en premier sur Les Actus du Net.

Attal veut pouvoir couper certains réseaux sociaux pendant les émeutes, le Conseil d’État lui a déjà dit non

Thu, 22 Oct 2026 12:52:47 +0000

Gabriel Attal a relancé lundi 19 octobre une idée qui revient à chaque flambée de violences : donner à l’État le pouvoir de bloquer temporairement l’accès à certaines plateformes. Le candidat Renaissance à la présidentielle vise les réseaux sociaux, qu’il juge responsables d’une bonne partie des débordements observés le week-end du 17 octobre.

Son raisonnement tient en quelques lignes. Selon lui, les phénomènes d’émeute se fabriquent en ligne : points de ralliement diffusés sur les applis, appels à se retrouver, effets de mimétisme qui poussent des gens à rejoindre le mouvement alors qu’ils n’avaient rien prévu. Couper le robinet le temps que ça retombe réglerait le problème à la source.

Dans les faits, il ne cite aucune plateforme précise. Pas de X, pas de TikTok, pas de Snapchat nommément. Et surtout, aucun blocage n’a été décidé pour l’instant : on parle d’un outil qu’il aimerait avoir, pas d’une mesure déjà sur la table.

Le problème, c’est qu’Attal a déjà essayé. Au printemps 2024, quand il était Premier ministre, il avait fait couper TikTok en Nouvelle-Calédonie pendant les troubles. Le Conseil d’État a retoqué la décision en 2025, estimant qu’elle portait une atteinte disproportionnée à la liberté d’expression. La juridiction n’admet une coupure que dans des circonstances vraiment exceptionnelles, et à trois conditions cumulées : que ce soit indispensable, limité dans le temps, et qu’aucune autre solution ne soit possible dans l’immédiat.

Pour prendre du recul sur l’emprise de ces plateformes, l’essai de Bruno Patino sur le marche de l’attention reste une bonne porte d’entree.

La civilisation du poisson rouge→ voir sur Amazon

Lien affilié Amazon. En tant que Partenaire Amazon, je réalise un bénéfice sur les achats remplissant les conditions requises.

Autant dire que la fenêtre est étroite. À ça s’ajoute le règlement européen sur les services numériques, le fameux DSA, qui encadre sérieusement ce genre de coupure. Pour l’avocat Alexandre Archambault, un blocage décidé par la France supposerait de passer d’abord par un juge, ce qui vide largement de son sens l’idée d’une mesure prise dans l’urgence.

Reste la question de fond, celle que tout le monde se pose dès qu’un gouvernement évoque l’extinction d’un service grand public. Qui décide ? Pendant combien de temps ? Et comment distinguer l’organisation d’un rassemblement violent du simple fait de commenter l’actualité ? Les émeutiers ne sont pas les seuls à utiliser ces applis, loin de là. Couper Instagram ou WhatsApp un soir de tension, c’est aussi priver des millions de gens d’un moyen de communication parfaitement banal.

Le débat, lui, ne risque pas de retomber de sitôt.

Crédit photo : Wikimedia Commons

L’article Attal veut pouvoir couper certains réseaux sociaux pendant les émeutes, le Conseil d’État lui a déjà dit non est apparu en premier sur Les Actus du Net.

PHP2Shell

Thu, 22 Oct 2026 04:46:05 +0000

Malwarebytes:

If you’ve encountered websites in maintenance mode today, it may be a security precaution. Reports of attacks targeting two critical PHP vulnerabilities have prompted warnings to install emergency updates and consider temporarily taking affected services offline until they can be patched.
[…]
Successful exploitation could let an attacker run malicious code on an affected server without logging in. That code would run with the permissions available to the PHP process, potentially allowing attackers to steal application data, alter website content, or establish a backdoor.
[…]
The PHP team scheduled its emergency security updates for October 21 at 10:00 am ET (14:00 UTC). It has now released fixes in PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35, and urges users to update immediately. Administrators should check with their hosting provider or operating system vendor for the appropriate updated packages.

Adam Engst:

Expect to see numerous websites go down or serve “Page not found” errors as they update PHP, the programming language that underpins 70% of websites. If you run a WordPress, Drupal, or Joomla site, this affects you directly.

Nick Heer:

Word on the street is that these exploits have leaked, and that remote code can likely be executed all the way back to PHP 5. If you have access to your website’s php.ini file, it might be worth turning off multipart uploads for now.

Vincent Schmalbach:

Two changes reduce the risk until the fixed versions are out. They were checked against PHP’s source code and the PHP manual, but they are not an official PHP mitigation. When someone suggested that turning off session upload progress might be enough, PHP core developer Gina Peter Banyard replied, “The only thing I can say is that the only mitigation is patching / upgrading PHP. I sadly know too much.” Use the stopgaps to lower the risk for a few hours, and update PHP as soon as the fixed builds exist.

Add to php.ini:

session.upload_progress.enabled = Off

Add to .htaccess:

<If "req('Content-Type') =~ /multipart/i">
    Require all denied
</If>

Ofcom Concedes Defeat in 4chan Case

Thu, 22 Oct 2026 04:46:05 +0000

Guido Fawkes:

Ofcom boss Dame Melanie Dawes has admitted today that tech firms have paid just two of the eleven fines handed out under the Online Safety Act since March last year. Giving evidence to the Culture, Media and Sport Committee, she conceded nine remain unpaid, four of the offending sites have simply geo-blocked the UK, and three are still up and running with nothing changed.

Via Preston Byrne (Hacker News):

American courts have, by now, provided their preliminary view on the likelihood of Ofcom’s enforcement powers being successful in U.S. courts – the obiter dicta in 4chan v. Ofcom, the opinion in the case we filed against Ofcom in the federal District Court for the District of Columbia a little over a year ago.
[…]
Ofcom can’t enforce the Online Safety Act in America. Ofcom knows it, Ofcom has known it for a long time, and now, Ofcom has, finally, admitted it.
[…]
The GRANITE Act, a foreign censorship shield now before both the House and Senate (H.R. 10174 / S. 5478), is one proposed legal response America could adopt. The HOMEFRONT Act, H.R. 10309, is another. Either of GRANITE or HOMEFRONT would strip sovereign immunity from foreign censors and let Americans targeted by their orders drag those agencies into federal court, where they could be held accountable for their actions.

Previously:

Instagram Charging for Links

Thu, 22 Oct 2026 04:46:05 +0000

Meta:

If you subscribe to a Meta One plan, you can add links to a set number of posts and reels each month based on your plan:
Meta One Advanced plan: up to 4 posts and 4 reels with links per month
Meta One Expert plan: up to 8 posts and 8 reels with links per month
Meta One Max plan: up to 12 posts and 12 reels with links per month

Via Nick Heer:

Instagram has never supported links of any kind in individual posts, so that is a new feature with two links per month permitted for free, and more enabled by this pricey subscription — starting at $50 USD per month for four posts per month containing external links. But links in Reels have been commonplace for years. Meta is now gating that, too; and there is more.
[…]
Meta seems to have two objectives here: to take a cut from businesses that use Meta’s services as a referral source more generally, and — more specifically — to capture some of the money made by influencers.

Requiring login, removing RSS, discouraging links. Things are not looking good for the open Web.

Previously:

Reddit to Remove RSS

Thu, 22 Oct 2026 04:46:04 +0000

Jeff Johnson (June):

This new RSS rate limiting was perhaps foreshadowed by an r/modnews post a couple of weeks ago[…]

judy-funnie (September, via Jeff Johnson):

Because RSS is now a common surface for large-scale scraping and automated abuse, we'll stop supporting RSS feeds on November 13, 2026 while preserving moderation workflows that depend on it through supported alternatives.
[…]
To close this gap, in the next few months, we'll further limit access [to Old Reddit] for logged-in users to only those who have used Old Reddit in the last six months (which covers the vast majority of all Old Reddit users).

Ana Maria Constantin:

Public API access ends in March 2027, Reddit said in a separate post for developers. It will stop accepting new API requests on 31 October. From 12 January, it will start cutting off apps that have not registered.

Jeff Johnson:

Since I use RSS to follow Reddit, I intend to discontinue my Reddit use on November 13, unless Reddit backtracks on their user-hostile decision to drop RSS.
[…]
My biggest regret in leaving Reddit is that I‘ll have to shut down my product support subreddit.
[…]
The most ridiculous part of Reddit’s announcement was the suggestion that subreddit moderators replace RSS feeds with Discord notifications. What perversity, insanity to recommend a competing social network as the only practical way to use yours! I’m also skeptical of Reddit’s public excuse for dropping RSS: bot scraping. As I noted back in June, Reddit is already rate-limiting RSS feeds. If the current limits are insufficient, why not impose stricter limits?

John Brayton:

I am disappointed because I know that many Unread customers use Reddit’s RSS feeds to keep up with subreddits.

Sarah Perez:

Moderators have already expressed worry about how this shift would impact their workflow. When Reddit hinted earlier that it was preparing for the end of RSS on its site, many responded by complaining that Reddit would become unmanageable for them. Meanwhile, many users stressed that RSS was how they enjoyed accessing Reddit’s content.

Previously:

Update (2026-10-07): John Brayton:

I overlooked the fact that Feedly uses Reddit’s API to retrieve articles from subreddits. The folks at Feedly expect this functionality to continue working after Reddit removes their feeds.

Michael Tsai - Blog - Passkeys Attestation Trap

Thu, 22 Oct 2026 04:45:46 +0000

Passkeys Attestation Trap

The Hack (Hacker News):

Like the Trojan Horse, passkeys are legitimately elegant on the surface, but there is something troubling inside.

What’s important to know is that unlike with any other kind of login credential, you do not have ultimate control over your passkeys. With passwords, you can choose where to write them down; with authenticator apps, you can decide for yourself which ones to use (they’re pretty interchangeable); and with physical security keys you can hand them to your colleague if you really trust them. But with passkeys come a hidden dial that lets the websites you use them on gradually remove your ability to do as you please with them.

[…]

This is the feature that means you no longer get to make the calls about your passkeys. Fortunately, attested passkeys are not yet required on most websites. But the FIDO Alliance standard makes attestation a part of the passkey ecosystem, whether you want it or not. And even if the website doesn’t require attestation now, simply by using passkeys you indicate to the website that your setup supports the FIDO Alliance’s passkey standard and that you as a user are capable of using passkeys. This means that once Twitter (formally X) is satisfied that the overwhelming majority of its users would be unaffected, they can flip the switch – perhaps not all at once, perhaps just for ten thousand users at a time so as not to cause a fuss – and start rejecting non-attested passkeys.

[…]

My expectation is that the industry will start off with very few constraints on your passkeys, and gradually add more and more, not all at the same time, but staggered on different sites, and then in a few years people will forget that they were ever offered a choice in which security measures they want to enable on their passkeys (if they even knew there were different kinds of passkeys at all).

[…]

Remote attestation can allow them to verify that your device is not capable of, say, sending and receiving encrypted messages, or running a competitor’s app, or using social media without verifying your ID.

Apple’s passkey implementation currently does not support attestation, but it sounds like this is only until they can work out how to do syncing:

Attestation was designed to attest to a specific device, exclusively at the point of creation, with a specific set of security properties. It doesn’t make sense for synced credentials for a number of reasons, including syncing to devices with different security properties, changes in security properties that happen after key creation, security properties of the sync fabric, sharing the passkey, or exporting to other passkey providers. We’re working hard with W3C and FIDO to solve these problems.

Ricky Mondello:

The post is predicated on the idea that a feature of WebAuthn called “attestation”, which is only used in high-assurance and usually corporate scenarios, and usually with physical hardware security keys, will be leveraged to hurt people, somehow.

The post posits that a website like X will bait and switch users: first, you get a passkey. Then, later, scary “attested” passkeys! This simply isn’t possible to do because attestation isn’t supported on the web for mass market, consumer authentication.

Attestation for passkeys (software-based, syncable credentials) is antithetical to their mass market goals, and would freeze out independent, non-corporate-backed credential managers. It’s an explicit non-goal of the designers of passkeys, who work together in a forum anyone can join.

And trust me, websites and apps like banks repeatedly asked for attestation at the beginning of the industry’s passkey journey. The platforms, browsers, and credential management apps have held firm that the goal of passkeys is reducing phishing and not some kind of trusted computing scheme. (And I will note: over my dead body!)

I believe this is not the goal of Mondello and some of the others working on this, but so far I’ve not been convinced that they will be able to control it. It sounds like Apple is working on it, and once the technology is out there, what’s to prevent key sites from forcing it on users? It seems like all this would take is the cooperation of a few big credential managers. This would be to their benefit in the sense that it would make their products required. Smaller credential managers who resisted would be frozen out.

varx:

The fact that websites and apps have been asking for attestation just reinforces the main point of the passkeys post! Sure, browsers aren’t supporting it yet, but that’s the sort of thing that can change, and the sort of thing that has changed in the past. See the footnote on Widevine and Firefox. (“Currently not supported” is also very subject to change.)

And we already have sites and apps allowlisting passkey vendors. That’s no theoretical, slippery slope fear -- it’s a real restriction on user freedoms that’s already happening right now.

I don’t think that a couple of bad points (e.g. the TOTP thing) invalidate the main point of the post, because the post wasn’t an argument from authority. The author makes some good points that stand on their own.

Ricky Mondello:

To be clear, the websites have stopped asking for attestation. Or at least, they’ve stopped asking me. Why? Because they know there’s no use in asking — that the OS vendors, browsers, and passkey managers are unified on this front. And now they’ve seen firsthand that passkeys without attestation are awesome and a big step forward.

iinuwa:

This is antithetical to users, as the types of authenticators that can pull this off are difficult to use (security keys). Companies with IT departments who can do account recovery for the user can handle this, an average user cannot. Synced passkeys are the answer to this for consumers and therefore attestation does not belong in the consumer space. Which is why password managers are in the spec groups pushing back against this every time it comes up.

Scott Helme (Hacker News):

If a consumer website decided tomorrow that it would only accept attested passkeys, it would lock out almost all of its own users, instantly. What website is going to do that?

[…]

If you’re worried about attestation creeping into consumer logins, then that’s worth pushing back on, loudly (if it ever happens). But it hasn’t happened, the biggest providers don’t support it, and avoiding passkeys today while you wait for it won’t protect you from anything, it just leaves you open to phishing.

It seems like rejecting passkeys is the only way the average user has to push back. The main thing protecting us is that sites don’t want to lock out their users who rely on passwords and 2FA. Once most people have adopted passkeys, if Apple and Google sell us out, I don’t think it matters much what the rest of the alliance thinks. Sites would be able to require attestation with the assurance that users could easily comply. Safari would probably opt everyone into attested passkeys, as it currently opts you into passkeys in general (unless you uncheck “Allow Automatic Passkey Upgrades”).

Previously:

iOS iOS 27 Mac macOS 27 Golden Gate Passkeys Security Two-Factor Authentication (2FA)

18 Comments RSS · Twitter · Mastodon

Benjamin

October 15, 2026 2:08 PM

For all of the protestations to the contrary, about how passkeys are so great for preventing phishing and increasing password security they do seem to be a real trap that gives more power to corporations we have no control over and whose goals have been clearly shown not to align with users. Google is already using attestation to attack third party app stores and non-Google Android, I have zero confidence they would not do the same for passkeys.

Generally I think the passkey supporters are well meaning but naive when it comes to their belief that corporations wont try and use them as another means of exerting control over their customers. Just look at App Store and CTF/CTC in the EU, I strongly doubt Apple will remain on the side of the angels forever.

Dan Shockley

October 15, 2026 3:10 PM

It’s kind of astounding that anyone who has paid even the slightest bit of attention over the past few decades (centuries? millennia?) would think that powerful institutions won’t take advantage of the ability to control and extract power from others when given even half a chance.
If it is possible for them to gradually tighten the screws and extract more power and money, they will.

Max Oakland

October 15, 2026 3:13 PM

I don't use passkeys for this exact reason. Every single time there's a way to increase lock-in or interfere with open standards, these companies do it. It's not an *if* they do this, it's a *when* they do this. But only if we let passkeys get too popular

Sebby

October 15, 2026 11:21 PM

I guess I'm a useful idiot in that I take advantage of passkeys when available, but I store them in a KeePass database and KeePass is clearly on the side of the user. Of course I'll be against the wall when attestation means I can't do that anymore, at which point I (and BitWarden users too, presumably) will suddenly wake up and notice I've been boiled.

Something to think about …

Someone

October 15, 2026 11:27 PM

Ricky Mondello writing their own reputational epitaph there.

"Ricky, thanks for joining us. We've decided to make Passkeys into handcuffs"
"Passkeys will become handcuffs over my dead body!"
*bang*
"ok, so next on the agenda"

As for why vendors have stopped asking Ricky to make passkeys into handcuffs... the obvious explanation is they're speaking to someone higher in the org.

Alex R

October 16, 2026 11:13 AM

I'm sorry, but all the anti passkey backlash is just conspiracy theories for technical people. Of course there are many things that *could* happen. A service could simply stop providing a website and require all access via apps, where they could do anything attestation does and more. But that doesn't mean it's going to happen.

Benjamin

October 16, 2026 12:00 PM

@Alex R

We have seen over and over again how giving big companies the power to control something almost always leads them to trying to do so. For a long time Google androids attestation was also just a conspiracy and yet today Google is doing more and more to control android and prevent apps from working without Google’s approval. Any system where the specification allows for centralization of power is at risk and given the way the big companies who are pushing this have behaved in the last ten years it is quite clear they would like nothing better than yet another method to control us. Apple hasn’t released a new open platform since Mac OS X cheetah back in 2000… that’s 26 years of closing down competition and locking things down.

Benjamin

October 16, 2026 12:02 PM

@Alex R
Follow up. The conspiracy could have been avoided if they had made the spec explicit about interoperability, standardization, and exclusion of centralized attestation. They didn’t do any of that.

Plume

October 16, 2026 2:41 PM

"Of course there are many things that *could* happen."

Experience shows that if companies *can* do something to lock people into their ecosystems and extract more money, they *will*. The only variable is how long it takes.

That's not a conspiracy theory. That's observable reality.

Kristoffer

October 17, 2026 12:32 AM

Over started experimenting with account free apps, and I find it surprising how nice it feels when things like "your two lists of books, plus your favorite podcasts and all the settings you've done in the app" are expected and imported via a rather tiny file.

And it saves me all the hassle of managing a user database.

Dan

October 17, 2026 9:44 AM

Depressing prospect. The only way out is user-friendly regulation. Let's hope our elected representatives don't screw us over.

Kristoffer

October 18, 2026 2:44 AM

Another way out is to not support this. To build apps that aren't in the hands of a handful of SV companies run by craven old men. Up your things and leave. Make Enhsittification Resistant Software

Plume

October 18, 2026 4:31 AM

> Up your things and leave

Some people are seriously addicted to these platforms. For example, Gruber has now written multiple posts justifying his Twitter use, which clearly goes against his very public political opinions.

Just telling people to leave these platforms doesn't work. The underlying problem is a lack of antitrust regulation, which lets a small number of tech companies dictate these decisions to everyone else.

tim

October 18, 2026 3:03 PM

Plume: Gruber also recently wrote about how Apple contributed $25 million to the Trump ballroom and won't vote for any democratic candidate who won't promise to bulldoze it, but still buys all his computers from that same company that presented Trump with a gold trophy in the Oval Office.

We are all a mess of contradictions. Every tech product is one point in the infinitely-dimensioned potential product space. Every large organization is a complex mess of decisions and ideologies and relationships. Adam Smith and James Madison are long dead, and it's no longer possible to use our dollar or our vote to express precisely what we want.

Kristoffer

October 19, 2026 4:33 AM

> Just telling people to leave these platforms doesn't work. The underlying problem is a lack of antitrust regulation, which lets a small number of tech companies dictate these decisions to everyone else.

I 100% agree. But we as developers can start looking for alternate ways of doing things. Just as people are putting free time towards becoming Microsoft MVP they can experiment with foss solutions, interoperability etc.

We can chip in. We're not helpless. But absolutely stronger consumer protections and antitrust laws. Those are the ones that really will create change.

Unabomber

October 19, 2026 3:00 PM

You guys are right, can’t help but agree. It’s a slippery slope.

Sören

October 20, 2026 3:04 PM

>Safari would probably opt everyone into attested passkeys, as it currently opts you into passkeys in general (unless you uncheck “Allow Automatic Passkey Upgrades”).

Good reminder, thanks. Seems I have to opt out on each device, which may explain why some site (Google?) had decided "for me" (how nice) that I "want" to use a passkey.

I get the benefits of passkeys (including, for example, making phishing much harder), but they feel like a loss of user control+autonomy to me. I can scribble a password on a piece of paper. I _shouldn't_, but I can. I cannot meaningfully look at a passkey much less transport it without some intransparent API. It feels like a bridge too far.

Mark McConnell

October 21, 2026 10:31 PM

tim,

We are not a "mess of contradictions." We are a "mess of monopolies" and a "mess of unenforced laws." Another way of saying this is just "corrupt."

« On a un problème » : une faille de sécurité absurde met Internet en alerte

Wed, 21 Oct 2026 08:55:01 +0000

Huit clés privées de l’autorité de certification eMudhra étaient tellement faibles qu’elles pouvaient être retrouvées presque instantanément. Révélé le 20 octobre 2026, l’incident permet de fabriquer de faux certificats pour usurper l’identité de sites web auprès de logiciels vulnérables. Les principaux navigateurs ont réagi, mais les correctifs doivent encore atteindre de nombreux autres outils.

Après la découverte d’une faille dans PHP, une attaque massive pourrait se produire sur le web aujourd’hui

Wed, 21 Oct 2026 08:55:01 +0000

L'équipe de sécurité de PHP publie ce mercredi 21 octobre des correctifs pour deux failles critiques notées 9,2 sur 10. La mise à jour de PHP est vivement conseillée.

Le merveilleux monde des dégénérés du Web3

Wed, 21 Oct 2026 03:32:10 +0000

Nous sommes le 22 octobre 2021. Quelques jours après la fin de mon dernier article. On me promet toujours 500 000 euros en Ethereum.

The post Le merveilleux monde des dégénérés du Web3 appeared first on Je suis un dev.

J’ai codé l’univers tout entier (et au-delà) en JavaScript

Wed, 21 Oct 2026 03:32:10 +0000

J'ai codé un jeu gratuit en 3D dans le navigateur, librement explorable, à travers des univers infinis générés de manière procédurale.

The post J’ai codé l’univers tout entier (et au-delà) en JavaScript appeared first on Je suis un dev.

Sécurité web : l’indispensable à savoir

Wed, 21 Oct 2026 03:32:10 +0000

Laisser un énorme trou de sécurité est l'un des pires truc que tu peux faire. Les développeurs ignorent presque tout du sujet.

The post Sécurité web : l’indispensable à savoir appeared first on Je suis un dev.

Rendering untrusted HTML email, safely | The Making of Close

Tue, 20 Oct 2026 17:06:04 +0000

One of the earliest core features we built in Close was our email sync feature, which allows Close to automatically pull in email communication between your sales team and your sales contacts and display them for your team to see. We present a unified timeline of all communication (emails, calls, SMS, etc.) with a sales lead in one place for your team.

This feature required that we build a way to display email in our web app – safely, without security concerns that typically come with naively rendering untrusted HTML (Stored XSS Attacks).

We launched our ability to display synced HTML email in 2014, however the technical side of it is still very relevant and (I think) interesting since our approach is not one that I've seen widely used.

In the end, we found a way to, exclusively on the client-side (in web browsers), render untrusted HTML email safely inside our single-page application (written originally with Backbone.js, now mostly React). Here we'll discuss a few approaches we had to consider and how we solved this problem.

For example, we can display an IMAP-synced email thread like this:

HTML vs Plaintext?

While many emails do come with a plaintext variant, we had to immediately dismiss the idea of only displaying plaintext email, as convenient as that would have been from a security perspective. Many emails don't have a reasonable plaintext alternative, and users simply expect to be able to view HTML formatted email as they were designed.

Some emails only have a plaintext variant. In those cases we can render the plaintext content pretty simply in our web app: effectively just convert new lines into <br> tags and convert URLs into links.

But most of the interesting engineering/security concerns are around rendering untrusted HTML content (in this case, email content) safely, which is where the remainder of this blog post will focus.

Main goals and concerns

Our main goals were the following:

Display HTML email, not just plaintext
Display "full" HTML email. We care about much more than just a few simple tags like <b> and <i>, but rather want to support displaying sophisticated email styles (including custom style tags) that you often see in well-designed HTML email newsletters, calendar invitations, etc.
We want to render emails within our web application, without any conflicts of our CSS leaking in or the email CSS leaking out.
In addition to CSS styles, we also want to display images, expect links to work, etc.
Most important: Do not let any JavaScript run. Otherwise we run the risk of an attacker taking over our user's Close account by stealing cookies, or a number of other Very Bad™️ things.

Finding a solution…

Saying No to HTML Sanitization

While there may be some rock-solid libraries out there that can take untrusted HTML content and make it completely safe for rendering in HTML, there were a lot of potential downsides to this idea.

First off, in 2014, we didn't immediately trust any of them. HTML sanitization libraries often rely on parsing HTML with regex, which is a notoriously bad idea. We absolutely didn't want to be trying to maintain a library like this ourselves, or have to worry about some unhandled edge case that could lead to a major security vulnerability.

Additionally, unlike other use cases (e.g. rendering a blog comment which may contain just some basic markup for bolding text), we felt like we needed to render complex (heavily styled) HTML emails properly, just like you'd see in Gmail or other modern email clients, so we couldn't default to a tiny whitelist of tags or supported attributes.

Finally, HTML sanitization on its own wouldn't be enough, because we want to render the email within an existing web app, and we don't want its styles affecting the styles of the rest of the web app. There's a well-known solution to this – iframes – that we could have used to help here.

Once we explored iframes, however, we realized they could do everything we needed already on their own…

What can iframes do for us?

Most web developers know that an <iframe> can render a web page in a fairly isolated fashion. Certainly they can solve the issue of our web app styles incorrectly affecting an email's styles (or vice versa).

But we still have that pesky issue of JavaScript.

Uncommon but helpful iframe attributes

There are a number of lesser known iframe attributes that can be very helpful. Let's take a look at a few.

`srcdoc`

Most commonly iframes point to a src webpage URL – either on the same origin or different origin. But since Close is a Single Page Application and our frontend would already be fetching data about the email from our REST API (and could include the email body itself), we discovered that this attribute allowed us to inject HTML content into an iframe (with all the typical iframe benefits) without needing that content to be served by a separate page.

So rather than having to do something like:

<iframe src="/email/body/?email_id=EMAIL_ID_HERE">

... which would have required us to setup an additional endpoint, we could simply display the HTML we already had:

<iframe srcdoc="UNTRUSTED_HTML_HERE">

Neither approach is particularly more or less secure than the other. Both make you still think about "what about script execution" and consider the "same origin" vs. "different origin" options (e.g. we might have needed a separate domain and then have to pass some kind of token for authentication). We chose srcdoc because it worked and was easiest for our setup.

For the value that we inject into the srcdoc, we actually wrap the HTML email in a little HTML, with two main goals:

Give email bodies some sane default styles, and make them fit into the look-and-feel of our web app by default.
Put target="_blank" on all links by default (via a <base> tag), since we never want a user clicking an email link to load a new webpage in the iframe, and this is also a convenient way for us to apply this behavior to all links without having to traverse the email's HTML.
Apply a Content-Security-Policy <meta> tag instructing the iframe document to avoid executing any JavaScript whatsoever. (If we used a hosted page with src instead of srcdoc, this would be done with an HTTP Header instead).

<html>
  <head>
    <meta http-equiv="Content-Security-Policy" content="script-src 'none'" />
    <base target="_blank" />
    <style>
      body {
        margin: 0;
        font:
          13px -apple-system,
          system-ui,
          'Segoe UI',
          Roboto,
          Oxygen-Sans,
          Ubuntu,
          Cantarell,
          'Helvetica Neue',
          sans-serif,
          'Apple Color Emoji',
          'Segoe UI Emoji',
          'Segoe UI Symbol',
          sans-serif;
        overflow-y: hidden;
      }
      html:not(.x),
      body:not(.x) {
        height: auto !important;
      }
      p:first-child {
        margin-top: 0;
      }
      p:last-child {
        margin-bottom: 0;
      }
      a[href] {
        color: #3781b8;
        text-decoration: none;
      }
      a[href]:hover {
        text-decoration: underline;
      }
      blockquote[type='cite'] {
        margin: 0 0 0 0.8ex;
        border-left: 1px #ccc solid;
        padding-left: 1ex;
      }
      img {
        max-width: 100%;
      }
      ul,
      ol {
        padding: 0;
        margin: 0 0 10px 25px;
      }
      ul {
        list-style-type: disc;
      }
    </style>
  </head>
  <body>
    ${bodyHtml}
  </body>
</html>

`sandbox`

This attribute is the heart of our security model. By adding this attribute, it adds a whole bunch of restrictions to the iframe document, including preventing any JavaScript from running! Learn more about what's blocked here and here. The sandbox attribute allows you to opt back in specific behaviors that are blocked by default. We only allow:

allow-popups – We add target="_blank" to all of them.
allow-popups-to-escape-sandbox - So that external webpages opened via a link actually function properly.
allow-same-origin – We need this for our web app to detect the height of iframe's content. This would be dangerous (and defeat the purpose of sandbox) if we also allowed scripts to run by also including allow-scripts, however it's harmless on its own.

`csp`

We add a Content Security Policy to the iframe with a value of script-src 'none' as an additional mechanism to avoid any JavaScript from running in the iframe. This is mostly duplicative with sandbox but provides an extra layer of protection in browsers that support it.

As you can see, we have some overlap in coverage here (e.g. 3 separate features to avoid JavaScript running). We have learned of particular browser bugs where there were temporary limitations in any one of these indvidiual approaches. A reminder that security in layers is often best.

Bringing it together...

Handling unsupported browsers

As soon as we made the decision to rely on <iframe sandbox> as our primary safety mechanism, we also had to consider users with browsers who didn't have this safety mechanism, so that we didn't put their accounts at risk. Feature detection to the rescue:

// Don't show HTML at all if they are using a browser that doesn't support <iframe sandbox>
// since our security model relies on it to prevent XSS.
// (And the basic functionality relies on <iframe srcdoc>)
const iframe = document.createElement('iframe');
const isHtmlEmailSupported = 'sandbox' in iframe && 'srcdoc' in iframe;

Based on this, we can make sure we only display the plaintext email variant (if one exists) or else render a message like "Your browser does not support displaying email content."

Known limitations

One can envision additional enhancements where we would want to parse and modify the email HTML before rendering it. One example would be if we wanted to try to rewrite and proxy all image URLs (similar to Gmail) to protect our users' privacy.

Similarly, we do have a problem where browsers will show a Mixed Content warning (since our site is https://) after you display an email that includes an <img> with an http:// src. Those warnings are still fairly unobtrusive, however, but ultimately we should proxy them to be served over https.

So while we may one day layer in additional HTML parsing measures (either client-side or server-side), and could decide to switch from an <iframe srcdoc> to <iframe src>, the other security features mentioned here would still likely play an important part of safely rendering HTML email.

Lots of other details to get right

There were a lot of other details to get right. Each of them could deserve their own blog post, but here is a summary:

We have to convert "inline" images (images that are embedded within the email itself, not referencing an external URL) to be displayable by the web browser.
We have to deal with understanding quoting parts. We wrote quotequail for this. (Mailgun later open sourced a similar library called talon). You can see in the screenshot at the top of this post a little "..." button where the quoted part of the email is collapsed by default, but expandable.
We want to avoid the "extra scrollbar" issue you typically experience with iframes, so we carefully (this is surprisingly tricky) detect the height of the iframe email contents and then set the iframe to that height, giving it a seamless look on the page.
We need to consider how composing email works too. We needed a WYSIWYG editor for HTML Email that also prevents any XSS. We currently use Froala Editor for this, after having tested many editors for security.

Thoughts?

Can you find any flaws in our email rendering security model? Our product and approach has been audited by third party security firms, however we always appreciate any reports of security vulnerabilities at security@close.com.

Feel free to hit me up at @philfreo with any comments or questions!

– Phil Freo

We won’t need to know | Happiness Machines

Tue, 20 Oct 2026 10:34:46 +0000

I’ve been working in a heavy agentic workflow lately, and I foresee two states of what we are doing.

Barebones: enough architecture for us as a species to extract data and act on behalf of the commander.

And on the other side: problems utterly complex to scrape from.

The first to fall will be authentication. If everything is open, there is no one left to prove yourself to.

Then the web. Boxes in the shadow, communicating through obscure protocols optimized for machines, not us. Even a naive version of it, MCP, skyrocketed, so the need and the adoption are clearly there. A2A is the horizontal twin: agent to agent instead of agent to tool.

There will be no network but a market. A minimalist global version of Gemini, the grandchild of Gopher, where agents won’t even interact with us. It will be there for us to consume from, a GPS of knowledge, a universal standard, but with no need to connect yourself to it. You will already be there.

Not your name, not your identity. A rasterization of all your bits of information, chained together in a sequence only you have.

Decision makers will not look at landing pages. Insights will be exposed directly, for autonomous pointers, in a .txt. Like llms.txt, but insights.txt: readable as data, not as content or usability.

It’s the end of human-interface. One project points in this direction: Ink & Switch and their malleable software, tools anyone can reshape with minimal friction instead of locked-down appliances. It feels like the right time for it: the sequence of bytes stops being a dead file and starts behaving like part of a living organism.

As Dirac mentioned in his 1939 lecture, The Relation Between Mathematics and Physics:

“It seems to be one of the fundamental features of nature that fundamental physical laws are described in terms of a mathematical theory of great beauty and power, needing quite a high standard of mathematics for one to understand it.”

We want to be there. We want to be present in the loop, part of the node that orchestrates the rest. But we are being displaced from the conversation.

We should take the opportunity: think outside the box, and take on better problems we can finally tackle.

We won’t go back. Not unless energy and infrastructure logistics, turbines, steam engines, all of it, are not sufficient. The IEA counts data centres at 485 TWh in 2025, around 1.5% of global electricity, doubling by 2030.

If I had a billion dollars right now, I would invest in elevators, fire and maintenance, HVAC.

We won’t need to know. At least not this, not anymore. To leave space for other problems, and make humanity a better hive.

Web agéntica en WordPress: guía de arquitectura e IA

Tue, 20 Oct 2026 06:27:52 +0000

La web agéntica es el paradigma de internet en el que agentes de IA autónomos navegan, interpretan datos y ejecutan transacciones en sitios web sin intervención humana directa. En WordPress, que impulsa más del 43% de la web, implementar un WordPress agéntico requiere exponer protocolos como MCP y NLWeb para permitir que las máquinas operen directamente sobre el CMS.

¿Qué es la web agéntica y por qué WordPress está en el centro?

Desde una perspectiva operativa, un sitio adaptado a la web agéntica deja de ser un catálogo visual exclusivo para humanos y se convierte en un nodo de servicios ejecutable por software. En el plano académico, el marco teórico de Yang et al. (publicado en arXiv en julio de 2025) define este entorno como una nueva fase de internet definida por interacciones autónomas, multimodales y orientadas a objetivos complejos.

Para diseñar una estrategia digital hoy, es fundamental distinguir entre un asistente de IA y un agente de IA. El asistente de IA se limita a procesar lenguaje natural para informar o resumir respuestas en una interfaz conversacional. Por el contrario, los agentes de IA en WordPress toman decisiones secuenciales y ejecutan acciones reales: comparan inventarios en tiempo real, autentican credenciales, rellenan formularios multipaso, reservan citas o completan compras mediante pasarelas de pago.

El papel de WordPress en esta transición es estructural debido a su cuota de mercado superior al 43% de todos los sitios web activos. Al ser el gestor de contenidos más extendido del mundo, cualquier agente autónomo diseñado para interactuar con el ecosistema digital pasará inevitablemente por millones de instalaciones basadas en esta arquitectura. En marzo de 2026, el propio ecosistema dio un salto definitivo cuando WordPress.com habilitó nativamente que agentes de IA escriban, publiquen y gestionen sitios completos mediante 19 operaciones nuevas sobre seis tipos de contenido bajo autenticación OAuth 2.1.

La urgencia de adaptar tu sitio responde al impacto directo en la cuenta de resultados y en la cuota de tráfico. En el primer trimestre de 2026, el tráfico referido por IA hacia retailers en Estados Unidos creció un 393% interanual y, por primera vez en la historia, convirtió un 42% mejor que el tráfico tradicional, revirtiendo el déficit del 38% inferior registrado un año antes. Además, el tráfico automatizado global ya supera en volumen al tráfico humano, con los agentes autónomos representando entre el 8% y el 12% de todas las visitas en sitios de comercio electrónico.

Los usuarios que delegan su navegación o llegan precalificados a través de sistemas de IA generan un 37% más de ingresos por visita que el tráfico convencional. También permanecen un 48% más de tiempo en el sitio y consultan un 13% más de páginas por sesión. Preparar tu plataforma para recibir y procesar estas visitas automatizadas es hoy la palanca de conversión más rentable del comercio digital.

¿En qué se diferencia la web agéntica del SEO, el GEO y el AEO?

El SEO busca posicionar páginas para obtener clics humanos, el AEO estructura textos para aparecer en fragmentos destacados, y el GEO optimiza la autoridad para ser citado por motores generativos. En cambio, la web agéntica transforma tu WordPress mediante APIs y protocolos para que un agente autónomo ejecute tareas completas sin intervención visual humana.

La evolución desde los motores de búsqueda léxicos hasta los agentes transaccionales no elimina las disciplinas anteriores, sino que las integra en capas acumulativas. Un agente necesita primero descubrir la fuente mediante SEO, extraer respuestas verificadas a través de AEO, validar el consenso semántico con GEO y, finalmente, ejecutar la orden del usuario utilizando la infraestructura de la web agéntica.

Atributo	SEO Tradicional	AEO (Answer Engine Optimization)	GEO (Generative Engine Optimization)	Web Agéntica
Objetivo principal	Posicionar URLs en las SERPs para captar tráfico orgánico humano.	Ocupar la posición cero, featured snippets y respuestas de voz directas.	Ser citado e integrado como fuente autoritativa en síntesis de motores generativos.	Permitir que un agente autónomo ejecute una acción o transacción de principio a fin.
Usuario primario	Humano utilizando un navegador web tradicional.	Motores de extracción de respuestas directas y asistentes de voz.	Sistemas RAG y modelos de lenguaje (ChatGPT, Perplexity, AI Overviews).	Agentes de IA autónomos orientados a objetivos y clientes MCP.
Métrica de éxito	Posiciones de keywords, impresiones, CTR y sesiones orgánicas.	Cuota de featured snippets capturados y visibilidad zero-click.	Frecuencia de atribución, cuota de citación generativa y tráfico referido de IA.	Tasa de finalización de tareas autónomas, llamadas a endpoints API y conversión agéntica.
Formato de contenido óptimo	Artículos extensos, jerarquía HTML limpia, link building y velocidad de carga (CWV).	Bloques de preguntas y respuestas concisas (atomic answers) de 40 a 60 palabras.	Datos estadísticos verificables, citas de fuentes primarias, tablas y prosa densa en entidades.	Grafos Schema JSON-LD unificados, endpoints MCP, NLWeb y web verbs tipados.
Acción esperada	El usuario hace clic en el enlace, lee la página y navega por la interfaz visual.	El motor lee o muestra la respuesta exacta sin requerir clic hacia la web.	El modelo sintetiza múltiples fuentes y recomienda la marca con un enlace de atribución.	El agente negocia parámetros, consulta stock, reserva o compra mediante protocolos autenticados.

El respaldo empírico de esta progresión es contundente. Ya en noviembre de 2023, el estudio fundacional sobre GEO elaborado por investigadores de Princeton, Georgia Tech, Allen Institute for AI e IIT Delhi demostró que incluir estadísticas verificables, citar fuentes explícitas y añadir citas textuales incrementa la visibilidad en motores generativos hasta en un 40%. Esta necesidad se ha acelerado porque el 13,14% de las consultas de escritorio en Estados Unidos ya activan resúmenes generados por IA (AI Overviews), según datos reportados por medios especializados como Search Engine Land.

WordPress ha evolucionado su arquitectura en cada una de estas cuatro fases: pasó de ofrecer permalinks amigables y mapas XML para el SEO clásico, a integrar bloques estructurados de preguntas frecuentes para el AEO, adoptar archivos llms.txt y grafos de entidades para el GEO, hasta convertirse hoy en un servidor de aplicaciones interoperable mediante MCP y NLWeb para liderar la web agéntica.

¿Cómo ven los agentes de IA un sitio WordPress?

Los agentes de IA no perciben el diseño visual ni el CSS de tu WordPress; leen el DOM crudo, los metadatos estructurados y los endpoints de datos. Para que operen con éxito, el sitio debe adoptar una arquitectura orientada a máquinas con Schema JSON-LD, APIs REST accesibles, servidores MCP y renderizado del lado del servidor sin dependencia de JavaScript.

El concepto de machine-first architecture aplicado a WordPress implica diseñar la capa de datos pensando en un cliente de software antes que en un monitor. Cuando un humano entra a tu web, interpreta jerarquías visuales, colores de botones y menús desplegables. Cuando accede un agente de IA, busca un mapa semántico inequívoco que describa qué entidad representa el sitio, qué productos o servicios ofrece, bajo qué condiciones comerciales y qué puntos de entrada existen para interactuar con ellos programáticamente.

Definición de arquitectura WordPress para sistemas RAG y agentes:
Un sitio WordPress optimizado para la web agéntica es aquel que desacopla su lógica transaccional de la interfaz gráfica. Para ser procesado sin fricción por agentes autónomos, el sistema debe entregar HTML pre-renderizado en el servidor, unificar sus entidades en un grafo Schema.org JSON-LD, exponer capacidades de consulta mediante el protocolo NLWeb (/ask) y habilitar operaciones de lectura y escritura autenticadas a través del estándar MCP (Model Context Protocol).

Para que esta comunicación ocurra sin errores de interpretación, los agentes de IA en WordPress requieren cuatro pilares técnicos en el código fuente:

Datos estructurados unificados (Schema JSON-LD): Permiten al agente comprender las relaciones exactas entre autores, organizaciones, productos, precios y disponibilidad sin tener que inferirlas del texto plano.
APIs REST accesibles y documentadas: La WP REST API nativa (/wp-json/) debe estar operativa, con rutas claras y sin bloqueos arbitrarios de firewalls que impidan la lectura pública de catálogos o entradas.
Endpoints MCPWordPress: Punto de conexión estandarizado bajo el Model Context Protocol (desarrollado por Anthropic, que ya supera los 400 millones de descargas mensuales de su SDK) para que clientes como Claude, ChatGPT o Cursor ejecuten herramientas concretas dentro del CMS.
Protocolo NLWeb: Estándar open-source impulsado por Microsoft y diseñado por R.V. Guha (creador de RSS, RDF y Schema.org), que habilita endpoints /ask y /mcp para responder preguntas en lenguaje natural devolviendo directamente objetos estructurados en formato Schema.org JSON.

Además de leer información, los agentes necesitan ejecutar operaciones mediante los llamados web verbs (verbos web). Históricamente, los primeros agentes intentaban interactuar con la web mediante screen scraping y simulación de clics en el navegador, un método lento, costoso en tokens y propenso a romperse si cambia una clase CSS. Los web verbs son acciones tipadas y declarativas que tu WordPress expone (como add_to_cart, check_availability, book_appointment o create_draft) con esquemas de entrada y salida estrictos, garantizando que el agente complete la transacción con precisión determinista.

Un obstáculo técnico crítico en este proceso es que la inmensa mayoría de los crawlers y agentes de IA no ejecutan JavaScript. A diferencia de Googlebot, que dispone de una fase de renderizado diferido mediante un navegador Chromium sin cabeza (headless), los agentes de IA priorizan la velocidad de respuesta y el ahorro computacional descargando únicamente el documento HTML inicial.

En el ecosistema WordPress, esto representa un punto ciego masivo: si tu tema visual (page builder), tus tablas de precios, tus variantes de WooCommerce o tus reseñas se inyectan dinámicamente en el navegador del cliente mediante React, Vue o scripts AJAX pesados, ese contenido es completamente invisible para los agentes de IA. Garantizar que todo el contenido semántico y los metadatos se entreguen en la primera respuesta del servidor (SSR o HTML estático cacheado) es un requisito indispensable de supervivencia digital.

¿Qué plugins y herramientas de WordPress necesitas para la web agéntica?

Preparar un WordPress agéntico requiere instalar herramientas que traduzcan la base de datos y las funciones del CMS a estándares legibles por máquinas. El ecosistema actual cuenta con plugins WordPress IA especializados en cinco áreas críticas: servidores MCP, optimización AEO/GEO, agregación de Schema, detección analítica de agentes e implementación del protocolo NLWeb.

A diferencia de los plugins de primera generación que solo añadían un generador de textos en el editor Gutenberg, la nueva infraestructura de plugins actúa sobre la arquitectura de red y la capa de datos del servidor. A continuación se detallan las soluciones específicas disponibles hoy para transformar tu instalación, organizadas por su función técnica:

Servidores MCP (Model Context Protocol):
- NIBWP: Convierte tu instalación de WordPress en un servidor MCP completo, exponiendo entradas, páginas y taxonomías para que clientes externos de IA lean y modifiquen contenido de forma segura.
- WSP MCP: Integra el protocolo de Anthropic directamente con los hooks y filtros nativos del núcleo de WordPress, permitiendo exponer custom post types a flujos de trabajo agénticos.
- Sokket: Actúa como un puente de baja latencia que expone las capacidades operativas de tu sitio como herramientas invocables por agentes desde entornos como Cursor, Claude Desktop o agentes personalizados.
- AICOM: Especializado en el comercio agéntico, traduce el catálogo de productos, las variaciones de stock y los flujos de pedido para que agentes de compra operen sobre el sitio.
- MCP Content Manager Lite: Ofrece una interfaz ligera enfocada exclusivamente en operaciones CRUD (crear, leer, actualizar y borrar) de contenidos editoriales para automatizar redacciones asistidas por agentes.
- Invizo MCP: Proporciona una capa empresarial de gobierno y control de acceso granular sobre las herramientas MCP expuestas, ideal para sitios corporativos con múltiples roles.
- StrifeBridge MCP: Conecta arquitecturas WordPress híbridas o headless con redes de agentes distribuidos, asegurando la sincronización de estados entre el CMS y servicios externos.
Optimización AI SEO (AEO y GEO):
- Agentimus: Analiza y reestructura la jerarquía semántica del contenido en bloques atómicos para maximizar la extracción directa por parte de motores de respuesta y sistemas RAG.
- AJ Agent Crawl Optimizer: Gestiona el presupuesto de rastreo (crawl budget) específico de los bots de IA, sirviendo versiones ligeras en HTML puro y evitando la sobrecarga del servidor.
- FocusWeb AI Visibility: Monitoriza qué fragmentos de tu WordPress están siendo citados en respuestas generativas y sugiere ajustes de densidad estadística y de entidades.
- AI Data Layer: Inyecta una capa de datos estandarizada y predecible en la cabecera del documento para que los agentes extraigan atributos comerciales sin necesidad de parsear el diseño visual.
- AgentReadyScan: Ejecuta auditorías técnicas dentro del panel de administración para detectar bloqueos en robots.txt, dependencias de JavaScript en contenidos críticos o errores de esquema.
Schema y datos estructurados:
- Yoast SEO con Schema Aggregation: El plugin presente en más de 13 millones de sitios WordPress anunció en noviembre de 2025 su alianza con NLWeb y lanzó en marzo de 2026 la función Schema Aggregation, que consolida todos los fragmentos dispersos del sitio en un único grafo de conocimiento coherente para la web agéntica.
- DataStackLogic Schema Manager: Permite modelar relaciones avanzadas de entidades personalizadas y vincularlas con bases de datos de conocimiento externas como Wikidata.
- AI-Ready WP: Automatiza la generación de metadatos estructurados y archivos de contexto plano en formato Markdown para facilitar la ingesta masiva por parte de modelos de lenguaje.
Detección y analítica de agentes:
- Tactical — AI Agent Detection for WooCommerce: Identifica, separa y mide el tráfico procedente de agentes autónomos frente a visitas humanas, permitiendo atribuir ingresos y tasas de conversión específicas al canal agéntico en tiendas online.
Implementación de NLWeb:
- WPNLWeb: Es el plugin oficial para el ecosistema que implementa el protocolo open-source NLWeb de Microsoft, habilitando de forma automática los endpoints /ask y /mcp para que cualquier agente consulte el catálogo o el archivo editorial en lenguaje natural y reciba respuestas en Schema.org JSON.

Para que todas estas herramientas operen sin comprometer la integridad del sitio, el estándar de seguridad exige mecanismos robustos de identidad. En WordPress, la autenticación más común y recomendada para conectar agentes de IA se realiza mediante Application Passwords (contraseñas de aplicación nativas en el núcleo de WordPress desde la versión 5.6, que permiten revocar accesos individuales al instante) o a través del protocolo OAuth 2.1, que gestiona tokens de autorización con permisos delegados y expiración controlada.

¿Cómo preparar tu WordPress para la era agéntica?

Adaptar tu sitio a la web agéntica requiere ejecutar una hoja de ruta técnica que abarca desde la capa de renderizado hasta la exposición de protocolos transaccionales. Este checklist práctico de 12 pasos guía la transformación de un WordPress convencional en una infraestructura preparada para recibir, informar y transaccionar con agentes de IA.

Audita y unifica tu grafo de Schema markup: Verifica con el validador de resultados enriquecidos que tus páginas no emitan etiquetas inconexas; activa Schema Aggregation en Yoast SEO o configura DataStackLogic Schema Manager para entregar un grafo JSON-LD unificado.
Garantiza el renderizado en servidor (SSR) del contenido crítico: Audita tu tema y tus plugins con AgentReadyScan para asegurar que precios, textos, tablas y especificaciones se entreguen en el HTML inicial sin requerir que el cliente ejecute JavaScript.
Optimiza el archivo robots.txt para crawlers de IA: Revisa tus reglas de acceso con AJ Agent Crawl Optimizer y permite explícitamente el rastreo a agentes verificados como GPTBot, OAI-SearchBot, ClaudeBot y PerplexityBot en las secciones públicas de valor.
Publica los archivos llms.txt y agent-facts.html: Crea un archivo /llms.txt en la raíz del dominio (puedes automatizarlo con Yoast SEO o AI-Ready WP) que resuma la arquitectura del sitio en Markdown limpio, acompañado de un documento agent-facts.html con los datos verificados de tu empresa.
Instala y configura un servidor MCP en tu WordPress: Elige e instala NIBWP, WSP MCP o Sokket según la arquitectura de tu proyecto para exponer de forma controlada las capacidades de lectura y gestión de tu CMS.
Despliega el protocolo NLWeb para consultas en lenguaje natural: Instala el plugin WPNLWeb para activar los endpoints /ask y /mcp, permitiendo que agentes externos interroguen tu base de datos y reciban respuestas estructuradas en Schema.org JSON.
Configura autenticación segura mediante Application Passwords u OAuth 2.1: Crea cuentas de usuario en WordPress con roles específicos para tus agentes y genera credenciales mediante Application Passwords nativas o flujos OAuth 2.1, evitando siempre compartir contraseñas de administrador principal.
Expón «web verbs» claros para tus acciones de negocio: Si operas un e-commerce o web de reservas, utiliza AICOM o extiende tus endpoints para declarar acciones tipadas (consultar stock, calcular envío, reservar hora, iniciar pago) que los agentes puedan invocar sin simular clics.
Reestructura tus páginas con bloques de respuesta atómica (AEO): Edita tus artículos y páginas de servicio apoyándote en Agentimus para que cada encabezado H2 vaya seguido de una síntesis directa de 40 a 60 palabras antes de desarrollar el tema.
Enriquece el contenido con densidad estadística y fuentes (GEO): Añade datos cuantitativos propios o de terceros, citas textuales de expertos y enlaces a fuentes primarias para incrementar hasta un 40% la probabilidad de citación en motores generativos.
Implementa analítica específica para tráfico agéntico: Instala Tactical — AI Agent Detection for WooCommerce para separar las sesiones de agentes de IA de las visitas humanas y medir con exactitud el retorno de inversión de este canal.
Establece políticas de seguridad, permisos granulares y audit logs: Utiliza herramientas como Invizo MCP para restringir qué operaciones pueden hacer los agentes sin supervisión y exige aprobación humana (human-in-the-loop) para cualquier acción de escritura o publicación definitiva.

Errores comunes al adaptar un WordPress a la era agéntica

La transición hacia un WordPress agéntico suele fracasar cuando se confunden herramientas visuales para humanos con infraestructura de datos para máquinas. Evitar errores arquitectónicos como bloquear bots de IA, depender de JavaScript en el cliente o ignorar los protocolos MCP y NLWeb es decisivo para mantener la visibilidad y la capacidad transaccional.

A continuación se detallan los cinco errores más frecuentes en departamentos de marketing y desarrollo, junto con su corrección técnica:

Error 1: Pensar que instalar un chatbot en la esquina de la web es suficiente.
- Corrección: Un chatbot tradicional es una interfaz pasiva para que un humano haga preguntas dentro de tu página. En la web agéntica, el usuario no entra a tu web para chatear: envía a su propio agente externo (desde ChatGPT, Claude o su sistema operativo) a negociar con tu servidor. Necesitas exponer endpoints MCP y NLWeb, no solo un widget visual.
Error 2: Bloquear indiscriminadamente a los crawlers de IA en robots.txt o en el WAF.
- Corrección: Muchos administradores bloquean por defecto a todos los bots de IA por temor al raspado de datos, o activan desafíos visuales de Cloudflare (CAPTCHAs) en todo el dominio. Dado que los agentes no resuelven desafíos visuales ni ejecutan JavaScript, un bloqueo total hace que tu negocio deje de existir para el canal que hoy convierte un 42% mejor que el tráfico convencional. Configura reglas selectivas que permitan el acceso a agentes de búsqueda y compra mientras proteges áreas privadas.
Error 3: Ocultar información comercial crítica detrás de eventos de JavaScript.
- Corrección: Utilizar constructores visuales pesados que cargan precios, tablas comparativas o disponibilidad de inventario mediante llamadas AJAX posteriores a la carga de la página impide que el agente lea los datos. Asegúrate de que toda la información relevante para la decisión de compra esté presente en el HTML renderizado por el servidor y reflejada en el bloque JSON-LD.
Error 4: Tratar los datos estructurados (Schema) como un complemento opcional de SEO.
- Corrección: En el SEO clásico, el Schema servía únicamente para ganar estrellas de valoración o fragmentos visuales en Google. En un entorno de agentes de IA en WordPress, el Schema es el lenguaje nativo de lectura de la máquina. Utiliza Yoast SEO con Schema Aggregation para que el agente comprenda sin ambigüedad las políticas de envío, devoluciones, precios y relaciones de tu catálogo.
Error 5: Confundir el protocolo MCP con un plugin de generación de texto.
- Corrección:MCP WordPress no es un asistente para redactar posts más rápido dentro de tu panel; es un protocolo bidireccional de comunicación de red. Su función es permitir que agentes autorizados se conecten desde el exterior para consultar estados, cruzar datos con otros sistemas empresariales (como tu CRM o ERP) y ejecutar operaciones autenticadas en nombre del usuario o de tu equipo.

Preguntas frecuentes sobre la web agéntica en WordPress (FAQ)

Las dudas más habituales sobre la implantación de la web agéntica en WordPress giran en torno a su convivencia con el SEO tradicional, la elección de plugins MCP, la medición analítica y la seguridad operativa. A continuación, respondemos de forma directa y estructurada a las cinco consultas clave para responsables digitales.

¿La web agéntica reemplazará al SEO en WordPress?

No, la web agéntica no reemplaza al SEO tradicional en WordPress, sino que se construye sobre sus cimientos técnicos. Los motores generativos y los agentes autónomos siguen utilizando índices de búsqueda, rastreadores web, mapas del sitio y arquitecturas de enlaces para descubrir fuentes fiables antes de interactuar con sus endpoints MCP o NLWeb.

¿Qué plugin MCP de WordPress debería instalar primero?

La elección del primer plugin MCP depende del modelo de negocio de tu sitio WordPress. Para portales editoriales o blogs corporativos, NIBWP o MCP Content Manager Lite son ideales para gestionar contenidos; en cambio, si operas una tienda en WooCommerce, debes priorizar AICOM o Sokket para habilitar consultas de inventario y transacciones.

¿Cómo mido el tráfico de agentes de IA en mi WordPress?

Las herramientas de analítica tradicionales como Google Analytics 4 no registran a la mayoría de los agentes de IA porque estos no ejecutan etiquetas de JavaScript. Para medir su impacto real en WordPress, debes analizar los registros del servidor (server logs) e instalar plugins especializados como Tactical — AI Agent Detection for WooCommerce.

¿Es seguro dar a un agente de IA acceso de escritura a mi WordPress?

Sí, es seguro siempre que apliques el principio de mínimo privilegio en la arquitectura de tu WordPress. Nunca entregues credenciales de administrador; debes autenticar a cada agente mediante Application Passwords nativas u OAuth 2.1, asignarle un rol restringido a borradores y exigir aprobación humana usando gestores de gobierno como Invizo MCP.

¿Qué es NLWeb y cómo se integra con WordPress?

NLWeb (Natural Language Web) es un protocolo open-source creado por R.V. Guha en Microsoft que permite consultar sitios web en lenguaje natural y recibir respuestas estructuradas en Schema.org JSON. En WordPress, se integra instalando el plugin WPNLWeb o mediante la infraestructura de Yoast SEO, exponiendo automáticamente los endpoints /ask y /mcp.

Conclusión: la ventana de oportunidad para WordPress

Las empresas con sitios WordPress que adapten hoy su infraestructura a la web agéntica obtendrán una ventaja competitiva directa y medible en visibilidad, eficiencia operativa y conversión comercial. Cuando un canal emergente demuestra convertir un 42% mejor y generar un 37% más de ingresos por visita que el tráfico tradicional, dejar tu arquitectura web preparada únicamente para navegadores humanos supone renunciar al segmento de mayor crecimiento del mercado digital.

Esta transición tecnológica no es una proyección a largo plazo, sino una realidad desplegada en producción. La integración nativa de operaciones agénticas bajo OAuth 2.1 en WordPress.com, el soporte de Schema Aggregation e integración con NLWeb por parte de Yoast en más de 13 millones de instalaciones, y la madurez de los plugins de servidor MCP demuestran que el ecosistema ya dispone de todas las piezas necesarias. Tal como destacan los análisis técnicos de publicaciones como Search Engine Journal, la interoperabilidad entre gestores de contenidos y agentes autónomos definirá el estándar de desarrollo web de los próximos años.

El primer paso no exige reconstruir tu sitio desde cero, sino evaluar con precisión cómo lo interpretan las máquinas hoy. Realiza esta semana una auditoría técnica de tu instalación WordPress: comprueba qué información entregas sin depender de JavaScript, valida la coherencia de tu grafo Schema JSON-LD y planifica el despliegue de tus primeros endpoints de consulta para asegurarte de que, cuando el agente de tu próximo cliente llegue a tu dominio, encuentre las puertas abiertas para operar.

La entrada Web agéntica en WordPress: guía de arquitectura e IA se publicó primero en Inprofit.

Roastidio.us Tagged with web

Mastodon 5

Putting this blog on ATProto with standard.site | Redowan's Reflections

What it is #

Why bother #

Setting it up with Sequoia #

Making it hands-free #

Seeing it work #

Decorative Images… — Adrian Roselli

Decorative Images…

Decision Tree

If yes, the image contains text…

If no, the image contains no text…

If yes, the image is contained in a control…

If no, the image is not contained in a control…

If yes, the image contributes meaning…

If no, the image contributes no meaning…

If no, the image is not purely decorative or is intended for the user…

If yes, the image is purely decorative or not intended for the user…

If yes, users would care if the image went away…

If no, users wouldn’t care if the image went away…

If no, the author wouldn’t care if the image was replaced by poo…

If yes, the author would care if the image was replaced by poo…

Related

3 Comments

Leave a Comment or Response Cancel response

Réseaux sociaux, streams, rencontres : le jeu vidéo, une pratique communautaire pour la Gen Z

43 % des pros du SEO font du GEO une priorité pour 2027, alors que sa mesure reste floue

Google veut rendre les liens plus visibles dans les AI Overviews

Please don't mess with links:

Please don't mess with links:

Other common problems:

Related:

Episodio 107. SEO Local ¿Cómo se hace, pero bien?

¿Qué es el SEO Local?

SEO Local: Beneficios

¿Cómo hacer SEO Local en mi negocio?

Recuerda…

Oracle Cloud Free Tier 2026: Ainda Vale a Pena? Guia Completo + Alternativas | Home

O problema

Redirecionamento de Portas no Roteador

DMZ para o host executando NPM

Configurar domínios e endereços IP

Cloud VPS

Oracle Cloud Free Tier

Links de referência

Conclusão

iPhone Duo and Safari

La Turquie ferme les réseaux sociaux aux moins de 15 ans, et sa méthode change tout

Attal veut pouvoir couper certains réseaux sociaux pendant les émeutes, le Conseil d’État lui a déjà dit non

PHP2Shell

Ofcom Concedes Defeat in 4chan Case

Instagram Charging for Links

Reddit to Remove RSS

Michael Tsai - Blog - Passkeys Attestation Trap

Passkeys Attestation Trap

18 Comments RSS · Twitter · Mastodon

Leave a Comment

« On a un problème » : une faille de sécurité absurde met Internet en alerte

Après la découverte d’une faille dans PHP, une attaque massive pourrait se produire sur le web aujourd’hui

Le merveilleux monde des dégénérés du Web3

J’ai codé l’univers tout entier (et au-delà) en JavaScript

Sécurité web : l’indispensable à savoir

Rendering untrusted HTML email, safely | The Making of Close

HTML vs Plaintext?

Main goals and concerns

Finding a solution…

Saying No to HTML Sanitization

What can iframes do for us?

Uncommon but helpful iframe attributes

srcdoc

sandbox

csp

Bringing it together...

Handling unsupported browsers

Known limitations

Lots of other details to get right

Thoughts?

We won’t need to know | Happiness Machines

Web agéntica en WordPress: guía de arquitectura e IA

`srcdoc`

`sandbox`

`csp`