I wrote some time ago about how I was testing ZeroClaw, a self-hosted agent in the Claw-like ecosystem, and how I wanted to build a workflow for sending links and ideas through Telegram to turn into structured notes that I could later use to write posts for this blog. At the time, the ZeroClaw project was having some issues and had been temporarily taken offline by GitHub. Everything was eventually fixed.

I finally sat down and upgraded to the the latest version of the binary. Since the last time I used it, the structure had changed so much that I couldn’t even open the dashboard with my current config. So I just wiped everything and started over using the install script and onboarding process, which are much smoother than before. The previous issues with tool use in chat also seem to be fixed: the bot can actually do useful things out-of-the-box.

I sat down and co-developed a new note-taking skill with ChatGPT. The workflow is simple:

• Invoke with /note in chat
• Draft a concise note of the provided content (using web fetching for links)
• Present the note to the user and go back-and-forth until the user approves
• Run a Python script to write the note to the local blog repo, commit it, and push it
• The resulting note is now visible in Sveltia CMS under ‘Notes’

I thought DeepSeek V3.2 would be a good model to pilot OpenClaw and this skill, but I was wrong. The chat would frequently hang and the bot would stop responding, sometimes giving me dry orchestration messages like the following instead of actual responses:

Today marks the 16th anniversary of Bitcoin Pizza Day, the closest thing the cryptocurrency has to a holiday. May 22, 2010 was the first time Bitcoin was used to purchase something in the real world, when Laszlo Hanyecz paid another user of the Bitcoin Talk forum 10,000 bitcoins to deliver him two Papa John’s pizzas.

Every story about Bitcoin Pizza Day inevitably converges on the same thing: the remarkable present value of the 10,000 bitcoins used to purchase those two pizzas (more than $770 million USD at time of writing). The humour in this situation was recognized very early in the crypto community—nine months later, the pizzas were already “worth” $10,000 USD, and their value has appreciated immensely since then.

Bitcoin Pizza Day is the longest-running joke in crypto, and there have been numerous trackers over the years providing constant updates on the comical divergence in value between the two pizzas and the 10,000 bitcoins that were paid for them. From 2015 to 2023, Twitter’s Bitcoin Pizza account provided daily updates on the value of the Bitcoin pizzas (until Twitter API changes killed the account). The more elaborate Bitcoin Pizza Index breaks down the pizzas component-by-component: each tomato slice is worth north of two million dollars.

So what is the joke here, exactly? The subtitle to this CoinTracker article put it best (emphasis mine):

To follow the theme of my post from two days ago,“hey, what are we actually measuring?”, I want to recap a classic public health example in the same vein: heat-related deaths during the June–July 2018 heat wave in Quebec and Ontario.

Per the Toronto Star article:

Sixty-six people died from the heat in Montreal in the first week of July 2018. Eighty-nine across Quebec.

Yet zero in Ottawa. Zero in Ontario.

The Ottawa River, which divides the two provinces, didn’t separate two major weather systems last summer. Heat and humidity ignore political borders.

There are differences between Quebec and Ontario, such as the greater prevalence of air conditioning in Ontario. But can these factors really be responsible for such a stark disparity? According to Montreal public health official Dr. David Kaiser, the real story here is measurement, in particular the strictness with which Ontario defines heat deaths compared to Quebec:

This is because people who die during heat waves are not dying from heat stroke, a medical diagnosis that is coded into medical records, Kaiser said. If you only count deaths by heat stroke, you’re missing the vast majority. […] “If the coroner doesn’t have information that he had an elevated body temperature, signs of heat-related illness, heatstroke and shock, they won’t count it as a heat-related death.”

…

There has been some movement on surveillance pricing (i.e., algorithmic price discrimination) bans in the United States. In late March, we talked about the Colorado House advancing a bill to ban the practice. A recent article from CalMatters summarizes some of the progress that has been made since then:

• The Colorado legislature passed the aforementioned surveillance pricing ban.
• Maryland banned surveillance pricing for groceries, the first state to do so.
• The Connecticut legislature passed a surveillance pricing ban.
• The California Legislature voted to advance a surveillance pricing ban.

It remains to be seem how these bans will actually be enacted, as roughly half of states consider bills to regulate the practice. In April, Canada’s minor New Democratic Party introduced a motion to ban surveillance pricing.

On to prediction markets. First, chain analysis firm Bubblemaps appears to have identified an individual or group making millions betting on US military actions:

Nine connected Polymarket accounts have raked in more than $2.4 million betting almost exclusively on U.S. military actions […] Across more than 80 bets, the accounts had a 98% win rate, even as many wagers were made when the odds of winning were low

Minnesota has also become the first US state to pass a law banning prediction markets. The Commodity Futures Trading Commission has sued Minnesota to stop their prediction market ban, creating a legal showdown likely to set precedent for future bills. The federal regulator argues the state lacks the authority to regulate prediction markets and specifically mentions the restriction on agricultural trading on weather-related contracts that farmers uses to hedge against risk. The NPR article mentioned an updated version of the bill allowing trading on the weather, but I’m not sure what the status of that is given that the CFTC specifically mentioned this objection in their release yesterday.

Gideon M-K wrote an article recently on “The Most Persistent Myth About COVID-19”. It debunks the persistent myth, echoed by public health luminaries like RFK Jr., that people who died of COVID-19 mostly died of pre-existing chronic conditions, rather than the virus itself. This falsehood is encapsulated by the following quote from testimony RFK Jr. gave last month:

In fact, during COVID, we had the highest death rate of any country in the world. And when you ask CDC, why is that true? They say, well, it’s because we’re the sickest population. The average American who died from COVID had 3.8 chronic diseases. What was killing them? COVID or the chronic disease? You have to understand infectious disease has a very hard time killing a healthy person.

This is false, but it stems from a misunderstanding in how death reporting works. Consider the following passage from the CDC website on COVID-19 deaths:

For over 5% of these deaths, COVID-19 was the only cause mentioned on the death certificate. For deaths with conditions or causes in addition to COVID-19, on average, there were 4.0 additional conditions or causes per death.

Perusing the “Comorbidities and other conditions” table on that website will show you that many of the most common conditions listed on the death certificate alongside COVID-19 are downstream consequences of the disease, such as respiratory failure and pneumonia. But as M-K points out, CDC reporting does not distinguish between a condition contributing to death and a secondary underlying cause.

The UK’s National Health Service (NHS) has responded to advancements in automated AI code scanners by deciding to close nearly all of its open source repositories. As noted by open source advocate and one-time civil servant Terence Eden, the UK’s Government Digital Service subsequently released a report decrying this “closed by default” turn. They summarize the objections like so:

1. Private repositories can create a false sense of security. Making a repository private can encourage security-by-obscurity thinking, and can reduce the urgency to fix underlying weaknesses.

2. Closing code after publication may not remove exposure. Where code has been developed in the open, making a repository private later may not remove access for a capable adversary as popular repositories are often mirrored or forked, and even low-profile repositories may already have been indexed or cloned by researchers or attackers.

3. Closure can become a one-way door. Private repositories reduce reuse and external scrutiny, and over time teams diverge. That makes it harder to make the code public again, because the work required to publish safely and confidently increases.

4. The same tools can be applied to defence. As discovery accelerates, defence must rely on continuous review, testing and remediation. Openness reinforces this discipline, while avoiding scrutiny does not remove defects and can allow weaknesses to persist.

5. Openness can surface issues earlier. Public code allows issues to be identified by a wider set of reviewers, including across government and the supplier ecosystem. Closing code concentrates discovery within delivery teams and operational monitoring.

   …

Everyone’s talking about that New York Times article “unmasking” Satoshi Nakamoto, the pseudonymous developer of Bitcoin. Or at least they were when I started writing the draft of this post a little over a month ago, after listening to the related interview on The Daily podcast.

In short, investigative journalist John Carreyrou of Theranos fame purports to be 99.5–100% certain of his identification of Satoshi based primarily on stylometric analysis and a timeline of events (plus other circumstantial evidence) which admittedly lines up pretty well.

I am skeptical of the ability of stylometry analysis to bring anyone to the level of certainty Carreyrou claims for his identification. (But maybe I shouldn’t be, given the apparent power of LLMs to unmask individuals online.) There are many approaches, and different ones inevitably lead to different results. Carreyrou himself reckons with this in his article, facing early disappointments in his investigation when a series of stylometric analyses appeared to favour another candidate.

Another problem is the major unstated assumption that every stylometric analysis on this topic relies on: that the entire Satoshi corpus has a single author. This assumption is challenged by those who believe “Satoshi” was a pseudonym used by a group, with different members authoring (or collaborating on) different components (e.g., the forum posts, emails, code, and white paper).

Halina Bennet’s observation that most people can’t really stomach pop culture depictions of the COVID-19 pandemic got me thinking about my country’s curious lack of reckoning to this generation-defining crisis. As I wrote a few days ago:

That being said, I don’t think we should be complacent about the overall risk of a pandemic as bad as or worse than COVID-19 in the coming years and decades. Our biomedical tools (e.g., mRNA vaccines) may be sharper than ever, but as a society we have not done nearly enough to grapple with our response to the last pandemic. Instead of confronting our failures directly, we have largely chosen to move on. My fear is that our civilizational capacity to respond to another global pandemic has been badly depleted.

Canada has not had any kind of national public inquiry for the COVID-19 pandemic, despite repeated calls for one. Canada is hardly unique in this respect. The United States also never had a public inquiry, even as backlash to public health measures helped usher in a new generation of political and health leadership. There was a United States House COVID Subcommittee, but this was a partisan-led congressional investigation, not an independent inquiry. Canada has not even had the equivalent of that, such as a national parliamentary investigation of comparable scale.

This silence is doubly strange because there is a direct Canadian precedent, albeit a provincial one. After the 2003 SARS outbreak, the Government of Ontario established the SARS Commission, chaired by Justice Archie Campbell, as an independent inquiry into how the virus was introduced, spread, and dealt with. The death toll from SARS in Canada numbered in the dozens. The death toll from COVID-19 numbered in the tens of thousands. And yet the smaller disaster was the one to produce an institutional reckoning.

FiveThirtyEight was a US politics and sports analysis blog founded by Nate Silver in 2008. In 2013, the site was acquired by ESPN and in 2018 it was transferred to sister property ABC News, both owned by Disney. Nate Silver left the site in 2023 amid cost-cutting measures. Two years later, the whole site was killed off.

Today, Disney nuked the FiveThirtyEight’s archives. Everything ever written on the site is gone, with the URLs simply redirecting to the ABC News politics feed. Their data page remains up for now, and while the articles it links to are inaccessible, the dataset links still lead to a working GitHub repository. I assume everyone who knew the password is gone, but I wouldn’t be surprised if Disney eventually gets this taken down, too.

Nate Silver reportedly wanted to buy the remaining FiveThirtyEight IP, but Disney preferred to shred it. In his words:

BTW, I approached ABC about buying back the former FiveThirtyEight IP*, and they said they wouldn’t sell at any price because I’d criticized their management of the brand. Costing Disney shareholders $$ b/c of their vindictiveness.

* I own the models but the trademarks, etc.

FiveThirtyEight was a pretty formative website during my education when I was learning about statistics and later survey methodology. I think it was from Nate that I first learned about the famed “MRP” technique (even if Nate has since become more skeptical of it). I learned a ton from the website, even if I always much more into the politics side of it than the sports side.

This post contains light spoilers for The Boys.

Very few TV shows increase in quality toward the end. The Shield is a rare exception, where the quality of each season increases in a somewhat linear fashion. The Boys, Amazon Prime’s irreverent superhero show, is not one of these exceptions. The first season is the best. I just finished watching the final season’s penultimate episode, and unless the show delivers a mind-blowing finale next week, the final season will have been the show’s worst.

Something that has become more grating as the show’s writing has deteriorated is the constant stream of pop culture references. I have no problem with the show providing its own satirical lens on modern-day media such as livestreamers and podcast bros; indeed, this has provided some of this season’s best material. But the specific pop culture references, like this week’s references to the assassination of Jeffrey Epstein (oops, death of Jeffrey Epstein) and the TV show Love Island, or the countless celebrity name drops earlier this season, are a problem.

The problem is that Vought International, the most important corporation in The Boys universe, was founded in 1950 and has been dominant since the 1970s. The corporation is dominant in defence, pharmaceuticals, fast food, politics, and who knows how many other industries. And despite this, pop culture seems to have developed in much the same way as in our own world, with the same celebrities and the same reality TV hits dropped in almost unchanged. Somehow, Love Island survived Vought.

Matt Bruenig recently posted about transitioning his think tank’s website from Wordpress to a fully customized CMS vibe-coded by Claude. It inspired me to write a bit about the stack that powers BIg Muddy, as I have also used vibe coding to bolt some features onto this blog.

Big Muddy is created using Hugo as a static site generator based on the Archie theme. To manage content, I use Sveltia CMS, a git-backed headless CMS that runs in the browser and requires nothing more than a GItHub auth token. My site is hosted on Cloudflare Pages and regenerates automatically every time the site’s public content is updated.

While I enjoy the simplicity of Sveltia, it does lack some of the features of a more complex hosted CMS. For example, there is no ability to schedule a post and the handling of drafts (normally a toggle on a post to set to published/unpublished) is not great if you have many drafts. This is a problem because I eventually plan to create an agent that can create drafts based on notes I sent to it, so I can more easily turn my half-based thoughts into full posts when I have the opportunity.

I solved all of these problems by creating a new content category for “drafts”, rather than using the drafts toggle in my current “posts” category. Sveltia has no mechanism for changing content type (i.e., from draft to post), so I created a Python script for promoting a draft to a post (changing type, adding the current date and time, and generating the URL slug). I also added an optional field in the drafts content type for “scheduled date”. Now, I have a GitHub Action that runs every day and will promote a draft to a post if it’s scheduled for today’s date (obviously, I schedule it using a cron on my server and not the horribly unreliable GitHub Actions cron).

If you were a PC gamer and BitTorrent user in the 2000s through the early 2010s, you were probably familiar with DAEMON Tools. The software allows users to mount disk images as if they were physical disks in a physical drive. Well, it turns out the software is still around and has been compromised since at least April 8, 2026. As Kaspersky Securelist reports:

In early May 2026, we identified installers of the DAEMON Tools software, used for mounting disk images, to be compromised with a malicious payload. These installers are distributed from the legitimate website of DAEMON Tools and are signed with digital certificates belonging to DAEMON Tools developers. Our analysis revealed that the software installers have been trojanized starting from April 8, 2026. Specifically, we identified versions of DAEMON Tools ranging from 12.5.0.2421 to 12.5.0.2434 to be compromised. At the time of writing this article, the supply chain attack is still active. Artifacts suggesting that the threat actor behind this attack is Chinese-speaking have been identified in the malicious implants observed.

The fact that the attacker has been distributing malicious binaries signed with the official cert on the official website for nearly a month (and counting) would seem to indicate a pretty deep level of compromise. While Kaspersky observed the malicious software on thousands of machines, a handful of high-value targets appear to have been targeted for further exploitation:

Dr. Marty Makary, head of the FDA, the United States’ drug regulator, announced something genuinely interesting and innovative last week. As Abigail Beaney of Clinical Trials Arena reports:

The US Food and Drug Administration (FDA) is launching a pilot to implement real-time clinical trials (RTCT).

While announcing the pilot, the FDA revealed that two proof-of-concept clinical trials have been successfully initiated, which will report endpoints and data signals to the agency in real time, from AstraZeneca and Amgen.

[…] For each trial, the FDA met with the sponsor on the establishment of criteria for reporting signals in real time. The agency has since received and validated signals for AstraZeneca’s trial through Paradigm Health’s Study Conduct Platform, which automates data collection and analysis while improving how key safety and efficacy signals are reported to both trial sponsors and regulators, supporting more efficient oversight.

We’ve previously discussed Eroom’s law on this blog, which describes the exponential decay of productivity in drug discovery over time. Shortening the time between the conclusion of a trial and the reporting of its results could us realize the potential of AI for drug discovery. Currently, AI is helpful for discovering candidate molecules, but we still have a huge bottleneck in actually testing the resulting experimental therapies in patients. Automated reporting pipelines to regulators could also give us greater confidence in the data if it results in more pre-specification (and less human error/latitude) in data collection and analysis, but that depends on the particulars of how the system is implemented.

The seed of this post was hearing “I Don’t Wanna Wait” on the radio while shopping for groceries. The song rips off “Dragostea Din Tei” by O-Zone, which anyone who was on the Internet in 2004 knows as “Numa Numa”.

Gary Brolsma’s lip-syncing video was one of the Internet’s earliest memes, and perhaps the best. It was pure, joyful, spontaneous, and released with no expectation of fame or commercialization. It was just some guy in front of a webcam having the time of his life. Now everyone is lip-syncing all the time on TikTok, except there is no joy, no spontaneity, only endlessly choreographed offerings to the almighty algorithm.

I’ve been mourning the old Internet over the past year or two. Kids growing up today will never know that the Internet used to be different. Golden ages are usually defined in retrospect. As a kid on the Web from the early 2000s through the mid-2010s, we knew we were living through something special, but it always felt like there was something better around the corner.

When I was growing up in the 2000s and early 2010s, privacy and mass surveillance by governments were a major topic of discussion. Laws like the Patriot Act (and the local equivalents around the world) were endlessly fretted over in the media and debated in legislatures. This probably peaked in 2013 with the Snowden leaks, which revealed that American and allied intelligence agencies were sucking up data from major tech companies and tapping the very backbone of the Internet itself.

We imagined mass surveillance as a problem of centralized government power. We feared that the state would build a machine capable of watching everyone. But then the best minds of our generation got thinking about how to make people click online ads. First, we gave over all our data willingly enough to social media companies. Then, without really noticing, we handed it over to a never-ending stream of data brokers and middlemen and whatever category of company Palantir is (mass-surveillance-as-a-service?). Mass surveillance was no longer only a feared tool of the state. It was just the business model of the Internet: available for governments and anyone else willing to sign a contract. That’s how a nonprofit ends up spending millions of dollars to figure out which priests are using Grindr.

Technology quaintified the surveillance debate. It made the old fears feel almost wholesome. They assumed a world in which only the government could weave together the disparate threads of our online lives into a proper panopticon. But then ad tech built the same system, only bigger and cheaper and for anyone to purchase. The old arguments weren’t wrong, it’s just that the government didn’t have to win them. Ad tech changed the facts on the ground while trying to make people click ads.