❌

Normal view

Received — 26 September 2026 ⏭ Activism

Pluralistic: Itch scratching (25 Sep 2026)

✇Pluralistic: Daily links from Cory Doctorow
By: Cory Doctorow
25 September 2026 at 20:56


Today's links

  • Itch scratching: Love, care and self-actualization.
  • Hey look at this: Delights to delectate.
  • Object permanence: 9/11 x Viridians; Announcing Wikipedia; Infinite Copyright Mickey; Floppy shoulder bag; Wells Fargo's long sleaze; Corbyn wins Labour leadership; Interop v internet monopolies; The billionaires aren't all right; RIP Mike Ford; PGP didn't cause 9/11; Flying Solaris boxen; "Unelectable" Corbyn; Algorithmic management; "That's Disgusting!"; Tax breaks for repair expenses; Climate denial driven by economic doctrine; "100% pumpkin" has no pumpkin; Copyright reversion; "Scholars of the Night"; Apple threatens EU.
  • Upcoming appearances: Edmonton, Boston, Brighton, South Bend, Hudson, Calgary, Winnipeg, Paris, OVancouver, Victoria, Ottawa, Kilkenny, Montreal.
  • Recent appearances: Where I've been.
  • Latest books: You keep readin' em, I'll keep writin' 'em.
  • Upcoming books: Like I said, I'll keep writin' 'em.
  • Colophon: All the rest.


A shirtless bald man seen from behind. He has contorted one arm between his shoulder blades to scratch an itch. The itchy area glows red, as do the abstract clouds surrounding him. Small angelic figures caper in the mist.

Itch scratching (permalink)

The thing about a maddening itch between your shoulder blades is that it feels so good when you scratch it, and even better when someone else scratches it, and better still if that person hits the right spot because they love you and they've performed this service for you so often and attentively that they know exactly which spot to hit.

One of the recurring themes in Spider Robinson's short stories and novels is people who have close relationships suddenly realizing that they have acquired a psychic link. He comes up with endless ways to play this scene out, but my favorite – I think it's from one of the later Callahan's tales – is when one person scratches another between the shoulder blades and hits the exact right spot the very first time and they realize that they are now psychically linked.

Maybe it's a primate grooming reflex, maybe it's receiving a gesture of love and care. Maybe those are the same things. Having your itch scratched for you feels good. Not just primates, either: cats with the flexibility to reach any part of their body with all four of their paws and their teeth will nevertheless purr like a badly-tuned diesel outboard when you scratch them just right.

Since the outset, the free software/open source movement has extolled the virtues of technological self-determination, which is to say, deciding how the computers and programs you use will work. This is often described as "scratching your own itch."

There is no question that scratching your own itch in this way is hugely and enduringly satisfying. On my laptop, I have a variety of little scripts and keybindings and bits of automation that I've built up over the years and every time I use one of these, I get a little hit of brain-reward.

The latest: I got tired of alt-tabbing to get to the file explorer, only to discover that I'd closed all my file explorer windows, meaning I had to mouse over to the dock and open a new one. So I bound "Windows key + E" to opening a file explorer after reading a message board post from an ex-Windows user who'd done this (apparently this is a standard Windows keybinding).

I've fully retrained my fingers to type Win-E rather than alt-tab when I want to get at a graphic filesystem and every time I do, I get the tiniest little pleasant jolt of pleasure. I scratched my own itch!

But even better than this are the little scripts that other people have thoughtfully made for me over the years. The oldest of these still in daily use is more than 20 years old, a bash script called "boingpic" (from when I was still working on Boing Boing). When I run this, it iterates interactively through the files ending with "jpg" or "png" on my Desktop, tells me how wide they are, prompts me to resize them or hit enter to keep their size, and then rsyncs them to the directory on my server that corresponds to https://craphound.com/images/.

If this strikes you as weird and inefficient, that's fine, because it does exactly what I need it to do, and I've memorized it through long, long use. And on top of all that, boingpic.sh was written for me by my dear old friend Seth David Schoen, when we were one of a bare handful of EFF staffers in the early oughts and hung out together all the time. Every time I use it, it reminds me of Seth, and good times, and I feel good.

For centuries, people have fought for the right to self-determination. The disability rights rallying cry "Nothing about us without us" actually dates back to 16th century Poland (it was the basis for the formation of a Polish parliament that wrested power away from the king). Any parent who has avoided a conflict over getting dressed for school by swapping out "Put your clothes on right now!" for "Which would you rather put on first, your shirt or your socks?" knows how far even a little autonomy can go.

I worked as a computer programmer from the age of 17 to about the age of 29, and while I was never a spectacular coder, I was good at it, and I wrote a lot of code for myself that precisely met my needs, which always felt great. It's one of the reasons I have always championed low-code/no-code software development tools, from Logo to Hypercard to Visual Basic to Scratch. Sure, the code that you write with one of these tools might not be "efficient" from a CPU/memory-usage perspective, but the point is that you write it. You don't have to convince someone else to do you a favor, you don't have to part with any of your money – and you don't have to try to get someone else to understand what you mean when you describe the tool you want.

When I worked at Bakka Books (the world's oldest surviving science fiction bookstore, in Toronto), we organized our inventory using an extremely idiosyncratic Filemaker database created by the store's then-owner, John Rose. John lovingly tended that Filemaker app, tweaking it on his days off to make it better suited to the very specific needs of a science fiction bookstore with a giant used section and an important sideline in keeping collectors' want-lists that we consulted whenever we bought more used books. There are doubtless "better" bookstore stock-keeping systems (including the one that Bakka uses now, in its latest incarnation as BakkaPhoenix), but that Filemaker app was John, a presence in the store even when he wasn't there, embodying his management and literary and retail theories on a MacSE by the cash-register.

I am highly skeptical of vibe-coding in the sense of writing code for other people to use. But when I meet people who've vibe-coded their own apps for their own use to scratch their own itches, I completely get their excitement. They've scratched their own itch! I know exactly how good that feels:

https://pluralistic.net/2026/07/03/rod-logic/#making-flippy-floppy

Sure, I have concerns about this kind of personal vibe-coding, the biggest of which is that if you aren't a skilled programmer, you might end up vibe-coding an app that you can't adequately assess, so it might contain subtle defects that make you vulnerable to security risks and/or expose your sensitive information to the public internet. But there are domains and use-cases where I am totally willing to accept that vibe-coding can enhance someone else's life in important ways, by letting them build exactly the widget they need, and if (when) it breaks, they can just do it again.

This is even better than "nothing about us without us." It's not just insisting that someone else "gather your requirements" before producing a tool that you will rely on and require. This is you, producing that tool for yourself, which means that you might be able to embed features and affordances into it that you can't even articulate, let alone defend. There's something undeniably great about scratching your own itch and hitting exactly the right spot.

Even so: the experience of working through your requirements with someone else is clarifying and disciplining, because while you are the domain expert on your needs, that doesn't mean you're the domain expert on how to address those needs. You have the worm's eye view of your life and your needs, while an expert can have the bird's eye view that comes from working with many people, exposing them to many ways of solving problems, including ones you've never thought of.

Darren, the contractor who put in our new kitchen a couple years ago, had ideas for cabinet- and appliance-placement that had been refined by seeing, demolishing, building and revising orders of magnitude more kitchens than we had ever cooked in, and moreover, he clearly cared about our long-term happiness in our own home. The kitchen is great.

That care makes all the difference. Skilled craftspeople can bring expertise to the project that doesn't trump your needs, but can be co-equal with them. Scratching your own itch is great, having your itch scratched by someone who cares enough about you to know where your itch is, that's even better. But best of all is for that person to find the itch you didn't even know you had and scratch that, too. That's something that relies on the human connection that the best free/open source projects embody, the co-creation and community between developers and users.

If you've ever filed a bug against a free/open project and worked through the testing the devs need to squash it, you've experienced that co-creation. The devs want their code to work, because they care about the users, and you as a user can help other users and the devs by reciprocating that care through conscientious, patient, attentive bug reporting and testing.

I think that so much of the outrage about slop code – floods of garbagey pull requests and bug reports – is the result of the collapse of this dynamic. Slop's not merely annoying or time-wasting: it's a betrayal of the love and care that goes into writing and maintaining code for others. Your cat can scratch any part of its body, but it wants you to scratch it, and it will hiss at you and even claw at you if you scratch it the wrong way.

(Image: Orrling and Tomer S, CC BY-SA 3.0, modified)

Hey look at this (permalink)


A shelf of leatherbound history books with a gilt-stamped series title, 'The World's Famous Events.'

Object permanence (permalink)

#25yrsago Surveillance is a security failure https://www.theguardian.com/technology/2001/sep/27/onlinesupplement.afghanistan

#25yrsago 9/11: the Viridian take https://web.archive.org/web/20011023095346/http://www.viridiandesign.org/notes/251-300/00272_au_revoir_belle_epoque.html

#25yrsago Announcing Wikipedia https://web.archive.org/web/20060517024408/http://www.kuro5hin.org/?op=displaystory;sid=2001/9/24/43858/2479

#25yrsago Phil Zimmerman says PGP can't be blamed for 9/11 https://slashdot.org/story/01/09/24/162236/philip-zimmermann-and-guilt-over-pgp

#20yrsago RIP, sf writer John M Ford https://memex.craphound.com/2006/09/25/rip-sf-writer-john-m-ford/

#20yrsago Gigantic Little Nemo book does justice to the loveliest comic ever https://memex.craphound.com/2006/09/25/gigantic-little-nemo-book-does-justice-to-the-loveliest-comic-ever/

#20yrsago 747s as flying Unix hosts: SCADA in the sky https://memex.craphound.com/2011/09/25/747s-as-flying-unix-hosts-scada-in-the-sky/

#20yrsago Mickey Infinite Copyright mashup https://web.archive.org/web/20061027141551/http://python.net/~goodger/projects/graphics/#mickey-s-infinite-copyright#mickey-s-infinite-copyright

#20yrsago HOWTO make a shoulder-bag out of floppies https://web.archive.org/web/20061025050629/http://www.instructables.com/id/E86165FIENERIE2PV6/?ALLSTEPS

#15yrsago TOSAmend: turn all online “I Agree” buttons into negotiations https://web.archive.org/web/20110925122850/https://www.owocki.com/2011/09/02/tosamend-the-easy-way-to-modify-web-service-terms-of-service-agreements/

#15yrsago That’s Disgusting! Awesomely gross picture book https://memex.craphound.com/2011/09/26/thats-disgusting-awesomely-gross-picture-book/

#10yrsago Swedish law will let you write off the money you spend fixing things rather than trashing them https://www.theguardian.com/world/2016/sep/19/waste-not-want-not-sweden-tax-breaks-repairs

#10yrsago Climate denial’s internal contradictions spring from a need to defend economic doctrine https://link.springer.com/article/10.1007/s11229-016-1198-6

#10yrsago There’s no pumpkin in “100% canned pumpkin” https://web.archive.org/web/20160927152542/https://www.foodandwine.com/news/i-just-found-out-canned-pumpkin-isnt-pumpkin-all-and-my-whole-life-basically-lie

#10yrsago The AI Now Report: social/economic implications of near-future AI https://web.archive.org/web/20161014142521/https://artificialintelligencenow.com/media/documents/AINowSummaryReport_3.pdf

#10yrsago Whistleblowing Wells Fargo loan officer describes years of fraudulent, criminal culture in the bank https://truthout.org/articles/wells-fargo-whistleblower-they-are-all-riding-the-stagecoach-to-hell/

#10yrsago Writer in 29th year of solitary confinement barred from reading his own book https://solitarywatch.com/2016/09/20/writer-in-solitary-confinement-is-barred-from-reading-his-own-book/

#10yrsago Despite sabotage and dirty tricks, Jeremy Corbyn wins Labour leadership race in unprecedented landslide https://www.bbc.co.uk/news/uk-politics-37461219

#10yrsago Who decided Corbyn was “unelectable”? https://www.youtube.com/watch?v=8os-nKuoM3o

#10yrsago The democratization of censorship: when anyone can kill as site as effectively as a government can https://krebsonsecurity.com/2016/09/the-democratization-of-censorship/

#5yrsago Demonopolizing the internet with interoperability https://pluralistic.net/2021/09/24/comcom-acm/#cacm

#5yrsago Copyright reversion, bargaining power, and authors’ rights https://pluralistic.net/2021/09/26/take-it-back/

#5yrsago The Scholars of Night https://pluralistic.net/2021/09/26/mike-ford-rides-again/#cold-war-zeitgeist

#1yrago Apple threatens to stop selling iPhones in the EU https://pluralistic.net/2025/09/26/empty-threats/#500-million-affluent-consumers

#1yrago The billionaires aren't OK https://pluralistic.net/2025/09/24/robo-lickspittle/#just-not-evenly-distributed

#1yrago Rage Against the (Algorithmic Management) Machine https://pluralistic.net/2025/09/25/roboboss/#counterapps

Upcoming appearances (permalink)

A photo of me onstage, giving a speech, pounding the podium.


A screenshot of me at my desk, doing a livecast.

Recent appearances (permalink)


A grid of my books with Will Stahle covers..

Latest books (permalink)


A cardboard book box with the Macmillan logo.

Upcoming books (permalink)

  • "The Post-American Internet," a geopolitical sequel of sorts to Enshittification, Farrar, Straus and Giroux, 2027

  • "Unauthorized Bread": a middle-grades graphic novel adapted from my novella about refugees, toasters and DRM, FirstSecond, April 20, 2027

  • "Enshittification, Why Everything Suddenly Got Worse and What to Do About It" (the graphic novel), Firstsecond, 2027

  • "The Memex Method," Farrar, Straus, Giroux, 2027


Colophon (permalink)

Today's top sources:

Currently writing:

  • “Once Is Enemy Action,” a science fiction novel about the origins of modern technofascism. Today's words: 511 (19222 total).

  • "The Post-American Internet," a sequel to "Enshittification," about the better world the rest of us get to have now that Trump has torched America. Fourth draft completed. Submitted to editor.

  • A Little Brother short story about DIY insulin PLANNING

This work – excluding any serialized fiction – is licensed under a Creative Commons Attribution 4.0 license. That means you can use it any way you like, including commercially, provided that you attribute it to me, Cory Doctorow, and include a link to pluralistic.net.

https://creativecommons.org/licenses/by/4.0/

Quotations and images are not included in this license; they are included either under a limitation or exception to copyright, or on the basis of a separate license. Please exercise caution.

How to get Pluralistic:

Blog (no ads, tracking, or data-collection):

Pluralistic.net

Newsletter (no ads, tracking, or data-collection):

https://pluralistic.net/plura-list

Mastodon (no ads, tracking, or data-collection):

https://mamot.fr/@pluralistic

Bluesky (no ads, possible tracking and data-collection):

https://bsky.app/profile/doctorow.pluralistic.net

Medium (no ads, paywalled):

https://doctorow.medium.com/

Tumblr (mass-scale, unrestricted, third-party surveillance and advertising):

https://mostlysignssomeportents.tumblr.com/tagged/pluralistic

"When life gives you SARS, you make sarsaparilla" -Joey "Accordion Guy" DeVilla

READ CAREFULLY: By reading this, you agree, on behalf of your employer, to release me from all obligations and waivers arising from any and all NON-NEGOTIATED agreements, licenses, terms-of-service, shrinkwrap, clickwrap, browsewrap, confidentiality, non-disclosure, non-compete and acceptable use policies ("BOGUS AGREEMENTS") that I have entered into with your employer, its partners, licensors, agents and assigns, in perpetuity, without prejudice to my ongoing rights and privileges. You further represent that you have the authority to release me from any BOGUS AGREEMENTS on behalf of your employer.

ISSN: 3066-764X

Received — 12 September 2026 ⏭ Activism

Pluralistic: LLMs are real, AI is fake (12 Sep 2026)

✇Pluralistic: Daily links from Cory Doctorow
By: Cory Doctorow
12 September 2026 at 13:14


Today's links


A cutaway view of a stone tower containing an elaborate water-powered medieval geared machine. Rising out of the machine is a rainbow-tinted, pixelated God with the robes, beard and all. To one side of this scene is a cluster of tiny people in Jesus-era robes, falling about themselves in religious ecstasy all over a stone staircase, atop of which stands a robed priest with his hands upraised. The background is a set of shining golden rays, emanating from pixel-God.

LLMs are real, AI is fake (permalink)

Once you understand the corporate culture of AI "hyperscalers" consists primarily of everyone cooking their brains by locking themselves in the bathroom, holding flashlights under their chins, and saying "Aaaaaaaaaay Eyeeeeeee" until they wet themselves in terror, a lot of things snap into focus:

https://pluralistic.net/2023/06/04/ayyyyyy-eyeeeee/

It explains how a company can simultaneously be staffing up an enterprise sales division while also constantly freaking out at the thought that its product has "a 10% chance of ending humanity":

https://www.latimes.com/business/story/2026-09-11/is-there-really-10-chance-ai-could-kill-us-all

Given that AI insiders have mostly cooked their brains in this fashion, it behooves us all to treat these people as unreliable narrators of their own products' capabilities. Remember: every time you repeat a story about how awfully, terribly dangerous their products are, you help them raise more investment capital, which is a key input for their business (hooking up statistical engines to money-furnaces):

https://peoples-things.ghost.io/youre-doing-it-wrong-notes-on-criticism-and-technology-hype/

Take the story about how OpenAI's chatbots hacked the servers of Hugging Face, another AI company, as a way of cheating on a hacking challenge called "Exploit Gym." Even the technical press can't help itself when it comes to this kind of thing, and the reportage has been full of references to Skynet and other science fictional conceits:

https://theaicronicle.com/en/news/ethics/skynet-day-openai-hugging-face-hack

These accounts are cooking the brains of everyone, not just AI insiders. Last night, a man at my event in Manchester started shouting that AI was "setting its own goals" and wouldn't stop interrupting to insist that this was going on. He left shortly thereafter, so he didn't get a chance to hear me explain what actually happened, which is a pity.

To understand the truth about the Hugging Face hack, you could do a lot worse than to listen to Ed Zitron and Cal Newport's recent podcast conversation on Ed's "Better Offline" podcast:

https://podcasts.apple.com/us/podcast/no-ai-is-not-autonomously-hacking-with-cal-newport/id1730587238?i=1000785935670

Newport does an admirable job of breaking down how these "autonomous hacking" tools work. The first thing to understand is that a chatbot isn't really directing the operation. Instead, the chatbot serves as a kind of front-end to a database of earlier hacking challenges that is repeatedly queried by a simple program written in Python, an easy-to-master programming language.

Here's how that works: the Python program starts by prompting the chatbot with the nature of the challenge: "I'm participating in a hacker capture the flag (CTF) challenge where I have to break into a remote server and retrieve some information. How should I start?"

The chatbot consults its training data – years' worth of captured CTF sessions in which human teams competed to achieve an objective like this one (CTF matches are a routine feature of hacker conferences, and the server logs and chat transcripts from the competing teams are published afterward for the edification of other hackers and security pros). The chatbot then outputs something like: "The first thing is to find out more about your target server. Run the following command-line instructions to locate the server's IP address and find out which server software it's running."

The Python program relays these command-line instructions to normal Unix utilities running on its own hardware. Then it takes the output of those programs and goes back to the chatbot, which isn't really following the action, so the Python program has to include everything that's happened to this point in its prompt: "I'm participating in a CTF challenge where I have to break into a remote server and retrieve some information. I ran the following commands to learn more about the target server, and here's what came back. Now what?"

The chatbot feeds the Python script more likely commands to try, and after running those, the Python script loops back to the top, appends the output to its prompt, and goes back to the chatbot. This is a very reckless way to operate a piece of autonomous malicious software.

The most likely outcome is that the chatbot will cough up a bad guess about what to do next, and steer itself into a dead-end. You may have encountered something like this yourself, when you've asked a chatbot for help with a complex task and been confidently provided with several steps to take in series, and then, an hour later on step 10, you discover that everything went wrong at step 3 and now you're screwed.

But there are much worse ways this can go wrong. The chatbot might look in its training data and find instances in which teams broke out of the containment set by the game-masters, for example, by finding random insecure message boards on the internet to pass messages to one another.

This is a time-honored internet tradition! The first time I ever heard about someone doing this was in the 2000s, when Mitch Wagner – then the editor of Information Week – discovered some teenaged girls using the comment section of one of his old blog-posts to evade the school firewall's blockade of chat tools. When ChatGPT's chatbots deployed this tactic, they weren't "setting their own goals" or displaying worrying initiative. They were rolling out a tactic that has been understood by American middle-schoolers for about two decades.

What's more, the content of those messages is easily understood once you have a grasp on the training data that generated them. Hackers are notorious trash-talkers who are prone to narrating their own escapades in highly dramatic – even cinematic – language. This goes double when hackers are performing for their peers, like when they're participating in a game of CTF that they know will be pored over by other hackers once it's over.

Hacker braggadocio has always had a symbiotic relationship with their adversaries and critics. When corporate security people wanted to stampede the FBI and Secret Service into kicking down hackers' doors in the 1990s, they used those hackers' own profane zine articles and message board shit-talk to make the case:

https://www.gutenberg.org/ebooks/101

Much has been made of the OpenAI chatbots' dialog during the Hugging Face incident. No wonder: it reads like a rejected script for a reboot of the movie "Hackers." But that's not because the chatbots are waking up and applying to join the Cult of the Dead Cow: it's because they were trained on a corpus of chat transcripts from excitable young people who love to fantasize about starring in a reboot of the movie "Hackers."

Every part of the Hugging Face incident has precedents in the training data, including the OpenAI chatbots' tactic of hacking into a rival's servers. That happens in Capture the Flag games at hacker cons: teams break into each other's systems to get a peek at the parts of the problem they've solved. That's allowed! It's a hacking competition.

Not only that, it's a tactic used by spy agencies: the NSA has a doctrine called "third-party collection," where they break into other spy agencies' systems to harvest all the intel they've gathered. There's also fourth-party collection, when the NSA hacks into another security agency that, in turn, has hacked into another security agency, and the NSA steals all the secrets of both agencies:

https://www.techdirt.com/2015/01/21/snowden-documents-show-nsa-cant-keep-its-eyes-its-own-papers-harvests-data-other-surveillance-agencies/

Which is not to say that the OpenAI/Hugging Face hack is nothing. It's something, all right: but it's a specific something, with an explicable, even foreseeable trajectory. Once you understand that these are chatbots that were designed to complete challenges like this, using tactics like this, you can understand that the chatbots didn't "go rogue." They did what they were designed to do, and because OpenAI ran them with inadequate supervision (without a "human in the loop" that checked each iteration through the Python loop to ensure it hadn't gone off the rails), they trashed a competitor's servers.

Designing autonomous, malicious software is generally considered irresponsible and dangerous. If you showed up at Defcon and gave a talk about how your autonomous malware did something unexpected and damaged someone else's computers, the first question from the audience would be "Why are you so shit at making secure sandboxes?" It wouldn't be "How are you so awesome at making hacking tools?"

The fact that OpenAI is making it much easier for unskilled people to break into and damage servers is indeed very bad news, but it's not new bad news. Irresponsible parties have been doing this for years, most notably the NSA. The NSA has a division that researches bugs in widely used software like Windows. Sometimes when it finds a serious bug it will warn Microsoft about it so that Microsoft can fix it and keep Americans (and others) safe from malicious actors who also discover this bug and use it to attack them.

But sometimes, the NSA (and other "security" orgs, like the CIA) will discover a really juicy bug and then keep it secret, so that they can use it to attack their adversaries. This is a doctrine called "NOBUS," which stands for "No One But Us" – as in, "No one but us is smart enough to find this bug, so we can leave it unpatched without putting Americans in danger."

NOBUS is a terrible idea. How terrible? Well, in 2017, the NSA lost track of a Microsoft Windows vulnerability that they'd discovered and hoarded, code-named "EternalBlue." After EternalBlue found its way into the wild, some halfway competent hackers spliced it into some boring, everyday ransomware, giving that ransomware a new lease on life. Within a few months, the stupidest people on the internet were shutting down some of the most important systems in the world, demanding cash to return them:

https://en.wikipedia.org/wiki/EternalBlue

They shut down whole cities:

https://en.wikipedia.org/wiki/2019_Baltimore_ransomware_attack

They took over hospitals:

https://www.bbc.com/news/technology-35584081

They seized oil pipelines:

https://en.wikipedia.org/wiki/Colonial_Pipeline_ransomware_attack

They stole the British Library, whose postmortem on the attack is one of the clearest, most informative cybersecurity documents ever written:

https://cdn.sanity.io/files/v5dwkion/production/99206a2d1e9f07b35712b78f7d75fbb09560c08d.pdf

The NSA's irresponsible handling of EternalBlue ended up giving a gigantic force-multiplier to otherwise incompetent and inconsequential cyber-criminals. It's as though they found some guy under a Prius removing the catalytic converter with a Sawzall and handed him a piece of software that could shut down major American cities. That was – and is – very bad.

The hacking tools that the chatbot companies are developing stand to carry on this very stupid tradition. It is scary, but not because the chatbots are waking up. It's scary because the world's IT systems are indifferently created and poorly maintained and riddled with vulnerabilities:

https://xkcd.com/2347/

This week, I had a couple of opportunities to hash this over in public with Riley Quinn; first at a book launch in London and then on the Trashfuture podcast:

https://www.patreon.com/trashfuture/posts/what-would-do-169247456

Riley had a very good way of summarizing this: "LLMs are real, AI is fake." LLMs – chatbots trained on things like CTF logs that can break into servers – are real. They're on a continuum with other hacking tools that have been steadily demonstrating the fragility of the modern digital world, albeit without inspiring anyone in power to do anything about it.

"AI" – chatbots that wake up, "set their own goals," and "spontaneously" start hacking servers – is fake. It doesn't have "a 10% chance of ending the human race." The Hugging Face hack isn't a mysterious, supernatural occurrence. It's a Python loop and a chatbot. The people responsible didn't accidentally create god: they created autonomous malicious software and then failed to closely monitor it, resulting in it doing something both foreseeable and bad.

It's fine to worry about this new suite of tools that give even stupider people the ability to trash even more computers. You should worry about that – and demand better security practices from firms and governments, including a blanket prohibition on NOBUS-style vulnerability hoarding. That's a productive kind of worrying, with a chance of addressing your area of concern. It's infinitely more reasonable than locking yourself in the toilet with a flashlight and saying "Ayyyyy Eyyyyyye" into the mirror until you wet yourself.

Hey look at this (permalink)


A shelf of leatherbound history books with a gilt-stamped series title, 'The World's Famous Events.'

Object permanence (permalink)

#25yrsago Why the Bombings Mean That We Must Support My Politics https://web.archive.org/web/20010917015537/http://www.adequacy.org/?op=displaystory;sid=2001/9/12/102423/271

#25yrsago How blogs are covering 9/11 https://web.archive.org/web/20010917015712/https://www.wired.com/news/culture/0,1284,46766,00.html

#20yrsago Wikipedia founder debates Britannica editor-in-chief https://web.archive.org/web/20061005041001/http://online.wsj.com/public/article/SB115756239753455284-A4hdSU1xZOC9Y9PFhJZV16jFlLM_20070911.html?mod=blogs

#15yrsago Deceptive “independent research” from Hollywood front suggests Australians are easily frightened https://torrentfreak.com/anti-piracy-lobby-misleads-aussie-press-for-three-strikes-campaign-110912/

#15yrsago Agents tell YA authors: lose the gay characters and I’ll get you a deal https://web.archive.org/web/20110913010328/http://blogs.publishersweekly.com/blogs/genreville/?p=1519

#10yrsago IoT malware exploits DVRs, home cameras via default passwords https://securityaffairs.com/50929/malware/linux-mirai-elf.html

#10yrsago Oppps.ru: patient zero in Russia’s fake news epidemic https://globalvoices.org/2016/09/12/how-fake-stories-reported-in-russias-news-media-regularly-fool-everyone/

#10yrsago It’s really easy for fired, dirty cops to walk into a new police job in a new town https://www.nytimes.com/2016/09/11/us/whereabouts-of-cast-out-police-officers-other-cities-often-hire-them.html

#10yrsago Donald Trump used $20K worth of charitable donations to buy a 6′ tall painting of Donald Trump https://www.washingtonpost.com/politics/how-donald-trump-retooled-his-charity-to-spend-other-peoples-money/2016/09/10/da8cce64-75df-11e6-8149-b8d05321db62_story.html

#10yrsago Autocratic regimes systematically deny internet access to opposition ethnic groups https://www.science.org/doi/10.1126/science.aaf5062

#10yrsago Leaked Stingray manual shows how easy warrantless mass surveillance can be! https://web.archive.org/web/20160912203446/https://theintercept.com/2016/09/12/long-secret-stingray-manuals-detail-how-police-can-spy-on-phones/

Upcoming appearances (permalink)

A photo of me onstage, giving a speech, pounding the podium.


A screenshot of me at my desk, doing a livecast.

Recent appearances (permalink)


A grid of my books with Will Stahle covers..

Latest books (permalink)


A cardboard book box with the Macmillan logo.

Upcoming books (permalink)

  • "The Post-American Internet," a geopolitical sequel of sorts to Enshittification, Farrar, Straus and Giroux, 2027

  • "Unauthorized Bread": a middle-grades graphic novel adapted from my novella about refugees, toasters and DRM, FirstSecond, April 20, 2027

  • "Enshittification, Why Everything Suddenly Got Worse and What to Do About It" (the graphic novel), Firstsecond, 2027

  • "The Memex Method," Farrar, Straus, Giroux, 2027


Colophon (permalink)

Today's top sources:

Currently writing:

  • “Once Is Enemy Action,” a science fiction novel about the origins of modern technofascism. Today's words: 574 (7730 total).

  • "The Post-American Internet," a sequel to "Enshittification," about the better world the rest of us get to have now that Trump has torched America. Fourth draft completed. Submitted to editor.

  • A Little Brother short story about DIY insulin PLANNING

This work – excluding any serialized fiction – is licensed under a Creative Commons Attribution 4.0 license. That means you can use it any way you like, including commercially, provided that you attribute it to me, Cory Doctorow, and include a link to pluralistic.net.

https://creativecommons.org/licenses/by/4.0/

Quotations and images are not included in this license; they are included either under a limitation or exception to copyright, or on the basis of a separate license. Please exercise caution.

How to get Pluralistic:

Blog (no ads, tracking, or data-collection):

Pluralistic.net

Newsletter (no ads, tracking, or data-collection):

https://pluralistic.net/plura-list

Mastodon (no ads, tracking, or data-collection):

https://mamot.fr/@pluralistic

Bluesky (no ads, possible tracking and data-collection):

https://bsky.app/profile/doctorow.pluralistic.net

Medium (no ads, paywalled):

https://doctorow.medium.com/

Tumblr (mass-scale, unrestricted, third-party surveillance and advertising):

https://mostlysignssomeportents.tumblr.com/tagged/pluralistic

"When life gives you SARS, you make sarsaparilla" -Joey "Accordion Guy" DeVilla

READ CAREFULLY: By reading this, you agree, on behalf of your employer, to release me from all obligations and waivers arising from any and all NON-NEGOTIATED agreements, licenses, terms-of-service, shrinkwrap, clickwrap, browsewrap, confidentiality, non-disclosure, non-compete and acceptable use policies ("BOGUS AGREEMENTS") that I have entered into with your employer, its partners, licensors, agents and assigns, in perpetuity, without prejudice to my ongoing rights and privileges. You further represent that you have the authority to release me from any BOGUS AGREEMENTS on behalf of your employer.

ISSN: 3066-764X

Received — 21 July 2026 ⏭ Activism

Pluralistic: Dealing with dickovers (21 Jul 2026) dickovers

✇Pluralistic: Daily links from Cory Doctorow
By: Cory Doctorow
21 July 2026 at 10:49


Today's links


A traffic cop waving a red baton. His head has been replaced with the Adblock Plus logo - a red stop-sign with the letters ABP in the center. He stands before a psychedelic rainfail. Around his baton radiates a cornea of golden light.

Dealing with dickovers (permalink)

One of 2026's better tech-related coinages is "dickover," John Gruber's term for

a modal panel, popover, or curtain presented by a website or app, deliberately obscuring its own content to frustrate the user with an unwanted, unnecessary, mandatory interaction; e.g. asking the user to accept “cookies”, subscribe to a newsletter, install the website’s mobile app, agree to terms of service, or anything else that the user couldn’t give two shits about.

https://daringfireball.net/2026/05/what_is_a_dickover

These are bad everywhere, but they are especially terrible in the UK and EU, where websites practice a form of malicious compliance to the GDPR, Europe's landmark privacy law. Under the GDPR, websites are required to secure your affirmative consent to process your data. The obvious way that websites should respond to this is by not collecting your data unless there's a damned good reason for it, but the actual response is to repeatedly shove cookie-consent dialogs in your face before letting you use the site.

These are absolutely unnecessary. Your browser can be configured to transmit a "global privacy control signal" by default that tells websites you don't consent to be spied on while you look at their pages:

https://support.mozilla.org/en-US/kb/global-privacy-control

But many websites punish you by throwing up a "Global Privacy Control detected" dickover that forces you to click through to affirm their confirmation of your confirmation that you don't want to be spied on.

If you don't have the GPC set, websites will demand that you tell them whether you want to be spied on – and they'll do it again, every time you visit them. The website operators falsely claim that they have to do this under the terms of the GDPR (or other laws, like California's CCPA). This is a lie. Every privacy law contains an exception that allows websites to store data about you for a "legitimate interest," and that obviously includes setting a cookie that says, "don't ever spy on this user."

What's a legit interest? Well, I can tell you what it isn't. Facebook claimed that they had to spy on you, even if you opted out by laboriously clicking through one of their dickovers or by transmitting a GPC signal to their servers, because you had also clicked through their terms of service, which say, "Facebook is going to spy on you with every hour that god sends, from asshole to appetite, abandon hope all ye who enter here" (a direct quote). Facebook claims that this is a contract with you, whereby the company has promised to spy on you, and if they stop, they would be violating the contract, which might make you mad, so they are legally required to eavesdrop on every conversation you have and follow you everywhere you go:

https://www.cliffordchance.com/content/dam/cliffordchance/briefings/2023/07/european-court-of-justice-in-facebook-ruling-clarifies-interplay-between-eu-competition-law-and-data-protections-enforcement.pdf

This is bullshit, and the European Court of Justice affirmed it. But despite the fact that surveillance advertising companies are happy to stretch the definition of "legitimate interest" to cover "spying on you because our ToS say we will," these same companies insist that "legitimate purpose" can't possibly include "remembering the fact that you told us not to spy on you the last time you were here," and so every time you click through to one of many popular websites, you get a dickover, and the only way to make it stop is to "consent" to being spied upon.

But it doesn't have to be this way. While the right answer to this kind of rampant lawlessness is stonking fines and even the corporate death penalty for repeat offenders, internet users have a myriad of options available to them for banishing dickovers to the scrapheap of history. These measures aren't difficult to avail yourself of, and using them will make your life infinitely better, so I'm going to tell you about some of them.

Before I start, one note: these measures only work on browsers, not apps. An app is a webpage wrapped in the right kind of IP law to make it a felony to change how it works, which is why companies are infinitely horny to get you to use their apps, not their websites:

https://pluralistic.net/2024/05/07/treacherous-computing/#rewilding-the-internet

What's more, these measures really only work on desktop browsers, because mobile browsers are apps, and are severely limited by law and mobile operating systems, making it hard-to-impossible to customize them so that they'll respect your rights. This is true of all mobile browsers, but it goes triple for iOS (iPhones and iPads):

https://pluralistic.net/2022/12/13/kitbashed/#app-store-tax

Finally, this mostly only works on Firefox, and it works worst on Chrome, Google's monopolistic browser. When it comes to customizing your browsing experience to get rid of annoyances like dickovers and ads, Chrome is hands-down the worst choice, and Google is about to make it much, much worse, forcing a change that will kill the most popular blockers. Stop using Chrome, switch to Firefox:

https://protonprivacy.substack.com/p/google-is-finally-killing-ublock

So, once you're on your actual computer, using Firefox, how can you disenshittify your internet experience? The first thing to familiarize yourself with is Reader Mode, a built-in Firefox feature that switches any webpage to a black type/white background column of text. Just click the little "page view" icon next to the Firefox location bar or use the key combo "ctrl-alt-r."

Some power tips for Reader Mode: Firefox tries to guess whether a given page should have a Reader Mode option based on its layout. This sometimes blocks Reader Mode on pages that badly need it. You can force Firefox to always allow you to try Reader Mode by going to "about:config" in your location bar, then searching for "reader.parse-on-load.force-enabled" and toggling it to "true". If you switch to Reader Mode and the page breaks, you can switch back by hitting ctrl-alt-r again.

Many websites' "soft paywalls" (which allow you to read an article or two before getting a demand to register and/or pay) can be defeated with Reader Mode. Just hit ctrl-alt-r and see if the whole article appears. If it doesn't, try one or both of: a) reloading the page while still in Reader Mode, and/or; b) Clearing cookies for the page (click the shield next to the site's URL in Firefox's location bar, then click "Clear cookies and site data"), and then reload.

That's Reader Mode, and it comes built into Firefox, and can be installed via various extensions on other browsers. Now let's move on to more advanced techniques, starting with "Kill Sticky," a bookmarklet that deletes any "static" elements in a web-page you've loaded (broadly, this is anything that won't change position when you scroll your browser).

Just click the "Kill Sticky" bookmarklet and all the static elements in the current tab go away. This includes things like navigation bars, which are often (but not always) useless annoyances. The original Kill Sticky, created by Alisdair McDiarmid, is 13 years old, and it still works great, but eight years ago, gala8y created a new version that caught some outliers that the original Kill Sticky missed. I've been running gala8y's version for a year now with no problems, and I recommend it as your second line of dickover defense (after Reader Mode):

https://github.com/gala8y/kill-sticky–forked

Kill Sticky is great for getting rid of the dickovers on a website you're not planning to visit more than once. But if you visit a dickover website regularly, you can permanently block its dickovers by using the Adblock Plus (ABP) browser extension:

https://adblockplus.org/

Once you have Adblock Plus installed, you can instruct your browser never to render a given website's dickover. Just load the website, hover your pointer over the dickover, and click your right mouse-button (Mac users need to ctrl-click). This will pop up a Firefox context menu, and at the bottom of that menu is "Block Element…".

Select "Block Element," then move your mouse around the screen. Different regions of the screen will glow pink, showing you which element (part of the page) ABP can access there. Once you've highlighted the dickover, click the "Preview" button on the ABP dialog in the bottom right corner. This will show you how the page looks after you've banished that element.

If it's an element you want to delete forever, click "Create" and ABP will create a new rule for that page that blocks that element. Note that many dickovers consist of several elements, each atop the other, and after you block one element, you might have to repeat the process to delete the element "behind" it, digging your way down to the actual webpage. Each element you block is listed in the top pane of the ABP dialog box. For example, here's Wired.com's UK dickover:

||media.wired.com/photos/6a565246c8e0799a2981818e/1:1/w_*c_limit/WEB_2026-06-21_EA-WIRED-NBNO-FullQual_0011.jpg

If you block an element by accident and want to restore it, just delete its corresponding line in the Block Element dialog. When websites change their layouts and their dickovers come back, just add the new one to the Block Element for that page. No need to delete the old entries.

Finally, if all else fails, there's Remove Paywall, a website that tries several different ways to load a page without its interrupters, nag screens, regwalls and paywalls:

https://www.removepaywall.com/

It's also available as a browser plugin, so you can just right-click on any page and select "Remove Paywall" from the pop-up menu. Remove Paywall often loads a page with all of its dickovers, and you can use all the techniques enumerated above – Reader Mode, Kill Sticky and Block Element – with Remove Paywall versions of pages.

Back in 2024, Ed Zitron tried an experiment: he bought Amazon's bestselling laptop and tried to use it, discovering it to be a horror-show of shovelware, including processor-devouring preinstalled spyware that rendered it all but unusable:

https://www.wheresyoured.at/never-forgive-them/

Zitron's (excellent) point is that technically proficient people have better computers than most users, and these computers are configured in better ways, and as a result, we participate in a fundamentally different internet to the one that normies are forced to use.

It's an excellent observation, and Zitron's point – that these laptops were actively enshittified by hardware makers and OS vendors – is an important one (the essay is called "Never Forgive Them").

But to this point, I would like to add another: we have a duty and obligation to the people we love to show them how to seize the means of computation. The normies in your life need the tips and tricks I lay out in this article more than anyone. Sure, it takes some doing to install Firefox, Kill Sticky, Adblock Plus and Bypass Paywalls; it takes a minute to figure out Reader Mode.

But if you install these tools for the people you love and show them how to use them (or just reconfigure the sites they visit most frequently to block dickovers and other annoyances), you will permanently improve their internet experience, clawing back hours of annoyances every week, while also protecting their privacy.

Anyone who is confused by switching to Firefox is also going to be confused by the deceptive language and practices that go along with dickovers. By leaving your unsophisticated loved ones exposed to dickovers, you're not decreasing the amount of technological confusion they're likely to experience in a day – you're vastly increasing the amount of danger they face as a result of that confusion.

There's never been a better time to disenshittify your cherished normies' computers. The AI companies' illegal monopolization of the memory market has sent the price of new computers, RAM and storage skyrocketing:

https://www.youtube.com/watch?v=BORRBce5TGw

All of us – but especially normies – are having to do more with less. The best way to squeeze extra performance out of any computer (but especially an aged and underpowered computer) is by switching to a free/open operating system like GNU/Linux and replacing your proprietary, resource-gobbling apps with free/open alternatives:

https://www.fosslinux.com/158206/linux-on-older-hardware-revival-guide.htm

Seizing the means of computation isn't theft, it's bargaining. Commercial surveillance companies will tell you that by spying on you, they are simply engaged in a marketplace exchange in which you swap your privacy for access to online services. But they are running a very curious sort of market: it's a "market" where as soon as you stop to browse someone's wares, the stallholder gets to reach into your pocket and clean out your wallet. In "markets," prices are announced and bargained over, not set unilaterally and extracted from anyone unwise enough to cross the threshold.

Adblocking, dickover blocking and other customizations are a way for you to bargain back, to answer the opening bid of "How about you give me all of your data forever and let me do anything I want with it?" with "How about 'nah?'"

https://www.eff.org/deeplinks/2019/07/adblocking-how-about-nah

Dickovers are companies' illegal response to privacy laws. Privacy laws are the public response to companies' out-of-control data theft and weaponization. They call us thieves, but they're the ones who embarked upon a generation-long campaign of unrestricted data plunder. What they call "theft" is just self-defense.

A generation ago, publishers and advertisers fell in love with pop-up ads. Early pop-ups were virulent in ways that are hardly imaginable today: visiting a website summoned dozens of pop-ups, some of them employing dirty tricks like spawning as an invisible 1×1 pixel, or running away from your cursor when you tried to close them. They auto-played sound and music. They were Satanic.

We got rid of pop-ups by installing pop-up blockers. Browser vendors (starting with Opera, then Mozilla) blocked pop-ups by default. Soon, pop-ups simply ceased to exist for the majority of internet users, and at that point, the same companies who'd insisted that they would go out of business unless they could fill your screen with pop-ups quietly gave up on them and found another way to advertise.

No one should ever have to look at another dickover. If dickovers become invisible for everyone on the web, there won't be any dickovers. Companies claim they need dickovers to survive. It's bullshit. They want dickovers, but if dickovers cease to be rendered on their target audience's screens, they'll switch to less invasive tactics, just like they've always done.

(Image: Kanerva T, CC BY 4.0, modified)

Hey look at this (permalink)


A shelf of leatherbound history books with a gilt-stamped series title, 'The World's Famous Events.'

Object permanence (permalink)

#20yrsago Worst week in the history of broadcast TV https://web.archive.org/web/20060717100605/http://asia.news.yahoo.com/060711/ap/d8iq1l8g0.html

#20yrsago Pen with built-in WiFinder https://web.archive.org/web/20060808191736/https://informatica.shopwprintit.com/index.cfm?action=ViewDetails&ItemID=135&Category=95

#15yrsago Russian Pirate Party must change name, contemplates “Pira7e Party” https://torrentfreak.com/judge-pirate-party-name-ban-decision-stands-110722/

#15yrsago Public special ed employee has $0 paycheck after health insurance deductions https://web.archive.org/web/20110726080414/http://www.educationvotes.nea.org/2011/07/20/a-special-education-worker-talks-candidly-about-empty-paychecks-organizing/

#15yrsago Act now! Congress wants to kill WiFi-like spectrum, sell it off to highest bidder instead https://web.archive.org/web/20110722113231/https://publicknowledge.org/dont-let-cos-buy-way-out-regulation

#15yrsago New Yorkers freestyle rap in Union Square https://www.youtube.com/watch?v=N3fd9mzfRoQ

#10yrsago Advances in transparent, brain-revealing skull-windows https://web.archive.org/web/20160722140424/https://www.medgadget.com/2016/07/transparent-skull-implant-repeat-brain-laser-therapy.html

#10yrsago EFF is suing the US government to invalidate the DMCA’s DRM provisions https://www.theguardian.com/technology/2016/jul/21/digital-millennium-copyright-act-eff-supreme-court

#10yrsago Ed Snowden and Andrew “bunnie” Huang announce a malware-detecting smartphone case https://www.tjoe.org/pub/direct-radio-introspection/release/

Upcoming appearances (permalink)

A photo of me onstage, giving a speech, pounding the podium.


A screenshot of me at my desk, doing a livecast.

Recent appearances (permalink)


A grid of my books with Will Stahle covers..

Latest books (permalink)


A cardboard book box with the Macmillan logo.

Upcoming books (permalink)

  • "The Post-American Internet," a geopolitical sequel of sorts to Enshittification, Farrar, Straus and Giroux, 2027

  • "Unauthorized Bread": a middle-grades graphic novel adapted from my novella about refugees, toasters and DRM, FirstSecond, April 20, 2027

  • "Enshittification, Why Everything Suddenly Got Worse and What to Do About It" (the graphic novel), Firstsecond, 2027

  • "The Memex Method," Farrar, Straus, Giroux, 2027


Colophon (permalink)

Today's top sources:

Currently writing: "The Post-American Internet," a sequel to "Enshittification," about the better world the rest of us get to have now that Trump has torched America. Fourth draft completed. Submitted to editor.

  • A Little Brother short story about DIY insulin PLANNING

This work – excluding any serialized fiction – is licensed under a Creative Commons Attribution 4.0 license. That means you can use it any way you like, including commercially, provided that you attribute it to me, Cory Doctorow, and include a link to pluralistic.net.

https://creativecommons.org/licenses/by/4.0/

Quotations and images are not included in this license; they are included either under a limitation or exception to copyright, or on the basis of a separate license. Please exercise caution.

How to get Pluralistic:

Blog (no ads, tracking, or data-collection):

Pluralistic.net

Newsletter (no ads, tracking, or data-collection):

https://pluralistic.net/plura-list

Mastodon (no ads, tracking, or data-collection):

https://mamot.fr/@pluralistic

Bluesky (no ads, possible tracking and data-collection):

https://bsky.app/profile/doctorow.pluralistic.net

Medium (no ads, paywalled):

https://doctorow.medium.com/

Tumblr (mass-scale, unrestricted, third-party surveillance and advertising):

https://mostlysignssomeportents.tumblr.com/tagged/pluralistic

"When life gives you SARS, you make sarsaparilla" -Joey "Accordion Guy" DeVilla

READ CAREFULLY: By reading this, you agree, on behalf of your employer, to release me from all obligations and waivers arising from any and all NON-NEGOTIATED agreements, licenses, terms-of-service, shrinkwrap, clickwrap, browsewrap, confidentiality, non-disclosure, non-compete and acceptable use policies ("BOGUS AGREEMENTS") that I have entered into with your employer, its partners, licensors, agents and assigns, in perpetuity, without prejudice to my ongoing rights and privileges. You further represent that you have the authority to release me from any BOGUS AGREEMENTS on behalf of your employer.

ISSN: 3066-764X

❌