Goodbye to Proton Mail…

I’ve been a subscriber to Proton Mail for over 4 years now, but I won’t be renewing my subscription, which is coming up in the next couple of months. Like many subscribers my primary interest was to make my email more secure and private than I would get with other providers, but the company’s CEO sees this interest in security and privacy as “loser thinking”.

So, why would I spend more money in a service that has now decided to abandon the principles which are the entire reason why I subscribed in the past? And for what? for AI vibe-coding. A serious, leading product is literally being turned to shit. Well Andy, you can pay for slop out of your own pocket. You’ve lost my money, and that of thousands of other subscribers.

That’s the cost of arrogance and greed. Another reason to abandon the project is that employees have been summoned to “re-interview” on their AI skills to keep their existing jobs, which frankly sounds like a fancy way of expressing “constructive dismissal”, a process by which an employer hounds employees into quitting. That’s just a downright scummy thing to do, and as someone who’s spent the entire year looking for employment I am absolutely disgusted by this move. Yes, those “re-interviews” have been cancelled — as a result of public backlash. If Andy Yen thinks that this is enough to keep me as a customer, he’s got another thing coming. Only his resignation from the company could even get me to reconsider at this point. He is not someone that can be trusted.

And trust is what Proton used to have. It was the selling point. It’s not so much that I’m quitting Proton — it is Proton and its CEO that have quit my patronage.

MASS HYSTERIA! WEB VULNERABILITY!

We’re currently seeing about 2 security exploits in a web programming language and kind of framework known as PHP. “The whole web could be forced to go dark!” some say, “70% of the internet could be affected!” This is alarmist nonsense, but you wouldn’t know it from looking at tech reporting.

Well, since no one else feels like being the sober man at the table, I will.

The security exploits

AI-assisted cybersecurity researchers, while going through code that probably dated back to the 1990s, managed to find two instances in existing PHP code where a very specific condition would lead to an ability by attackers to execute code on a server. That is known as a RCE vulnerability. Two of those were found in existing PHP code. For historical context, PHP was created in 1994 as “personal home page tools” by Rasmus Lerdorf.

To put it in very simple terms, an attacker could put a web site (or, more likely, web host) in a condition where the PHP server framework would just quit unexpectedly. And a failure at that point means that there is a very small opportunity of time where an attacker could execute code arbitrarily on the underlying operating system. Now that code could do anything, including decrypting passwords held in memory and then using those credentials to gain access to external systems. Obviously not a situation you want to be in.

Now, PHP has changed greatly since 1994, which is, let’s remember, 32 years ago, and software testing has as well. However with the use of AI tools, researchers were able to point out exactly what the conditions of the exploit could be found.

Initially the new vulnerabilities were meant to be kept secret until October 22nd. However, someone leaked the story, on October 21st, which set off the tone of panic.

The problem had already been found and, patched, with new, safe versions being ready for use, by the time the information was made available to the public.

So that’s 90% of the problem solved already. The remaining 10% is deployment.

This is things can become complicated. Not for most sites which are regularly maintained, but for legacy sites, which are often left to languish without maintenance but keep working as web sites, “as long as it works”. PHP, as a development language, has created a lot of those sites, largely because it’s an easy and accessible languages for creating dynamic web sites.

Those sites can still represent a problem because the patch that resolves the RCE issues was issued only for the current versions of PHP, which are all decimal versions of PHP 8. As such any site running previous versions of PHP (7 and below) would still be vulnerable. And with AI-assisted coding tools it could be easy to create a way to trigger the conditions for the RCE and insert malicious code into those sites. Those servers need to be updated to PHP8, if they’re even maintained at all, or their owners risk being liable for damage or system intrusions that originate from their servers.

That being said, those sites are not of particular concern.

Why the “crisis” is overblown

While the RCE vulnerability is serious, it’s a problem that’s resolved at the system administration level. For a lot of sites that are served through a shared web host, the site owner does not have to do anything. In fact the owner will probably already have received a notification that the system has been patched to a safe version of PHP.

For people (like myself) who use their own host to serve PHP pages — I do it through a cloud provider, but it’s the same process for people serving from their own bare-metal servers — it’s a simple matter of updating PHP at the host level. In that case it involves a little more work on the site owner’s part, but the fixed PHP versions have been available since the afternoon of October 21st. That’s when I patched my host.

No other change is required, the web app does not have to be modified in any way. The change implemented by the patch works purely at the level of PHP’s internal workings and has no other effect.

That’s why I can’t understand companies that have taken their entire site offline for extended periods as a result of the vulnerability. Once the patch is applied, you restart the system and things work as they previously did. That’s all.

Alarmist tech journalism is the real problem here. Unless you run your own web server, there is no cause to be alarmed. If you do run your own web site, maintain your system. That’s all there is to it.

An experiment in hiring in 2026: the unsurprising conclusion

See part 1 of this exciting experiment here!

Unsurprisingly, all four “new connection” recuiters turned out to be scammers. I noticed that 3 of them no longer have LinkedIn accounts, and I just reported the fourth one.

The game is this: these “people” (probably AI bots) pretend to be “independent recruiters” who have a job you’d be interested in. This can be sniffed easily enough from your profile. They give you a little spiel about they’re impressed by your qualifications and experience and you’re almost sure to get the job… BUT they want to make sure you get picked and your resume could use improvement! And of course they know someone who can do this, for a fee.

What are the tells? Just look at the profile. Low number of connections (for a recruiter in this economy?), their email is a free account (gmail, outlook, yahoo), often they don’t appear in the “recruitment firm” they claim to work at but they follow that company, sometimes they’ll redirect you away from Linkedin messaging and onto a proper custom-domained email account… that’s also a free email account. 1/4 of the candidates in my experiment did this, and probably just didn’t know that Yahoo mail adds branding to the emails they send. Also the custom domain had no web site. For a recruiter. In 2026.

They’ll also be as impatient as a Nigerian scammer — if you don’t answer quickly they’ll keep pinging you on Linkedin, and send reminder emails that say stuff like “looking forward to your feedback”. 2/4 of the scammers “suggested” resume optimization within 2 hours. One of them even showed that my resume had an ATS score of 39%… when all the ATS checkers I used showed high 60s to low 70s.

So, yeah. Looking for a job makes you a huge target for scammers on Linkedin. But at least Linkedin seems to be doing something about it, or at least acting on the reports they get, even on a long weekend. So, there’s something positive to get out of this.

Ultimately, if something seems just a little too good to be true, it’s because it is. The tech job market is absolute shit right now and it’s not about to get better.

An experiment in hiring in 2026

See the exciting conclusion of this experiment here!

I’ve now been looking for employment for 8 months, after 4 month of unemployment last year and an unsuccessful stint at a job I had not applied for but been offered by the manager in charge, which turned out to be a complete shit show. So, I’ve come to know a lot about how companies hire — or, more exactly, DON’T hire — candidates at this time in history.

Along the way I’ve come across a number of sus “recruiters” who take it on themselves to string candidates along, promising jobs that pay a little too well, and try to sell you on “resume reviews” costing hundreds of dollars, while not really having any access or say in hiring decisions and probably not even being recruiters. Now, the thing about scams is that they tend to follow patterns. This is not a field of creative geniuses, and they have a number of tells.

So today I went to LinkedIn, posted a video entitled “Yes, You ARE Getting Auto-Rejected” which is apparently causing a whole lot of controversy in the HR community. A mere minutes later I was contacted by FOUR people claiming to be recruiters who have a job for me. One of them was for a job I had already applied for at the target company, so it’ll be interesting to see what comes from that. Two more advertised a job I had seen in my local job searches but was not a good fit for me for certain specific reasons.

Well, I decided to take the bait and send all four of them my resume, which has already been optimized by Claude AI for ATS performance. As things progress I’ll make follow-ups to track the progress of these “applications”. So, stay tuned.

Setting up PostgreSQL for use with a Django database — without errors

As a technical writer, there’s something that frustrates me very much — instructions that just don’t work. It really grinds my gears. When I write instructions on how to accomplish a task, something I always make sure to do is actually test the instructions to make sure that they work and lead to the expected result, because when I am following specific instructions and things don’t work it really frustrates me as someone who has ADHD.

So I’m setting up a Django project, and naturally I wanted to use PostgreSQL with the project. I just don’t like SQLite, it’s something I’m forced to use with Calibre and it causes problems with database portability — I have to have the application on the same host as the database and that’s a pain in the ass.

So I modify the venv in which Django is running and install psycopg2-binary, which has the PostgreSQL bindings for Django, and modify the settings.py file to point to the correct database.

Then I went online and the instructions everywhere are always this:

Log into PostgreSQL as the root user (e.g. psql -U postgres) In psql: CREATE DATABASE new_database; CREATE USER new_user WITH PASSWORD 'newpassword'; GRANT ALL PRIVILEGES ON DATABASE new_database TO new_user;

This does not work! Well, it doesn’t work with PostgreSQL 16 and Django 6. When you go back to your django project, make the migrations, and migrate the project, you end up with this error:

psycopg2.errors.InsufficientPrivilege: permission denied for schema public

The worst part of this is, it’s not a new problem. After searching online, this is something that’s been pointed out for several years, and yet none of the “AI-powered search results” seem to be aware of this. It’s really not changing my opinion that search engine-generated “AI summaries” are crap that no one has ever verified — like most AI generated slop out there.

The missing instruction is that you have to, as the postgres user, log into the new database and ALSO grant the privileges to the public schema of the new database to the new user.

To do this, you must do this in a separate operation from the one that created the database:

Log into the new PostgreSQL database as the root user (e.g. psql -U postgres -d new_database) In psql, GRANT ALL PRIVILEGES on SCHEMA public TO new_user;

Once you do this, you can perform the database migrations as expected.

It’s really annoying that I even have to write this. Most search engines now will provide you with instructions that don’t work, and this is directly due to their decision to pollute their search results with unverified AI slop that just doesn’t work. It’s very frustrating and will probably continue being an issue as long as tech companies continue to insist on burdening the rest of us with this “artificial intelligence” monster they’ve sunk billions/trillions of dollars into, while laying off hundreds of thousands of employees and essentially killing the software job market.

The closest I’ve come to death

This is a little story about the closest I’ve come to dying. So far. Which also explains why I tend to drive gingerly when it’s snowing.

I was coming back home from work in dad’s (manual) Ford Tempo on December 21st 1991. It was snowing moderately hard in Quebec City and I felt I just knew that road so well because I drove it at least 3x a week and let my confidence get the better of me, also I was heading to my dad’s Xmas dinner and we had guests over. It was on Du Vallon in Quebec City, which really wasn’t built to be a proper highway as it’s got a big kink to get around the support for an overhead highway that crosses it. Anyway I get past a guy and decide that kink would be a good spot to get back in the right lane, so I stupidly push down on the clutch and let inertia get me back to the slow lane… on snow.

That’s when I learned a very valuable lesson about liftoff oversteer. The rear of the car swings around and I’m just a passenger now. I seize the steering wheel with all my strength and close my eyes because I know it’s going to be a big one. Somehow a part of the car hits the guardrail, I feel I’m no longer in touch with the ground, and the car lands heavily on the passenger side.

By some miracle the car stops neatly in the right lane and everyone around successfully gets around me. I just sit there in a bit of shock and realize I’m still alive. I don’t even realize that the crash caused my glasses to whip off my face — unfortunately they’re on the road way right under me, and as I undo my seatbelt my foot lands heavily on them. My arm hurts a bit, just because I was holding on to the wheel so tight I tore my bicep a little bit. I find a way to pull myself out through my side window and by then a lot of people have already stopped and are helping out. Then a police car comes and eventually takes me home.

Now I had a close friend who was working at the same place and normally I would have given her a ride home, but that day her shift ended later so I was alone in the car, which was definitely a good thing because she would have been seriously injured. And that’s about as close as I came to dying but somehow walked away with barely a scratch (and broken glasses).

On the role of AI in technical writing

For those who are new to my blog, hi, I my name is Tony and I am a technical writer. More specifically, I am a technical writer with 25 years’ experience in the role, and have plied this trade at all levels, from writing illustration-heavy instructions for self-checkout robot supervisors working in grocery stores to system administrators tasked with rebuilding market-trading systems from scratch in the event of a major disaster such as an earthquake — covering both hardware and software. I’ve written docs for distribution in printed manuals, virtually-printed manuals (you know, Acrobat format), and online help formats. I’ve implemented XML-DITA based complex help infrastructure for companies. I’ve also created and maintained web sites since the web became something accessible to everyone in the mid-90s.

I’ve also been looking for a job for a year now. Sadly the only “success” I’ve had was to get a technical support job for which I had not applied, but was contacted directly by the manager, and I’ve been spending the last 7 months wishing I’d said no to that one for so many reasons, but that’s a story for another day. Let’s just say that I have learned to look on unsolicited job offers with suspicion, maybe a little late, but it’s probably better than if I had never abandoned the “let’s not look a gift horse in the mouth” attitude.

The simple fact is that AI has taken a huge bite out of the numbers of jobs in the software field. I’ve been laid off several times, and more than once jumped at surprise job opportunities which turned out to be nightmares I ended up bitterly regretting. The point is, at many points in my career I have looked for new employment. As with the craft of technical writing, I have lots of experience in that. And yes, there are far, far fewer job offers in the field than there used to be. This is a manifold problem — and the rise of generative AI has had a role to play in most of it.

Many companies seem to think that the nature of AI as a “large language model”, and the fact that it can generate intelligible text, means that you don’t need writers
Companies have been laying off hundreds of thousands of IT workers in many different functions thinking that AI can do those jobs, resulting in a glut of available IT workers with industry experience and qualifications
AI companies right now are soaking up capital that would otherwise be going to fund profitable companies and sinking that money into an endless money pit.

Now, there’s not much that can be done about that third factor. Right now the only thing money managers are seeing is that “market gains” — little more than enormous bets — are favoring AI companies for investment money. In a world where the stock markets have become little more than speculative betting parlors, it’s just something we have to live with.

However, the technical writing market is, I would argue, unfairly paying the price for AI’s unrealized — and in my view unrealizable — promises, and falling victim to what’s known as the doorman fallacy. Note that the doorman doesn’t have to be a man, but that’s how the fallacy is widely known at this time.

To put it simply, the doorman fallacy describes the pitfall of reducing a role to only its most obvious characteristics. Why would you pay someone to be a doorman? On the surface, it doesn’t make any sense to do that. People can open their own doors, they already do that every day in their homes. Why not just install a revolving door that anyone can walk through without any effort, or an automatic door?

The fallacy here is that a doorman provides a service that goes beyond simple ingress and egress from a building. The mere presence of the doorman shows that there is someone there paying attention to the people who enter and exit the place, and to the general environment of the building. If you’re someone who lives there, this provides a certain level of comfort, not just in not having to open the door yourself, but in the sense of knowing that if something unusual is happening, this person can tell you about it. In the classic sense, the doorman can also tell you about other places in the neighborhood, such as where to go for lunch. They can also receive packages for you. If there’s a fire happening in the building, they may be the first person to know about it and contact the fire department.

And by getting rid of the doorman, one simply abandons providing all those services. People living in New York City know what that’s like, and that’s why apartments in “doorman buildings” rent at a premium.

Opening doors is just a small part of the doorman’s job.

Getting rid of technical writers because “the LLM can write” is to fall into that trap. Actually writing the docs is only a small part of what a technical writer does. Most of the job, for any technical writer position, consists of knowing the product inside and out.

An LLM may be able to take a web app, go through it, and tell you what each option in each UI element does, but it cannot tell users how to execute the tasks they want to use the software to accomplish. That is a technical writer’s real job. Yes, “writing the docs” may technically be a description of what we do, but in order to get that done you need to integrate a lot of knowledge, including (but not limited to):

knowing the audience for which the docs are written (the most essential part, I would argue)
knowing why the audience needs to use the product, what they hope to accomplish with it
knowing the ins and outs of the product
testing the product from a user-acceptance point of view
passing feedback to the development team as to what works and what doesn’t — not just bug reporting, but is the product putting obstacles in the user’s way
organizing this knowledge into a logical and natural pattern for the user for the online help
identifying areas where the user may need more context-sensitive guidance
organizing the knowledge of the product in ways that will provide the most practical way for the organization to keep said knowledge so that it may be used by product managers, project managers and developers

By getting rid of technical writers companies are largely abandoning knowledge about their own products, their users, and how to best serve their own needs in the future.

Likewise there is an idea among tech companies that the technical writer’s role can be filled by developers themselves. This is another trap. Developers in this day and age tend to work on a specific feature, or sometimes a sub-feature, and once that one “atomic” piece is complete move on to another feature. Rarely does a developer have a good overall sense of what the product as a whole is supposed to do, except maybe in the case of senior devs within a company who — and they will freely tell you this — have little time for the docs, except for API documentation where they more often than not end up being both the consumers as well as the producers. But again, APIs are domain-specific, and rarely cover the full functionality of a software product.

The other aspect of this is that developers look at a software product as something they make, and not something they use from end-to-end. Something may seem very obvious to a developer but require explanation to a layman who is just trying to use the product to accomplish a task that’s entirely foreign to them. I’ve met many developers who are absolutely brilliant at what they do, but once they step outside that very delimited discipline they are simply at a loss for words and engage in behavior that strikes non-developers as bizarre and irrational. The same is often said of (for example) university professors and people with PhDs. They don’t give doctorates to stupid people, that’s just a fact. However the same thinking that gives rise to industry-leading developers and thinkers leads to people with extremely deep knowledge in one particular area of knowledge to the detriment of other areas, including many that are just common sense to most people. As I said I’ve worked in the software industry long enough to know how true that is.

And this brings us to the question of what role artificial intelligence has to play in the technical writing process. And I would argue that I just don’t see much there. Technical writing, at least in the software industry, is about taking a product that was written by people, and making it easier to use by other, completely different people. And that’s why you need people in technical writing positions.

Yes, there are contributions that can be made, largely in the area of analytics. In a world where documentation is mostly distributed online, it’s very useful to be able to identify which areas of the documentation are being consulted, how much time users are spending on those areas, and which areas are barely if ever looked at. But I would argue that consulting with technical support would yield greater benefits. See what subjects users need to consult technical support about — it’s not just bugs. Sometimes the documentation can use more conceptual information before jumping into individual tasks. Sometimes a feature may have been updated without letting the documentation team know about it. That happens, especially with distributed teams. And technical support teams tend to have far better analytics already in place than documentation teams, because that’s a large part of their key performance indicators (KPIs) in a way that it’s just never been for documentation teams. But there’s a certain role there.

However when it comes to the core tasks of technical writing, I just don’t see much of a role for generative artificial intelligence.

Does that mean I’m against AI altogether? I’m not against the concept. I find it useful as an agent that can handle the coding part of development. Why? Because coding is a discipline that’s very tightly delimited. And by “coding” I mean in the strictest sense — turning algorithms into code, and doing basic testing on the resulting code to ensure that it works. The algorithm still needs to be spelled out by the user for AI coding to be effective. And the code needs to be read and reviewed by a human to make sure it doesn’t have a ton of side effects. It’s also proving to be a lot more expensive than what its chief sales people have been clamoring. When a company releases a new technology, it’s looking to monetize. That’s literally the only role of a corporation. Look out for the shareholders.

AI has its uses. Thinking those uses include technical writing is a mistake.

We Need to Talk About Carney

On this Canada Day in 2026, we really need to have a serious talk about the “leadership” of this country. And not in oversimplifications and trite hockey metaphors. The fact is, the barbarians aren’t at the gate. They’re in the Prime Minister’s Office. Mark Carney is the Great Canadian Bamboozle.

Swept into power after assuming the Liberal leadership after Justin Trudeau’s retirement, Carney did the two things Canada needed him to do at the time — stand up to the criminally insane Donald Trump, and save the country from the humiliation and indignity of a “Prime Minister Pierre Poilievre”, which honestly it probably wouldn’t have survived. However since that time, the mask of “great Canadian hero” has come off. Yes, Carney was an alternative to Poilievre, but sadly, that distinction has becomes little more than skin deep.

Where are the Canadian values in the Carney government? They’re just plain missing. The Prime Minister has done little for the country but consolidate power for himself by making recruiting MPs from other parties his first priority — not because he values diversity of opinion, but on the contrary, because he wants to consolidate the sort of power that a PM wields in the British Parliamentary system has an absolute majority.

And to achieve this, he has abandoned virtually every principle the Liberal Party has stood for, or at least has traditionally pretended to stand for. He has shown little but contempt for the country’s First Nations. He started his government by abandoning women’s issues, beginning with abolishing the ministry for women and gender equality and effectively relegating it as a back-burner issue. He has now officially told the country that the environment doesn’t matter, if it impacts business.

In short, he’s pretty much ruling as a Conservative. But he’s not going to tell you that.

The signs are all there, however. He waxed nostalgic about how Trudeau Senior’s national energy policy left him feeling betrayed as youth in Edmonton. He talks a good game about “data sovereignty” for Canada, but doesn’t see a problem with Canadian data being essentially controlled by Microsoft and other large American corporations. But the faux-nationalistic chest-beating and tired hockey cliches can’t hide the truth — as a country, we will be weaker than we’ve ever been in the face of the neo-liberal menace which has gradually been siphoning away everything we hold dear as a country. EI has become kind of a joke, and its decimation continues to accelerate, even as it is more needed than ever in the face of job purges led by “efficiency gains” of artificial intelligence, which Carney never fails to promote. Waiting lists in Canadian hospitals keep getting longer and longer, because Ottawa is constantly cutting transfer payments to provinces, and on top of that cutting the federal government payroll, which leads to more unemployment and a shrinking tax base not only for the provinces but also the federal government itself. The government is getting leaner and meaner with every passing month.

But oddly enough, the federal deficit is at a record high. Which would seem weird, if you didn’t realize that we’re spending hundreds of billions of dollars to push the neo-liberal accelerationism to new highs. And of course we’re doing all that without raising any taxes. I mean, Canadians are already very highly taxed, and as I’ve previously mentioned we’re getting less and less value for the value of our tax dollars, but that’s only half the story. Our corporate taxes are, frankly, a joke. The big reason why we’re paying more and getting less, as individual taxpayers, is that the overall tax burdens has shifted since the 1980s. 46 years ago the corporate sector paid a majority of the tax burden in North America. Now they pay less than half of the tax burden paid by individual taxpayers. That’s the neoliberal accelerationism I’m talking about.

So while increasing military spending and data infrastructure are not necessarily bad things, they also overwhelmingly benefit the rich and corporate interests — not even necessarily Canadian corporate interests — while the burden of paying for all this investment will fall overwhelmingly on the people, who are increasingly poorer, less cared for, and less free. That’s a reference to many bills like C22 which Carney is ushering through Parliament, something I plan to write more about later, but I want to get this piece out today.

But you wouldn’t hear about that from the Canadian corporate news media, any more than the American corporate news media mentions Donald Trump’s rapidly deteriorating mental state — which many honest observers would describe as a descent into madness. Because in the corporate world, nations no longer matter. We are effectively ruled by billionaire media owners who control what we see and hear, and Carney’s pseudo-nationalism has done a great job bamboozling the people of this country, while corporate tax cuts have sent a clear message that the rich should get on Carney’s side because he’s looking out for them.

We’re more like the USA than we like to think. We may think they’re dumb for having voted Trump in, but we’re hardly better. We took the word of an establishment figure without checking any receipts, and like our neighbors to the South we’re soon going to be facing a bill that’s much, much higher than we can imagine.

Killing WordPress Comment Spam for Fun and Profit

I recently had to “reboot” this blog as I had to remove it from a wordpress-multisite installation and serve it as a standalone instance. By the way, if you’re starting a new WordPress project, avoid multisite installations like the plague, they really don’t work well and are an expensive pain to spin off, as the plugins that actually work for multisite installations are typically much more expensive than the (often free) ones that do not require that capability.

This aside, one of the big problems you will come up against when administering a “default” wordpress installation is comment spam. Basically you will see hundreds of comments on your posts pile up, but when you actually have a look at those comments you will quickly realize that almost all of them will be essentially from bots that attempt to spam your posts with links. But you can avoid this with a few very simple steps that will stop the spammers dead in their tracks.

WordPress Settings

The relevant settings can be found by logging into your WordPress instance as an administrator, then from the Dashboard going to Settings > Discussion.

Default post settings

The first thing to do is decide whether you want to allow comments on your posts at all. It’s not as obvious as thing as it might seem. If you try to measure engagement by relevant comments on WordPress, you will likely be very disappointed. A much better measure of engagement is how much discussion you can generate on social media sites on which you share your posts. So, the easiest way to cut down on spam is to disable comments entirely by unselecting the checkbox next to Allow people to submit comments on new posts and skipping the rest of this article.

Other comment settings

If you do allow comments, the most effective way to cut down on the amount of spam is to select Users must be registered and logged in to comment in this section. Spammers are just not going to go through the trouble of registering as a user and will just skip your site, which is the best scenario.

Before a comment appears

Unless you expect that your blog will be a particularly busy one in terms of users comments — and in 2026 that is not a very likely eventuality — make sure to select both the Comment must be manually approved and Comment author must have a previously approved comment options. These will make sure that spam comments do not appear under your posts by default. I believe that those are the default settings in WordPress, but you’ll want to double-check.

Comment Moderation

At this point your installation is already pretty secured, but to “bulletproof” things you should change the Hold a comment in the queue if it contains X or more links option to 1 instead of the default 2.

Conclusion

Just adjusting your WordPress settings in the ways described above should cut down the spam submitted to your site by 99%. Sure, having a large number of comments on posts may seem encouraging if you’re starting a new project, but what you really want is engagement, not people using your site to advertise (mostly) porn and other questionable sites. And in my experience the engagement will actually come from the forums and social media sites on which your share your posts, and not those left on your site.

Thanks for attending my TED talk…

A new theory about Longlegs

There are many theories out there about Oz Perkins’s Longlegs. One of them is that Oz Perkins really can’t be bothered to give his movies a proper name. I mean, just look at his previous movies. “The Blackcoat’s Daughter”? What does that mean? The father famously does not show up in the movie so we have no idea what color his coat is, or the relevance to the whole story. I really liked the movie but the title kinda bugs me.

However I think there can be a good case made that “Longlegs” is actually the perfect name for this movie, for several reasons.

One of them is that it’s difficult to take Longlegs seriously. There’s a distinct lack of anything that’s really threatening there. This guy’s a loser, always was, always will be. He’s just this puffy-looking guy who seems to be about a year away from dying himself.

Now part of the threat he represents is the “normal” level of threat that people like me — straight white cis guys — don’t usually experience. It’s coming under the attention of some weirdo. And that’s something that has to be recognized.

But I think there’s a more pernicious dynamic at play here.

There’s an obvious source for killer’s monicker. It’s “daddy longlegs”, an insect (not a spider! this will be relevant later!) which tends to live in unseen parts of your habitat. I mean, these things are harmless. Contrary to all the silly urban legends you may have heard they effectively have no venom and cannot hurt any reasonably mobile human being.

And that’s the assumption that is essential to Longlegs’s success. He looks, acts and talks like a dingbat.

But the scary thing is, it apparently didn’t take much more than that to keep the FBI fooled back in the mid-90s. I mean, there are plot holes here that could encompass the entire LA area. There are obvious pitfalls for crime fighters back then who were still essentially working by phones (only recently made mobile!). There’s no internet. There’s no huge pool of data from which one could have made inferences. Although part of that is due to mind control — Lee Harker is clearly held back until her doll is destroyed — there are also a number of unforgiveable, almost comedic blunders. I mean, the murders are all connected to one particular birthday, and it didn’t occur to anyone to check what Harker’s DOB was? Or, for that matter, her boss’s daughter’s DOB? REALLY?!?

But that’s exactly the situation in which the viewer is put, in part by the very name. Daddy longlegs aren’t a threat. They’re not even proper spiders (whose bodies have two segments). They have 8 legs but that’s about it. Frankly a single house centipede would easily win a battle of fright with anyone over that goofy thing.

But therein lies the rub. Those little critters are just allowed to thrive, and they do, in attics and crawlspaces, frankly you probably don’t even know that you have them most of the time.

And likewise Longlegs literally lives in Lee Harker’s mom’s basement.

But that’s how evil propagates. It doesn’t do big political rallies. It is a way of life for so many people, just by being the “normal thing”. It just quietly drives wedges between people. Even between investigators. At the FBI. Who clearly should have been taken off the case were it not for some hidden force that has kept them there.

All of it was really easy to see, once you have the power of that force no longer bearing down on your judgement.

There’s a lesson in there somewhere.