Stuart Breckenridge — Links

'One Month In'

2026-05-01T23:34:12.565Z

Gobbler is one month old. Overall, it’s been a stable first month, with user numbers growing and a few interesting events along the way.

Stability

According to DigitalOcean, Gobbler had over 99% uptime. There was the odd latency spike from distant regions (think us_east to se_asia), but nothing worrying. The database is also performing well as the number of entries grows (at time of writing, ~150,000).

Success, 403s, and 404s When You Least Expect Them

Despite initially working fine, *.substack.com and medium.com feeds stopped working in their entirety in weeks three and four, respectively. This has largely been resolved by routing fetches to these domains via Cloudflare egress. Gobbler has also been submitted to Cloudflare’s Bot Verification Program, which should make the egress workaround a thing of the past.

youtube.com feeds are special. For most of the day they’ll work fine, then they’ll 404 for a few hours, then they’ll work fine again. It’s a known issue and there doesn’t appear to be a solution.

The only other problematic sites belong to, or are partnered with, IGN Entertainment. We have reached out to IGN to see if this can be resolved. However, as these sites are protected by Cloudflare, Bot Verification is hopefully the long-term solution.

Outside of the above, 5% of feeds are not reachable due to network errors, and Gobbler’s article fetch success rate sits at 84%.

Improvements in Month 1

New accounts: switched from email/password to social sign-in (Apple, Microsoft, Google) and app passwords

Implemented WebSub support

Improved newsletter rendering

Tags: gobbler, rss

'Someone Bought 30 WordPress Plugins and Planted a Backdoor in All of Them'

2026-04-27T11:18:48.348Z

Austin Ginder, Anchor Hosting:

Last week, I wrote about catching a supply chain attack on a WordPress plugin called Widget Logic. A trusted name, acquired by a new owner, turned into something malicious. It happened again. This time at a much larger scale.

[...]

The injected code was sophisticated. It fetched spam links, redirects, and fake pages from a command-and-control server. It only showed the spam to Googlebot, making it invisible to site owners. And here is the wildest part. It resolved its C2 domain through an Ethereum smart contract, querying public blockchain RPC endpoints. Traditional domain takedowns would not work because the attacker could update the smart contract to point to a new domain at any time.

[...]

Two supply chain attacks in two weeks. Both followed the same pattern. Buy a trusted plugin with an established install base, inherit the WordPress.org commit access, and inject malicious code. The Flippa listing for Essential Plugin was public. The buyer’s background in SEO and gambling marketing was public. And yet the acquisition sailed through without any review from WordPress.org.

WordPress.org has no mechanism to flag or review plugin ownership transfers. There is no “change of control” notification to users. No additional code review triggered by a new committer. The Plugins Team responded quickly once the attack was discovered. But 8 months passed between the backdoor being planted and being caught.

It's truly astonishing that WordPress, despite its scale, has such exploitable supply-chain security. I'm aware of a similar npm supply-chain risk with Gobbler, though I am using both Dependabot and Socket.dev to mitigate it.¹

I am also reminded of my own brief stint with WordPress in mid-2025 — I was quite excited. However, after four days I was already concerned about its security and installed wpfail2ban. ↩

Tags: wordpress, security

'App Store Reviews Are Busted'

2026-04-17T13:37:45.026Z

Let's start with the original article by Terry Godier:

For example, if you have a 4.1 star rating in the App Store, any 4 star review is going to decrease that average. In other words, leaving a 4 star review is essentially leaving a negative review.

John Gruber:

Problem #1 [...] If you’re going to collect and average ratings from users, the system that works best is binary: thumbs-up or thumbs-down. Netflix switched from stars to thumbs in 2017, and YouTube switched all the way back in 2009.

I'd add one more to this list, and certainly one that's more analogous to the App Store: Steam. Steam's thumbs-based model is far superior. Not only can you rate and review the game (or app), but other users can also rate your review. Potential buyers can then find and filter by the most helpful reviews. It's a better model for all involved. See UPDATE #1 below.

Problem #2 is that even if the App Store switched from stars to thumbs, the system would still be gamified by developers, rewarding, as Godier aptly puts it, not the best apps but instead the apps that are best at “review prompt execution”. Apple should remove the APIs that allow apps to prompt for reviews, and forbid the practice of prompting for them.

Apple should remove those APIs, but they won't, and until they do, we're playing within that ruleset. Full disclosure, I've built what Terry and John are describing, Singapore Buses does include a review prompt. It's insidiously well designed. On the third launch, the app asks for a rating.

UPDATE #1: I just discovered that the App Store also has a thumbs-up/thumbs-down rating system for reviews of an app. Long-press a review and a context menu appears with Helpful vs. Not Helpful responses. Its outrageous that this system is hidden behind a long-press.

Tags: app-store, steam

'Apple's MacBook Neo Sold Out Through April Amid Surging Demand'

2026-04-16T22:39:18.597Z

Juli Clover, Macrumors:

Apple's MacBook Neo has been a huge hit, and it's still in high demand over a month after it launched. The ‌MacBook Neo‌ is just $599, and with PC makers raising prices because of global RAM shortages, the Neo's low price tag and Apple allure are even more appealing.

MacBook Neo‌ orders placed today on the online Apple Store won't reach customers until May, which means that it's sold out for the month of April, as 9to5Mac points out. All colors and both the 256GB and 512GB SSD configurations will be delivered between May 1 and May 8 at the earliest.

That the MacBook Neo is a success doesn't surprise me. I used one briefly in the nearby Apple Store and it's a really nice laptop. For $599 you're getting something cheaper and more capable than my iPad Pro paired with a Magic Keyboard. In fact, if the iPad Pro doesn't start running macOS in the future, I'm not sure I'd buy another one: iPadOS hobbles the iPad Pro to the point where it can't justify its price tag.

Tags: macbook-neo, ipad-pro

'You Can Absolutely Have an RSS Dependent Website in 2026'

2026-04-12T12:53:28.834Z

Mat Duggan

At one point I did have a Subscribe button up, and enough people clicked it that the cost of actually sending those emails started to resemble a real bill. Sending thousands of emails when you have no ads, no sponsors, and no monetization strategy beyond "I guess people will just... read it?" doesn't make a lot of financial sense.

…

But the bigger reason — the one I actually care about — is that I didn't want a database full of email addresses sitting under my control if I could possibly avoid it.

…

The people who use RSS really use RSS. They're not trend-chasers. They're the type who still have a working bookmark toolbar. They are, in the best possible sense, your people.

I had the same strategy of no ads, no sponsors, and no monetisation when I was using Ghost (Pro) and, yes, that resembled a real bill of US$348 a year (because I had to have a custom theme). That fee also covered membership management, database security, and email distribution, so it wasn't just hosting and a CMS.

When I switched to Astro, I dropped my free membership, membership-only pages, and newsletter, effectively going RSS only. And Atom. And JSON feed. It can be done.

RSS just isn't as easy to explain as email is to people that are new to the format.

Tags: rss

Stellar Photography

2026-04-11T13:56:38.920Z

There's a fantastic, and growing, selection of exposures from the Artemis II mission over on Flickr. All of them are jaw dropping.

Tags: nasa, artemis, photography

A Decisive Victory

2026-04-08T13:38:14.235Z

Sky News:

Donald Trump says the US has received a "workable" 10-point plan from Iran after the two countries agreed to a two-week ceasefire, labelling it a "complete victory" for his nation.

What's in that "workable" plan? Again, from Sky News:

Withdrawal of U.S. forces in the region
Iranian control of the Strait of Hormuz
Compensation for damages to Iran
Removal of sanctions
Release of frozen Iranian assets
Iranian commitment to not build a nuclear weapon
Acceptance of Iran's right to enrich
Iran's agreement to peace treaties with regional countries
Ceasing hostilities against all resistance groups in the region
Provisions backed by UN resolution

So, in summary, all U.S. military objectives have been met, says Pete Hegseth, and, as a workable plan: U.S. forces will withdraw, Iran will gain more control over the Strait of Hormuz, Iran will be compensated, sanctions against Iran will be removed, frozen assets will be released, and Iran will continue to enrich.

You have to wonder what the military objectives were.

Tags: politics

'A Good Mac Studio is Hard to Find'

2026-04-04T12:09:47.615Z

Stephen Hackett, at 512pixels.net:

It’s not just the Mac Studio; it’s easy to build a Mac mini that won’t ship until August. That is bad news if you need a new Mac desktop on short notice. These long delays are not impacting all Macs, though, as the iMac and notebooks seem to all have much better shipping dates.

I don't need a new Mac desktop (mini or Studio) on short notice. I have, however, been looking for a Mac mini for Gobbler development. 95% of development is done on my MacBook Pro and I've tried to replicate the development environment on my gaming PC through Windows Subsystem for Linux. It's close, but not the same.

Regardless, pricing up any Mac mini results in a delivery estimate way into the future. My thinking is that this is due to Apple running down what's left of M4 stock with an M5 refresh delayed due to memory shortages.

Tags: mac-mini, mac-studio

Earth in the Rear View Mirror

2026-04-04T07:22:51.475Z

Auroras along the North and South poles, the Sun about to peek out, and Venus visible in the bottom right. Amazing.

The photograph was taken with a Nikon D5, for those wondering.

Tags: nasa, artemis, photography

'Apple Lays Groundwork for Ads in Maps on iOS 26.5'

2026-03-31T13:12:42.950Z

Juli Clover, Macrumors:

Businesses in the U.S. and Canada will be able to show ads in search results and at the top of a "Suggested Places" section in the app, which is new in iOS 26.5. Suggested Places displays recommendations for locations to visit based on trending places nearby, recent searches, and more.

Ads in the Maps app will have a clear "Ad" label, much like the ads shown in the App Store search results.

I have no issue with ads in Maps. I would also have no issue if Apple brought back iAd, presumably as Apple Ads, for third-party apps. I would drop AdMob pretty quickly, if Apple Ads proved competitive with AdMob.

Tags: apple, ads