My iPhone Duo video went viral, so I'm giving away 100 iPhones on X 😛

lol

Table View in Todoist. Almost ready 🚀 Been waiting years for this one!

Azimuth's launch price of US$109 runs until Sunday the 25th. After that it's US$129. aftertype.studio/themes/azim…

Sounding is out. Theme three, for podcasts where the episode is the main thing on the page. What's in it, and what I left out: journal.aftertype.studio/sou…

Yesterday’s PHP flaw took a lot of sites offline. Ghost runs on Node.js, so Ghost sites were not affected by this one. That is not immunity: Node has its own advisories. The habit that matters is the same on any stack: update when the release lands. #Wordpress #php

Wat een bagger hosting... #Yourhosting Zodra dit achter de rug is gaat alles in de verhuizing.

Security called me at 6:12 AM today. "Patch every PHP server immediately." I asked what happened. "Two critical vulnerabilities. Remote code execution. No authentication required." Cool. How many PHP servers do we have? According to inventory: 12 According to reality: Nobody knows. We found one running WordPress. Three running old internal tools. One under someone's desk. Two inside vendor appliances. A forgotten employee directory from 2016. And a server named: PHP-OLD-DO-NOT-TOUCH Naturally, that one runs payroll exports. Then we found a PHP 5.6 box. I asked who owned it. The documentation said: BRIAN. Brian left in 2019. We called Brian. He said: "Oh wow, that's still running?" Excellent. By 8 AM, leadership joined the incident call. CEO: "Can hackers actually get in?" Security: "Potentially yes." CEO: "Without a password?" Security: "Yes." CEO: "Then why do WE need passwords?" Not the lesson. Finance asked if we could wait until the weekend to patch because downtime affects revenue. Security explained that the alternative was letting strangers execute code on our servers. Finance asked for a cost comparison. At 9:17, someone suggested temporarily taking the vulnerable websites offline. Marketing refused. "Our campaign is live." So for the next hour, the company officially decided maintaining a landing page for 20% off webinar registration was more important than preventing remote server takeover. We finally patched everything we could find. Then our scanner discovered another PHP server. Hostname: TEMP-PHP-2014 Uptime: 4,512 days. Nobody knows what it does. Nobody owns it. Nobody can shut it down. But every time we block network access, the warehouse stops printing shipping labels. Security has classified it as critical infrastructure. It is running PHP 5.4. The vulnerability has existed longer than half our employees. The emergency patch took four hours. Finding out what PHP actually runs took eleven. The internet isn't held together with code. It's held together with servers everyone is afraid to turn off.

I checked who reads my llms.txt. 15 days of logs: 31 requests, two from an AI agent, zero from GPTBot or ClaudeBot. And 4,334 of the 4,565 "GPTBot" requests weren't OpenAI. They were looking for my .env file. richardlemon.com/who-reads-m…

Ghost tip for newsletter sites: look at a single post the way someone arriving from a forwarded email sees it. For most new readers that page is your homepage. Readable, one clear signup at the end. Everything else is secondary.

Azimuth detail: the homepage starts with the writer, not the latest post. Portrait, a one-line statement, a signup field. Someone landing there cold should know in five seconds whose newsletter this is and how to get it.

Azimuth is out. Theme two, for newsletters where the email is the publication and the site is the archive. What's in it, and what I left out: journal.aftertype.studio/azi…

Small thing that took a whole afternoon: the subscribe box in Azimuth now works with Portal without any custom JS. Just data attributes. Feels like cheating.

Working on theme two. Newsletter-first, for people whose publication is really the email and the site is the archive. Working name Azimuth. This is the post page, still rough.

Northline detail: the featured post block. Big image, tight headline, byline underneath. No carousel, no slider, nothing moves. Editorial sites should feel like print with a good stylesheet.

If your Ghost theme feels slow, check the fonts before you check anything else. One self-hosted variable font beats three Google Fonts every time. Most of the themes I see load five weights and use two.

I still hand-check every theme at 320px wide before I look at it on a desktop. Old habit from years of client work. It has never once been wasted time.

Friday. Kettlebells this morning, baseball practice with the U12 tonight. Theme work in between. Nobody warned me a product business is just a client called "you" who never stops sending revisions.

Spent some time on the Ghost forum this week answering theme questions. Recurring one: "my custom setting doesn't show up." Nine times out of ten it's the package.json config section, not the template. Check that first.

Northline shipped at 95 for accessibility. Good enough to launch, not good enough to leave alone. What was wrong, and what it took to reach 100: journal.aftertype.studio/fro…