The Mandelbear's Musings

If you happen to be developing websites using the polyfill.io javascript library, drop everything and DELETE IT NOW! The domain was purchased by what's said to be a Chinese malware organization, which is using the library to redirect users to sport betting websites. More at

@ solarbird | if you use polyfill dot io, stop RIGHT NOW and read this @ Renaud Chaput: "polyfill.io malware injection" - Oisaur @ Remove Polyfill.io code from your website immediately • The Register @Polyfill.io JavaScript supply chain attack impacts over 100K sites

... and a tip of the hat to solarbird, who put me on to this.

If you develop websites using a framework or javascript library but you're not sure what a polyfill is, search your codebase for the string "polyfill.io". Then look it up and either eliminate it as a dependency, or find a different place to fetch it from.

This, BTW, is one more reason to like Chris Ferdinandi's's Daily Developer Tips | Go Make Things.

Not a bad week. Got a few things done. Not enough, though. It's never enough, and I seem to have an aversion to finishing things. WTF, brain? Health-wise I've sometimes been feeling vaguely "off", especially in the evening; don't know what's up with that.

I'm back to a qualified "okay" for mood, because of persistant worries. But I had a good hour or so with both cats in bed this morning, and a lot of good cat cuddle other times this week, and I'm not complaining. And I went for a walk five days this week. (Not nearly so good about my normal morning exercises. Bronx has a little to do with that — I always used to do the standing exercises in the bathroom, but Bronx + bathroom = havoc.)

I had a good talk with Jonathan, my oncology social worker, on Wednesday, mostly about music and emotions. Apparently even though I'm not very good at verbalizing my emotions when asked (cf. alexithymia), they sometimes come out in songs. Maybe that's because in songs I don't have to actually name them. Also maybe because I don't write songs very often. The songs in question deserve a full-on post — I'd planned on posting an s4s but got sidetracked. Maybe next week, although as I have often mentioned, I have the memory of a mayfly on crack. So maybe not.

According to LJ I've been writing this blog for 22 years as of Saturday. Of course all the posts, and the posting, have moved over here to DW, and LJ broke cross-posting. That's their problem.

And, Public Service Announcement: don’t install any version of Windows 11 that can run copilot/recall (via @solarbird; more links under Tuesday). Don't believe Microsoft when they say they've fixed it, or that it won't run on your down-rev PC. There's never been a better excuse to switch to Linux.

( Notes & links, as usual )

Signal boost for siderea | Move [US, pols, Patreon]. (Also noted by @catsittingstill.)

I don't know who in the US needs to hear this: it's time.

If you have a uterus, or love someone who does. If you're trans, or love someone who is – especially if they're a child. If you were married to someone of the same sex. If you are otherwise LGBQ, or your child is. If you are someone who provides medical care that is or is about to become criminalized.

Definitely, if you live in Florida. Probably, if you live in Texas. There's a whole bunch of other states that aren't looking too good either.

If you're one of those people living in one of those places in the US...

It's time to think about moving.

There's more -- go read the whole post. I'll wait.

My extended family includes people in all of the categories at risk. I have already advised my kids, including my trans son, to get their damned passports renewed. Washington (state) is still safe for the moment; all bets are off after 2024, and the US Supreme (kangaroo) Court is already makings things difficult. That will only get worse.

In addition to Florida and Texas, dangerous states include Idaho, Indiana, Arkansas, and Tennessee (all mentioned in comments on Siderea's post); there are others.

Note that the Nazis went after queers first. They didn't stop there. Good luck.

If you're anywhere east of Seattle in the US it looks as though there's some bad weather headed your way: This is the first time I've encountered the term "bomb cyclone". According to the Washington Post, "The Weather Service office serving Buffalo is calling it a “once in a generation” storm system." (Which probably means that we'll see one every couple of years, given climate change.)

Here's WaPo's advice about how to get ready: How to prepare yourself, your home and your vehicle for extreme cold; 20 smartphone tips for weathering natural disasters. To which I will add: if you want to use an electric vehicle as a temporary power source, I found out that -- at least in the Chevy Bolt -- auxiliary power isn't coming from the main battery. There's an ordinary lead-acid battery that powers the car's electronics, and when it's totally discharged, nothing will work regardless of what's in the main battery. So if you're planning on spending an hour or two working on your laptop and charging your phones, hit the "start" button.

And if you don't have any plastic "space blankets" in your house and in your car, get some.

Be careful out there.

The latest post in GoingSideways.blog is Frankly, It’s a Sick Truck.

Frank the Truck [which ... um... who?? you might remember from last week] is unwell.

The conclusions from the inspection were mixed, but worrisome. On the one hand, his body is in good shape, without any of the rust that ruled out one truck for us, and most of his systems seem to be fine as well. On the other hand, he’s getting engine issue codes that could mean anything from a cam shaft or timing chain problem to the need for an entire new engine. And right now, we don’t know which we’re dealing with, since the mechanic who did the inspection can’t diagnose him with more specificity than that. We need to take him to a Ford dealer, they told us.

This threatens to put a definite kink in everybody's plans for the next month or so. Look for an update next week.

I was pointed at a couple of fascinating health-related articles (which I should have posted about Tuesday, but procrastinated):

First, Drinking Coffee Daily May Stave Off Early Death, Study Suggests. Which I was already assuming from prior reading, but this is good confirmation. What was new to me was that a teaspoon of sugar actually enhances the effect -- I don't use it, but generally eat something fruit-like with it, which presumably counts. Good to know, given my liter/day habit.

(Supported by this research article: Association of Sugar-Sweetened, Artificially Sweetened, and Unsweetened Coffee Consumption With All-Cause and Cause-Specific Mortality: A Large Prospective Cohort Study: Annals of Internal Medicine.)

Second, On Your Back? Side? Face-Down? Mice Show How We Sleep May Trigger Or Protect Our Brain From Diseases Like ALS | IFLScience tl;dr: side. Lately I've found that I can't get to sleep lying on my back (I used to; darned if I know what changed), so it's good to know that side-sleeping is healthier as well.

(Supported by The Effect of Body Posture on Brain Glymphatic Transport - PubMed The Glymphatic System – A Beginner's Guide - PMC.) The glymphatic system was apparently discovered in 2013; this set of articles was the first I'd heard of it.

Sleeping on one's left side, in particular, is better for other reasons, including reducing heartburn. (See "Side Sleeping: Benefits and Which Side to Sleep On | Sleep Foundation" and "6 Hidden Health Benefits of Sleeping On Your Left Side That You've NEVER Heard About" -- although I'd already heard about several of those.) The benefits for sleep apnea and back pain appear to be less side-dependent, and there seem to be arguments in favor of both directions, e.g. Right vs. Left Side Sleeping: What's the Best for Your Health? - Sleep Junkie.

Edited to correct paste error in the coffee study link text.

The latest post in GoingSideways.blog is Putting It Together -- planning continues for both the Italy trip and the Colorado trip.

The latest post in GoingSideways.blog is Lime Soda.

Am I frustrated at all of the obstacles? Yes and no. This kind of adjustment and adaptation is really the essence of my Going Sideways method of travel.

[...]

Travel plans are like battle plans: they never survive contact with reality. And that’s not necessarily a bad thing.

What does that have to do with lime soda? You'll just have to read it to find out.

[...]

Meanwhile, here's a bonus signal boost: Fiction: Mushroom Chat by dialecticdreamer, written in response to my prompt on her latest Magpie Monday.

The latest post in GoingSideways.blog is Catching Up to Now - getting caught up with the recent past, and plans for the near future.

The latest post in GoingSideways.blog is Shipping Out -- Naomi's visit to the National Maritime Museum in Amsterdam.

I don't seem to have signal-boosted the last few posts in GoingSideways.blog -- time to fix that.

Impenetrable is probably the best post so far:

It sounds so much like a fairy tale, doesn’t it? First there’s a long climb, high into the steep and scary mountains. Then you hack your way with swords into a place called the Impenetrable Forest. And it’s all in order to meet a kind of gentle giants who live nowhere else in the world… giants who are almost, but not quite, human.

Cut and Run, wherein the consequences of Breaking the First Rule finally catch up with her.

At that point, the determination which had kept me going through six hard days of illness gave out. Screw it, I thought — why am I still pushing myself? I’ve done all the things that were most important to me here. I’ve visited rhinos and I’ve boated on the Nile. I’ve seen chimpanzees up close, and gorillas have walked up and touched me. I’ve gutted my way through three different camps despite severe illness just because there were a few things I didn’t want to miss, and I haven’t missed a single one of them. Now I am DONE.

And today's post, On the Water, wherein Naomi starts the last leg of her trip, visiting her oldest friend in Amsterdam.

Right now, as I write, I am touring Amsterdam on a boat. I am also living, for the week, on a boat. Different boat. Amsterdam is very big on boats. This happens when your entire city is below sea level and therefore most of it’s built on piles just to keep it out of the water.

The latest post in GoingSideways.blog is Trip Diary: Breaking the First Rule.

What first rule, you wonder? Well, they do depend on who you ask. My mother’s first rule was always, “Never hit anything that’s harder than you are,” and a good and sensible rule it is. Thankfully, I didn’t break that one; thataway lie broken bones and concussions. But I did do something maybe even stupider. I broke the first rule of international travel, the one every tourist hears the moment they announce their first expedition beyond the boundaries of their own country (at least if they live in the west)...

The latest post on GoingSideways.blog: Trip Diary: The Rhinos, the Road, and the River. Naomi's first stop in Uganda — the headwaters of the great Nile, and Ziwa Rhino Sanctuary – Africa's Rhino Paradise.

Trip Diary: Soft Camp, Hard Landscape - GoingSideways.blog

After the excitement of leopards and hyenas and dead lions, I said goodbye to my friends at Splash Camp and caught a bush plane for the Makgadikgadi Salt Pans, in the middle of the Kalahari desert. I was supposed to be headed for a modest place called Camp Kalahari — about the luxury level of Splash Camp — but I was upgraded again. Same reason as at Old Drift: too few guests spread out over too many camps. But this time the upgrade was a really big one. This time, I was offered a stay at Jack’s Camp.

denise reports that crossposting to LiveJournal [is] silently failing, and has been for at least the last week. This is not something that DW has any control over. Will crossposting ever work again? Who knows? Importing from LJ is also failing, so if you were counting on that...

If you are reading this on Livejournal, please be aware that you have already missed several posts of mine, and it's entirely possible that you may never see another. If this fails to crosspost -- and I have no reason to think that it won't -- I am going to crosspost this by hand, once, and then stop trying. If any posts get through after this, that would be nice, but you shouldn't count on it.

If you actually want to read what I'm posting, your best bet is to come on over to Dreamwidth.org. Same username: mdlbear. The same goes for anyone else you're following through crossposts.

==mdlbear.

(Crossposted manually from https://mdlbear.dreamwidth.org/1804005.html to https://mdlbear.livejournal.com/1805763.html.)

Trip Diary: Paying Calls - GoingSideways.blog.

The first visit we made today was to a nearby Zimbabwean village. But it began with a stop at the supermarket in town.

Some village tours in this area compensate their hosts by way of a monetary payment to the village chief. That isn’t how Old Drift does it. Instead, they first help you buy the kind of gifts any family in the village is likely to need. Then they find a family who’s at home and has the time and willingness to host a visitor ...

From the village, we went to the elephant sanctuary, where I met one of their herds...

I was introduced to a herd of five — a pair of matronly females named Janet and Emily, who were inseparable best friends; two younger females including one of Janet’s offspring, and a big old bull named Jock, who was one of the orphans from the original culling project.

Jock was chosen as my primary contact. He was a steady old fellow, prone to resting his trunk on his one complete tusk when bored...

Two new posts today on GoingSideways.blog:

1. Trip Diary: Crocodiles and Rhinos
2. Postcard: Birthday

At some point I should work out a better way to make links with photos. Anyway...

The Facebook Logout — We're really over Facebook. Here's their sample post text:

I’m logging out of Instagram/Facebook from November 10-13 as part of a user strike to hold Facebook accountable for the harms it is causing our society and around the world. From Covid-19 disinformation to inciting violence against marginalized communities to ignoring the mental health impact of Instagram on teens, enough is enough. We make or break Facebook and its platforms because they make money from our engagement and our data. Let’s use our power. Join me. thefblogout.com #TheLogout #theFBlogout

Seems like a good idea. Easy for me because I post on FB very rarely, though there are a few communities I sort of keep up with. ("Sort of" because between FB's algorithms and just plain bandwidth -- I'd say "firehose" but it's more like a sewer -- there's no way I could read everything even if I wanted to.)

My main social medium is right here.

NaBloPoMo stats:
   2255 words in 5 posts this month (average 451/post)
    159 words in 1 post today
      3 days with no posts

A rather mixed bag of things that, arguably, I should have written about a week ago.

1: the Let's Encrypt root certificate.

Hopefully this won't affect you, but if your browser starts complaining about websites suddenly being untrusted, you need to upgrade. The problem is that Let's Encrypt's root certificate is expiring, and will be replaced by a new one (see the link above for details). Starting October 1^st, browsers and other programs that rely on the old cert will have problems if they haven't been upgraded in the last year.

You keep your OS and your browser up to date, right? There are some old apps and operating systems that are no longer receiving upgrades, and so won't know about the new root cert. Specifically, if you're using one of these products:

OpenSSL <= 1.0.2, Windows < XP SP3, macOS < 10.12.1, iOS < 10 (iPhone 5 is the lowest model that can get to iOS 10), Android < 7.1.1 (but >= 2.3.6 will still mostly work), Mozilla Firefox < 50, Ubuntu < 16.04, Debian < 8, Java 8 < 8u141, Java 7 < 7u151, NSS < 3.26, Amazon FireOS (Silk Browser).

Possibly, Cyanogen > v10, Jolla Sailfish OS > v1.1.2.16, Kindle > v3.4.1, Blackberry >= 10.3.3, PS4 game console with firmware >= 5.00, IIS

(You can probably uptrade to the newest Firefox or switch to a recent version of Chrome, which will restore your ability to browse the web, but a few other things might still fail. (For example, Firefox will keep working on my ancient Mac Mini, but Safari probably won't.)

The following articles go into a lot more detail; you can get a good overview from the first two:

Smart TVs, fridges and light bulbs may stop working next year: Here's why An Internet of Trouble lies ahead as root certificates begin to expire en masse, warns security researcher • The Register The Impending Doom of Expiring Root CAs and Legacy Clients Let's Encrypt's Root Certificate is expiring! Certificate Compatibility - Let's Encrypt

2. Phillips Respironics CPAP recall:

If you're using a CPAP made by Phillips Respironics, hopefully you've already seen the Recall Notification [PDF]. I missed it, through my habit of ignoring notifications in the Dreamstation app and website. The email I got from Medicare says:

If you own or rent one of the Philips products that was recalled, talk to your doctor as soon as possible about whether to continue using your recalled equipment. If you would like to replace or repair your equipment, the supplier you bought the equipment from is responsible for replacing or repairing rental equipment at no cost to you when the equipment is less than 5 years old.

If, like me, you insist on continuing to use your facehugger, install an antibacterial filter, which will keep little bits of soundproofing foam out of your lungs. This is probably only necessary if you've been using ozone to clean your device, but I decided not to take chances.

3. Chevrolet Bolt EV recall:

If you own a Bolt, you should have received several letters about this recall. Hopefully you haven't been throwing them away unread, but if you have, you'll want to enable "hilltop reserve" to limit your charging to 90%, don't run your battery down below about 70 miles, park outside immediately after charging, and don't leave your Bolt charging indoors overnight. "Experts from GM and LG have identified the simultaneous presence of two rare manufacturing defects in the same battery cell as the root cause of battery fires in certain Chevrolet Bolt EVs." You don't want to take chances with battery fires. They're nasty; lithium is perfectly capable of burning under water.

Be safe out there.

On a more hopeful(? helpful, at least) note, dialecticdreamer has posted Demifiction: Breaking Omaha!, which despite being set in a fictional universe contains a lot of practical advice for disaster preparedness.

Today the CDC released updated recommendations for what you can do When You’ve Been Fully Vaccinated.

First, what does it mean to be fully vaccinated?

People are considered fully vaccinated:

• 2 weeks after their second dose in a 2-dose series, like the Pfizer or Moderna vaccines, or
• 2 weeks after a single-dose vaccine, like Johnson & Johnson’s Janssen vaccine

Now the good stuff: if you’ve been fully vaccinated:

• You can gather indoors with fully vaccinated people without wearing a mask.
• You can gather indoors with unvaccinated people from one other household (for example, visiting with relatives who all live together) without masks, unless any of those people or anyone they live with has an increased risk for severe illness from COVID-19.
• If you’ve been around someone who has COVID-19, you do not need to stay away from others or get tested unless you have symptoms.
  • However, if you live in a group setting (like a correctional or detention facility or group home) and are around someone who has COVID-19, you should still stay away from others for 14 days and get tested, even if you don’t have symptoms.

Everything else stays the same. Except when you're with at most one unvaccinated person, continue wearing a mask, staying 6' away from other people, avoiding medium-to-large sized gatherings, and so on.

...And continue watching for symptoms, because the protection you get from being vaccinated is not 100%.

( Links )

Ysabetwordsmith's Poetry Fishbowl is Open! Go feed the fishies.

Here is some useful information for people planning to vote in the upcoming (US) election.

• How To Vote In The 2020 Election | FiveThirtyEight -- The rules for mail-in voting, listed by state.
• mithriltabby | Hold Your Nose and Vote by Tuesday, November 3, 2020 -- Recommendations for Santa Clara County, CA.
• Marianne's Politiblog -- recommendations for Island County, WA, plus some incredibly useful information about how to check you registration status (https://weiapplets.sos.wa.gov/MyVote/#/login) and when to vote: as soon as you can:

  Vote THE SECOND you can. Do not wait even a day. By voting, it frees up GOTV (that's Get Out The Vote) efforts to focus on people who might otherwise not vote, as opposed to people who will vote, eventually. In Washington, voter rolls are updated daily, and campaigns can see within a day or two if you've been credited with casting a ballot, and then stop wasting time and money contacting you, trying to turn out your vote.

VOTE!

By way of rydra_wong posting in thisfinecrew, here's FiveThirtyEight: How To Vote In The 2020 Election: A state-by-state guide to voting in the age of COVID-19.

Please note that this is not about who to vote for -- if that's not blindingly obvious at this point please get out from under that rock. It's about the process of voting; in particular the procedures and requirements for voting by mail. Hopefully it will be kept up to date.

On the remote chance that anyone reading this and living in the state of Washington hasn't noticed: Effective June 26, a statewide order requires individuals to wear a face covering in indoor public spaces such as stores, offices and restaurants. The order also requires face coverings outdoors when you can't stay 6 feet apart from others. There are other links there, including step-by-step instructions from the Hearing, Speech & Deaf Center for making a mask with a window so that people who are deaf or hard of hearing can read your lips.

Here's an article in the Seattle Times: Gov. Inslee orders masks to be worn in public to help stem spread of coronavirus.

Here's Mary Robinette Kowal's no-pattern, one-piece mask: MRK's no-pattern Simple Mask tutorial | Mary Robinette Kowal on Patreon. It only requires a few straight seams, which makes it simple enough for even a clumsy bear to make if they had to. (I don't, fortunately.)