self.md radar — 2026-11-08
the second number in the PDF
Tom Clancy was assigned to test whether a financial-document reader parsed filings correctly
he tried adding an earnings figure that a person looking at the page would not see
the reader picked it up
1. a PDF’s visible earnings can differ from its extracted text
Clancy’s November QA account describes successful tests with white-on-white text, text outside the visible page and zero-height characters
these were documents he constructed, not fraudulent filings caught in circulation
his team had treated internal document processing as safe from manipulation
the resulting checks inspect pixels, character positions, Unicode and accessibility metadata, among other channels
a PDF can use inline /ActualText to substitute different text for extraction
Clancy says this can pass the accessibility check and make the text-versus-pixels check validate the substituted payload
the report describes six checks and their limits
Clancy says he has not caught anyone in the wild; the report gives no measured detection rate
reading: Clancy’s checks, attacks and known gaps
2. Firefox fetched a Datasette page nobody clicked
about 80 KB of extra HTML, plus another server render
that is what Simon Willison observed when Firefox followed a Datasette table’s HTTP Link header with rel="next"
the November 7 fix removes that header from HTML responses
JSON pagination keeps it, and the regression test now checks both behaviors
this is a committed fix, not a new tagged release
the browser behavior has a Mozilla bug dating to 2002, with a link to Willison complaining about it back then
reading: Datasette #3046 and the observed prefetch
3. a Free-software law firm retires its little-used servers
in Neil Brown’s November 6 update on decoded.legal, Nextcloud has given way to Syncthing for files and radicale for calendars and contacts
he stopped running Jitsi a few months earlier because most meetings meant joining someone else’s Teams or Zoom call
he now offers Signal when hosting
CryptPad also went: too little use
InvoicePlane produces PDF invoices; clients never log into it
Brown has run the small English firm on Free software for roughly five years
he still uses LibreOffice Writer when exchanging Word documents with other lawyers
reading: Brown’s 2026 stack and what he switched off
more to read
- Mozilla’s original prefetch bug — opened October 19, 2002; the discussion predates Datasette and records the unresolved browser behavior