Until it did.

Inspired by James Titcumb and Owls, I started investigating how to implement webmentions, and ended up going down the rabbit hole myself.

There has long been a PHP API for Microformats (php-mf2). It's not been updated in 4 years — largely because it's complete — and uses PCRE for finding microformats and validating URIs. Here's the thing: the last two releases of PHP (8.4 and 8.5 at the time I write this) have included some amazing features that make things like this both far simpler and more accurate. These include the new HTML5 parser included in PHP 8.4 — which even provides querySelector() and querySelectorAll() implementations — and the Uri extension included in PHP 8.5, which provides robust, standards-based URL parsing and validation.

Add in things like PSR-18's HTTP Client, and it seemed possible to create a pretty minimal library that gives full-featured support for both microformats and webmentions.

So, I decided to try my hand at it.

I'll likely open source the libraries I created (one for parsing microformats, another for sending and receiving webmentions), but I want to wait until I've ironed out any edge cases. While I've tested against the various resources that webmention.rocks provides, as well as the microformats website, I'm sure that I'll be observing some oddities in the wild. But I have webmention receiving in place, with microformats discovery for identifying the type of webmention sent to my site. I have also setup a post-publication process for parsing my own content for links, and performing webmention discovery and sending. I want these all to run for a while to find what is working and what isn't in the real world.

In the meantime, feel free to send webmentions to my blog posts, art gallery images, or Now pages. Just like my comments, I moderate all webmentions before publishing them (someday I'll blog about how I accomplished that as well).

Update

I immediately discovered an error in how I was combing my own content for potential links to which to send webmentions when I first published this! Hopefully I have that corrected now, and folks will get some mentions from this post!

Web­men­tion support was originally published 18 September 2026 on https://mwop.net by Matthew Weier O'Phinney.

The HTML entity ­ is a "soft hyphen"; it won't display unless the browser decides to introduce a line wrap at that point.

It's shy like that.

HTML Hyphenation Hints was originally published 31 August 2026 on https://mwop.net by Matthew Weier O'Phinney.

Since moving all my hosting to a home lab, I noticed that Nextcloud News was unable to retrieve feeds from my own website, which was weird. Looking at the logs, I saw notes about "host violates local access rules".

This was a DNS issue (it's always DNS), right? Well, kind of.

In order to help prevent SSRF attacks, Nextcloud, by default, has protections against domains that resolve to internal IP address ranges. When I moved my sites to my homelab, I also setup DNS such that when on the local network, the services resolve to the local address range instead of the public external IP. This was the root of the problem.

Fortunately, there's a configuration setting for that:

// in the Nextcloud config.php:
[ 'allow_local_remote_servers' => true ]

After making that change and restarting Nextcloud, I was able to get it to resolve and access my feeds.

Nextcloud SSRF rules and internal address ranges was originally published 7 July 2026 on https://mwop.net by Matthew Weier O'Phinney.

Evidently, the AI models trained on my internet activity, and I have thoughts.

I recently saw some folks posting images like the above, linking to intheweights.com; the site allows you to put in a name, and then it analyzes the various models to see how much they have used that person's work to train them.

I evidently fall in the top 2% of sources on which they trained.

Now, this is not entirely surprising. I have done a lot of open source software development over the past couple decades, and have hundreds of thousands of lines of code up in GitHub that have been downloaded many 10s and 100s of millions of times. I've participated in newsgroups, mailing lists, forums, and standards bodies. I've written a lot of documentation, published a ton of blog articles, and co-authored books.

So, how do I feel about AI companies slurping it all up to train their models?

There's so much more I could cover in this post. I know I'm not even touching on the environmental impacts, or the inability of AI companies to optimize code and models to consume fewer resources. That doesn't mean those topics are not important; they just weren't the ones top of mind as I wrote this. My apologies if I missed something you find important.

The copyright and attribution problem

Most of my OSS work has used either a BSD, MIT, ASF, or Creative Commons license. The thing about these licenses is that they are permissive; they basically allow anybody to use them in any way, without restriction.

Well, I should say almost no restriction.

Most of these have an attribution clause: the work can be re-used and remixed, so long as attribution is given. This is generally something as simple as including copyright information when you redistribute code.

But here's the thing with generative AI: it doesn't do that. It simply spits out some code. It doesn't tell you where it came from, who wrote it, etc. In fact, it will tell you that the generative AI tool wrote it... and recent court rulings indicate that such code cannot be copyrighted.

This is not great from an ethical or legal point of view. Using generative AI means you're not attributing the work that informed and powered it.

The reality of work in IT today

All that said, I work for a software company, and, like basically all software companies today, there's a push to use AI to accelerate outcomes. And like many in the software industry, I have bills to pay, and can't just walk away.

So, I've been learning the ins-and-outs of generative AI, both for managing processes as well for doing development.

Unsurprisingly, I can point generative AI at a code base of mine, and it will generate code that is structurally similar to what I would have done by hand. And it will do it in a fraction of the time. It's fairly uncanny to prompt Claude Code with a change I want to implement, and have it generate tests, code, and templates that look pretty much how I would have written them. And to be honest, a lot of this is stuff I don't have time for: yes, they may be tools I maintain for doing my work or coordinating with my teams, but as a PM for two different brands, I simply don't have time for coding. Being able to write a specification of what I want to do, tell Claude Code to do it, and then go off to do the strategy and planning work that my employer expects of me is huge.

We're also using it as part of our process workflow within the various PM teams. We have MCP servers setup with access to a ton of our internal tools, which gives the agents we use for our PM processes a huge amount of data. And this data turns into signals that were really, really hard to get at before. Developing a business proposal in the past required that I do weeks and weeks worth of competitive research, pricing research, reporting out of our CRM, scouring support and engineering tickets, and more — oftentimes to ultimately decide to table the idea. Today, I can fire off an agent to do some discovery, and take that work to develop a hypothesis for a product or support feature, and then agents will fire off to do more research, collating the information, raising questions for me to follow-up on with peers, and helping me identify if an idea has value we should follow-up on — often in hours or days.

With web search having gone to shit, and so many enterprise tools being opaque and requiring expert knowledge to use effectively, what AI agents and tools enable for me is tremendous.

The workforce problem

When it comes to coding, one thing that sticks out: I have been programming for literal decades. I know how to write a specification. Between that, and the fact that generative AI models trained on my literal code, I'm an ideal target for these tools, as what I write is perfectly tailored for them.

But here's the thing: how do new, junior developers get to that same stage?

In the past, we'd toss those specifications their way, give them tools to help them conform to coding standards guidelines, and do peer review of their work. These activities helped them learn. This was how we got a pipeline from junior to senior developers, by mentoring and training. If we cut out that stage, what will happen to the software industry once the senior developers of today retire?

GenAI as an accessibility aide

I mentioned the process changes where we're using GenAI. There's something I didn't talk about though, and it's pretty important.

I'm Autistic and have ADHD. One trait I have is that I see all the steps that need to happen to accomplish something, and quite often, that will overwhelm me. Business plans? One of the worst. I have to do web research, and that often leads into rabbit holes. I have to ask other people to run reports for me, or prepare estimates for me, and that means — ugh! — waiting on somebody else, and the uncertainty of when I'll get the information I need pushes my anxiety up. Then there's trying to understand what information is relevant to the executive team. It's a lot of work. I can do it, I'm even good at it, but knowing what I have to do can lead me to freeze, until it becomes urgent, and then I'm panicking as I scramble to get it all done.

Even doing the weekly reports — sure, I've developed systems to capture that information in my Obsidian vault, but I still have to collate download statistics and make sense of them, and then locate the Confluence page for this week's report, edit it, and paste my material in. And even with all that, I have to also think about if the information is even useful, and if I'm communicating it correctly, because Autism and masking. And this happens every. Single. Week.

What does this have to do with AI?

Surprisingly, AI has acted as an accessibility tool for me.

I can task GenAI with doing something, and then go off and do other things. It allows me to let go of the plan from my head, because it's already written down, and the agents are doing the squirreling for me. Being able to free up this cognitive space means I'm less tired, and I'm more able to focus on what matters.

Those recurring tasks? As Larry Wall said, one sign of a good programmer is that they're lazy; the counterpoint is we'll spend hours and hours automating something that takes just a few minutes every now and then. But GenAI changes that; I can walk it through a process, and have it capture it as a repeatable skill.

Being able to focus on what matters, and still have energy at the end of the day? This makes a huge difference to my quality of life.

(I've rediscovered the joy of cooking, because I still have the ability to make decisions at the end of the day!)

The GenAI paywall

But for all of that, it's also creating an accessibility issue.

I got into open source in part because I did not need to pay for licenses in order to code software. I was able to download runtimes for free, and access manuals for free.

This may not seem like a big deal today, but back in the late 90s and early 00s, it was huge. I didn't need to fork out for ColdFusion, or Frontpage, or Dreamweaver. I didn't need a Microsoft NT license or IIS license. I could spin up Apache with mod_php on my computer, along with MySQL, and just start coding.

Here's the issue: GenAI tools cost money.

Sure, the plans seem cheap, and sure, there's even free thresholds. But the bills are coming in for the data centers used to train LLMs, and investors are starting to wonder when they'll see money back, and this is already leading to pricing changes; just this past month, Microsoft and Github changed from flat pricing plans to usage-based models, and many people discovered that using them was no longer tenable when bills went from $200 to sometimes tens of thousands.

Which leaves me in an interesting spot: GenAI tooling can make my work more accessible to my neurodivergent brain — but I have to pay for that, even though I have no control over how my brain works.

The new build-vs-buy equation, and the death of OSS

I mentioned above that I got into OSS in part due to the fact I didn't have to purchase licenses. I stayed because of community, and because I believe strongly that we all build things better when we do them together. You may be the most brilliant coder in your domain, but when you step out of it — implementing a message queue, working with encryption, adopting DevOps processes — you'll benefit from reaching out to somebody with that experience to review.

Open Source Software commoditizes that. We all share our software, and we can all contribute to other people's software. We can stop reinventing the wheel, knowing somebody else, or some group of people, has done it already, and knows the domain better than we do.

For a company that consumes OSS, this can be critical. Your teams do not need to be experts of every technology they touch or implement; they can rely on OSS packages or frameworks or libraries to do the hard work.

The downside is that when a "supply chain" attack occurs on an OSS project, every piece of software in the world that depends on the project, whether or not it's OSS or commercial, now is vulnerable. I put "supply chain" in quotes deliberately: OSS is not a vendor, not a supplier, but businesses treat it as such. And that puts a lot of pressure on OSS developers, who are often unfunded or underfunded, and getting pressure from companies who depend on them, but will never pay them a dime.

But one benefit of OSS is the oft-cited parable of "many eyes makes all bugs shallow." Because the source is openly available, and because the patching happens within a community, an OSS project is also often uniquely suited to rapid patching of security vulnerabilities.

AI turns all of this on its head.

Because LLMs are trained on OSS, it also means they are very good at generating code to solve the problems that OSS addresses. And because GenAI is currently relatively cheap compared to developers (I expect this to change, and we're already seeing it change!), the "build vs buy" equation has changed.

"Buy" in the "build-vs-buy" equation doesn't need to literally mean "buy"; it can also mean "we're going to add this OSS dependency". When you add a dependency, you now have to monitor it for security vulnerabilities, and have processes in place to mitigate those. The more dependencies, the larger your security surface area.

And that means a lot of companies do a lot of review before they adopt an upstream dependency.

But now you can tell GenAI, "please develop the functionality X; it should act like OSS project Y and give us the same public API to consume. Provide tests so we can maintain this going forward, and hook it into our static code and security analysis tooling." And GenAI will happily go and do that, you'll have a one-time token cost, and a small amount of ongoing token costs for periodic maintenance, and have eliminated an upstream dependency for yourself. Sounds like a win, right?

Except it comes at the expense of the OSS ecosystem.

Over time, we'll get more proprietary software that's created using GenAI, and the models won't have a growing corpus of OSS to work against.

And developers will increasingly need to rely on GenAI tooling to do basic programming, because there's nothing in the commons anymore to use. And that will depend on having privilege and money, excluding a whole class of potential upcoming software engineers from ever entering the workforce.

So, what do you really think?

I'm incredibly torn on the entire subject.

I hate the hype cycle behind GenAI, and the hand-waving at environmental, ethical, and societal concerns.

At the same time, the tooling has truly freed up time and literal energy for me, and helped me combat some of my worst executive dysfunction, and I see it as being a huge enabler for people.

In other words... it's like everything I've ever observed after decades in technology fields. And I wish it wasn't.

Musings on GenAI was originally published 6 July 2026 on https://mwop.net by Matthew Weier O'Phinney.

Today I learned I can simply check for the existence of the file /var/run/reboot-required.

Determining if a reboot is required on Linux was originally published 4 May 2026 on https://mwop.net by Matthew Weier O'Phinney.

To recreate the conditions, you can try the following:

$date     = '2016-06-16';
$fromForm = DateTimeImmutable::createFromFormat('Y-m-d', $date);
$today    = new DateTimeImmutable('today');
echo $fromForm == $today ? 'Equal' : 'Not equal'; // outputs "Not equal"

What's happening? Well, if you were to echo the results of each of $fromForm->format('c') and $today->format('c'), the difference is clear: the $fromForm value includes the time when the instance was created, while $today has the time set to midnight.

So, how do you zero out the time when using createFromFormat()?

It turns out that one of the format characters you can use is the | operator. When you include this at the end of your format string, any fields not included in the format are zero'ed out:

$fromForm = DateTimeImmutable::createFromFormat('Y-m-d|');

Reference

• DateTime­Im­mut­able::­create­From­Format() Parameters

PHP DateTime­Im­mut­able::­create­From­Format Reset Character was originally published 16 April 2026 on https://mwop.net by Matthew Weier O'Phinney.

My question: is this safe?

The short answer, in my research, is "yes", but with caveats.

For Postgres, it's trivial; you can easily add values to ENUM types:

ALTER TYPE some_previously_defined_enum ADD VALUE 'new-value';

For MySQL, it's a bit more complex. ENUMs are defined within the table schema, and to change them, you use an ALTER TABLE statement:

ALTER TABLE some_table
MODIFY some_previously_defined_enum ENUM('value-1','value-2');

Essentially, you're replacing the definition. This is fine... so long as you don't change the order, or remove any previously defined value in the ENUM. In other words, append to the existing list if you want to safely change it.

SQL ENUM Modification was originally published 8 April 2026 on https://mwop.net by Matthew Weier O'Phinney.

It turns out it's been renamed to "display: grid-lanes" in the CSS Grid Level 3 specification. Otherwise, everything else remains the same; continue using grid-template-columns and grid-template-rows as you did with the the masonry display.

Safari has it in preview already, while Firefox and Chrome-based browsers have it behind a flag. (On Chrome-based browsers, visit chrome://flags, and enable the "css-grid-lanes-layout" flag.)

CSS Grid Lanes was originally published 7 April 2026 on https://mwop.net by Matthew Weier O'Phinney.

In browsing a number of forums, I saw one recommendation to switch the BIOS to use FastBoot.

~~Can confirm, works!~~

Update

While FastBoot helps, it doesn't entirely fix the issues. What I discovered was that the server was requiring my keyboard in order to boot; I tested this by rebooting the machine without cables, and plugging in only the keyboard.

Unfortunately, there are no BIOS settings to override this behavior. I dug up an old USB dongle for a presentation pointer, plugged that in, and voilá — it boots now. I suspect any USB HID dongle will likely work.

Headless boot for Beelink EQ14 was originally published 24 February 2026 on https://mwop.net by Matthew Weier O'Phinney.

However, the -f option only accepts a single value, and doesn't recognize globs.

The printf solution

The solution is to pass the glob to printf, with the format '-f %s '. This will print out an option per file.

When in a terminal, this can be done using printf within a subshell. Now how you do that depends on the shell, because the -f in our format string can be interpreted as an option/flag to printf itself depending on the shell.

For bash, we can do this:

helm upgrade -n qa . $(printf -- '-f % ' *.values.yaml)

This is because printf in bash will emit an error for any unknown option/flag it encounters; the -- tells the command when the end of all options/flags have been reached, so that it treats the remainder as arguments.

For fish, we don't need the --, as the printf implementation in fish doesn't accept arguments anyways:

helm upgrade -n qa . $(printf '-f % ' *.values.yaml)

Makefile

Of course, subshells in a Makefile require a little change as well. In a Makefile, I write the above as:

helm upgrade -n qa . $(shell printf -- '-f %' *.values.yaml)

(And since I also declare SHELL=/bin/bash at the top of my Makefile, I have to use the -- trick here.)

Globbing files to pass to CLI command options was originally published 18 February 2026 on https://mwop.net by Matthew Weier O'Phinney.