_" We spoke with voters who cast their ballots for Mr. Trump and said they were disappointed with his second term. A few said they even regretted their votes. —_ New York Times_ - - - MODERATOR: In one or two words, finish this sentence: _“I’m feeling ‘blank’ about the Empire these days, now that the galactic superweapon I willingly supported hovers overhead.”_ TALLIS, 44: Concerned. MIRA, 29: Confused yet hopeful. BRENN: Annoyed. KELAN, 38: Surprised. OOLA, 61: Worried. DARO, 24: Betrayed. LYSA, 47: Frustrated. JOREN, 63: Apathetic. CEN, 35: Discouraged. PAVA, 19: Anxious. RINN, 56: Disappointed. HASK, 41: Steady. MODERATOR: Mira, you said, “confused yet hopeful.” Tell me more. MIRA: I think a lot has happened very quickly. There were promises about stability, about restoring order to the galaxy. At the same time, when I look up… it raises questions. Still, I feel like there must be a plan. They wouldn’t position something like that over a loyal world without a reason that benefits us. MODERATOR: Kelan, you said, “surprised.” KELAN: I voted for strength. The Emperor projects strength. That’s important. But I didn’t think strength meant a planet-killing battle station this close to _my_ planet. I assumed deployments like this were for Outer Rim situations. You know, for lesser things, like Jawas. MODERATOR: Daro, you said “betrayed.” DARO: We were told this was about keeping the galaxy safe from extremists who don’t share our values. Alderaan isn’t that. We’re peaceful. We comply. But seeing that thing’s massive dish warming up like that, it certainly doesn’t feel like protection. It feels like something else. MODERATOR: Have you felt this way for a while? DARO: Not until it blotted out the Sun. Before that, it was easy to trust the Empire. MODERATOR: Oola, you mentioned you’re worried. OOLA: I supported the Emperor because I thought he’d learned from the Clone Wars. I thought this time would be different. But now there’s this constant vibration I can feel deep in my bones. My grandson says it’s “charging.” I don’t know exactly what that means, but it doesn’t sound like an agriculture policy. MODERATOR: Tell me why you supported the Empire in the first place. BRENN: Lesser of two evils. The Senate was ineffective, and the liberal Jedi were out of touch. The Emperor said he’d cut through all that. And he did—sometimes literally. You have to give him that. Things moved. Maybe a little too much moving right now, with the Death Star repositioning every few minutes to maintain a firing solution on our planet, but still. MODERATOR: Are there things the Empire has done well? HASK: Disintegrations. And I like that they’re decisive. You look at that battle station, and you think, _Wow, that’s decisive engineering._ People make jokes about the cost of it, but I see efficiency. They should make two. MODERATOR: Some of you mentioned concerns. Any regrets? HASK: None. The Emperor is a smart man. He’s playing a long game. People see a glowing aperture pointed at our planet capable of snuffing out all life as we know it, and they panic. But that’s emotional. Irrational. Grand Moff Tarkin is probably up there doing calibrations we just don’t understand. TALLIS: I regret it. My sister said this is exactly how it would go. I told her she was overreacting. Now she’s on Yavin 4 with the Rebellion, and I’m outside watching an ominous green light fill the whole sky, and I feel foolish. JOREN: I don’t know that regret changes anything. It’s there now. It’s not like we can vote it away at this point. MODERATOR: Are there Imperial policies that have affected you personally? LYSA: Blue drink sales are way down. People aren’t dining out when the sky looks like that. MODERATOR: Who do you feel the Empire is most focused on? RINN: Not us. I always thought we were part of the “us.” Now I’m not sure. I feel like a Bothan spy, to be honest. MODERATOR: Do you think the Empire understands what life is like on Alderaan right now? TALLIS: I don’t think they understand the fear. Every surface is glowing green. HASK: Or illuminated. That’s another way to put it. MODERATOR: Sorry, “illuminated”? Hask, you disagree. HASK: People assume the green light and orbiting space station are ominous because they’re unfamiliar. But large-scale governance can look intimidating up close. MODERATOR: Do you think Alderaan is being treated fairly? CEN: No. We’re being made an example of. BRENN: Maybe, but examples are how order works. I’m not saying I like the thought of Alderaan becoming a loose collection of asteroids floating in space. I’m saying I understand the political theory. CEN: The political theory is currently pointed at my son’s school. MODERATOR: Has anything changed your mind in the last few minutes? RINN: The Death Star’s green beam separating into smaller beams and then joining into one larger beam has been clarifying. HASK: I’d still caution against reading too much into military optics. MODERATOR: Optics? HASK: If you build a planet-killer, people are going to assume the worst every time you park it near a planet. That’s just a messaging problem. MODERATOR: And if it fires? HASK: Then obviously we’ll need to revisit the messaging. _EDITOR ’S NOTE: At this point in the discussion, the laser beam from the Death Star intensified, grew closer, and permanently blinded everyone._ MIRA: I still think there’s a plan. DARO: I don’t think the plan includes us. HASK: I think people are overreacting. The Empire wouldn’t target its own loyal citizens. That would make no sense.

Meow meow meow meow Meow Meow Meow (MEOW). MEOW meow meow meow meow-meow meow meow meow Meow meow meow, meow meow meow meow meow meow meow meow meow meow meow meow meow Meow. Meow meow meow, mrrp meow meow meow meow meow meow meow MEOW meow meow meow meow meow MEOW MEOW, meow meow meow meow meow meow meow mrow meow meow. Meow meow meow meow meow meow meow meow meow meow meow meow meow MEOW MEOW. Meow meow meow MEOW MEOW, meow meow meow Meow MEOW, MEOW, MEOW, MEOW, MEOW, meow MEOW meow meow meow meow MEOW MEOW. Meow meow Meow MEOW meow MEOW, meow meow meow meow meow meow moew meow meow meow meow meow meow meow meow meow MEOW meow. Meow meow meow MEOW MEOW meow meow nya meow meow meow meow meow meow meow meow MEOW-MEOW meow. Meow MEOW meow meow meow meow MEOW MEOW meow meow meow meow meow meow MEOW MEOW.

I’ve recently finished overhauling this site. If you’ve noticed anything different around here, this is why. (If you haven’t, sweet! That was my goal.) ## What? I migrated player03.com from shared hosting to a virtual private server (VPS). Along the way, I improved the site’s security (both front- and backend), wrote a bare-bones privacy policy, and tidied up some old posts and images. I considered big changes like switching to a more recent theme, but most of them broke something or would require extra work, and might confuse visitors. So instead, I aimed to keep it as close to the old version as possible. ## Why? Because CryptCheck gave me an F. Two ranks _below_ the bare minimum, ouch! (Note: I have no evidence that anyone ever exploited these vulnerabilities in the wild.) ## Who? I don’t actually know who runs cryptcheck.fr, other than that they’re French and highly opinionated. The site was recommended by a security geek on social media, and as we all know, geeks on social media are infallible. Whether or not I felt like trusting CryptCheck, Mozilla corroborated them. Their HTTP Observatory gave me a 40/100 (D-). Thankfully, unlike CryptCheck, Mozilla provided detailed descriptions of what was wrong, why it was wrong, and how to fix it. ## What and why? * I was allowing unsafe inline scripts. This meant that if someone found a way to insert text into the page, they could run a script in another visitor’s browser, potentially stealing data or directing them to a virus. (WordPress sanitizes comments, but you never know when someone will find a way to bypass that.) * I was allowing other sites to embed mine in an iframe. In theory this can be used to steal user data, though in practice, what is there to steal? * I wasn’t implementing HTTP Strict Transport Security (HSTS), meaning http://player03.com didn’t redirect to https://player03.com early enough in the connection process. It did redirect eventually, but the initial connection was done over http, which would technically be enough for someone to intercept the data and redirect users to a fake site. ## How? The easiest one to fix was iframe embedding. I opened up the root .htaccess file and added two lines. The first line sets `X-Frame-Options "SAMEORIGIN"`, telling browsers not to let other sites embed mine. The second line sets `frame-ancestors 'self'`, telling browsers not to let other sites embed mine. I think the difference is that the former is for old browsers and the latter is for new ones. Next, I had to disable inline scripts. This isn’t hard to do: just delete `'unsafe-inline'` from .htaccess. The trick was, I wanted my site to continue working afterwards, and some of my fancier blog posts made heavy use of inline scripts. I’d have buttons that you click, each with its own `onclick="do.unique.thing()"` inline script. To fix this, I went through all my blog posts and figured out a way to replace these scripts. Turns out, while `onclick="xyz"` is unsafe, you can just move `xyz` into a .js file, and then it’s safe. The site uses HTTPS, which means all the .js files are cryptographically signed, so there’s no tampering with them during transit. I also submitted a pull request to Lime to remove inline scripts from Lime apps. WordPress uses its own inline scripts, and I couldn’t transfer those. Instead, I manually approved them using SHA-256 hashes. These scripts will run as long as they’re completely 100% identical to the versions I approved, but even adding or removing a space would make browsers reject them. This ALSO means that I can expect parts of the site to break when WordPress updates, and I’ll need to manually re-approve it. WordPress is working on clearing out inline scripts, but not quickly. Finally, HSTS and redirection. HSTS is easy: add a single line in .htaccess, promising to keep using HTTPS for a year. As for redirection, it’s just a couple more lines of code… that didn’t work. Each time I tried, it broke the whole site. Digging deeper, I realized these lines could not go in .htaccess, and what’s more, I didn’t have access to the correct file. ## Where? I needed access to the Apache server configuration files. However, I was on shared hosting, and being able to mess with those files would mean I could mess with other people’s websites (and they could mess with mine). Understandably it wasn’t allowed. To do this one last little thing, I needed to move my entire website over to a whole new server, one under my control. On the plus side, it turns out that virtual private servers are cheaper than shared hosting, at least when you get the self-managed option. Pros of self-managed: I’m in full control, and no longer need to ask permission to change settings. Cons of self-managed: I’m in full control, and with great power comes great responsibility. Since I had already spent time configuring Apache settings, I picked a LAMP stack (the A stands for Apache) over LEMP (the E stands for Nginx). My hosting provider offered a one-click install, but that didn’t work so I installed it myself. I set up firewall rules, an https redirect, restricted accounts for each service, SSH access, SELinux, and various other security measures. After briefly confusing FTPS and SFTP, I bulk-uploaded the site’s contents. Aside: either guides have gotten better since 2014, or I’ve gotten better at following them, because everything ended up working as described. I did run into snags, but I was either able to work through them quickly enough, or I’d discover that there was a good reason it wasn’t allowed. I ended up with an aggressively basic setup, and I’m happy with that: basic means easy to verify. ## When? This Tuesday, I updated my DNS records to point to the new site. Several things immediately broke, most notably the CSS, due to URLs still pointing to the test version of the site. My Content Security Policy (CSP) specified that scripts and styles must be loaded from `'self'`, not some strange alternate-dimension version of `'self'` at a different web address. (It was the same thing, but browsers couldn’t verify that, so didn’t trust it.) I updated the site link in the WordPress dashboard and Apache config files, and things went back to normal. Then I encountered another issue: my hosting provider unexpectedly restored the site’s old DNS record, in addition to the new ones. This left visitors with a 4/5 chance of getting the correct site, but a 1/5 chance of being sent to the old one, which was now broken due to the same sort of URL issues described above. The reason this broke? Their nameservers were for shared hosting, and I wasn’t supposed to use them anymore. So I set up my own nameserver on the VPS. Now, when you connect to my site, your browser contacts my server for instructions on how to contact my server. Seems weird, but there are several guides for exactly this, so I suppose that’s just the world we live in. ## Is that all? First off, rude, this took over a week of research and work. Second, no, it’s not all. I have a short list of things still to do, and I’m sure there will be user-reported issues. I’ve already received one such report: apparently Run3.swf no longer works in the standalone Flash Projector. (Not sure how to debug this, sadly. If anyone has solid information on how the Flash Projector loads files, let me know!)

Attached: 3 images This month, I want to practice #Blender3D. My goal is to learn basic techniques and get faster at sculpting, so I'm going to make a simple model each day in June. To keep this from being a huge time commitment, I'll limit myself to about one hour per model, cutting all the corners I need to make that happen. Sometimes this may involve posting a model half-finished and coming back to it the next day. I'll think of it like a 3D sketch. To start off the month, I sculpted the Angel, copying his 2D sprite. This took at least two hours, maybe three. Whoops! 🙃​ #B3D #Sketch #SketchADay #Run3