If you live in a tiny bubble and only take an Uber to the Work Campus, Uber to the small number of marts you've found that accept card, Uber to the small number of restaurants that accept card... you have to find them first of course.

Want to buy some cigarettes while you take a stroll in the evening? Good luck. Want a tuktuk to take you a mile across the beautifully walkable road infrastructure? Good luck. Want to get lunch with friends? Good luck.

90% of life doesn't exist inside the corpo "work hotel sleep" bubble, I described it to somebody as akin to trying to pay with bank transfer in the UK, technically you can do it... the manager will come out and spend 20 mins futzing, taxi drivers may be able to do it if you ask nicely, your shopping options will be very limited and far between because you're trying to transact in the non-predominant medium.

Yes, loads of places accept card, larger stores accept card, want coffee? Blue Tokai accepts card. Want Blinkit or Zomato? You need an Indian number first. Want a Hotel? Booking.com is predominantly "pay at the hotel" across most of India, which means it's a dice roll as to whether they'll accept card. You'd be surprised at how many hotels completely forget that not all customers are Indian+Aadhaar+UPI, except by the time you've got there and realized they accept neither C-form nor Card despite telling you explicitly they do - you've already spent the time, money and effort getting there only to find out that no... it's not practical in reality for you to book a hotel and pay for whatever reason. Repeat ad-nauseum everywhere daily

Otherwise you're stuck with AliPay+ merchants (easy via Wise) or TAGTHAi which should still work but is expensive and sucks.

--

I forgot about https://p2p.me - they're taking the regulatory arbitrage 'personal travel payment concierge service' approach, basically "work around the problem, not with it" as the founders realized the people making the regulations neither know nor care about on-the-ground practicalities.

I see this often cited, but in reality it's a farce. "UPI is international" the staunch defender says, so I rebut "Yes, in one place at the Eiffel Tower... everywhere else? The French have no idea what UPI is, and your bank will charge you stupid FX fees for card payments".

Meanwhile if I'm in India, people look at me weirdly for paying with UPI yet most won't take card payments outside of tourist areas or it will get declined because foreign cards are blocked - and if you try to pay cash suddenly nobody has any change, will refuse to take the 20 rupee note they gave you yesterday, or have concerns about whether the notes you literally just withdrew from an ATM are legitimate - meaning you can end up with notes that are defacto unspendable despite being perfectly legal tender and in acceptable condition.

And as a tourist... you want UPI? There are a few ways but they're byzantine, apps locked to the Indian App Store (for tourists?), in-person KYC upon landing, very low first-payment limit, topup/signup and idle fees that push the net fee % easily into the 5-10% range.

Lets look at a perfect example... you pre-KYC on an app ahead of your trip on the one app that allows remote KYC, but you can't load money onto - first you must provide your visa, but the eVisa doesn't count they want the actual visa stamped in your passport. You land, immediately after customs you submit the picture of your visa stamp and wait an indeterminate amount of time, it could be 8 hours, or 24 or 48 or it could get rejected and you could be required to do in-person KYC (either you go to them, or they come to you within a ~5hr window... but only in the major cities).

So day 1 it's impossible to use UPI. It gets approved on day 2, you take a taxi somewhere maybe a nice restaurant, your UPI is now loaded with INR and you try to pay the driver... Your driver has a personal UPI account, you can't pay him! You only have cash... Large denomination INR notes because that's what the ATM provides, he doesn't take card and refused to admit he has change. You eat the already inflated cost and swear to only use app-based services (assuming the Taxi Mafia hasn't had them banned in your city).

You get to the resto and enjoy a meal with your friends, it's a nice place and somewhat expensive, you come to pay, the bill is reasonable and you think "I will pay with UPI", you try paying, it's a business account so should be OK! NO.... You have exceeded your first-day limit! Waiter tells you there is no card machine, and they have no change for cash...

Eventually you leave India, there's a non-trivial amount left in your tourist UPI account, you look for somewhere to withdraw it back to your card - no physical counters open at the airport, you request a withdrawal via the app... it never comes, the next month you get hit with a 500 INR inactivity fee, your visa expires and the app shuts down, next month 500 INR inactivity fee - can't make support requests through the app any more because your visa is no longer valid... Your balance slowly goes to 0 because you didn't think to spend every last rupee on your way out so it gets eaten by the system.

I say a small sub-1% fee on UPI is fine, it's great infrastructure when it works, but more needs to be done with global UPI integration. I have QR enabled payments available across maybe 10 different countries and India sticks out as being the one that's consistently an absolute pain and actively works against you.

Using UEFI SecureBoot + vTPM for cloud root-of-trust, a stack to prove what's released on github/gitlab is what's actually running on GCP/EC2 (and soon Azure & AliYun).

I was annoyed that so many companies in the Web3 space would do the on-chain theater of verified contracts and "audits" then 99% of their infra would be deployed on EC2 (or god forbid Vercel) in full un-ironic "Trust Me Bro" mode.

It's a different trust model from SGX/TDX, more pragmatic and hopefully easier/cheaper. Currently polishing off "Docker to verifiable cloud VM" stuff, and then gVisor support next.

Let me translate this for you:

> - Secure-by-design and secure-by-default must become standard practice – not an aspiration.

This means we will enforce censorship of many many topics, often broadly, even egregiously, and at the whims of whichever policy wig is trying to climb the ladder.

> - Resilience cannot depend on a single solution or technology. Defence in depth remains essential.

This means it will be wide sweeping policy applied to anything tangentially related to "AI" - pushing the compliance burden down onto everybody, luckily a small number of firms will profit massively from this due to regulatory capture.

> - As AI systems evolve, new and previously unknown vulnerabilities will emerge, including zero‑day vulnerabilities.

This means we're realizing that so much software is utter shite, instead of letting people fix it we will bury our heads in the sands and only allow approved government contractors access to models which can fix vulnerabilities (fixing them requires finding them too)

> The rapid pace of frontier AI development means cyber risk assumptions can become outdated in months, not years. We must act before and be prepared to adapt and withstand evolving threats.

This means "We're fucked, and we know it, this will be rushed through parliament and congress, basically the "AI Patriot Act" on steroids as a "temporary measure", to try and keep ahead of the curve.

It's a huge PITA in practice because whatever you want to run inside some enclave usually ends up being a 'normal program' that needs to talk TCP/IP over sockets... so your vsock I/O becomes a weird mix between a TUN proxy or a SOCKS5 local listener inside the VM that tunnels through vsock.

For example, I have the Windows NT 3.50 kernel compiling from scratch with virtio-net drivers, it's fairly straightforward for me to add a bus driver that runs over vsock inside Nitro Enclave that exposes itself (o,o) as a NIC then handle the tunneling logic in a usermode process in the host - but I don't uderstand the point of why you would do that when you already have sufficient attestation methods that don't require you to do vsock isolation.

On metal you would simply embed the URL and pubkey into the EFI loader binary (or a file on disk), put it into your ESP partition and reboot the machine. Typically the certificate DB of the machine would be reset with a single certificate that signed stage0 then switched into 'Deployed mode' so no new certificates can be added.

This separates the 'provision machine' phase from the 'machine boots and runs your latest release' phase. Although at this point we're booting UKIs so a Linux kernel + uefi stub + initramfs all in a single file.

[1]: https://wavebend.org/blog/2026-06-13-stage0-http-netboot/

And as I got older, I realized "I am not the customer, there is no money in responding to me, I am a net negative cost to your business".

And uhh... I'll shuffle the F out now then? And try and catch-up on 200 years of math.

I don't think anything has changed IRL, aside from my knees hurting

It's like dealing an angry grandpa throwing mud over your newly cleaned car, "You gotta start at the wheels lad, not the windows, do it again".

Great, now you've broken the flow, I have to re-do everything, figure out which tests to introduce in which order and unravel them all, ironically this is where I've found more bugs creeping in, because you're no longer diligent - you're appeasing performatively.

https://justine.lol/cosmopolitan/

The most recent example is I wanted a simple home security system with presence detection and a private control panel, none of the free ones hit my requirements, or require custom hardware, or lock you into a cloud, or assume you can spin-up some containers - or are super enterprise grade stuff.

Within about 2 days I had an android app for my tablet, Google FMDN integration, fingerprinting of my other devices, all controllable via Telegram from any of my phones with alerts that "just work" wherever I am and include an inline gif snapshot.

What I wanted didn't really exist as any individual product, so I absolutely see the appeal of DIY vibe-coded stuff, and a day of the build time was optimizing the OpenGL motion-detection pipeline with shaders & DMA which in itself was good to learn about.

A friend recently came across a project with no RLS and described it as "a once in a lifetime fuckup, a career defining moment, you could shitcan them but they wont learn how to fix it, either way they need adult oversight".

And once you find some dumb low-hanging fruit like that, you usually discover that the vibe-coded ignorance is fractal, especially with TypeScript projects where people assume that you define something in an interface with a given type that the user will always supply that - and your user will always be the app you wrote - and duck-typing doesn't exist.

Maybe worth scanning the various Android app stores? It's incredibly depressing.

I think we're talking apples vs oranges here.

Whereas now I almost exclusively eat set menus, thalis, nasi kandar etc. at small family run places and ask for extra rice, pickles and veg at little to no cost, and the staff end up getting to know me.

So most days it's "Oh... it's 8pm, I should eat now" and I'm done in half an hour without really thinking about it and somebody else handles the cooking, shopping & cleaning - sometimes I just sit down and look at my phone and food turns up.

As a weird benefit - I don't really drink alcohol any more. The craving and even desire is gone.

---

Re: food noise, it's irrational craving to fill the time, it's sugar, fats, salt. It is an addiction, a little devil on your shoulder going "IM HUNGRY!!! GO TO SHOP AND CONSUME" even when you're not. It's a choice I've had to make to regain more control, and I understand not everybody has the same relationship or brain so may not experience it the same.