Blog

2026-08-10 / tags: projects, security, quick reads, sidebar updates, ai, housekeeping

Scenes from my inbox over the past month:

July 10th: [Constance Bello's Blog] Your site has been updated to WordPress 7.0.1
July 17th: [Constance Bello's Blog] Your site has been updated to WordPress 7.0.2
August 6th: [Constance Bello's Blog] Your site has been updated to WordPress 7.0.3

I had my blog running on a managed WordPress site run by May First, a technology cooperative I'm a member of – and their staff have been busy. I'm far from the only person having to deal with frequent updates for my software of late. And WordPress is far from the only affected software. Though 7.0.1 was a maintenance release to follow up on non-security bugs from 7.0 a month and a half prior, 7.0.2 and 7.0.3 fixed critical- and high-severity security bugs that are being discovered at a rapid clip thanks to advances in frontier LLM capability combined with more and more researchers pointing them at software projects, intentionally or not^[1]. You may have noticed that your operating system, web browser, or other important software has been needing updates more than usual lately – this is why.
The most secure code is the code that never runs, so I've decided to switch to a static site generator-based website. Instead of a WordPress process running on a server at all times to give you access to my posts, this setup spits out a folder that contains static files that make up the website, which can be served by a variety of service providers and HTTP servers with ease. This trades off a bit of functionality for users (like the ability to comment on posts and subscribe to a mailing list without going to another website) with lots of upside for all parties (better security and a more privacy-respecting posture for users, and the same for me, plus less maintenance overhead and more customizability). If you're interested in all the gory details, I might put out a technical writeup at some point, but for now feel free to look at a mirror of the code.

Personally, my life has been a hot mess the past couple months, between moving (twice... ask me about my Airbnb experience when I was between apartments) and continuing to look for work. I've only recently had time to settle back into projects and getting back to the blog was on top of the proverbial priority queue. I'm bundling that with an update to my #branding; that logo in the top left of the screen^[2] is also in my wallet now!

I'm looking forward to giving some of these out at the New Yorker Hotel, where I'll be next weekend for HOPE!

And, as per usual, sidebar additions:

• The Casual Finance YouTube channel tackles the AI bubble from an economics perspective, explaining how fucked everything is in the ✨capital markets✨ that allocate resources in the systems we exist within.
• Simon Willison's Weblog has lots of insights on the day-to-day use of LLMs for software engineering. I resisted for a long time, but I finally bit the bullet and started using LLMs in a very limited way for my projects, with Zed's built-in AI features hooked up to Ollama running models locally. This way, I won't need to worry about what might happen to my model access when the bottom falls out from under OpenAI and Anthropic, since I'm not using any of their tech anyway, and by using open weight models I'm not propping up their business model predicated on extraction.

Until next time, friends...

2026-06-25 / updated 2026-06-25 / tags: ai, anthropic, openai, spacex, quick reads

Elon Musk (SpaceX), Sam Altman (OpenAI), Dario Amodei (Anthropic), and a whole bunch of their buddies in and around the billionaires club are in the final stages of pulling the rug. The AI bubble has worked like every other bubble has: convince a lot of people that something is worth way more than its actual value; rake in a lot of money promising unlimited future growth; and make sure someone else holds the Beanie Babies before everyone realizes they're not going to autonomously cure cancer or end civilization.

If your bubble gets big enough, and you have enough insiders in on the racket, then you get to [rewrite the rules to the Nasdaq index](rewrite the rules to the Nasdaq index) to force passive investors to buy those shares of a company from the egomaniacal grifter who brought us the wildly successful Hyperloop whose official stance on its path to profitability is "we are going to launch data centers into space".

Uh huh. Sure.

A lot of people have been suckered into believing that this technology is as revolutionary as the three men I named at the beginning of the post, and countless AI boosters on LinkedIn, are claiming. Well, sure, if you can get past the fact that the AI companies have been navigating diminishing returns for nearly two years already, they've started charging you to use the models based on how much they actually cost to run, and as a result everyone is flipping out about how much money they're lighting on fire. The simple fact is that the fundamentals are not there.

Speaking as someone who worked at a financial firm: Wall Street does not know better than you. They are being conned like every other C-suite exec that gets a call from an OpenAI or Anthropic rep, getting pitched a miraculous technology that replaces 90% of their workers (who they'd love to fire and keep all that sweet, sweet salary money for themselves), and is accurate enough to increase the business' productivity. Meanwhile, actual, real businesses that invest heavily in AI just end up wasting more and more of their own resources trying to justify the sunk cost, and on and on it goes.

People want to believe the hype and bury their heads in the sand. This has proven throughout history to be a wildly ineffective strategy for accomplishing anything other than getting run over. We must be clear eyed about what is coming, and prepare and protect ourselves to the extent possible, dominant narratives of "too big to fail" be damned. Right now, in my humble opinion, one important piece of that is being very careful and thorough about zeroing out exposure to SpaceX (and, when they IPO, OpenAI and Anthropic) stock, including via funds that hold shares in those companies, and minimizing exposure to the tech sector more broadly.

Large language model technology is useful. It is interesting. It is categorically not useful and interesting enough to warrant OpenAI, Anthropic, and SpaceX to be currently valued at what is likely upwards of $5 trillion combined^[1], a number I expect to show a further rise before a precipitous crash. We are all going to suffer when that basic truth can no longer be avoided. A sinking tide lowers all boats; make your plans accordingly.

Update 6/25/2026: I got feedback on this post that inspired me to add some clarification. I do not mean to say that anyone should sell all their stocks and hold cash, which is also called "timing the market" and "a bad idea". What I am saying is that it makes sense for folks to consider reallocating their equity holdings to funds that track a different index, like the S&P 500. In a retirement account, selling holdings is not a taxable event, but in a regular brokerage account it is, so keep that in mind as well. At the end of the day, I am not a financial advisor or fiduciary, just someone who can see the cracks crawling up the foundation. If you have someone to help you navigate your personal financial situation, absolutely trust them over me with those matters.

2026-06-11 / updated 2026-06-17 / tags: privacy, projects, quick reads, sidebar updates

Advertising. None of us ever agreed to it. We all hate it. Yet since the Internet established itself as the most dominant technological force since electrical grids, advertising has managed to thrust its tendrils into every possible space you could think of, and many, many more you couldn't. Far from a benign infection, its negative effects on people are thorough and wide-ranging.
If you've ever signed up for a hot new app for selling your used clothes, a multiplayer online role-playing game, or any connected service in between, you were asked for some information. Username, date of birth, email address, and often even more identifying info is demanded as the price of entry. Culturally, we are so used to giving up this information over the Internet that we do it without hesitation. Besides, what else are we going to do – lie?
Well, yes, we're going to lie. Introducing identity-spinner.

identity-spinner is a really simple tool designed for lying. More specifically, it takes info from reliable data sources and uses it to generate realistic data for fake people to be given to online services for account signups. Or for anything you want, really!^[1] The README will give you a rundown of exactly where that information is sourced, and the top of it links to the live app where you can experiment.
As is written in that document (and copied to a slot in the app itself), information gathered by advertisers from your devices can reveal a lot about you. Here's some examples of where that information ends up...

• Target figured out a teenager was pregnant before her dad did, sending her coupons for baby clothes.
• Chatrie v. United States, currently being considered by the Supreme Court, has massive implications for whether geofence warrants violate the 4th Amendment. In this case, a criminal conviction was secured on the basis of information found when law enforcement demanded Google fork over info on anyone whose phone reported being near the crime scene around the time it occurred.
• ICE bought access to a tool that tracks location data from hundreds of millions of phones many times a day. If you thought that adtech data collection wasn't a serious and potentially life-threatening concern when you opened this blog post, hopefully these three examples have shown that the impacts of data leakage are real, physical, and sometimes brutal.
  But here's the neat part: A lot of that data is voluntarily given. We can still push back against the normalization of giving away our data. I created identity-spinner because I knew all of this bad stuff was happening and wanted to be more secure with my online activity, but coming up with new names, usernames, and birthdays on the spot is hard, since humans aren't random.
  From what I know of all the people who don't get so far as setting up a password manager, most folks find keeping themselves secure to be more trouble than it's worth. I really want to lower the barrier to entry and make myself and everyone around me as secure as possible with as little pain as possible, and education (like this blog post) and tooling (like identity-spinner) are two main angles I'm approaching it with.
  I've been working on this a bit and have some more features coming down the pike, with a focus on things that are actually useful, like more types of personal info and being able to load the app offline. In the meantime, I'm very curious to hear your thoughts... from whatever moniker!

I would be remiss if I didn't mention that I've added 404 Media to my sidebar^[2]. Their journalism has inspired much of my strategizing and they deserve lots more attention and praise than they get right now. If you have the means, consider joining their paid subscription, which gets you lots of cool perks like access to their "FOIA Forum" on top of unrestricted viewing of some of their biggest stories.

Note 6/17/2026: This post initially stated the conviction related to the Chatrie v. United States suit was related to a "violent crime", which is a mischaracterization. I have corrected the error and sincerely apologize for framing the incident as such.

2026-06-06 / tags: big tech, meta, quick reads, rants, social movements

Note: This post is primarily aimed at participants in social movements.

I'm really tired of people thinking that posting their events, news, and writing only on Instagram and nowhere else is acceptable. It makes me angry. More importantly, it only includes that grouping of people who are both in Meta's good graces and actively choose to use their services.
Guess who can't fit in there? Mad people and all those who choose to prioritize their emotional and mental wellness over participation in the attention economy. Radicals whose speech has gotten them banned from the platform. And anyone who isn't interested in giving Meta personally identifiable information like an email address, phone number, and their behavioral data.
There are so many other options to disseminate information over the Internet and otherwise, and organizers are too comfortable ignoring the masses of people that can only be reached in other spaces in favor of what's easy and comfortable.
I happen to be in a position in my life where I have a lot of free time that I would love to spend going to community events and participating in building that I am not invited to because I choose to care for my Mad crip bodymind by not bending over backwards to get a second phone number to use for the billionaire-owned brain poison app.
I am not asking for people and orgs to move off of Instagram. I recognize that it is a powerful tool for outreach and engagement, and, in many ways, a necessary evil. I am, however, demanding that folks do the absolute bare minimum by publishing the details of your activity elsewhere as well. Or, alternatively, accept and sit with the fact that your allegiance to corporate social media as your only communications outlet is actively alienating people who want to build with you and, often, people you claim to be in solidarity with.
This post sponsored by my manic episode last year spurring me to stop using Instagram, which has considerably improved my overall wellbeing.

2026-05-14 / updated 2026-06-17 / tags: big tech, data sovereignty, github, microsoft, sidebar updates, ai

The open source software ecosystem collectively putting all its eggs in one basket may not have been the best decision.

I'm going to start with a brief timeline of events.
June 29, 2021: GitHub launches Copilot Technical Preview (Wayback Machine link).
June 30, 2022: The Software Freedom Conservancy launches their Give Up GitHub campaign, in response to GitHub and Microsoft's refusal to engage with critiques of their use of publicly available code uploaded to GitHub for training Copilot models regardless of how that code is licensed.
August 11, 2025: GitHub CEO Thomas Dohmke resigns, and Microsoft folds it into its CoreAI group, eliminating GitHub's independence from Microsoft management (paywalled link).
April 28, 2026: GitHub CTO Vlad Fedorov apologizes for serious issues GitHub had on April 23 and April 27 that brought usage to a complete halt twice in one week.
April 28, 2026: The same day, HashiCorp cofounder Mitchell Hashimoto says GitHub is "no longer a place for serious work" in his blog post announcing the migration of the Ghostty project to another hosted git platform. Damningly, the decision to migrate Ghostty was made before the April 27 outage.
May 4, 2026: dayswithoutgithubincident.com is posted to Hacker News. When I first saw it, it showed 0 days since last incident; as of writing, it shows 1. It's also got a neat little "High Score" widget, showing the longest streak of days in 2026 with no incidents (6, from April 2 to April 9).

You might notice a trend here, which is tied together by that word Cory Doctorow coined and I've included in the title of this post^[1]. Priorities undoubtedly changed for GitHub once they were acquired by Microsoft back in June 2018, first slowly, then quickly. The AI bubble has needed significant engineering effort to sustain itself, which Redmond was more than happy to allocate when GitHub was all upside; seemingly limitless access to training data for AI coding models, vendor lock-in for thousands upon thousands of widely used open source projects, and a breezy talent pipeline to push engineers from GitHub enthusiasts to Azure DevOps professionals.
So much for "embrace, extend, extinguish"; right now it looks more like GitHub has exploded and everyone else is sprinting away.
The downsides to the world's reliance on Silicon Valley for critical services are making themselves more and more apparent over time. When Karim Khan, a prosecutor at the International Criminal Court, was blocked from accessing Microsoft services following the Trump administration placing sanctions on the ICC, a lot of people all over the world took notice. Digital sovereignty isn't a pie-in-the-sky ideal anymore – for many organizations, it's a base requirement urgently needing to be met.
I recently came across this post entitled "Why I'm leaving GitHub for Forgejo" that makes a lot of salient points related to these topics. I encourage you to read it and come back here when you're done. I'll highlight a specific idea pointed out by the author, Jorijn Schrijvershof, that isn't getting enough airtime:

The reliability story is downstream of the AI story. GitHub is not slowing down on AI features. It is doubling down on them. The outages are what doubling-down looks like in production.

The AI bullshit is wrecking the actual reason people ever came to GitHub in the first place: to come together and make software. These sort of antics were telegraphed in 2018, but decision makers were not listening to pundits in comments sections ranting about how it's time to move off of GitHub. Those network effects are strong, and concerns about espionage, software supply chain attacks, and managerial trust that were voiced in HN comments didn't reach the ears of decision makers. Now that organizations' bottom lines are being hit, whether their attitudes will change remains to be seen, but it seems clear now that to know who will burn you tomorrow, you should investigate who smells smokey today.

Speaking of Cory Doctorow, my initial sidebar had some glaring omissions. These have been rectified, as I have now added:

• Pluralistic by Cory Doctorow
• Addie LaMarr on Instagram and YouTube
• Good Work by Dan Toomey and Morning Brew

I could say a lot about Cory Doctorow and how much he's influenced my thinking and action, and I likely will at many points as I get further into this blogging thing.
Addie LaMarr's YouTube channel contains plenty of useful resources for folks wanting to get up to speed on seeing past cybersecurity hype and getting to the real heart of the matter.
Good Work just won a few Webby awards for their disgusting(ly hilarious) videos drilling down into such topics as "why is oil still such a big deal?" and "what does {Meta,Palantir,Oracle} actually do?" Oh, and peptides. Being in New York, a lot of the tech industry happenings I interact with get exported from the Bay Area, so having Dan and co help me recognize that, no, I'm not insane, everything really is that ridiculous is super helpful.
While I've got my sights on Microsoft, maybe next time I could talk about their irresponsible security posture, evidenced by a newly revealed exploit that unlocks any BitLocker drive by copying some files to it. Until then...

Addendum 6/17/2026: It was reported two nights ago that Microsoft is now buying compute from Amazon to keep GitHub afloat. So much for GitHub being a strategic asset to acquire...

2026-05-09 / tags: housekeeping, sidebar updates

Hello, and welcome to my newfangled blog! Folks have been writing their thoughts in this format since time immemorial^[1] and I am standing on the shoulders of giants to take part in this tradition.
By way of introduction, my name is Constance Bello. I'm a rebel technologist with strong interests in privacy, security, and anonymity; the relationship between tech and disability justice; and how tech can be used for the interests of the people instead of the powerful. I'm also deeply invested in sharing what I know with others, building community, and meaningfully contributing to social movements. I am about to complete my B.S. in Computer Science at Fordham University.

I'm starting this blog at a crossroads in my life where I've realized that to take another step on the path I thought I was following would make no sense. I've put in a few thousand hours on writing software through the lifecycle: conception, development, shipping, and maintenance; and I only now have the qualifications most people expect in order to consider hiring a "new" software engineer without much professional experience, despite having much more practical experience than folks who might be newer to CS topics getting their degree at the same time.
At the same time, the job market for software engineers is abysmal. AI, or more accurately, the people promoting it for their own benefit, have come in and wrecked this industry (among plenty of others) in another brazen smash and grab attempt on the economy.
I interned at BlackRock in the summer of 2024 because I thought I needed a big paycheck to be okay in this life, and to get that I had to sacrifice my values. As someone who believes in egalitarianism, it stained my soul to show up to work every day at 50 Hudson Yards and work on an LLM chatbot. Since then, I've learned a lot about who I am, and what trade-offs are right for me to make.

I'm a rebel. I always have been. And I've always been able to identify what's a fad and what's real innovation. Right now, AI is at the end of tulip mania and the petals are falling quicker and quicker by the day^[2]. The real innovation in 2026? Jumping ship from Big Tech, decentralizing infrastructure, and getting ready for a world that'll be undergoing more and more rapid changes.
Being forthright and saying the things in this blog post is a professional risk for someone trying to break into the tech industry. You know what else is a risk for someone like that? Applying for job after job for months and month and months, burning down their resources and spirit. And I know more people in the tech industry – with established careers and polished résumés – in this position or in a precarious spot with their job than with stable work. I'm done trying to break into a burning house.

For a long time I've tried to keep my private beliefs and public persona separate. But part of me has been nagging at the idea that I need to shut up and collect my bread to get through. Is that really true? I am one of the best communicators I know, especially on technical topics. Every time I am in a technical space, and almost always in non-technical spaces, as soon as people find out what I know, they ask me for help with their questions. I have made myself available for that and been helpful to so many people that I've been slowly realizing that is where my potential lies. I can throw together code with the best of them – but I can explain how to use the tools, how they work, and how they will impact you like few people I know.
This is my pivot. I'm planning on fighting this fire that started with the tech industry and is burning the world. AI threatens natural resources like fresh water and green space more than any other computer workload, increases energy demands the same way, and it's all deployed by the powerful in the service of trying to wrest as much economic control as they can from what remains of middle class workers. Not to mention the social issues caused when people are convinced to speak to a chatbot instead of a therapist, or a "character" instead of a romantic partner. Fuck all that. I am very interested in how we, as individuals and as communities, can protect ourselves from this force, and I've been doing myself and the people around me a disservice by hiding. That ends today.

If you're similarly inclined, I would truly appreciate if you would consider subscribing to RSS updates from this blog. While I'm not totally sure what the frequency of posts will be at this point, you can expect some ranting, thoughts on privacy, security, anonymity, and my other interests, and highlights from the things I'm reading. I value citing my sources, and I have a sidebar with links to other resources I check out regularly on the blog home page; any time I add something new to it I'll write a post about it too.