What city name is shared by the capital of West Virginia and the largest city in South Carolina?

What Jane Austen title character has the last name Woodhouse?

What animal is called "cochon" in French and "cerdo" in Spanish?

Who has the Major League Baseball records for most home runs and most league MVP awards?

What Peacock TV series is named after the location of the Friday the 13th movie?

In what city is the Isabellla Stewart Gardner museum, site of a 1990 theft?

Who are two of the top five female artists with the most #1 Billboard hits?

What 1988 heist comedy earned an Academy Award for Kevin Kline?

What Nubian kingom had capitals in Kerma, Napata, and Meroë?

What color are Louboutin heels?

What team used to play in "The Igloo", but now plays in PPG Paints Arena?

Of what company was Elizabeth Holmes the CEO?

What "Waiting on the World to Change" singer has announced a residency in the Las Vegas Sphere?

What word for an online digital world was popularized by William Gibson in "Burning Chrome" and "Neuromancer" ?

What river flows from Lake Tanganyika and divides the cities Kinshasa and Brazzaville?

On what planet is Maxwell Montes?

What "Much Ado About Nothing" character says "I wonder that you will still be talking, Signior Benedick: nobody marks you." ?

What English scientist was an apprentice bookseller before discovering electromagnetic induction in 1831 ?

What brain structure shaped like a seahorse plays an important role in consolidating memory?

What is the correct spelling of a four-syllable word for a graveyard?

Who inspired a 1999 "costume" consisting of a sports bra and shorts when she celebrated a game-winning shot by removing her jersey?

What country celebrates Pangangaluluwa and Undás ?

What horror franchise mostly takes place in fictional Haddonfield, Illinois​​​​​​​?

On my street, a young woman and a girl around 11, walking toward me, speaking English:

Young woman: “... and then the bomb goes off, and everybody dies! Even the trees...”

No, OnePo isn't vulnerable to php2shell, in case you're wondering. I mention it because it made the NPR News Now hourly newscast this morning. That's pretty high-visibility stuff.

If you run WordPress or Drupal or anything built on PHP, make damn sure your host has updated PHP itself. Ask questions and follow up on this one.

I will not crow about this. I'm sure it'll be our turn at some point, some zero-day exploit in Ubuntu or Node.js. We do install system package updates automatically. But I am not the entire security division of Meta (for better or worse), and all that.

I'm not surprised, because of what's happening at work. We used to get hardly any security advisory reports on ApostropheCMS. That has been ramping up since last November. Last month we got 23. All of them valid, almost all of them unique. These all come from independent researchers, none of whom are actually using the CMS. It's just a good place to hunting for bugs with your AI agent: a big system without a lot of known vulnerabilities. Fortunately, the system motivates people to do the right thing and report these privately so they can take the credit after we publish the fix, and the CVE.

Obviously, I'm fighting fire with fire. Once a month, before release, a Claude Code skill evaluates all of the advisories and proposes patches. I review them (yes, really) and in some cases I'm able to simplify or point out something is just security theater. But, I'd be sunk without Claude Code in this situation.

I take on that job myself to keep my team from losing focus on building useful things.

Hugs to all the PHP people out there. Seriously.

I finally identified one of the songs from my first #peppy post!  It turns out not to be about death, but I won't take away any stars for that.

Awhile back I did a little work on a book cover for an old guy. A few weeks ago I got a very plausible invitation from his address inviting me to a book launch. I have another elderly friend who likes to send animated greeting cards which are harmless but mildly boring to download and view. The launch invitation had that kind of feel, the sort of thing an old person might think fun on the internet. But I felt a twitch of suspicion, just enough to email the man's stepson (the acquaintance who brought me the work) who looked into it and found that the old guy's email had been hacked and was sending out these very believable book launch notices that required a download and a sort of installation to view.

Just today I got an email sent from the office of a quirky weekly paper for which I'm the proofreader. Subject line "Office Westmount Independent shared ''New Proposal Policy'' with you" and attached a Google document "New Proposal Policy.pdf" which, when downloaded, was actually a .msi file.

The email didn't have a signature so it struck me as odd right away and I replied asking them what it was for. It wasn't beyond the bounds of possibility that they might want me to tackle the job in a different way. But the response was the real key to very nearly persuading me:

Hi Kate,

I hope you are well. I actually sent that.

You can find more about this proposal via the link below.

[...]

Use passcode: 047192 to access file after download

Let me know if you have any questions.

No signature, and the “I hope you are well” didn't sound like any of the three people I know at the office. But the editor I proof for tends to be terse and unforthcoming in a similar fashion.

I replied again saying I was not going to install this thing till I knew more.

I just got an actual email from the newspaper office saying their email had been hacked, not to click on any links, etc. etc.

But the sheer plausibility of these two scams is well beyond any Nigerian prince offering you millions. Be alert.

My three least-favorite parts of our trivia league are multiple-choice questions, toss-ups (random numbers), and the betting of up to 40 points on the last question.  Today my bet landed us in a three-way tie for first, and I didn't realize that we'd end up with another toss-up to resolve the tie.  It really does usually come down to all or nothing as the best bets.

What city is the home of Batman?

How many stars on the flag of China?

What creature has a hyperphagia contest in Katmai National Park?

What percentage of U.S. adults with ADHD were diagnosed as adults?

In what letter-shape does a chess knight move?

What Danish toy manufacturer recently promised not to use AI designs?

What Harry Belafonte song was involuntarily sung in  Beetlejuice ?

How much is the first-offence fine for physical contact with an official in the NFL?

What store changed their motto from "Always Low Prices" to "Save Money.  Live Better"?

What is the Italian name of mural painting on wet lime plaster?

What Aboriginal Australian wind instrument makes a droning sound?

What clothing and shoe brand is named after a kind of antelope?

What K-pop band's fans are called Blinks?

What company created an assistant called Clippy?

How many contestants out of 750 beat the Green Line train in a Boston race?

What 1994 film based on a Stephen King novella is #1 in the IMDB Top 250?

What 2026 film with a one-word title stars Anne Hathaway and Dakota Johnson?

In what pub does Harry Potter first taste butterbeer?  The Three Broomsticks, The Leaky Cauldron, or The Hog's Head?

What percentage of U.S. adults read at less than a 6th-grade level?

What British sketch comedy team considered silly walks and a dead parrot?

Whose final public performance was "Nessun Dorma" at the 2006 Olympics?

What German potato-and-egg casserole is also the name of a Dutch rum-and-egg drink?

What is the name of one of the two men who twice served as Continental Congress president?

At what age did Charles II of England die?

What is the first name of Fidel Castro's brother, who succeeded him as President of Cuba?

What brand of personal lubricant was invented for NASA to improve the heat transfer in the cooling system of the shuttle?

What French sculptor created The Thinker?

Who is the titular hero of a Babylonian epic poem about a king of Uruk?

What lake was created by flooding Glen Canyon on the Colorado River?

What city hosts the Tower of the Americas, built for the 1968 World's Fair?

What is the oldest Major League Baseball mascot, introduced in 1964?

What National Hockey League team plays in Little Caesars Arena?

What are the three types of sword used in fencing?

What was the original name of Caesar Augustus before he became emperor?

What word for a type of dog was the title of a 2010 FX comedy-drama about unlicensed private investigators?

What animal is the subject of a joke referenced in the title of a book by Lynne Truss: "Eats, Shoots & Leaves"?

"[What an LLM agent wants is] something that can only be deduced from its behaviors. Same with dolphins, humans, all animals."

Six, Waiting for Godot, Hadestown, Paranormal Activity, Maybe Happy Ending, Masquerade... this is getting to be a habit.

Always take advantage of Broadway Week. Don't listen to the naysayers who say they can't find the half-price tickets. Pay attention to the specific dates, performances and seats that are part of the promotion for each show.

Don't sit behind columns. Do sit in the front row of the mezzanine. Absolutely sit in the front row of the orchestra, which is occasionally cheaper due to a peripheral-but-amazing view. Often the rows are well-pitched to ensure a view for shorter patrons, but not always. Use A View From My Seat to avoid disappointment and spot surprisingly good options.

Eat reasonably and well at the Columbus Circle Underground Market if you don't have the time to walk further from the Times Square Neon Zone.

Save a ton with a matinee day trip. Amtrak is not as cheap as you'd hope. FlixBus and friends aren't bad, but by the time you make the connection and wait in traffic, your matinee day trip is ballooning to twelve hours, soooo consider just driving yourself.

Driving into Manhattan? Yes! There is no congestion fee on weekends, they want you to come! Always use SpotHero to reserve (yes, this is a thing) a parking garage within a few blocks of the theater well in advance. Navigate with Waze, and pay attention when it offers you routes that add 5 minutes and save $15 in tolls. You'll pay tolls no matter what, but it's still a lot cheaper than Amtrak for two.