Bear Blog Trending PostsModify

2025-08-15 10:47:28

There's something I love about opening a text-only webpage.

They're a refuge from the GDPR cookie banners, the trashy ads, the email opt-ins, and the god-forsaken auto-play video.

A text-only webpage is clean. It's readable. It's fast and it's simple.

The page is just made of text, so it's infinitely reproducible.

You can paste the whole thing into an email to a friend. You can put it in ChatGPT to ask questions.

Hell—you can post the whole thing on X and pretend you wrote it!

You can read it right there, or you can send it to Kindle, save it to Matter, or print it on real-life paper.

It's going to work everywhere because it's just text.

If you click on a link, it loads lightning fast. It doesn't need a CDN or to pre-load on hover.

Hosting text is so cheap it often doesn't have to be monetized. The entire website could be running off a Raspberry Pi.

When you're reading, you can skim if you're bored, and then slow down to a crawl when you want to savor the words. You never ever come out of a haze, guilty after reading text for hours.

So thank you to everybody who writes and publishes text-only webpages.

You've probably lost some engagement by keeping things so clean, but you're contributing to a simple, calm, and happier internet.

And I love it.

2025-08-14 23:49:00

There are some conversations I’d give anything to hear again. Not because I’ve forgotten the words, but because I want to feel the moment they were spoken: the air in the room, the weight in my chest, the way time seemed to slow down. The last one I had with my grandmother is etched into my memory with the kind of clarity that comes when you know you’re living a goodbye.

In August 2014, I flew halfway across the world to see her. Our visits were rare due to life, and distance, but she was rarely far from my thoughts. She was, without a doubt, one of my favorite human beings in this world. Outside of her declining health, she had recently took a tumble, and we knew we were running out of time. This particular trip wasn’t for catching up or eating my favorite home cooked meal by her... it was to say goodbye.

She was bedridden, not really speaking (/unable to), but her eyes followed me when I entered the room. She hadn’t spoken in a while, so I filled the silence for both of us, speaking to her in my broken Tagalog. I told her she mattered to me. I told her I loved her. I needed her to know that, even if I had to be the only voice in the room.

On the last day of my trip, I sat beside her, held her hand, and told her that I loved her once more. We both knew, without needing to say it, that this was the final time we’d see each other. And then, in a voice that hadn’t been heard for a long time, she whispered back that she loved me too. Just four words, but they reached me in a way nothing else ever could.

She passed away the following March, but that moment for me has lived on. It’s been 12 years since I last saw her, shorter since I lost her... and yet, in some ways, the pain is still a little bit fresh. Recently, a photo from that visit surfaced in my "On This Day" memories. Seeing it pulled me right back into that room. I remember the quiet, the closeness, the gravity of knowing we were nearing the end of our time together.

Since her passing, I’ve carried her words with me in a different way: tattooed on my wrist, in her own handwriting... a simple “I love you.” When loneliness creeps in, I glance down to look at it. It’s a reminder that the quiet love we shared didn’t end in that last visit in 2014. It’s here, in my skin... in my heart, replaying every time I need to hear it¹.

🕊 In remembrance of my grandmother, my lola, MCC (1924-2015).

Reply by email

2025-08-14 00:09:00

When you are younger, it is almost suspiciously easy to make friends. You sit next to someone in school, or you both get assigned to the same team for kickball, and suddenly you are inseparable. There is no scheduling, no “let’s find a time that works,” no weighing how much social energy you have left for the week. You just... hang out.

As an adult, most new friendships come from work. You see the same people every day, go to team lunches together, complain about the meeting that should've been an email, and before you know it, you have formed some sort of friendship. But when you work from home full time, that pipeline basically dries up. Unless you are ready to take a random hobby class, join a running club, or walk up to a stranger in a bar¹ and say hello, you are left wondering where exactly these magical “new friends” are supposed to appear from.

The thing is, adulthood changes the friendship equation. Schedules are full. People move. Everyone’s calendar is already some sort of Tetris game of work deadlines, family obligations, partners, kids, and hobbies. You are essentially asking two people to merge two complicated calendars just to grab dinner. Even if you manage to pull it off, there is that silent pressure to make the hangout worth it, because you might not see each other again until the next fiscal quarter.

Then there is the weird limbo of casual acquaintances. You like each other enough to say “We should meet up!” every time you run into each other, but somehow a date never gets set. Months pass. You keep liking each other’s posts on social media, quietly maintaining this digital version of friendship without actually hanging out in real life.

But here’s the thing... The friendships that survive adulthood’s chaos are almost always worth the effort. You are not friends because you sit in the same classroom or live on the same block. You are friends because you made the decision to invest in each other despite all the other demands on your time.

Yes, making new friends as an adult is hard. I have been struggling with it, and the friends I have managed to keep have told me they are struggling too.

How are you making friends?

♾️ Related: Outgrowing Friendships

Reply by email

2025-08-13 17:25:00

This is part 3 of a 3 part series on digital hygiene. I suggest starting at part 1.

Whenever I watch heist movies, I always roll my eyes at the "hacker" character. They can consistently hack building's camera system; or download the contents of a target's phone for use later in the heist. They also manage to hack the bank, which questions the need for a heist in the first place.

While there are real-world programatic attack vectors that can be exploited, they're generally opportunistic. When a new vulnerability has been discovered, nefarious actors try to exploit it at scale before it’s patched. The chances of finding and executing a "hack" on the spot (via bluetooth or something equally ridiculous) is highly unlikely.

Although, I digress. The most common vulnerability is significantly more boring. It's compromised passwords. These can be stolen through social engineering, like phishing, that exposes account details; but it's also likely exposed through a data leak, where a service hasn't stored passwords securely, and thousands of email+password pairs are stolen. These authentication details are then systematically tested on a bunch of other services in the hopes that some people have re-used their passwords, and thereby gain control over those accounts.

And that brings me to the topic of today's post: Password hygiene.

Leaked or stolen passwords are by far the most effective way to hack an account. And so it is imperative that everyone who uses the internet, which accounts for 93% of people in the developed world, to spend some time ensuring that their accounts and login information are secure.

On Bear Blog, the blogging platform I run, it is interesting to see the frequency with which the Forgot Password flow is used. This is a pretty good indication of the number of people who do not store their passwords properly, since it should never be the case that you've forgotten your password. You should never have to remember your passwords in the first place.

I wonder how many work hours are lost globally due to people following the forgot password flow.

I have hundreds of accounts online, everything from my bank, to a free tool for converting ebooks. If I don't reuse any passwords (which I don't, see above) I'll have hundreds of email+password pairs. I certainly can't remember hundreds of different passwords and match them to the relevant services; and outside of a small subset of people, neither can anyone else.

Before I saw the light and started using a password manager, I used to use a password cipher of my own design. I'd take a string of letters, symbols, and numbers, say !xlk-bd15j-hjk, then replace a certain character with the first letter of the service I was accessing. So for example, if I was trying to access Amazon and the character I'd replace was the 6th one, the password for that service would be !xlk-ad15j-hjk.

This setup isn't very secure (but it is still better than using the same password everywhere). It works until it doesn't. The first issue I ran into with this is that some services had extra password requirements like needing at least one capital letter or a number. The second issue is that this leads to password re-use for all services with the same starting character in their name. And finally, some services do require that you change your password regularly (more on that later), so I'd have to remember which accounts had updated passwords, generally by adding a 1 at the end of it.

It is possible to get extra creative with this, and I did for a while, running a bash script to generate passwords on the fly by taking in the name of the service and hashing it. A storage-less password manager, if you will. But this turned out to be pretty inconvenient, especially since this is a solved problem.

Enter the password manager.

Keeping passwords and 2FA recovery codes safe is easy, you just need to decide on a tool, and stick with it.

There are lots of great password managers out there like Dashlane, 1Password, or Bitwarden. I'm quite partial to Apple's built-in password manager because it syncs between my devices and integrates seamlessly with Apple's biometric authentication, making every login a simple fingerprint scan.

Once you've chosen a password manager, you set a master password. This is the most important password so it is never to be forgotten or written down. I find using a passphrase is both higher entropy, and easier to remember than a password. Here's a classic XKCD comic explaining password entropy.

Now, every time you log into a service or use the forgot password flow, ensure that you put the password into your password manager, or generate a brand new password using the password manager's built-in generator. You'll only need to do this once per service, and from then on you can use the password manager to login to that service. Another reason I like Apple's password ecosystem is that a lot of this is done by default, without having to manually copy and paste passwords. Password managers do have browser extensions and mobile apps to make this easier across devices. Use them.

Your password manager will also generally alert you of password re-use. If the password has been used multiple times, I'd recommend going and updating all of the accounts. The best way to think about this is that at some point the password will be leaked. Which accounts are you comfortable having compromised? Naturally something like banking or email needs to be updated as a priority, but if it's for a background removal tool...actually, still update it. Why not?

Let's talk about 2-factor authentication (2FA), also known as multi-factor authentication (MFA). While there is a slight difference between 2FA and MFA (hint: it's the number of factors), I'll be using them interchangeably here.

MFA is a security measure to prevent access to an account where the login details have been compromised. Generally if you have good password hygiene and are vigilant about phishing attacks, this is unlikely. However, for high priority accounts it is a necessary security step.

SMS 2FA tends to get a lot of hate, justifiably, due to sim-swap attacks. However, the reason many retail services (like banks) still use SMS instead of TOTP authentication is due to retail customers not having good recovery code storage and backup. If you use Google Authenticator or a similar tool, and do not back up your codes, losing your device is an effective way to lock yourself out of your account. Banks rely on the assumption that you'll reclaim your mobile number, whereas the same cannot be said about lost TOTP recovery codes.

That all being said, if you have the option to use a TOTP authentication code instead of SMS or email 2FA, I highly recommend you do that. You'll just need to ensure you've backed up your recovery codes.

I'm going to say something quite controversial here: I think it's okay to back up your recovery codes in your password manager.

While it does mean that if your password manager is compromised, then all of your accounts (including the ones protected by MFA) are exposed, MFA is generally there to protect against compromised login details and not against a compromised password manager. If your password manager is hacked...I'm sorry. You're going to have a tough time.

At the end of the day, the best tools are the tools you use. I like how Apple's 2FA codes also populate with biometric authentication, removing the need for me to go and find my phone (which I generally leave in another room while I'm working).

Some side notes:

• Changing passwords regularly, especially as a requirement, leads to worse and not better security. Mostly because users don't use password managers correctly, and end up defaulting to a rotation of memorised passwords. The act of changing a password is also a well known phishing attack vector.
• Ensure you take a regular (encrypted!) backups of your passwords to store offsite, just in case you lose access to your password manager, however unlikely.
• Hardware authentication devices are neat, but most people don't work on systems important enough to warrant that level of security. There will always be a trade-off between usability and security, and more security isn't always better. I once misplaced a Yubikey and all of the accounts I used it on had TOTP authentication as a redundancy, so I guess it didn't add much extra security?
• Developers, please stop logging people out of their accounts! There is very little to gain from having short sessions. It's annoying and leads to users forgetting and needing to recover their passwords more often.

As frustrating as it is, it's up to us developers to account for human folly and bad password hygiene. I'd love to create a webservice that only has a username and password with no need for an email address. But I know that I'll receive regular emails asking about account recovery due to a lost or forgotten password.

tldr; Get a password manager, and use it exclusively. Don't try to remember passwords. It's easier and more secure this way. Having good password hygiene makes you significantly less likely to wake up one day with your bank account drained.

As the old joke goes: If you're running away from a bear, you don't need to be faster than a bear, just faster than everyone else.

2025-08-13 05:25:00

Heya! So, as you might know, I've been using gmail since starting this blog. Honestly, the reason for that was just pure lazyness. I have the gmail app on my phone and can't uninstall it because it came with the thing. I know, it kinda sucks. Anyways, thats why I was using gmail. I've been meaning to switch for a while because its really really not great to voluntarily give google more data. I've been too lazy to do that for a while now, but today I actually sat down and pulled the trigger.

You can now reach me at [email protected]!
I know, fancy custom email.
I will still check my old gmail ocassionally and try and see if i cant get all mails auto forwarded from there to my new adress. We'll see.
Anyways, thanks for reading!

2025-08-13 04:15:00

Though I hope to post about literally anything else moving forward, I think it's only fitting that the beginning of a new era for me start by paying respects to the prior one. Paladins was so many things to me: a formative video game, my first solo CM job, my first design role, and above all the outlet for my passion. Every day working at Evil Mojo was one spent pouring who I was and wanted to be into this misunderstood gem of a project.

From the moment I started my internship at HiRez, I had begged to be placed on Paladins. It's not that I didn't enjoy SMITE or their other titles but instead was because I knew at my core it was the best fit. The community it had built over years of living at the most niche of intersections between fantasy, hero shooters, and build crafting spoke both to my personal taste as well as my fledgling queerness. It took over 6 months and came only out of the first of many layoffs, but I eventually got my shot.

I came onto the team at a very tumultuous time, internally and externally. The yearly tentpole update was mid-announce, the community had lost their CM over a month ago, and my first task was to spin down a creator program. To this day, I'm not sure how large a role my own skill played versus the amount of luck needed to survive that moment (in reality, it's always both). Over the first few months, I would have to prove to the player base that I was cut out for the responsibility while also working internally to mend a rift between CM and the development team. Everyone pitied my position, thinking Paladins was basically already on death's door, a potential reality I chose to ignore as all it did was serve to distract.

I worked with every single discipline to ensure player concerns were known and in turn that we communicated them in a way that started to see sentiment improve and more importantly the people behind the game being seen. Paladins was Evil Mojo, its culture and identities directly informed the game it had become. By leaning into who we were and the existing internal belief that the team was unique, we achieved a level of success thought impossible a year prior.

The Anniversary Update was something the team nearly didn't do, but myself and several others pitched it as a core part of our plan. We needed to make Paladins and the act of playing it something to be proud of again. I'm still hugely grateful to everyone on the team who backed us and admittedly overly-crunched ourselves to ship it...which made the fact that another set of layoffs happened a week later only sting more.

It's in that moment of falling from grace yet again, this time harder and as a part of the team itself, that I understood why everyone else involved from developers to players felt the way they did. This was Paladins' history. A constant battle between success that defied all odds and tragedy either within or existential that tore it all down. It was an echo of the general strife the entire industry was going through, but for us a painfully familiar circumstance.

We would never reach Anniversary again. However, once again I couldn't let that likely outcome decide how I moved forward. I took on more responsibility, I started working directly with the design team, I took the lead of narrative. It was an insane opportunity that I couldn't ignore and though many would think it not worthwhile, that's exactly why I felt they needed to be shown love.

Even as things continued to get rougher and the team fought for any chance at a more secure future, I fought on the frontlines as well as our defenses. I was promoted to a designer while still maintaining my CM workload, a fact that made most of my peers shudder on my behalf. I wrote over a dozen flash fictions, designed countless modes and ended up finally giving in and doing game balance (I fought to avoid it for several months to not mix CM/Design too heavily). Others on the team took similar multifaceted roles, either equally as dedicated or insane as myself.

This entire time, we had to project our confidence in Paladins. Every week, it felt like there was some discussion in the community that was about "the final straw" that buries us, and even in moments where we feared the same I had to pull myself together and be the first step into the future I wanted. Nothing ever lasts forever, but that doesn't mean you give up on it.

Our team was a skeleton crew refusing to lose our flourish, a dying star destined to go out in a beautiful supernova. When the final layoff came, it was met with us begging that they still ship what we had been working on yesterday. Even after we had been whittled down and beaten, our final concerns were not ourselves but making Paladins the best we could.

That's what made Evil Mojo so special. I've never known a group of people so willing to go out of their way to try and make something better absent praise...in fact, we often got met with hatred for our effort. None of that mattered in the little moments: when a new player would try the game and been shocked how much they missed out, community members who would discover who they were through our Champions and stories, creators who would lead events for charity with us as a headlining title. We loved Paladins more than I ever could convey.

Evil Mojo is gone, and Paladins will never be what it was again. I have hopes it will live on through community preservation and HiRez's recent track record of keeping games up as long as feasible. I wish my work wasn't so likely to fade into history, however that's a deeper industry problem. All this was to say...I don't regret a moment of it all. The pain, the stress, the fighting to exist that often left me exhausted in bed. We gave a game with hundreds of thousands of fans extra years on its life, memories that cannot be taken away from us.

The story of Paladins and Evil Mojo is exactly why I wanted to start this blog. Its spirit was that of finding hope even in the darkest of times, believing that no moment is in vain if it ends up making someone smile. Even if that era is over, that's a part of my identity I never want to lose. I would often tell team members of my optimism: "It's not that everything isn't going wrong, it's that there's something we can get right." As long as there are ways to make the world a better place, I'll be damned if I'm not there making it so.