Tris Sherliker

Red Lines

2025-11-02T00:00:00Z

I had a negotiation a while ago which very nearly derailed itself. I keep thinking back to what happened and what it tells me as a lawyer and a person. As lawyers, we’re usually advocating other people’s views. Our business is representing other people’s business, but sometimes it can be hard to keep track.

This was the settlement stage of a long-running dispute. The contract had gone back and forth several times, resulting in layered redline.⊕However a case begins, almost all of them end with drafting tweaks on an A4-shaped MSWord document trying to untangle the redline.

Redline-swapping is a nightmare if you don’t keep good track of your versioning, because it all blends together unless you take time to check the metadata for each revision. Worse, most law firms automatically strip out the metadata of all sent attachments out of caution, so it becomes verbal soup.⊕Version control was solved in software decades ago but it’s harder in law because (a) most lawyers are allergic to plain text and (b) it’s much, much easier to version collaboratively than it is when you’re adversarial.

In this case, we thought we were at the end. We’d decided to accept some of the less reasonable requests from the other side just to get the deal done, so we expected to be getting a signature back quickly. Couldn’t work out why it took so long to hear back. After chasing, we got another tangled version of the agreement, with comments this time:

The guy on the other side had clearly taken against some of the wording and committed several paragraphs in the margin to explain why it was blocking the deal, how unreasonable it was, and what awful people we were for having it in the draft in the first place.

A quick phonecall was enough to remind him that the wording came from his client, and we agreed with him. The deal was done within the day.

Putting scripts into $PATH

2026-03-22T00:00:00Z

Whenever I find myself doing a task for a third time, it’s probably going to come up again and probably worth writing a script to get it done faster when it does. This is a pretty common habit far from unique, but mine were beginning to get out of hand so I was interested to see Evan Hahn’s post about handling the cutter.

Ditching aliases

Instead of using aliases in bashrc (or in my case usually config.fish) for execution, Evan recommends adding basic scripts to a directory. You can then put that directory in your PATH The $PATH is the list of places where your system looks to find commands it’s being executed. This is different to the common (lowercase) “file path” showing where a file is found. and have the script execute right from your shell, while the directory is version controlled.

The effect is like a personal multitool that’s ready whenever you need it. Maybe obvious in hindsight but quite powerful in practice. Julia Evans also explains how to do this in a very clear way, covering lots of different cases.

I found the idea compelling and started using it straight away.

Doing the thing

I use fish shell (because it just works), so I can use the handy “do what you mean” built-inAlthough Julia Evans warns against this for a couple of reasons, including that it’s hard to undo. to do this:

~> fish_add_path (realpath ./script-path)

The (realpath …) function in the snippet above will be replaced by the full directory path. That will then be added to the PATH.

“Symlinks” is always the answer

One tweak to the setup I use is to have two folders:

/.../scripts for the scripts themselves, which is version controlled and
a subdirectory /.../scripts/script-path, which goes into the PATH.

⊕

scripts/
├── myscript.sh
├── .gitignore
└── script-path/
    └── myscript

script-path/ is gitignored and goes on $PATH; the scripts themselves stay under version control in the parent directory.

I can then use git to track the version control in the scripts directory, without needing to have a git history in my PATH (which feels like it could go wrong). So:

/.../scripts ~> mkdir script-path
/.../scripts ~> git init
/.../scripts ~> echo "script-path/" >> .gitignore

All that remains is to add the scripts themselves to the subdirectory. Rather than making copies of the various scripts, symlinks do the job cleanly. This way even when I update the main files, the symlinks still point where I want them to, and the files themselves remain under version control. Add scripts one at a timeThe first time, I did it in bulk. All my existing scripts were named with a .sh extension so in fish: ~> for sh_file in *.sh; set filename_without_extension (string split -r -m1 . $sh_file); ln -s (realpath $sh_file) ./script-path/$filename_without_extension; end with:

ln -s (realpath ./scripts/myscript.sh) ./script-path/myscript

And don’t forget to give all the script files executable permission with chmod +x filename.sh.

When was a webpage modified?

2026-05-02T00:00:00Z

Working out the date of a web page can be useful (especially for prior art in patent cases, and for evidence in litigation), but it can also be difficult. Most of the time a useful page has a date on it of some kind which may be reliable. For others the Wayback Machine helps perhaps about half the time but it hasn’t got perfect coverage. There’s another tool that can sometimesThis is mainly directed to static web content, i.e. content stored as files on a server. A lot of web content is generated dynamically and isn’t stored as files in the same way. help fill the gap.

The Last-Modified header

When you save or edit a file on your computer, the system logs a “last modified” timestamp recording the change. This is also true for a lot of web content.

When your browser requests a page online, it sends an HTTP request and the server’s response includes a set of HTTP headers, with extra information alongside the web content itself. This often includes a Last-Modified header, a time and date stamp recording when the content was last changed on the server. The Last-Modified header is used by web systems to detect whether something has changed since it was last fetched (e.g. for caching and archiving), but it is useful evidence of modification or publication date.

A response containing one looks like this:

Last-Modified: Tue, 15 Oct 2024 09:32:00 GMT

It isn’t always reliable and there are lots of reasons that a webpage’s date might show as more recent than it in fact is. Some servers set it accurately, others might be generating content dynamically at the server and set it to the current date and time; or it might record the last time the server’s cache was refreshed. But it’s a useful point of information, and usually broadly reliable in the same way as other computer timestamp information.

Checking for Last-Modified Timestamps

To view in Chrome:

Go the web page you’re interested in.
Press F12, opening the developer tools console. This allows viewing the normally-hidden metadata.
Choose the “Network” tab in the console.
Refresh the page (pressing F5), so the console can record the request and response traffic.
There will often be several files loaded (the web page itself; images; scripts etc): click on the one you’re interested in.
Look for the Last-Modified header.

Here’s an example for http://landley.net/history/mirror/collate/aa080499b.htm, which shows that the page was last-modified Tue, 28 May 2002 18:51:09 GMT

The Wayback Machine

When the Internet Archive’s Wayback Machine snapshots pages it also preserves the HTTP headers that it saw at the time (i.e. those which accompanied the original response to the Archive, at the time when it retrieved the page in question). This is labelled with X-Archive-Orig- or X-Orig- prefix for example:

X-Archive-Orig-Last-Modified: Tue, 15 Oct 2024 09:32:00 GMT

To find these, load the archived version of the page on web.archive.org, then open DevTools and inspect the response headers as above. Look for any header beginning X-Archive-Orig-. This can help to establish a sequence of edits (or that there were no edits) between snapshot date and the present.

Vibecoding a simple feature with Claude

2026-05-09T00:00:00Z

My side project has been entirely handcoded in the backend, until today. I’ve used Claude Code a great deal for frontend work — I am no web designer — but I’ve tended my backend carefully with my own hands.In fact using my hands is part of the point, being effective rehab while recovering from an injury. Today I decided to break that habit and try adding a feature using Claude to generate all the code edits.

BunTool (git) is for making PDF bundles for use in court and legal settings, and one feature requested by a colleague (who absolutely knows what she is talking about and should be listened to) was the ability to add a custom coversheet. That’s a great test case, because the feature is easy to conceptualise and express, it touches multiple points in the bundle-making pipeline from frontend to output, and because I can hold the logic in my head from beginning to end for checking purposes.

Framework

Also a good chance to test a new (to me) claude.md variant. I heard from a friend today that Forrest Chang’s Karpathy-Inspired Claude Code Guidelines was usefulDescribed as “A single CLAUDE.md file to improve Claude Code behavior, derived from Andrej Karpathy’s observations on LLM coding pitfalls.” I’ve used Claude enough in the past that I think I’ll be able to spot differences, though this is a slightly different exercise., so I installed it as a plugin before I got started. This was pretty easy using claude’s inline plugin management commands.

Specifying

I decided to work from a markdown checklist and iterate through the steps one by one, so I started by planning out my spec for the feature:

# Adding coversheet checklist

## Backend

- [ ] buntoolconfig.js - add bool option
- [ ] validate cover page function: check file = 1 page or extract first page, return first page
- [ ] Add validation call in buntoolMain.js
- [ ] at 3/11 in buntoolMain.js Creation of TOC entries, page numbers +1 if coversheet
- [ ] at 5/11 buntoolMain.js (generating TOC pages) page number needs to respect toc entries setting if coversheet present (just check carries through)
- [ ] After current step 7/11 buntoolMain.js (add new step before current step 8, after toc is merged), the result of the step7 merge should then be merged again with coversheet
- [ ] the abbreviated justtheeindex flow in buntoolMain.js should merge with coversheet


## frontend

- [ ] Button to add optional coversheet
- [ ] call validate function at point of upload (belt and braces)
- [ ] show selected filename
- [ ] clear/remove button
- [ ] error handling for invalid file
- [ ] submit logic to accommodate coversheet as parameter coversheetFile
- [ ] add mention in tutorial

This is spec’d by reference to the logic flow in my buntoolMain.js main logic flow, but those steps in turn call out to various submodules.

Step by step

Setting Claude to ask-before-edits gave me peace of mind, and then I prompted it to follow stepwise ("ok let’s do the coversheet adding plan step by step. start with step 1: show me your proposed edits"). Baby steps from the interface within VSCode:

Claude politely making edits without fluff

And so it proceeded.

Overall it went very well. There were a few nits and irritations though:

Claude often used variable names which were fine in isolation but which were confusing in their overall context. For example coversheetFile and coversheetPDF were two different but closely connected things, one derived from the other, both the same type. I much preferred names that conveyed the functions - coversheetFile and validatedCoversheet. It would have been annoying to come back to maintain the confusing variables in future.
Without Forrest Chang’s plugin, Claude just loved haphazardly deleting my comments. I’m sure that some people would do the same, but I put them there for a reason! I found the plugin helped with this, suppressing unwanted edits.
Although it had no respect for my comments, it seemed to find the logging prints unassailable. They count up stepwise in the main pipeline ("step 4/11" etc), so a sed call or two was needed to update them globally as new pipeline steps were added.Using sed is quite boring. Luckily Claude could also save me all the typing.
In some cases it got the logical flow of steps out of order. That’s fine, this is why I monitor and could correct it. Somewhat sassily it reacted to that by amending my spec to hyperclarify… even after the edit was finished!

So I ended up being quite hands-on and I couldn’t surrender control entirely. Having said that, if I weren’t using Claude for maintaining my own stuff a lot of this wouldn’t matter a jot.

I let the LLM have the satisfaction of checking things off its list, and it took the opportunity for some sassy backchat.

At one point while testing I found quite a subtle bug with hyperlinking, which took a while to solve because it seemed to be only intermittently reproduciblea sort of Heisenbug, since trying to debug it with my preferred PDF viewers (which give richer control than a browser viewer) led to a different experience.. This was very annoying but I eventually worked out that it was due to relying on undefined behaviour being handled in a certain way. This wasn’t Claude’s fault, but Claude confidently proposed a fix that broke things much more acutely. I fixed it by hand in the end.

Overall?

But I didn’t get the most out of it because I’m apparently very stuffy about edits to my own handcoded work. It wasn’t quite as smooth as I hoped, but that was partly because I was so opinionated about how things should look that I tended to want to micromanage the result anyway.

In the frontend I’m perfectly happy to deploy UI features via Claude, and I went on to depend on it for an autosave feature which worked entirely in frontend. I suppose the different level of caution is appropriate.

Cloudflare cache frustration

2026-05-10T00:00:00Z

There are only two hard things in Computer Science: cache invalidation and naming things.

Phil Karlton

I spent most of today debugging a senseless error.

This morning’s flight of BunTool emails included a suggestion to include compatibility for Times New Roman and Arial fonts. That’s a great idea because some tribunals specify font typesIn fact it’s a minor access to justice issue that courts require people to use proprietary fonts, but probably not a deliberate one. Most people seem to think of TNR and Arial as being generic and free, even if that’s wrong. Fair enough given their prevalence and the hyper-niche nuance of font IP law. and the plumbing for it was mostly there in the backend.

The trouble is that both those fonts are proprietary and BunTool is FOSS. So I found two excellent alternatives - respectively, CharisSIL and Liberation Sans.Why not Liberation Serif too? Only because I liked Charis. All the Liberation fonts are great! So I loaded those in and connected up the plumbing, spun up the test cases and all worked well.

Deploying broke everything. Cloudflare was serving some fonts but not others, even fonts of the same size and in the same directories as working fonts.

Why? After two hours I’m pretty sure it was a Cloudflare caching error. Branching and deploying to a fresh preview instance confirmed this was probably the error, since it didn’t have the same problems. But annoyingly even purging CF’s cache didn’t fix it.

In the end I did:

Roll back to working instance
Copy font files only (and no code) from my dev branch to main
redeploy
then merge dev into main, once fonts were already deployed.

Somehow, that stage of copying just the fonts dir into CF’s deployment first, and then merging seemed to have helped. Or perhaps it just caught up over the two hours that I was trying to diagnose the problem? I’ll never know.

What logs does BunTool save?

2026-05-24T00:00:00Z

I say on its Privacy page and homepage that BunTool doesn’t log any personal information. This is part of the point, because it’s a private tool and if it ingested information about everyone and their legal cases it would be worthless

There is some logging though, and I recently posted about this on LinkedIn:

As you see, it’s technical logging only without any personal info. Having posted that I realised people might like to know exactly what is logged, so here are some examples of some real-life logs from the last few days, chosen at random (and slightly prettified for ease of display in a news post):

	6114	6022	6023
Started	2026–05–21 22:08:22	2026–05–21 11:06:56	2026–05–21 11:12:04
Files used	2	11	3
Page count	59	159	119
Size	2.1 MB	88.9 MB	0.7 MB
Duration	2.3 s	4.8 s	2.2 s
Status	Interrupted: cancelled by user	OK	OK

That’s about it. The error codes (here labelled "Status") can vary - for example there was an increasing trend of errors where people were creating larger and larger bundles which showed up as realloc error (8765432 bytes failed) and reference a line of the code where the problem aroseThe “stack trace”.

But still, no personal information.

Ah whoops. Computers can have accidents now

2026-05-30T00:00:00Z

I was using Claude to set up dotfile syncing before provisioning a new machine, and during the session I got this:

> Updated plan
User rejected Claude's plan:
Plan: Exit accidental plan mode

Plan mode was triggered accidentally mid-conversation. 
No implementation task is being planned. Simply exit plan 
mode and continue the planning session with the user.

This is a very human sort of “accident”. The idea of software doing something relatably and accidentally in 2026 is pretty striking. A few years ago this would have been fiction.

Vulnerability reports are still special

2026-06-24T00:00:00Z

I’ve just been reading Filippo Valsorda’s well-written post about why, in the age of LLMs and automated security analysis, Vulnerability Reports are not Special Anymore. It’s worth reading, and he also added to it to address several comments.

But I think I disagree with his premise. To my mind, vulnerability reports are still special and the fact that they are more accessible to a wider range of people fuzzing software through LLMs doesn’t change this, even in the open source world.

To be clear, I don’t claim to know better than Filippo: he is immersed in that world! I’m a lawyer who handles security through a very different lens, so I am only dealing with this from a high level, damage-limitation-after-the-event sort of perspective. I also don’t want to downplay how serious it can be to suffer the information overload of AI-generated materials coming thick and fast but taking disproportionate time to verify.But dealing with hard-to-verify overload is a problem where I think lawyers and software engineers do have a similar experience.

Anyway with those caveats, I had the reaction I had for three reasons:

1: Knowledge is power

Knowledge is not always power, but knowledge of a security vulnerability is power over a developer and their users. It is the fact that someone has invested time into uncovering the vuln which makes it valuable. If they choose to disclose it responsibly, they are surrendering that power and accepting that it will cease to put them in a privileged position. That is something special which doesn’t happen every day.

It is still potent even if discovered using modern tools, or has done so more quickly or easily than before. It’s true that the defending developer may also have access to these tools and may also be able to triage and find the vulnerability more quickly than before. But not all developers will have those tools or the time or knowledge to triage security analysis in the same way. And anyway, the fact is that the vulnerability is available to attackers now and presumably has been in the past, even if it might reasonably be patched on a shorter timescale than before.

As Filippo puts, it,

In exchange for responsiveness and attribution, they are offering precious insight and the confidentiality we need to ship a fix before attackers ship an exploit.

I think that holds true, and sacrificing attentiveness would be a shame because it would break the bargain. The bargain doesn’t even really require responsiveness, that’s just a good convention to follow.

2: What can be done once can be done again

If someone has found your vulnerability, others will be able to find it too. Assuming a roughly stable proportion of black-hats to white-hats, the odds of a disclosed vuln being found and abused by others have not changed just because LLMs are available to automate. It might just happen faster, is all.

Filippo makes the point that these things will be triaged and the triage would probably catch the vulnerability anyway. And that’s a good point! But not all tooling is equal, and even with access to the best tools any given project’s triage might just be wrong, or not take account of everything known to the researcher or attacker. So the triage might need to adapt. ultimately if this research was on the #TODO list anyway, that’s probably a signal that everyone agrees it’s worth addressing.

3: Abuse is also more accessible than ever

Finally and perhaps a bit more practically, I’m worried that LLMs are not just making vulnerabilities easier to find, but also easier to exploit. Exploiting a software vulnerability has never been an easy task, since it requires a decent depth of understanding even to receive the instructions. But it’s now possible to have LLMs guide and patiently explain the steps, or even automate them for you. To that end, I’m not sure the assumption I mentioned above holds: There may well be proportionately more black-hatting around if everyone and their dog is able to pick up a CVE and run with it without needing to understand the problem deeply.

I say this last thought is a bit more practical than philosophical, because it doesn’t change whether or not the disclosure is still special. But it might be the sort of thing that affects the analysis.

Does it matter?

Probably not really.

But I do think philosophically, the choices that a stranger makes - first to invest time and tokens into finding a vulnerability, and second to disclose it responsibly, are still a special kind of positive interaction, irrespective of the tools used.

Obfuscated, self-evaluating bash script by CDN Akamai being supplied to consumers via retail stores

2026-07-04T00:00:00Z

When my wife said to me “Let me show you a t-shirt I saw…”, I wasn’t sure what to expect, but it definitely wasn’t an obfuscated bash script printed on the back designed to print a happy Easter egg message.

I’m not in the habit of clickbaity headlinesI’ve no idea at all how many views this site gets, but I’m willing to bet it’s not even double-digit humans per month. but I can see why subeditors have such fun with them. The title above is, strictly speaking, entirely accurate, but probably not what you think. The obfuscated code in question is actually an easter egg, it’s being supplied via Uniqlo stores on an excellent t-shirt designed by Akamai in support of their Peace for All campaign.

And it’s very cool! The front has a heart in curly braces:

While the back has a big alphanumeric block:

Is that … a shebang?!

My wife was right that I’d want to see it. Was that… a shebang?

Take a closer look at the text block:

Yes, a shebang! On a t-shirt sold in a high street store, no less. And it is clearly a base64 encoded Here string being fed to eval via base64 --decode.

Interesting. I told my wife "that’s basically how people ship viruses’ and bought it.

OCR was cumbersome

There was good news and bad news:

The bad news was that base64 hasn’t got error correction, meaning that the transcription would need to be perfect. Sigh.
The good news was that the string seemed to be intact - at least, it terminated with the expected padding and had matching quotes and braces. This is a good thing because Uniqlo x Akamai sells another design of shirt in the same range which is plainly incompleteFor example, its imports are truncated and it ends “retu” instead of “return”. This is a pity, because it’s a really nice colour combination and contains the highly idiomatic instruction go doStuff(msg, work... which anyone can relate to., a truncated crop from a wider text block which could never compile.

I ran OCR in a few ways: First, using the built-in OCR of the circle-to-search feature on Android, which is often very good. Second, by using Tesseract with a few options and tweaks. And third by running it through Claude. After diffing the three to look for mismatches and getting Claude to output a table of locations for quick scanning, it became trivial but time-consuimg to tidy up the remainder. The resulting string was:

IyEvYmluL2Jhc2gKCiMgQ29uZ3JhdHVsYXRpb25zISBZb3UgZm91bmQgdGhlIGVhc3RlciBlZ2chIOKdpO+4jwojIOOBiuOCgeOBp+OBqOOBhuOBlOOBluOBhOOBvuOBme+8gemaoOOBleOCjOOBn+OCteODl+ODqeOCpOOCuuOCkuimi+OBpOOBkeOBvuOBl+OBn++8geKdpO+4jwoKIyBEZWZpbmUgdGhlIHRleHQgdG8gYW5pbWF0ZQp0ZXh0PSLimaVQRUFDReKZpUZPUuKZpUFMTOKZpVBFQUNF4pmlRk9S4pmlQUxM4pmlUEVBQ0XimaVGT1LimaVBTEzimaVQRUFDReKZpUZPUuKZpUFMTOKZpVBFQUNF4pmlRk9S4pmlQUxM4pmlIgoKIyBHZXQgdGVybWluYWwgZGltZW5zaW9ucwpjb2xzPSQodHB1dCBjb2xzKQpsaW5lcz0kKHRwdXQgbGluZXMpCgojIENhbGN1bGF0ZSB0aGUgbGVuZ3RoIG9mIHRoZSB0ZXh0CnRleHRfbGVuZ3RoPSR7I3RleHR9CgojIEhpZGUgdGhlIGN1cnNvcgp0cHV0IGNpdmlzCgojIFRyYXAgQ1RSTCtDIHRvIHNob3cgdGhlIGN1cnNvciBiZWZvcmUgZXhpdGluZwp0cmFwICJ0cHV0IGNub3JtOyBleGl0IiBTSUdJTlQKCiMgU2V0IGZyZXF1ZW5jeSBzY2FsaW5nIGZhY3RvcgpmcmVxPTAuMgoKIyBJbmZpbml0ZSBsb29wIGZvciBjb250aW51b3VzIGFuaW1hdGlvbgpmb3IgKCggdD0wOyA7IHQrPTEgKSk7IGRvCiAgICAjIEV4dHJhY3Qgb25lIGNoYXJhY3RlciBhdCBhIHRpbWUKICAgIGNoYXI9IiR7dGV4dDp0ICUgdGV4dF9sZW5ndGg6MX0iCiAgICAKICAgICMgQ2FsY3VsYXRlIHRoZSBhbmdsZSBpbiByYWRpYW5zCiAgICBhbmdsZT0kKGVjaG8gIigkdCkgKiAkZnJlcSIgfCBiYyAtbCkKCiAgICAjIENhbGN1bGF0ZSB0aGUgc2luZSBvZiB0aGUgYW5nbGUKICAgIHNpbmVfdmFsdWU9JChlY2hvICJzKCRhbmdsZSkiIHwgYmMgLWwpCgogICAgIyBDYWxjdWxhdGUgeCBwb3NpdGlvbiB1c2luZyB0aGUgc2luZSB2YWx1ZQogICAgeD0kKGVjaG8gIigkY29scyAvIDIpICsgKCRjb2xzIC8gNCkgKiAkc2luZV92YWx1ZSIgfCBiYyAtbCkKICAgIHg9JChwcmludGYgIiUuMGYiICIkeCIpCgogICAgIyBFbnN1cmUgeCBpcyB3aXRoaW4gdGVybWluYWwgYm91bmRzCiAgICBpZiAoKCB4IDwgMCApKTsgdGhlbiB4PTA7IGZpCiAgICBpZiAoKCB4ID49IGNvbHMgKSk7IHRoZW4geD0kKChjb2xzIC0gMSkpOyBmaQoKICAgICMgQ2FsY3VsYXRlIGNvbG9yIGdyYWRpZW50IGJldHdlZW4gMTIgKGN5YW4pIGFuZCAyMDggKG9yYW5nZSkKICAgIGNvbG9yX3N0YXJ0PTEyCiAgICBjb2xvcl9lbmQ9MjA4CiAgICBjb2xvcl9yYW5nZT0kKChjb2xvcl9lbmQgLSBjb2xvcl9zdGFydCkpCiAgICBjb2xvcj0kKChjb2xvcl9zdGFydCArIChjb2xvcl9yYW5nZSAqIHQgLyBsaW5lcykgJSBjb2xvcl9yYW5nZSkpCgogICAgIyBQcmludCB0aGUgY2hhcmFjdGVyIHdpdGggMjU2LWNvbG9yIHN1cHBvcnQKICAgIGVjaG8gLW5lICJcMDMzWzM4OzU7JHtjb2xvcn1tIiQodHB1dCBjdXAgJHQgJHgpIiRjaGFyXDAzM1swbSIKCiAgICAjIExpbmUgZmVlZCB0byBtb3ZlIGRvd253YXJkCiAgICBlY2hvICIiCgpkb25lCgo=

The decoded script

After Base64 decoding, the resulting script is a welcoming and nicely commented Easter egg:

#!/bin/bash

# Congratulations! You found the easter egg! ❤️
# おめでとうございます！隠されたサプライズを見つけました！❤️

# Define the text to animate
text="♥PEACE♥FOR♥ALL♥PEACE♥FOR♥ALL♥PEACE♥FOR♥ALL♥PEACE♥FOR♥ALL♥PEACE♥FOR♥ALL♥"

# Get terminal dimensions
cols=$(tput cols)
lines=$(tput lines)

# Calculate the length of the text
text_length=${#text}

# Hide the cursor
tput civis

# Trap CTRL+C to show the cursor before exiting
trap "tput cnorm; exit" SIGINT

# Set frequency scaling factor
freq=0.2

# Infinite loop for continuous animation
for (( t=0; ; t+=1 )); do
    # Extract one character at a time
    char="${text:t % text_length:1}"
    
    # Calculate the angle in radians
    angle=$(echo "($t) * $freq" | bc -l)

    # Calculate the sine of the angle
    sine_value=$(echo "s($angle)" | bc -l)

    # Calculate x position using the sine value
    x=$(echo "($cols / 2) + ($cols / 4) * $sine_value" | bc -l)
    x=$(printf "%.0f" "$x")

    # Ensure x is within terminal bounds
    if (( x < 0 )); then x=0; fi
    if (( x >= cols )); then x=$((cols - 1)); fi

    # Calculate color gradient between 12 (cyan) and 208 (orange)
    color_start=12
    color_end=208
    color_range=$((color_end - color_start))
    color=$((color_start + (color_range * t / lines) % color_range))

    # Print the character with 256-color support
    echo -ne "\033[38;5;${color}m"$(tput cup $t $x)"$char\033[0m"

    # Line feed to move downward
    echo ""

done

The result is a continuous happy sine-wave loop of the campaign message, Peace for All:

Detail: The font choice

Edit: The following font ID is wrong! User ralphinus on Hacker News pointed out that the font is Roboto Mono. I don’t know how I overlooked the very different g.

I guess Uniqlo is run through Windows though: one thing that struck me was the font, which ~~I’m~~ I was previously almost certain is ConsolasI was fortunate enough to correspond with the designer, Lucas de Groot, once in relation to a legal case in which someone had used one of his fonts to forge a document. He was very helpful and kind enough to confirm the necessary facts in writing, even though he owed nothing to us. , which I’m fond of. Note the very shallowly-slashed 0, the lack of serif on the 1 and the rounded curves of letters like BDyg and number 2. It’s striking because it’s primarily a Windows font, so not the sort of thing I’d expect to see calling Bash.

Linux, the language of the Internet

Akamai put out a press release about the shirt when it was released, which is another sort of interesting due to the blend of tech and marketing:

Design message

More than 25 years ago, Akamai helped make the internet we know today possible. This shirt’s design is a callback to those early days of life online. The light tan color is a reference to the “beige box” plastic casings that housed the early internet computers, and the heart on the front represents how the internet has been used for good all over the world. On the back of the T-shirt is real code. It’s a reference to Linux, the open-source language of the internet. This common language unites Akamai with the world’s top brands and the people they serve, as we work together toward a vision of a safer and more connected world.

Not the first

I deliberately didn’t search for spoilers at first, but I see that I am of course not the first person to get nerd-sniped by this. Wen Chuan Lee and that post also links to another (against which I’ve cross-checked my transcription above). I’m happy to carry on the chain.

Read the discussion of this post on Hacker News, which includes links to more info from the designer and other interesting observations