This year I went back to the Basel Herbstmesse and, like two years ago, I couldn’t resist riding the Ferris wheel. This time I got lucky with the timing. The sun was right behind me, and when the gondola reached the top, I noticed the shadow of the wheel itself stretched across the white façade of the house in front of me. You can see the rim and the spokes running diagonally down to the street, almost like a giant sundial drawn on the building.

Sometimes you are just in the right place at the right time, and this was one of those moments. I took a few photos, and I think this one turned out quite well. The Ferris wheel is a classic attraction at the Herbstmesse, and it’s always fun to see it from above.

Hopefully I will be able to go again next year. I’m already looking forward to the next ride.

Disclaimer: This post is different from the short ones I usually write here. It’s long and a bit technical, so if you’re not interested in how web authentication and authorization work under the hood, feel free to skip this one.

Last week, while I was helping a colleague who doesn’t have much experience with OAuth, I realized that it only makes sense once you understand the fundamentals of how a website or web application tells who you are apart from what you’re allowed to do.

So the objective of this post is to explain the basics of authentication and authorization, how they evolved over time and how they relate to OAuth 2.0 and OpenID Connect today. I have used all these methods during my career, so I thought it would be useful to organize them in a single post.

Authentication vs authorization

Authentication answers “who are you?” Authorization answers “what are you allowed to do?” I once read a good analogy about checking into a hotel, and I will use it here to explain the difference.

Picture yourself checking in:

1. At the front desk you show your passport. The receptionist checks that you are the person on the booking. That is authentication.
2. They hand you a key card. The card opens room 202, the gym and the pool, but not room 403 or the kitchen. That is authorization.

Two details from this analogy matter for everything that follows:

• Ideally, the door never sees your passport. It only checks the card. Later in this post, the card will be a session cookie or a token. The first scheme we’ll look at, Basic Auth, doesn’t work like this yet: it shows the passport at every door, and that’s exactly its weakness.
• The card can be given to someone else. If you hand it to a friend, the door lets them in. Whoever holds the card has the access. Security people call this a bearer credential, and it explains why we protect tokens so carefully.

Authentication almost always comes first: you can’t decide what someone may do until you know who they are. But they are separate problems, solved by separate parts of a system, and mixing them up is the root of most confusion about OAuth.

Step 1: HTTP Basic Auth

The simplest scheme the web has is HTTP Basic Authentication. The client sends the username and password with every single request.

It works like this:

1. The browser asks for a protected page.
2. The server replies 401 Unauthorized with the header WWW-Authenticate: Basic realm="admin". The browser shows its grey login pop-up.
3. The browser joins username:password, Base64-encodes it and resends the request with an Authorization header.

GET /admin HTTP/1.1
Host: example.com
Authorization: Basic anVhbjpteXBhc3N3b3Jk

anVhbjpteXBhc3N3b3Jk is just juan:mypassword in Base64. Base64 is encoding, not encryption: anyone who sees the header can decode it in one second. That’s why Basic Auth is only acceptable over HTTPS.

Why it’s still around: it’s trivial to implement, every HTTP client supports it, and it’s fine for quick internal tools, a staging site, or a machine calling an API.

Why it isn’t enough:

• The real password travels on every request, so every request is a chance to leak it.
• There’s no clean way to log out; the browser keeps resending the credentials until you close it.
• There’s no way to give limited access. Whoever has the password can do everything you can.
• The server must check the password every time, which is slow if passwords are properly hashed.

In the hotel analogy: there is no key card. You show your passport at every door.

Step 2: Sessions and cookies (log in once)

Sessions fix the biggest problem of Basic Auth: you send your password once, and get a key card back.

1. You fill in a login form and POST your username and password.
2. The server checks the password against a stored hash.
3. If it matches, the server creates a session: a record in its database or cache, like session 7f3a… → user 42, expires in 2 hours.
4. It sends the random session ID back in a cookie.
5. The browser attaches that cookie to every following request. The server looks up the ID and knows who you are.

HTTP/1.1 200 OK
Set-Cookie: session=7f3a9c2e81b4; HttpOnly; Secure; SameSite=Lax

Those three flags are worth knowing early:

• HttpOnly — JavaScript can’t read the cookie, so a cross-site scripting (XSS) bug can’t simply steal it.
• Secure — the cookie is only sent over HTTPS.
• SameSite — the browser doesn’t attach it to requests started by other sites, which blocks most cross-site request forgery (CSRF).

What we gained: the password crosses the network once, logout is easy (delete the session on the server), and the server can revoke a session at any time.

What it costs: the server has to remember every session. That’s fine for one web app, but awkward when you have mobile apps, many microservices, or several domains that all need to know who the user is. Cookies are also tied to a browser and a domain, so they’re a poor fit for APIs called by other programs.

Step 3: API keys and bearer tokens (credentials for programs)

When a program talks to an API, there’s no login form and often no browser. The usual answer is a long random string the program sends with each request.

An API key identifies the calling application, usually a project or account, rather than a person. You generate it in a dashboard and paste it into your server’s config:

GET /v1/forecast?city=Paris HTTP/1.1
X-API-Key: demo_key_not_a_real_secret_123

A bearer token is the same idea with a standard header. “Bearer” means exactly what the hotel card taught us: whoever bears it gets in.

GET /v1/me HTTP/1.1
Authorization: Bearer eyJhbGciOiJSUzI1NiIs...

Rules of thumb:

• Treat keys and tokens like passwords. Never commit them to Git, never put them in front-end JavaScript, never log them.
• Give each key the smallest set of permissions it needs, and rotate it if it leaks.
• Prefer short-lived tokens over long-lived keys: a token that expires in an hour is worth much less to a thief.

That last point raises a question. If tokens are short-lived and handed out by some login service, how does the API know a token is real without calling that service every time? One popular answer is the JWT.

Step 4: JWT (a token that carries its own proof)

A JSON Web Token is a token the API can verify by itself, without asking anyone. It’s three Base64URL pieces joined by dots: header.payload.signature.

// header
{ "alg": "RS256", "typ": "JWT" }

// payload (the "claims")
{
  "iss": "https://login.example.com",
  "sub": "user-42",
  "aud": "https://api.example.com",
  "scope": "mail:read",
  "exp": 1793620800
}

The login server signs the header and payload with its private key. The API holds the matching public key. If anyone changes even one character of the payload, the signature no longer matches and the API rejects the token. The API checks the signature, the issuer (iss), the audience (aud) and the expiry (exp), and then it knows who the user is (sub) and what the token allows (scope).

Things that trip people up:

• A JWT is signed, not encrypted. Paste one into a JWT debugger and you can read everything. Never put secrets in the payload.
• Always verify the signature with a well-known library, and reject "alg": "none".
• You can’t easily revoke a JWT. It stays valid until it expires, so keep access tokens short-lived (minutes to an hour).
• JWT is a format, not a protocol. It says what a token looks like, not how you get one. That’s the job of OAuth.

Delegation

Everything so far is about you accessing your stuff. OAuth solves a different problem: letting another application access your stuff, on your behalf, with limited rights.

Back to the hotel. A friend arrives before you and needs to get into your room to drop off their luggage. The lazy answer is to give them your passport and your key card. That’s a terrible idea:

• Your friend can now do everything you can: open your room, charge room service to your bill, even check out in your name.
• You can’t give them only your room, or only until tonight.
• To take the access back, you have to cancel your card at the desk, and every other copy you handed out stops working too.
• If your friend loses them, whoever finds them is you, as far as the hotel is concerned.

What you really do is go to the front desk and ask for a second card. The receptionist checks that it’s really you, asks what the card should open, and issues a valet key: it opens room 202 only, it stops working tomorrow, and you can cancel it at the desk at any time. Your friend never sees your passport. OAuth is the protocol for issuing valet keys.

Step 5: OAuth 2.0 (delegated authorization)

OAuth 2.0 is a framework for an app to get an access token that lets it call an API on a user’s behalf, without ever seeing the user’s password. Notice the word: authorization. OAuth is about what the app may do, not about who the user is.

Now the same idea on the web. Say it’s the evening before your flight and you want to print your flight tickets. They’re in your Gmail, and the printer in the business center has a touch screen with a “Print from Gmail” button. Without OAuth, the only way for the printer to get your tickets would be for you to type your Google password into it. From then on it could do anything you can: read all your email, send messages in your name, even change your password. That’s the passport hand-over again, and it has a name: the password anti-pattern. With OAuth, the printer asks Google for a valet key instead: permission to read your email for a short time, which you can cancel from your Google account.

The four roles

Role	What it is	Hotel	Business center example
Resource owner	The user who owns the data	You	You
Client	The app that wants access	Your friend	The business center printer
Authorization server	Logs the user in, asks for consent, issues tokens	The front desk	Google’s login and consent screens
Resource server	The API that holds the data	The door of room 202	Gmail API

Scopes and consent

The client asks for scopes, named permissions such as gmail.readonly. The authorization server shows the user a consent screen (“Hotel Printer wants to view your email messages”) and the user approves or refuses. The token that comes out is limited to those scopes. That’s the valet key: one door, limited time, cancellable.

The authorization code flow, step by step

This is the flow you’ll use for almost every real app:

1. You tap “Print from Gmail” on the printer’s touch screen.
2. The printer’s screen sends you to Google’s sign-in page (the /authorize endpoint), passing along its client_id, the scope, a redirect_uri, a random state value and a PKCE code_challenge (more below).
3. You log in at Google, not in the printer’s app, and approve the consent screen.
4. Google sends you back to the printer’s redirect_uri with a short-lived, single-use authorization code.
5. The printer’s backend sends that code to Google’s /token endpoint, together with its client credentials and the PKCE code_verifier. This call happens server to server, not through the browser.
6. Google returns an access token (and often a refresh token).
7. The printer calls the Gmail API with Authorization: Bearer <access token>, finds the email with your flight tickets and prints them.

Read it top to bottom: everything above step 5 goes through the browser; the tokens only ever travel on the highlighted server-to-server lines.

Why the extra hop with the code? The browser’s address bar, history and logs are leaky places. Only the short-lived code passes through them; the valuable token is handed over on a direct, authenticated back-channel.

PKCE and state

state protects you from being handed someone else’s key. Before sending you to Google, the printer makes up a random value, remembers it, and adds it to the request. Google hands it back unchanged in step 4, and the printer only accepts the code if the value matches. Without it, an attacker could start the flow with their own Google account, stop just before step 4, and trick you into opening that last link. The printer would then be connected to the attacker’s account, and anything you saved through it would end up with them. This is a kind of cross-site request forgery (CSRF).

In the hotel: when you ask the desk for a valet key, they give you a numbered ticket, and you only accept a card that comes with your number. Nobody can slip you the key to their room and have you leave your luggage there.

PKCE (“pixie”) makes a stolen code useless. The code travels through the browser, inside a URL, so it can leak through browser history, logs, or, on phones, another app that registers the same return address. With PKCE, the client invents a secret code_verifier, sends only its hash (code_challenge) in step 2, and reveals the verifier in step 5. The hash can’t be turned back into the verifier, so someone holding only the code can’t finish the exchange.

In the hotel: when you order the valet key, you tear a ticket in half, give one half to the desk and keep the other. The desk gives you a pickup slip (the code), and to collect the card you have to show the slip and the matching half. A thief who steals the slip still can’t collect the card.

PKCE was built for mobile and single-page apps, which can’t keep a client secret: anything shipped inside an app or in JavaScript can be pulled out by whoever downloads it. Today it’s recommended for every client.

Other grant types

Grant	Use it when	Status
Authorization code + PKCE	A user is present: web, mobile, single-page apps	The default
Client credentials	Machine-to-machine, no user involved (a cron job calling an API)	Recommended
Device authorization	Devices with no keyboard: smart TVs, CLIs (“go to this URL and enter code ABCD”)	Recommended
Refresh token	Getting a new access token without asking the user again	Recommended
Implicit	Old single-page apps; token returned straight in the URL	Deprecated
Resource owner password	App collects the user’s password itself	Deprecated

Access tokens and refresh tokens

Access tokens are short-lived on purpose, often minutes to an hour. When one expires, the client sends its refresh token to the /token endpoint and gets a fresh access token without bothering the user. Refresh tokens are long-lived and powerful, so they stay on the server (or in secure device storage), and good authorization servers rotate them on every use. When the user clicks “Remove access” in their Google account, the refresh token is revoked and the app is cut off.

An access token can be a JWT the API verifies itself, or an opaque random string the API checks with the authorization server’s introspection endpoint. OAuth deliberately doesn’t say which. And most importantly: the access token is meant for the API, not for the client. The client shouldn’t open it and treat its contents as proof of who the user is.

Step 6: OpenID Connect (authentication on top of OAuth)

Once OAuth existed, everyone wanted to use it for “Sign in with Google”. The trouble is that OAuth only says “this app may read your email”. It doesn’t reliably say who approved that, when, or for which app. Teams built their own shaky login schemes on top, often by calling some “get profile” API with the access token, and some of those were exploitable.

OpenID Connect (OIDC, finalized in 2014) fixes this by adding a thin, standard identity layer to the same authorization code flow:

• The client adds the scope openid (plus optional profile and email).
• The /token response now contains a third thing: an ID token.
• The ID token is always a signed JWT, written for the client, describing the login event.

{
  "iss": "https://accounts.google.com",
  "sub": "110169484474386276334",
  "aud": "hotel-printer-client-id",
  "exp": 1793620800,
  "iat": 1793617200,
  "nonce": "n-0S6_WzA2Mj",
  "email": "juan@example.com",
  "name": "Juan"
}

The client checks the signature, that iss is the provider it expected, that aud is its own client ID, that it hasn’t expired, and that nonce matches the one it sent (this prevents replaying an old token). Then the user is logged in, identified by the pair iss + sub, which never changes even if the email does.

OIDC also standardizes the plumbing around it:

• a UserInfo endpoint to fetch extra profile claims with the access token;
• a discovery document at /.well-known/openid-configuration listing every endpoint and the public keys (JWKS), so libraries configure themselves from one URL;
• options for logout and session management.

The one-liner to remember:

Token	Who reads it	What it says
ID token	The client app	Who the user is and how they just logged in (authentication)
Access token	The API	What the app is allowed to do (authorization)
Refresh token	The authorization server	“Please give me a new access token”

In hotel terms: the ID token is the receptionist’s note to the app saying “we checked this guest’s passport at 14:02”. The access token is the key card the doors read.

Summary

Each step on this path fixed something the previous one couldn’t do, and the hotel has been with us the whole way:

Mechanism	Hotel version	Use it for
Basic Auth	Show your passport at every door	Internal tools and quick scripts, over HTTPS only
Session cookie	Passport once at the desk, key card after	Classic server-rendered web apps
API key	A supplier’s badge: it names a company, not a person	Programs calling a third-party API
Bearer token	A key card that works for whoever holds it	Sending an access token to an API
JWT	A key card with a hologram the door can check by itself	Most access tokens, and every ID token
OAuth 2.0	A valet key from the front desk	Letting the business center printer read your email to print your tickets, without your password
OpenID Connect	The desk’s signed note telling an app who you are	“Sign in with Google”, company single sign-on

Next time my colleague and I go through our OAuth setup, I hope all those redirects, codes and tokens will look less like magic and more like a hotel front desk doing its job.

Some days ago I visited Sion, the capital of Valais, and climbed up to the Château de Tourbillon, the castle ruins on top of one of the two hills that rise above the old town.

The photo above was taken from one of its arched doorways. Framed in the arch you can see the Basilica of Valère on the neighboring hill, with the town of Sion below and the Alps fading into the haze behind it. The yellow leaves on the wall make it a very autumn picture.

According to Wikipedia, Tourbillon was built between 1297 and 1308 by Bishop Boniface de Challant and was the residence of the Bishops of Sion for a long time, until a fire in 1788 destroyed most of it. Valère is even older, with its first parts dating back to the early 12th century, and its organ, from around 1435, is one of the oldest working organs in the world.

Two hills, two old fortresses, and they have been looking at each other for more than 700 years!

Last Sunday I made a flash visit to Bern with A. As I’ve mentioned before, it’s one of my favorite cities in Switzerland, and it’s so easy to get to from Basel that even a short stop is worth it.

By the time I walked into the old town it was already dark and it had been raining. The cobblestones were still wet and reflected the lights from the shop windows and street lamps, as you can see in the picture above. In the center is the Käfigturm, with its clock and pointed spire, and on the right you can spot the green dome of the Federal Palace.

A short visit, but Bern never disappoints, even on a rainy evening.

The last couple of days at work have been intense. On Tuesday details of a new PHP vulnerability started leaking online, and by Wednesday afternoon the official patches were out. Everything else on the board stopped. For two days the only questions were: where do we run PHP, which version is it, and is it patched yet?

The bug has a name, PHP2Shell, and it is one of the most serious problems the web has seen in years.

What is PHP?

PHP is a programming language that runs on the server. When you open a web page, PHP builds the HTML before it reaches your browser. It was created by Rasmus Lerdorf in 1994 and is still everywhere. WordPress, Drupal, Joomla, Laravel, Symfony, Magento, and MediaWiki (the software behind Wikipedia) are all written in it.

The numbers are impressive. According to these PHP statistics from September 2026:

• PHP runs on 70.2% of all websites whose server-side language is known (W3Techs).
• Among PHP sites, 63.4% use PHP 8, 28.7% still use PHP 7 and 7.9% are still on PHP 5.
• Packagist, PHP’s package registry, lists 466,248 packages with almost 197 billion installs since 2012.
• About 19% of professional developers worked extensively with PHP last year (Stack Overflow 2025), and 64% of PHP developers use Laravel (JetBrains 2025).

PHP may not be fashionable, but it powers a huge part of the internet. That is exactly why a bug in PHP itself is such a big deal.

What was the vulnerability?

PHP2Shell is actually two bugs, CVE-2026-109618 and CVE-2026-109619, both rated 9.2 out of 10:

1. CVE-2026-109618: when PHP runs out of memory, for example during a huge file upload, it can be interrupted while its internal request data is only half built. The cleanup step then treats that broken data as valid.
2. CVE-2026-109619: some internal state survives after its memory has been freed. The next request on the same worker can use that stale state, and the upload progress feature is one way to reach it.

Both lead to remote code execution, which means an attacker can run their own commands on your server. Here is why it was so bad:

• No login needed. A single anonymous request is enough to attack, and it happens before any application code runs. It doesn’t matter how secure your own code is.
• It’s in PHP itself, not in a plugin or framework, so it affected PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed, from PHP 5.4 all the way to 8.5.
• Attackers were early. Amazon saw an exploitation attempt on October 17, four days before the public disclosure. The details then leaked on October 20, a day ahead of schedule.
• Old versions don’t get proper fixes. PHP 7.4, 8.0 and 8.1 only received source patches, and nothing older got anything. With almost 37% of PHP sites still on PHP 7 or 5, many servers can’t simply “update”.

As a precaution, government sites in Europe and Canada, many Wikimedia services and even the Internet Archive went offline for a while. Interestingly, the bug was found with the help of AI models. One of the out-of-memory problems had been spotted back in 2024, but without a working exploit it was never fixed.

Patch everything, now

So what did we developers do? We patched as fast as we could. The fixed versions are 8.5.12, 8.4.27, 8.3.36 and 8.2.35. If you run anything with PHP, even a small blog on shared hosting, check today that it’s on a patched version.

Lets see what the next week will bring in this new crazy world of LLM driven security research and exploitation.

Because of my living situation, I check train connections quite frequently, and I wanted to have a place where I could search using one tap instead of a page load, a cookie banner and a spinner. So I built CatCH: a small static site hosted on Cloudflare Pages that searches Swiss public transport with the same flow as sbb.ch, just lighter.

It is not a replacement for the official app. You can’t buy tickets, and there is no account. It does just one thing: show me the next connections between two stops, as fast as the network allows. If you want to try it out, check catch.jco.im.

What it does

If you have used sbb.ch, you already know how to use CatCH. The search form follows the same steps:

1. Type a From and To stop (or tap Stops near me to use your location). A swap button flips them.
2. Pick Leave now, Depart at or Arrive by, and optionally add a Via stop.
3. Hit Search and get the next connections: departure time, products (IC, IR, S-Bahn, bus…), platform and number of changes.
4. Open a connection to see each leg, walking transfers and the stops in between.

Two extras make it nicer: Saved routes pin trips I take often to the home screen, with a live “in 9 min” countdown to the next departure. A Departures tab shows the station board for any stop, like the yellow posters on the platform.

It also installs as a PWA on your phone, follows your system’s light or dark theme, and remembers your saved routes locally in the browser. No login, no tracking.

How it’s built

There is no backend. CatCH is an Astro site with a few React islands, built to plain HTML, CSS and JS and served from Cloudflare’s edge. The browser talks directly to the free Swiss public transport API at https://transport.opendata.ch/, which wraps the official timetable data from opentransportdata.swiss.

Some weeks ago, when I wrote about Noviodunum, the Roman town that became Nyon, I kept picturing how empty the shores of Lake Geneva must have been back in Roman times. Today it feels like the opposite. Switzerland now has about 9.1 million people, 2.7 times as many as in 1900, according to the About Switzerland population page from the Swiss foreign ministry.

Most of that growth comes from immigration. More than 2 million foreign nationals (raising my hand here) live in Switzerland, about 27% of residents, one of the highest shares in Europe. The flow also runs the other way: over 10% of Swiss citizens now live abroad. In recent years the population has grown about 0.8% a year, and 2025 alone added roughly 73,300 people.

All of this came to a head in June. On 14 June 2026, voters rejected the SVP’s “No to 10 million Switzerland!” initiative, which would have forced the government to act if the population passed 10 million before 2050. It failed 54.8% to 45.2%. The map was telling: French-speaking cantons and the big cities said no (Bern 83.6%, Zurich 75.9%), while rural cantons like Appenzell Innerrhoden and Schwyz said yes.

So what now? At 0.8% a year, 10 million is only about a decade away, vote or no vote. The real question isn’t whether Switzerland grows, but whether the trains, flats and schools can keep up. I guess only time will tell.

The Swiss town of Nyon in Vaud traces its roots back to 45 BC, when Julius Caesar founded the settlement as Colonia Iulia Equestris (also known to the Romans as Noviodunum).

Today, the ancient past still lives alongside the present. As you can see in the photo, the vestiges of three Roman columns still stand tall at the Esplanade des Marronniers overlooking Lake Geneva.

I’ll never forget the first time I saw Roman ruins in Europe, but to be honest, every single time I stumble upon them, that same sense of awe and curiosity comes rushing back.

Last night I decided last minute to stroll around the Basel Jazz Festival, and I was pleasantly surprised by the variety of acts around the city. The festival was alive with different settings from small intimate venues to larger stages, each offering a unique experience.

After buying some water at Barfüsserplatz, I wandered through the streets and found myself in front of a medium-sized stage on Freie Strasse, where a salsa-based Latin jazz band was performing. The musicians were incredibly talented, with a singer who reminded me of some of the greats of the genre.

I spent the next hour enjoying the music and sharing the experience with the rest of the crowd, Latin and non-Latin alike, who were completely immersed in the performance. Really cool!

I once read that the Spalentor is one of Basel’s most interesting iconic buildings—it's almost a whole history lesson in a single building! It truly does stand out in the city's old town with its unique architecture. The tower's history is very interesting because it is linked to one of the main events that shaped the city: the earthquake of 1356.

That dramatic seismic event reduced the city to ruins, and when it had to be rebuilt, the city was enclosed by a bigger ring of walls. This included multiple defensive structures, such as seven gate towers, and one of them was indeed the Spalentor. Today, the tower stands as a symbol of the city's history, alongside other historic landmarks like the St. Johanns-Tor and the St. Alban-Tor.

I passed through Bern again a couple of days ago. As I’ve mentioned here before, it’s one of my favorite cities in Switzerland, and it’s super easy to get to from Basel.

I was actually going to Vaud that day, but since the weather was so lovely and the day was perfect, I decided to stop for a while.

I continued my usual walk from the city center to the bear pit, but I paused at the Aare bridge. The landscape was so beautiful that I had to stop and take pictures of the river.

The view was incredible: the turquoise water flowing beneath the bridge, set against the bright green of the trees, grass, and forested slopes on the left riverbank, as you can see above.

Back in 2018 I wrote a short post about what I had always considered one of the structural quirks of Colombian democracy: presidential elections, held every four years, always collide with the Football World Cup. When Colombia qualifies, football takes center stage in the national conversation and the election campaigns have to fight for attention.

Today is May 31st — first round of the 2026 presidential election — and the timing is even tighter than it was eight years ago. The World Cup kicks off on June 11th, just eleven days from now. Unless there is a first-round victory, which looks unlikely since the leading candidate, Iván Cepeda, was polling below the threshold back in April, the runoff will take place on June 21st — right in the middle of the group stage. Colombia's third group match, against Uzbekistan, is on June 17th. Colombians vote again four days after that.

We need to focus on this election — it's so important! But honestly, I have a feeling the country is going to get distracted again, with its attention pulled toward 'mi selección'. Seriously, some things just never change. 🤦‍♂️

Yesterday, while riding the train through the city of Neuchâtel, I looked out of the window, and the scenery was absolutely spectacular during that golden hour when the light was just perfect for taking a photo. So, I quickly grabbed my phone and took the shot you can see above.

As you can see, the image captures the city of Neuchâtel as the train passed, with the historic Neuchâtel Castle and the Collegiate Church dominating the hill on the right. Below them, a sea of medieval rooftops descends toward Lake Neuchâtel. I was quite lucky with the timing.

This evening I took a stroll down by the lake in Morges. The air had a nice chill to it, but the view was absolutely worth it. The sky is rarely so clear that you can see all the way across to the Alps, but tonight was one of those nights, as you can see in the picture above.

The Morges is a river in Vaud that flows into the Rhône at Lake Geneva and passes through the town of Morges, which takes its name from the river. This is a fact I had no idea about! Anyway, one evening last week, I was walking by the Parc de l'Indépendance and saw the lights on the horizon reflecting on the water with some tulips in the foreground, and I thought it would be a nice picture to share.

The weather was gorgeous yesterday, and I had some time to spare near Voltaplatz, so I took one of Basel’s little Rhine ferries once more and remembered why this simple plan is something I enjoy every single time. It’s very interesting how this small wooden boat has no engine — it’s just a cable and the river current doing all the work, quietly carrying you from one bank to the other. No rush, no noise, just the water and the nice lady telling some stories in Basler Deutsch.

The history of these ferries is interesting as well: they have been around since the 19th century, back when they were actually needed as part of the standard transport system, before more bridges went up alongside the Mittlere Brücke. Today they’re not really essential for getting around, but they’re still there as a reminder of what they once were. For a few minutes you’re not commuting, you’re not in a hurry, you’re just floating across the Rhine. Really nice!

Today we had the opportunity to visit the Grottes de Vallorbe, and it turned out to be a really amazing experience. We started our journey by taking the train from Renens to Le Day, and from there it was super convenient to hop on a bus that brought us directly to the caves’ parking lot. From there, the entrance to the caves is about a 10-minute walk along the river.

The Grottes themselves were absolutely beautiful. Formed over millions of years by the underground flow of the Orbe River, the caves showcase incredible limestone formations that are really unique. As we walked through, the natural rock structures were beautifully highlighted, creating a magical atmosphere throughout.

All in all, it was a nice day trip into one of the most beautiful cave systems in Europe.

Yesterday we went for a walk in Basel-Landschaft while the weather was really lovely. We started at the SBB Bahnhof in Basel and took the IR to Liestal. From there, we continued by bus 70 to Reigoldswil village. Instead of hiking up, we decided to take the cable car up to Wasserfallen, which made the start of the day feel very relaxed and easy.

From the top, we then walked all the way back down together with A. and L. It was a really nice route through green hills, forests, and small waterfalls, with flower-filled fields along the way, as well as some truly beautiful landscapes like the one you see in the picture above.

Our feet were a bit sore after the steep descent, but it was totally worth it.

Yesterday a hacker compromised the account of the lead developer of axios — the npm package with around 100 million weekly downloads — and published two malicious versions that included a remote access Trojan targeting macOS, Windows and Linux.

The malicious code was pulled in through a staged dependency called "plain-crypto-js" and was designed to self-destruct after execution. It was only live for about three hours, but that was enough: security firm Huntress reported the first infection on a monitored endpoint just 89 seconds after the compromised version was published.

According to StepSecurity, the malicious dependency was staged 18 hours in advance, three payloads were pre-built for three operating systems, and both release branches were poisoned within 39 minutes of each other. Google's security team has linked the attack to a North Korean group that targets cryptocurrency theft.

This got me thinking: do we actually still need axios? The original reason it became so popular was that it gave you a clean, consistent API for making HTTP requests that worked the same way in the browser and in Node.js. But Node.js has had native fetch since version 18, and it's been stable for a while now. The browser has had it for years. So the problem axios originally solved is basically gone.

For my typical axios usage, I wrote a simple fetch wrapper called fetchios that mirrors the axios API — same .get(), .post(), .create(), interceptors and all. It works as a drop-in module so I don't have to change the code everywhere, just copy the file into utils, swap the import, and remove axios from my dependencies.

Every dependency you add is a potential attack surface — and this incident is a perfect reminder of that. Maybe it's time to stop running npm install axios by inertia and check what the platform already gives you.

I took this picture a couple of weeks ago during one of my early morning walks through Basel's city center. I love capturing shots in the early morning or late afternoon when places are quiet and you get to enjoy the small things that make them what they are — like a gravel pétanque court scattered with pigeons, a lone person sitting quietly on a bench, a bare winter tree, and the twin spires of the Münster poking up above the rooftops in the background. The light made it impossible not to stop and take a photo.

It's one of those scenes that feels completely unhurried, which is something I really appreciate about this city.

A couple of days ago the weather started to get better, so I decided to jump back on my bike and commute to work. I left relatively early to avoid the rush hour and enjoy the morning light.

The weather was perfect, but what was even better was the view on this commute: the sun rising behind the Alps, creating interesting shadows and beautiful colors reflected on Lake Léman. I stopped to take some photos and enjoy the moment.

I felt really lucky to witness such a beautiful scene during my daily commute!

Every year when the health insurance renewal letters arrive, I get that familiar sinking feeling. Premiums going up again? Of course they are. I finally decided to look at the actual numbers, and yeah, the data confirms what we all suspected.

Back in 2001, the average earned premium per insured person was 1,911 CHF. Fast forward to 2024, and we’re looking at 4,234 CHF. That’s a 121% increase over 23 years, or about 3.5% annual growth. Not exactly a surprise, but seeing it spelled out still stings a little.

This year I had to switch to another provider in order to keep my premium increase manageable, and I know I’m not alone in that. Every year, comparing plans and switching providers becomes more of a necessity than a choice. I wonder if a public option could curb these rising costs.

Source: Dashboard de l’assurance-maladie

Sometimes you turn your head while walking and suddenly realize you’ve found the perfect photo spot. That’s exactly what happened yesterday along the shores of Lake Zug. The sun was out, the water was calm, and bare tree branches and wooden posts framed a beautiful view of the edge of the lake, with the town of Zug and the surrounding hills clearly visible in the background under a blue winter sky. It was an amazing view!

I run a small VPS for some personal projects, and I often check the SSH logs to see who’s trying to break in. I have the standard setup: key-based authentication, password login disabled, a non-default SSH port, and fail2ban configured to block IPs after a few failed attempts. But that doesn’t stop the bots from trying.

This week, I decided to do a little analysis of the SSH logs to see where the attacks are coming from, and the results are not surprising but still interesting.

Nearly 31,000 failed login attempts from the top 20 IPs alone. Russia takes the lead with 45% of attacks (20,742 attempts), followed by the US at 30% (8,163 attempts). One particularly persistent Russian IP tried over 9,600 times. Points for determination, I guess?

The geographic diversity is almost impressive: Russia, US, China, Brazil, and South Korea are all represented. It’s like a World Cup of “please let me into your server.”

This is just life when you have an SSH server exposed to the internet. I decided to add some additional security measures this week after seeing the data, but I wanted to share the conclusion of this analysis as a public service to anyone else who might be running a VPS with SSH access.

Stay safe out there.

---

Top 20 most common IP addresses

This morning the winter weather wasn't too bad, so I decided to grab my bike and commute using my favorite mode of transport. As I was passing by the Blancherie parking lot, I had to pull over and turn right: the sunrise against the Alps in the background, reflecting off the calm waters of Lac Léman, was simply too beautiful to skip. I stopped, took a moment to admire it, and then shot the picture you see above. As you can see with the lady in the foreground, I wasn't the only one taken by the view :)

Yesterday I was biking on my way to work, and as I started to climb the hill on the Route de Genève that takes you to the Préverenges roundabout, I turned my head to the right and saw such a beautiful sunrise over Lake Léman, with the Alps in the background, that I had to stop to take the picture you see above.

On this New Year’s Eve of 2026, still recovering from the flu, we chose to celebrate quietly at home, preparing a traditional ajiaco from Bogotá for a late lunch—a dish perfect for a cold day like yesterday. In that simple moment, I felt hopeful that 2026 would be a good year!

Yesterday we had a nice day with A & L. We were looking for a day trip, and since they were absolutely dying to see some snow, I spent some time Googling the closest mountains accessible by public transport in the Vaud region. I eventually stumbled upon Rochers de Naye, and it turned out to be the perfect plan for a quick getaway into the snowy peaks.

We hopped on the cogwheel train from Montreux, and once we reached the top, the kids had the best time playing in the snow and building a snowman. We even got the chance to visit Santa’s Village, walking through a light-decorated tunnel, taking pictures with him, and leaving with a couple of treats in hand.

The train ride itself is an attraction, offering amazing panoramic views, just like the one in the picture above.

One of my favorite places in Basel is the Markthalle. This historic market hall has been transformed into a vibrant food court with a variety of international cuisines. The architecture of the building is quite interesting, with its high ceilings and large windows that let in plenty of natural light during the day.

Last week, when I was passing by the Markthalle at night, I noticed the full moon shining brightly above the building. The combination of the modern "Markthalle" neon lights and the natural glow of the moon created a beautiful view that I tried to capture in the photo above.

One of the joys of spending weekends in Basel is being just steps away from the French border. It’s really easy to slip across early in the morning, pick up fresh bread from a local bakery, and return before sunrise — ready to enjoy breakfast with a still-warm baguette. And as if that weren’t enough, this trip often rewards early risers with breathtaking sunrises, like the one captured in the photo above on Burgfelderstrasse.

Every once in a while, you get lucky enough to witness that exact moment at sunrise when the sun first peeks over the horizon, painting the sky in a beautiful palette of orange and pink hues. That’s exactly what happened in Morges a couple of weeks ago, when I opened the windows to let in the fresh morning air and I was fortunate to capture it in the image above. I hope my significant other is lucky enough to have such a view today. Happy Birthday, K!

A couple of days ago we did our usual day trip from Basel to Bern, but this time we took a really nice walk along the Aare River. We passed by Freibad Marzili and ended up at the Bern Tierpark, enjoying beautiful weather all along the way. We wrapped up the trip with a well-deserved drink before crossing the Kirchenfeldbrücke again. It was the perfect way to unplug from the daily routine!

The Eurovision Song Contest, created in 1956 in Lugano, Switzerland, is considered Europe's longest-running international music competition. It currently includes over 40 participating nations, celebrating a broad variety of musical styles and cultural expressions.

This year, the 69th edition of the competition is taking place in Basel (the third time Switzerland is hosting), and the city has transformed itself into Eurovision Town! Certain public spaces like Münsterplatz are adorned with heart-shaped decorations like the one you see above.

Last weekend, we passed by the Rathaus on the tram, where the Turquoise Carpet event was taking place. For these few weeks, the city has transformed itself into a hub of cultural celebration for Eurovision.

Bern has become one of our favorite destinations for weekend day trips. The fact that it's only an hour from Basel, with plenty of connections throughout the weekend, makes it incredibly easy to just hop on the next available train without much planning at all.

Our usual routine is to get off at the central train station and walk straight to the BärenPark, passing by several iconic Bernese landmarks like the Zytglogge and the Einsteinhaus, and crossing the Nydeggbrücke over the Aare River. The walk always ends at the Gelateria Eiswerkstatt, tucked inside the old tram depot, where we treat ourselves to some ice cream.

It was right there at the BärenPark where I took the photo you see above—on a day when the weather was perfect and the light couldn’t have been better for capturing the moment.

We were lucky that the weather last weekend in Morges was really nice: sunny but not too strong, perfect for a light jersey and a slow walk.

While strolling along the Cure d'Air beach, I sat on a bench near the lake and noticed a couple of people taking pictures. Among them, two women caught my attention, standing with the mountains behind them and the sun in front.

The scene felt perfect for a picture: the light, the contrast, and our shared desire to capture the moment came together to create the composition you see above.

This year, A and L were really eager to see the famous Morgenstreich—they’d been hearing about it non-stop. I hadn’t been in a while, not since COVID and everything, but I wanted to make them happy. So, I got up before 4 AM, as one must, and found a spot that wasn’t too crowded (at least by Morgenstreich standards). We ended up spending almost 45 minutes immersed in the atmosphere, listening to the different groups in traditional costumes play the drums and piccolos, marching alongside the iconic lanterns. It was there that I took the picture you see above.

Last week, EPFL announced on its official news channel that it had launched a Mastodon server (social.epfl.ch) for its academic community, choosing this platform because it aligns with its open science values and offers independence from corporate-controlled social media.

Although I've been away from traditional social media platforms for some time, I welcome this initiative and really hope it succeeds. The decentralised nature of Mastodon, combined with transparent algorithms and user privacy, offers a refreshing alternative to mainstream platforms. Additionally, it's really nice to see EPFL supporting high-impact open source projects.

The history of the famous German physicist Albert Einstein is closely intertwined with that of the renowned Swiss city of Bern. It was here, in 1905, while working at the patent office, that Einstein published four groundbreaking scientific papers that changed the course of modern physics: the photoelectric effect, Brownian motion, the special theory of relativity, and the iconic equation E = mc².

Many years ago, when I visited Bern for the first time, I had the opportunity to visit the Einstein House, a museum located in the apartment where Einstein lived during his time in the city. However, last weekend, I discovered something new: the bench near the Bear Pit that I had passed many times also features a statue of the famous physicist. Quite fascinating!

A couple of days ago, winter came early to Basel, and out of nowhere, the city turned into a winter wonderland. Snow was falling throughout the day and night, and the next day, the city was completely covered in white. It was so sudden that the city was not prepared for it; as a result, many tram lines were not working, and the streets were full of snow. The snowplows were out and about, trying to clear the streets, while people walked around in their winter jackets and boots.

Nevertheless, it was a beautiful sight to see! I took a walk through the city and captured some pictures, like the one above, taken over the Rhine River, next to the Wettstein Bridge. I always love the sight of snow falling and the city covered in white—it is so peaceful and quiet. Walking on fresh snow is always enjoyable, especially with the crunching sound under your feet.

A couple of weeks ago, I visited the Basel Herbstmesse. This year, I had the chance to ride the Ferris wheel again, which they usually set up on Münsterplatz. From the top, I snapped this picture showing the cathedral and the Rhine River in the background. The view is amazing, and it gives a nice perspective on the city!

Even though I've been going to this fair for years, I realized I’d never actually read up on its history. Turns out, it’s not just any fair; it’s the oldest and largest in Switzerland. It’s been held in Basel since 1471! The fair was first allowed by Emperor Friedrich III and started out as a market for selling goods and livestock. Hard to imagine that now, with all the rides, food stalls, and fun attractions we see today.

The fair’s changed a lot over the centuries, but it’s amazing how it still feels like a local tradition and brings the whole city together every year. If you’re ever in Basel during Herbstmesse, I definitely recommend a ride on the Ferris wheel for those city views—it’s worth it!

AnimeGAN is a deep learning model designed to convert real-world images or videos into anime-style artwork. Using this model, it's possible to transform photos into nice anime-style images that look like they were taken from a Japanese animation.

A couple of weeks ago I passed by this place early in the morning and was able to capture a nice photo of the beach. I decided to use the Tensorflow.js version of this AnimeGAN model to convert the photo into an anime-style image. The result is quite interesting, as you can see in the image above.

One of my favorite plans is to jump on a train and head to Geneva. I always walk along Quai Gustave-Ador to the Jet d'Eau, enjoying the nice path along Lake Geneva.

A couple of days ago, I did this again. After passing the Jet d'Eau, I looked back and noticed the setting sun creating a beautiful backlight behind the fountain. It was a view that I thought was worth a picture, so I quickly captured the moment with my camera.

This unexpected photo turned out to be one of my favorites from that spot, so I'm sharing it here with you.

Last week, I had the opportunity to visit the village just before the Vallorbe station, thanks to a kind invitation from a friend and former work colleague. He invited me for dinner at his house, which is conveniently located right next to the station 'Le Day'. Not only was it a very pleasant evening with excellent food and company, but it was equally interesting to get to know this region of Vaud.

Before heading to his place, he suggested that we take a walk near a meadow where we spotted some chamois grazing on the cliff near the viaduct. These animals are indeed very interesting. We then went through the tunnel under the viaduct, where I had the opportunity to take the photo above.

It’s a very nice region, and I will definitely come back.

Last week, we were walking near Schützenmatt Park when we stumbled upon an unusual sight in the middle of the central meadow. One of the storks that typically wanders through the park in the early morning was having a confrontation with a bird of prey, which looked like a falcon. The scene unfolded over a few minutes, during which the stork protested with its distinctive "clack-clack-clack-clack." Finally, the falcon got fed up and flew off to a branch of a nearby tree, close to where we had parked our bikes.

L. and I discussed how unusual this situation was. It's rare to see such wildlife behaving this way in the middle of an urban park. It made me wonder if the argument had started earlier, perhaps in the sky, between these two fascinating birds.

A few weeks back, I visited a dear old friend, whom I have known since our school days and who now lives close to me in Vaud, Switzerland. My routine for these visits usually involves taking the train to Montreux and getting off at the Burier station. This time, everything aligned perfectly, allowing me to witness a really nice sunset painting a particularly quiet Lake Léman in vibrant colors.

It has been almost 9 years since the last time I had the opportunity to visit Locarno. This is a beautiful city in southern Switzerland, located on the northern shore of Lake Maggiore. It is known for its mild climate, its Mediterranean air, and its amazing landscapes. Last night I took this picture in the Piazza Grande, which is the main square in the city center. I remembered that on that occasion in 2016, I attended a screening of the movie "Lo chiamavano Trinità" in this square.

Augusta Raurica is an ancient Roman archaeological site located near the modern town of Kaiseraugst, Switzerland. It was once a thriving Roman settlement and served as the capital of the Roman province of Rhaetia. Augusta Raurica was founded in the 1st century BCE and reached its peak during the 1st and 2nd centuries CE.

The proximity to Basel, along with convenient transportation options, makes this place an excellent destination for a day trip, especially when the weather is nice. Last weekend we visited this place again and enjoyed a walk around the site. It's interesting because it contains a number of well-preserved ruins, including the theater, the temple, and the forum. Highly recommended if you are visiting Basel.

Yesterday we celebrated New Year's Eve in Switzerland with a delightful dish from Bogotá called Ajiaco con Pollo. We placed the steaming pot at the center of the table, and everyone served themselves a good amount, adding capers, cream, and the all-important avocado slices. This Colombian dish always brings back nice memories of my childhood, so I was delighted to discover that we still had some dried "guascas" to recreate it as close as possible to the real deal. Wishing everyone a Happy New Year 2024!

A few weeks ago, Basel experienced an unusually chilly couple of days, including a particularly frosty weekend that gave us a fresh layer of snow. This wintry weather was the perfect excuse to enjoy classic winter activities such as crafting snowmen, engaging in friendly snowball battles, and enjoying some fun ice sliding.

The following day was bright and sunny, but the lingering cold ensured the snow stuck around a bit longer. These moments presented some interesting photo opportunities, such as the one captured in the image above. The photo shows the sun's rays creating interesting patterns on the snowy rooftop.

Every time I visited Geneva and had to wait on the train station platforms, I noticed those luminous works of art in the street in front, and I always wondered what the story behind them was. The last time I visited Geneva, I took the photo you see above when I was passing by.

Some days ago, I read the story of those displays, and it's as interesting as they are beautiful: in December 2016, this work, titled "Pinta Cura", created by the local artist Frédéric Post, was set up in the center of Geneva for the 3rd edition of the Geneva Lux Festival. The work depicts the shamanic symbolism of yagé medicine among some indigenous peoples of Colombia, featuring the figures of the anaconda and the jaguar, two animals of power linked to healing and care.

The Eurostat website published an interesting article that emphasizes the increasing importance of digital skills in response to technological advancements. It discusses how the EU aims for at least 80% of adults to have at least basic digital skills by 2030.

It also describes how, even though around 90% of EU citizens use the internet weekly, only 54% on average had basic or above-basic digital skills in 2021. Finland and the Netherlands led with 79%, followed by Ireland (70%) and Denmark (69%), highlighting disparities in digital proficiency across EU countries.

As more and more of our traditional activities move even further online, investing in digital skills education from an early age would seem to be a wise decision. I hope the EU governments will prioritise it.

A couple of days ago, when I was coming back from work and arriving in the picturesque town where I live, I started to think: what would happen if I told one of the AI tools to paint this place using the Impressionist technique, and then told it to describe it? Well, here is the result of this experiment:

"In an Impressionist painting of the Swiss town of Morges, we are transported to a tranquil and picturesque scene next to the pier of Lake Geneva. The essence of the Impressionist style is to capture the fleeting moment, the play of light and color, and the atmospheric ambiance. In this particular painting, the artist has masterfully conveyed these elements.

The canvas is alive with vibrant, dappled colors that dance across the scene. The shimmering waters of Lake Geneva, in soft shades of blues and greens, extend toward the horizon, creating a reflective surface that mirrors the world above. The surface of the lake is beautifully textured with strokes of various shades, conveying the rippling movement of the water..."

This is just an excerpt because the machine then started to describe parts of Morges that are not in the painting, but still, this visual and textual test was quite interesting.

I've been fortunate to explore several European sites showcasing remnants of Roman civilization, such as the Colosseum in Rome, the Library of Celsus in Turkey, the Theater of Mérida, and the city of Augusta Raurica. However, Pompeii undoubtedly stands in a different league altogether. Last weekend I had the opportunity to go there, and it was a truly fascinating experience.

Since this Roman city was frozen in time by the catastrophic eruption of Mount Vesuvius in 79 AD and remained undiscovered for centuries, the extent of its preservation is remarkable. It's surreal to find yourself walking along the original Roman streets, where horse-drawn carriages once rode. These narrow, cobblestone streets are flanked by impeccably preserved remnants of residences, stores, and public structures, such as the Amphitheater, the Forum, and even the impressive Tower of Mercury, which offers a panoramic view of the vast archaeological park.

Quite a magical place!

A couple of days ago I had the opportunity to visit Geneva again with a good friend of mine who was visiting the region for the first time. We decided to pay a visit to this interesting city without a definite plan, just to chill and walk around. When we were passing near the cathedral, I noticed there were some people up in the tower, and I suggested we go up to get a panoramic view of the city (I had never done it before).

The plan turned out to be a very interesting one, offering beautiful views of the different parts of the city with a clear and sunny sky. One of those views is captured in the photograph above: the iconic Jet d'Eau in the middle of the clear waters of Lake Geneva.

Saint-Sulpice, a beautiful village close to Lausanne and Ecublens, has some amazing scenery along its lakeside promenade. One of the landmarks in this nice place is a meticulously preserved 12th-century church, which you can see in this backlit picture taken a couple of days ago.

This picture, taken in Morges last weekend, features an amazing landscape with an interesting composition: in the foreground, there is a group of multicolored tulips arranged in a nice row; in the middle ground, there is Lake Léman with some boats and reflections on the lake; and finally, in the background, there are the alpine mountains with snow-capped peaks.

I think the contrast of colors in this picture is particularly nice, with the bright colors of the tulips contrasting with the blue and green hues of the lake and the earthy tones of the mountains, combined with the perfect sunset light. Nice!

A couple of days ago, while strolling through the center of Geneva, I stumbled upon a fascinating sight: an interesting composition in the background, with the Jet d'Eau visible in the distance, seemingly on the verge of reaching the grey clouds before it started to rain.

The Tulip Festival in Morges is an annual event that takes place in this picturesque Vaudois town. The festival is dedicated to celebrating the arrival of spring and the blooming of thousands of tulips that adorn the parks and gardens of Morges.

A couple of days ago, as I was strolling near the lake, my eyes caught this interesting sight. The scenery featured the lake and the mountains in the background, with bright yellow tulips in the foreground. I couldn't help but think that it would make a nice composition for a photo, such as the one I attempted above.

One of the advantages of the EPFL campus is its location relatively close to Lake Léman. Sometimes the landscapes that can be seen in the background are really spectacular, and this was indeed what happened last week: I was on the esplanade walking towards the library when I noticed in the background a composition that I thought definitely deserved a photo and a post.

As the sun began to rise over the horizon, the sky above the town of Morges was awash with brilliant shades of pink and orange. The tranquil waters of Lake Geneva below reflected these vibrant hues, creating a stunning and serene scene.

The calm waters of Lake Geneva stretched out into the distance, their surface rippling gently in the light breeze. As the sun continued to rise, the colors of the sky deepened and the reflections on the water became even more pronounced, creating a breathtaking visual spectacle.

... and all this text was AI-generated just by asking the model to describe this picture. I had to make some corrections, but it was still quite impressive :)

Last week I was at the office when suddenly it started to snow heavily, and I could see the snowflakes falling very quickly through the window. I thought at that moment that it would be worth taking a picture, and you can see the result above.

Sometimes taking a good picture involves a bit of good luck and being in the right place at the right time. That's just what happened in Morges, Switzerland, a couple of days ago. I was riding back on my bike after buying some coffee when I noticed the silhouette of the Morges church reflected in the lake, with that spectacular sunset in the background. It was definitely a moment that called for me to stop and take this shot!

Yesterday when we were on our way home, my girlfriend pointed out the window and said, "Look, look there in the background." At first I couldn't see what she was talking about, but then I spotted them: the amazing Bernese Alps on full display in the background. I quickly snapped this shot with my phone, which you can see in the picture above. Really nice!

A couple of days ago I was testing my electric bike, riding from the university to Vevey (about 25 km). At some point, when the sunlight was starting to dim, I decided to stop and look back, and I saw this beautiful sky that I captured in the photo you find in this post.

This morning, before starting work, I noticed that the day was quite beautiful, with a bright sun, so I went for a short walk to the lake here in Morges. While passing by the harbor, I captured this image with an interesting composition.

Nice picture of the moonlight casting the shadows of a tree's branches, taken a couple of days ago in Morges, Vaud, Switzerland.

The city center of Morges can be quite beautiful on snowy days in these winter months. That was the case a couple of days ago, as you can see in the photo above.

On this first day of 2022 I had the opportunity to enjoy this beautiful sunset on the shore of Lake Geneva, with the church of Morges in the background. I felt at that moment that, in spite of the difficult beginning of 2022, I had hope that everything would get better and that it would be a great year!

Last week when I was leaving work, the light was just perfect to take this snapshot at the EPFL campus.

Lausanne is a city that can be quite photogenic, and one of my favorite areas for taking photos is Ouchy. This area has stunning views of the lake with the Alps in the background. A couple of weeks ago I took this photo of the Éole sculpture, created by Clelia Bettua in 1995.

Last week I went out at lunchtime for a little walk to the lake, which is quite close to my home office. Although the day was quite cold, the sun reflecting on Lake Geneva created a beautiful view that I captured in the photo you can see above.

The number of COVID-19 cases in Switzerland increased dramatically in November, reaching more than 10,000 at the beginning of the month, which forced the cantonal and federal authorities to take strict measures to prevent contagion.

One of the main differences with respect to the wave that occurred in the spring is that the number of hospitalizations has increased significantly, as can be seen in the graph above. We hope that the measures taken by the authorities will help to control this new peak. Of course, everybody has to do their part: #wearamask.

Both in Basel city and Zurich, it is required to wear a face mask in order to reduce COVID-19 transmission. The country flattened the curve, but as soon as it began to reopen, cases started to go up again. The cantons of Geneva, Vaud, and Zurich are the most affected, as can be seen in the graph above.

There have been a few articles in the news lately discussing how the current occupant of the White House is losing ground against his Democratic rival, including: The remarkable collapse of Donald Trump's polling numbers and States that Trump won easily in 2016 are looking tight for him in November. The news is not surprising, given the horrible COVID-19 numbers in the USA, its economic impact, and the wave of protests against police brutality. The data from RealClearPolitics seems to confirm this trend.

The US Democratic primaries are around the corner, with the first state voting next Monday. I was curious how the Google search trends in the last 7 days reflect on each of the top-tier candidates. Bernie Sanders is clearly winning in that “interest” field. It will be interesting to see what happens in the actual Iowa caucuses.

On the 25th of April, Joe Biden announced he was joining the crowded Democratic primary race. The aggregate polls show an interesting trend. Even before his announcement he was leading the polls, but there was a clear bump in his numbers afterwards. It will be interesting to see what happens in the months ahead. Will those trends continue, and will the main race be between him and Bernie Sanders, or will another candidate get into the top spot? Time will tell.

The official FX data from the Bank of England site shows the changes related to the whole Brexit process. Yesterday it was reported that MPs have voted overwhelmingly to hold Theresa May to her commitment to give them a vote on delaying Brexit if her withdrawal agreement fails to win a majority within the next two weeks. It's interesting how every time Brexit seems to be further away... the better the British currency performs.

The charts above show party control of the US Senate and US House over time since the 19th century.

Yesterday I noticed that the autumn colors are already here. It's beautiful, as you can see in the picture above. However, with the crazy weather this year and the temperature going up and down, I barely realized that this season was already here.

I have always believed one of the main problems with the presidential elections in Colombia, held every four years, is the timing: they always coincide with the Football World Cup! Football is an extremely popular sport in the country, and when the national squad qualifies for the tournament, the country turns its attention away from everything except this event.

The graph above, generated with Google Trends data, supports this point, at least in the online sphere: Colombians are more interested in searching for information about World Cup topics than about the presidential race.

The first round of this election will take place on May 27th and the second round on June 17th (the World Cup starts on the 14th). Just saying...

A couple of weeks ago an article in Business Insider stated that Apple’s iOS was losing market share in Europe's four largest markets (Great Britain, France, Italy, and Spain) as well as Japan. I hadn't checked the global mobile market in a while, and checking the StatCounter stats today shows that Android is clearly dominant on a global scale. It's true Android has some issues, including its well-known fragmentation, but I still prefer the flexibility of this OS over iOS.

Some weeks ago, when I finished work, I was about to leave the building and saw on the wall a sheet of paper with information about a Vue.js meetup here in Berlin. I had never heard about Vue.js, and the more I read, the more interested I became in this front-end JavaScript framework.

Google Trends shows that Vue.js has been the most popular framework in the last 12 months. Vue.js is self-described as "a progressive framework for building user interfaces. Unlike other monolithic frameworks, Vue is designed from the ground up to be incrementally adoptable". I gave it a go, and it's quite interesting.

When Theresa May announced her intention to call a general election back in April, the Conservative lead over Labour in the polls was around 21%. As you can see in the graph above, this lead has been shrinking over time. It will be very interesting to see what happens in this election next month.

Today the French are voting in their presidential election, and the possibility of having a far-right president, who has campaigned against Europe and NATO, brings dark clouds to the European horizon. I'm hoping the French people will reject those proposals. Allez les Bleus!

A couple of days ago, on March 8th, it was International Women's Day. I was chatting with some family members about whether this day should exist at all (they were arguing that every day should be that day). I was checking the pay gap between men and women in European countries, and I think there is still a reason to celebrate this day.

Wikipedia provides an article containing a list of the top 100 sites in the world in terms of traffic, using Alexa and SimilarWeb as sources. The chart above shows the count of site types based on that list, and search engines are the top category by far. Now, it's interesting to see that this is due to the massive popularity of Google around the world: its localized versions in many countries make it into the top 100 list:

Sometimes you look out the window and the view is so nice that it doesn't look like a normal window but rather like a picture that was presented to you instead. That was the case today.

The poll aggregates from RealClearPolitics show that opinion of Trump has never been more favorable than unfavorable. In fact, it has been reported that he took office as one of the most unpopular presidents in modern history. The trend shows it's going down again after a short increase following the election.

Wikipedia has a useful page with a lot of statistics about Switzerland. The chart above shows the number of live births per year. Very relevant information today.

Looking at the final 2016 US presidential election results, it's remarkable how badly Trump lost in California: 8.7 million vs 4.4 million votes. It's not surprising that in the days after the election the #calexit hashtag started to trend. Clinton won the popular vote, so many Americans will feel underrepresented by the electoral college system they have in place, but nowhere is this more dramatic than in California.

Not surprising. The Earth's temperature measured by NASA in September was the warmest ever recorded for that month. http://data.giss.nasa.gov/gistemp/tabledata_v3/GLB.Ts.txt. This follows the same pattern as every month this year. The Paris climate agreement clearly recognized the wide impact of global warming, but with the recent results of the US elections, this issue needs to be raised constantly.

This morning I woke up very early feeling a bit uneasy. I started to follow the live US presidential coverage, and then slowly it became clear that the Republican nominee was going to win. As I mentioned a couple of days ago, the main danger with this outcome is that nationalist groups might feel empowered to spread and promote their hate speech. I'm really hoping this won't happen. And it was definitely a complete poll miss. A dangerous one.

Alright, the latest 4-way presidential polls still put Clinton slightly ahead. Fingers crossed the lead will hold. Yesterday the FBI director sent a letter clarifying there was nothing new in the emails from last week, so I hope US voters will be able to weigh the flaws of the Democratic nominee against the real sexist, racist, protectionist, and xenophobic positions of the Republican nominee.

I hadn't checked the mobile OS market share in a while. According to NetMarketShare, Android had 68.5% and iOS 25.8% last month. I'm curious how this will be affected by the whole Note 7 issue. Still, the growth compared with just 2 years ago is impressive.

Yesterday I saw the excellent documentary "Hate Rising" (https://www.youtube.com/watch?v=gOsRktPBNhI), a film where the journalist Jorge Ramos explores how the current US election has empowered white nationalist groups, leading to a rise in hate in that country, including attacks on minority communities. This documentary brought back memories of my mother, because I'm sure she would be extremely disappointed. Before she got sick and passed away, she worked with the Girl Scouts of the USA, setting up programs to make Latino girls proud of their heritage and to help all girls feel equal and part of one nation.

"The most important task in my job is to make one world. It's important for the Latinos and it's important for the American people.", my mom used to say. I have been following the US presidential election closely, not only because I have many relatives and friends living in that country, but also because I truly believe its outcome will have important repercussions around the world.

If you don't want to live in a country where hate is normalized, where sexist and misogynist views come from the top leadership, and where your liberties and rights get curtailed under the "law and order" sophism, please vote in this binary election! As a European, I followed the Brexit vote closely because I still think the European Union project has brought a lot of stability and peace to this continent, and I thought it would be bad for my adopted Irish nation. As you know, the Leave camp won mainly on “immigration control” grounds, and unfortunately the attacks against immigrant communities increased immediately after the vote. The future of this nation looks gloomy, since most of the promises of the Leave camp were not attainable.

On the other hand, as a Colombian, I was extremely hopeful about the referendum to accept the peace agreements signed in Cuba to put an end to the oldest civil conflict on the Latin American continent. For the first time during the civil war, the two sides were serious about ending the conflict and didn’t use the talks as a strategy of war. It pained my heart to see how a disinformation campaign orchestrated by the opposition helped the No camp win. Now, this conflict, affecting mainly the minority populations living in the most remote and poorest parts of the country, is in a very dangerous stalemate.

As an immigrant on the other side of the Atlantic, I'm really hoping the people appearing in Jorge’s documentary are a minority and that they don't reflect the United States population overall. And I really hope the outcome of the US presidential election will reflect this.

So please don't fall into the fear trap: go out and vote to take a stand against the people attacking the diversity that’s so needed in this world.

I have been using Python for many years and I recognize how powerful it is for data science with libraries like Pandas and Scikit-Learn. In a previous role, I had the opportunity to use R, but I haven't touched it in a while. I was curious to see the interest in R vs Python on Google Trends, and you can see the graph above plotted with this data source.

Last weekend I finished converting the FX calculator I developed during my career break to React.js. I have briefly touched some React code at work, but I wanted to get my hands dirty and better understand the advantages and challenges of this library.

Today I was also checking some interesting [Google Trends data](https://t.co/aCOxxTOhUo) about the most popular JavaScript frameworks in terms of search interest, and React is definitely winning the interest war.

FiveThirtyEight, an interesting site focused on opinion poll analysis, has become one of the most quoted sites in political news. A couple of days ago they published an interesting article on what the US electoral map would look like if only women voted, based on their poll models. It's interesting how it would be a landslide defeat for Donald Trump!

According to Nielsen, the viewer numbers for the first presidential debate between Trump and Clinton are out, and it was the most viewed debate in the history of presidential debates (84 million viewers). The second closest was the one between Reagan and Carter in 1980.

I hadn't checked the global search engine market share in a while because Google clearly dominates in almost every country, but yesterday I heard an interesting podcast on the BBC about the power of Google, and I was curious about the position of the 2nd and 3rd players. The chart above is generated with data from StatCounter.

Alexa and SimilarWeb rank Wikipedia as the 7th and 9th most visited site on the web, so the visit statistics produced by the foundation are a good proxy for getting data on the most popular platforms on the web. The chart above shows the visits by OS family. As you can see, Windows 7 is the most popular desktop OS, but mobile operating systems (Android and iOS) are responsible for almost 40% of the visits to those sites.

The US presidential election is far from over, since there are still some weeks ahead until November, but it's comforting to see evidence in the polls that Trump's divisive campaign is not "winning" at all.

The map above shows the countries that currently have or have ever had a female head of state. It's true that the historic nomination of Hillary Clinton is a milestone in U.S. politics, but it is not one in many countries of the world.

Last weekend my girlfriend and I took a long weekend trip to the Ticino region of Switzerland, staying in Locarno. I wasn't aware that the Locarno Film Festival was starting this week, and part of this event was a preview showing of a movie on Sunday night, open to the public.

The organizers decided to honor Bud Spencer, one of the classic Italian actors of the 70s in the action-comedy genre, who passed away earlier this year. They featured Lo chiamavano Trinità, one of the best examples of the "Spaghetti Western" genre. I really enjoyed this movie! It brought back nice memories, since the movies featuring the duo Bud Spencer / Terence Hill were one of my grandpa's favorites.

This morning I was reading an interesting section dedicated to the US elections on the FiveThirtyEight site. It tries to predict who will win the election based on the polls and historical data. They have been very accurate in the past, so it is definitely an interesting source.

One of the articles linked on this site was a post titled "Why Obama Might Be Trump's Biggest Challenge," which discussed how President Obama is enjoying a high approval rate. The chart above is generated with the RealClearPolitics data they mentioned in the post.

I was discussing it with a colleague a couple of days ago: Facebook's React is definitely here to stay. Look at the graphs above showing the increase in Wikipedia page views during the last year and the growing trend on Stack Overflow.

In the Canton of Solothurn, Switzerland, there is a Benedictine monastery called Mariastein, relatively close to Basel. Apparently, this place is a must for the Catholics, but it's also a nice place to walk around in the fields, as you can see in this picture we took yesterday.

Browser usage according to the Wikipedia article on browser usage and the global stats reported by W3Counter. Not surprisingly, Chrome is the most popular browser today, and fortunately, IE is in complete decline.

Yesterday I did a nice bike ride from Berlin to Lake Wandlitz, located some 30 km north of the capital. The area is really beautiful, as you can see in this picture.

If you analyze the last 30 days of Trump's and Sanders' Twitter feeds and plot the word frequency in a word cloud, it reveals what these candidates stand for. Guess which one belongs to whom?

Last night, when I was reading about the EgyptAir hijacking, I was thinking that fortunately this type of incident is now very rare. I remember that when I was a kid, this was one of the clichés in the American movies of the 80s (e.g., Delta Force), but with the tough security measures in place at most airports, this doesn't happen as often.

Wikipedia has a detailed compilation of aircraft hijacking incidents, and there is definitely a decrease compared to the peak in the 70s.

Wikipedia has a list of the terrorist incidents that happened during the current year. Based on this information, the countries most affected by the number of terror incidents are:

Asylum is defined as the protection granted by a nation to someone who has left their native country as a political refugee, mainly for fear of being persecuted for reasons of race, religion, nationality, membership of a particular social group, or political opinion. Due to the raging conflict in Syria, there has been a sharp increase in the number of refugees coming to Europe.

The latest quarterly data report by Eurostat demonstrates this upward trend. Germany and Sweden are the countries that have welcomed the highest number of asylum seekers.

I hadn't checked the operating system market share for desktop and mobile in a while. Based on data from StatCounter, the usual suspects dominate: Windows and Android lead in each sector, respectively.

The last episode of the excellent show Last Week Tonight with John Oliver dealt with a very contentious issue in the US: abortion laws. I really like the approach he took on this matter, acknowledging there are different positions on this topic, but hammering the "hypocritical" laws that, under the umbrella of protecting "women's health", create barriers for people who need this medical procedure and unfortunately don't have the money to go somewhere else.

The next map shows the US states that had enacted laws to force women requiring an abortion to see an ultrasound of the unwanted pregnancy:

Yesterday at the office we were discussing the possibility of the UK leaving the European Union. Some time ago, we actually wrote on our company blog about what Brexit would mean for European workers. But with all this Brexit discussion, we forget the UK is actually one of the oldest members of the European Union (1973).

You can check this map in detail here

It is hard to assess what the most popular programming languages are because there are multiple ways to measure them, but none of them are perfect (i.e., repositories, lines of code, occurrences in job offers, etc.). For example, if you work with embedded systems, C is very popular, but if you work on the web, the story is very different.

One interesting measure of a language's popularity is the number of questions asked about it. Stack Overflow features questions and answers on a wide range of programming languages and compiles a list of the most popular tags, with a breakdown by total, today, and this week.

This data is a nice proxy for how popular the different programming languages are.

Last night I was reading a headline in Business Insider about how Bernie Sanders just melted away a 30-point Hillary Clinton lead in a new poll related to the US presidential elections. Wikipedia has a useful article that tracks the different polls for both parties. The results of those polls are reported here on that page: Democratic Primaries.

It's true that the last poll conducted by Quinnipiac University shows a preference of: Clinton: 44% and Sanders: 42%, and with a 4.5% margin of error, they are virtually tied. There is even a newer one conducted by "Reuters/Ipsos" showing a similar trend: Clinton: 48% and Sanders: 45% (with a 5% margin of error).

It's fascinating to see how this candidate, without any of the infamous [super PACs](https://en.wikipedia.org/wiki/Political_action_committee#Super_PACs) behind him, has been able to attract so much attention and has become a real contender in the US 2016 presidential elections.

Yesterday I was reading the news about Apple. On Tuesday, they reported the financial results of their fiscal first quarter. One conclusion from this event is that even with record profits, iPhone sales rose by less than 1 percent from a year earlier.

I was checking the Mobile & Tablet operating systems market share data published by netmarketshare.net and this downward trend is clear:

I never owned an iPhone. I really like the quality of the hardware and software produced by this company (In fact, I'm writing this post on a MacBook Air), but I don't like the closed, restricted ecosystem associated with their business model. It's refreshing to see so many different Android devices on the market.