Jake versus 2025

Christmas is quieting down in my household, marking the end of yet another crazy life-changing year. At the end of last year, I told myself I needed to slow down and get to a more sustainable place. Needless to say that hasn't happened at all. Instead, life has developed and progressed in unexpected ways.

Last year, I started a traditional "year in review" style post, to go along with my also-stolen "state of the server" posts. I found it really useful to review what I've done in the last 12 months, digest it, and vaguely make plans for the upcoming year.

In no particular order, here are the highlights of my 2025:

#We bought a house

2025 started with a simple goal - let's buy a house. Around the middle of the year, my partner and I traded our 2-bedroom flat for a 90's 3-bedroom house with a garden, garage and driveway. We started searching at the beginning of the year, and after bailing on one property (something something illegal loft conversion), I moved around more money than I ever had before and we bought our first home.

Most people will say that buying a house is stressful - those people are correct. My partner disagrees. At the beginning of the year, she believed the hard bit was delving through Rightmove, searching for properties which fit our need and budget and going on viewings. In reality, that's the fun bit. The sea of legalese was a lot for her, and her brain switched off - leaving me to review and understand the mountain of confusing yet incredibly important paperwork. I'm not a lawyer, and after this I know I never want to be.

Even once we were in, there was still plenty of work to do. The previous owners clearly didn't care too much about the house. Nothing was damaged or especially mucky, but everything just looked tired and needed a bit of TLC. Every wall needed painting and every surface needed deep cleaning before we could even think about putting our mark on the place. Just 3 days after picking up the keys, we decided the main bathroom was too dirty and dated to use, so we redid the entire thing.

In the last few months, I've discovered I quite enjoy DIY. Again, I'm not doing a seemingly-cliche job change into manual labour, but being able to fix or improve something myself, rather than leaning on a contractor has been really empowering. It's not been anything complex - fitting blinds, replacing door handles, upgrading a bathroom extractor fan, changing light fittings, swapping taps - but I've loved it.

#Standing desk

As part of setting up my new office, we needed some desk changes. The 3^rd bedroom needed to serve as our office, but at the time we both had gigantic desks which overlapped and wouldn't fit. Reluctantly, I agreed to shrink my desk, on the basis I didn't need all that room for a couple of monitors and a keyboard.

If I was going to change desk though, I might as well upgrade. Around a year ago, I contemplated getting a standing desk, so I didn't spend quite so much of my day sitting on my lazy arse. I opted against it, since standing desks are expensive, and I wasn't completely sold on whether I'd actually use it.

This time around, I did a little more research than just sticking with Ikea. I stumbled on Wayfair - a company I keep forgetting exists when I need furniture. They had an electric standing desk for just ~£100 - so I bought one (140cm x 60cm). Sure, they weren't as glamorous as other brands, and the desk top came in 3 pieces (yes, really - but it's not that bad), but for just £100, it felt worthwhile to try and see if it was for me. Worst case scenario, it's a slightly expensive desk - Best case scenario I can get a better desk in the future when I probably have more space to work with.

Fast forward 3 months of use, and I really like it. I don't stand up at it too often, but I find even if I just stand up for meetings (or take stand-ups literally), then it's enough to keep the blood in my legs moving as it should be. The desk itself tilts a little if I lean on it too hard, but otherwise I can't fault it - especially for the money. Moving the desk out of the way to manage cables underneath it is much more comfortable, and I can even tweak the height very slightly if I'm feeling tired and want to slouch a little. Given these options are out there, especially at this price,, I don't think I'd go back to a fixed-height desk.

#Tailscale London Meetup

2025 was not without its "Alex Kretzschmar nerd-snipe". In this year's instalment, I received a message one Wednesday evening about an upcoming (the next week!) Tailscale meetup in London, and they were looking for speakers. I've been using Tailscale reasonably happily for the last year or so, and Alex knows I enjoy making technology do weird things, so it was a natural fit.

So, after spending a week writing a script, I turned up in London and talked about my setup - how I take services on my home server, and expose them publicly, without using any Tailscale infrastructure (eg Funnel). I've written about this setup before, but never talked about it.

I also talked about the incredibly convoluted setup I currently have for running services only on my Tailnet. It's in desperate need of being replaced, but it meets Alex's requirement of "tailscale for fun and/or profit".

There's no recording, but there are slides. But again, I'd recommend the original post.

In 2024, I started engaging on Mastodon much more than before, and joined Bluesky (which I self-host). Fast forward to 2025, and I've completely left Twitter. It's gone from my phone, and the only reason I ever log in is to bypass the login wall when I want to check if services are having outages.

Of the 2 left, I'd say I'm more active on Mastodon - it feels more in the spirit of decentralised networks than Bluesky, even if that's at the cost of less mainstream appeal. If I post something, it still ends up on both, and I try to engage with replies evenly.

#Half Marathon

On October 12^th, I ran a half marathon. Anyone who has met me will think I'm lying - but it's true. In all honesty, I still don't quite believe I did it.

It was such a journey that it deserved its own post.

#Django

2025, much like 2024, has been a crazy year for me and the Django web framework. Many of the foundations laid in 2024 have started to bare fruit:

#django.tasks exists

585 days after first whisperings, the first PR for DEP 14 was finally merged, and as of the Django 6.0 release, the foundations of first-party background tasks are available to all. django-tasks has been included in Wagtail since 6.4, and used on production-grade deployments for well over a year.

It may exist, but this is only the beginning of the long journey - there's still plenty of work to come. I wrote a dedicated post the day the PR merged if you want to find out more about the journey and what comes next.

The craziest moment for me was reviewing the dependency graph and seeing the likes of the Python Software Foundation and EuroPython using django-tasks. With Wagtail, the number of users is growing quickly, and now with Django 6.0 numerous projects big and small will start using my code!

#Bogus CVEs

Back in May, I received a message from a colleague about someone issuing a CVE for Wagtail. This CVE was issued without our knowledge or instruction, about a vulnerability which was already well known and documented against. Regardless, a CNA felt that it deserved a CVE. This meant automated code scans would flag Wagtail 6.4.1 as being vulnerable, despite that not being the case, nor a fix being available.

The long story is quite an interesting tale of browser security. The short story is that CVE-2025-45388 is bogus, is neither a vulnerability in Wagtail nor exploitable, and you should always treat user-uploaded content as hostile.

#Security team

In March, I received a message on the Django forum (I didn't even know Discourse had a private messaging feature) from Sarah Boyce, one of the Django fellows, inviting me to join the Django security team. As someone who has specialised in both Security and Performance over my career, not to mention has worked with Django for over a decade, I jumped at the opportunity.

I've been a member of the Wagtail CMS security team for a few years now, but the Django security team is a far more prestigious position, at least to me.

Since the team communicates primarily over email, I've sent far more emails in the last 9 months than I have in the previous 9 years. I've tried to review every report which comes through, but as you can imagine the security inbox is quite busy, sadly much of it is either regular email spam or AI-assisted spam reports.

In my time so far, I've:

• Authored the fix for 1 issue (CVE-2025-57833)
• Co-authored a few (CVE-2025-48432, CVE 2025-32873)
• Contributed to discussions on the vast majority of reports
• Had to amend a security release 28 minutes after it was published
• Raised some common issues to Python's Security Response Team (see below)
• Helped shape some internal processes

#Reporting a Python CVE

When issues are reported, it can be hard for a security researcher to fully understand the cause of a vulnerability, just its impact. In some cases, vulnerabilities in Django may be rooted in issues further down the stack, notably in Python itself.

Historically, the Django Security Team have received and mitigated a number of reports which were rooted in Python's HTML parser (html.parser). Django leans heavily on this parser for most of its HTML-based operations (tag stripping, HTML-aware truncation etc). Therefore, it's not uncommon for these code paths to receive "untrusted" input from a user, and are expected to be able to handle them.

In most cases, Django has mitigated vulnerabilities by setting more-than-reasonable limits on the amount of data it will reasonably process. Since we had a number of similar reports, all noting different inputs which would cause Python to take extraordinary amounts of time process, we decided to escalate this to the source - Python's Security Response Team (PSRT).

After sharing the details we knew, the PSRT worked on and released a fix (CVE-2025-6069) which drastically improved parsing speed on certain malicious inputs. I'm not sure whether there would be any baseline performance improvements, but since this fix is in Python itself, it helps more than just Django.

#Member of the month

For July 2025, I was the Django Software Foundation Member of the month. Every month, the DSF highlight a member and find out a bit more about them. If you want to find out more about me, and my Django Journey (Djourney?), it's a great read.

#Pycon UK

This year I didn't get to as many conferences as I would have liked. Due to other commitments, I wasn't able to get to Djangocon Europe in Ireland, despite it being much closer than it's been for many years. I'm hoping to get to Athens though, assuming my partner let's me go 🤞 ...

The conference I did get to this year though was Pycon UK. The last Pycon UK I attended was way back in 2018. Since then, the conference felt a lot smaller. This year, I was attending as a speaker, giving a talk based on my recent django-tasks research on stopping code after a timeout. It's well worth a watch if you enjoy Python and systems programming.

Whilst a few colleagues were also attending, I ended up spending most of the conference trying to be more social than usual. I spent most of it either chatting with complete strangers I'd only met at the conference or people I'd met at Djangocon the year before. A personal highlight and bucket-list moment was chatting JITs with the legendary Mark Shannon at dinner on the final day.

Naturally, I left the conference mentally and physically exhausted, but with a brain full of ideas and potential side projects that will likely never see the light of day. Such is always the way at conferences.

I'd love to go back in 2026, but that depends on so many factors.

#End of selfhosted.show

On 30^th May 2025, Episode 150 ("The last one") of the Self Hosted podcast aired. The community which formed around the show has been incredible, and was a big driving force behind much of the content on this website, and helped me kickstart my own audience. I even got the chance to appear back in Episode 42 (which feels like a lifetime ago). It was far from perfect, but it was a good show, and will be missed by many.

If you didn't get the memo, the Discord is still alive and thriving, with well over 8000 members. The show might be gone, but the community (and moderation team) aren't going anywhere!

#I bought an Android tablet

As a present to myself for getting through the fun process of buying a house, I bought myself an Android tablet. I had a tablet in the early 2010s, but eventually stopped using it and sold it. Now that most of my device time is more casual on the sofa than at a desk, a tablet felt like a good form factor for me. If most of what I'm doing is reading rather than writing or server admin, I don't need something as large as a laptop.

Device wise, I went with the Google Pixel Tablet for 1 reason - it can run GrapheneOS. I've not run any modifications to an Android device since I rooted my Galaxy S5 in around 2013. Given my interests in security and privacy, GrapheneOS is a really interesting project to me. Switching to a brand-new less-stable OS on my phone is too risky for me, but starting on a secondary device as a testing ground is perfect. GrapheneOS compatibility is pretty good. The Pixel Tablet I bought came with a speaker dock, but I don't really have a use for it.

Yes, I spent money on an Android tablet in 2025. To some, that may seem crazy, given Android's market share and tablet usage in general. Just a few days after the tablet arrived, MKBHD released this video:

Which, makes some very good point.

So far, I've enjoyed having a tablet - it's more comfortable to use on the sofa or on the floor trying to keep an eye on the little one. Having native apps for a lot of services is nicer than a tonne of separate web apps, and GrapheneOS makes it much less dangerous. Unfortunately, whilst foldables are helping, there aren't that many apps which truly take advantage of a large screen.

I have lots of thoughts on the Pixel Tablet, GrapheneOS and general Android vs Linux usability. If that sounds interesting to you, keep an eye out.

#Website performance is down

Over 2025, traffic to my website has dropped quite a bit. One reason for that could be that I'm not posting quite as much, on account of having much more going on in life than I used to.

However, the timelines correlate with everyone's favourite: AI. In March 2025, Google started rolling out their AI Overview feature, which uses content scraped from websites to generate an answer to whatever someone was searching for. Given most of my content is informational, it's perfect for being stolen and summarised for users to quickly get the answers they're looking for. But, a summary is a long way for an answer, and the impact is that over 2025, traffic has reduced by about 50%. It's not like everyone has disappeared - there are still views coming even from search engines, but it's far from what it used to be.

Sadly, I think this is probably the way the internet is going. AI assistants provide the answer quicker and more easily than users reading an entire page - even if it's exactly what they ask for. As part of some upcoming website changes, I'll be adopting Cloudflare's Content Signals standard, in hopes that legitimate scrapers don't just hoover up and repeat back what I've written without the wider context. Besides that, there's not much I can do besides keep making posts which are engaging in their own rights and hope people engage.

#Website posts

This year, I've written 10 posts on my website - even fewer than the 14 of last year.

In addition to the 10 posts here, I wrote 2 external. The feature I added last year to pull in posts from external sources is being nicely used. I'm hoping other people find them interesting too.

Again, unfortunately this shows yet more of a decline in content from last year. The backlog of ideas is ever growing, with what could be some really fun and cool projects (both for me and others). But whilst I love writing, finding the dedicated time to sink into a project with a young family is naturally rather difficult. 20 minutes here and there is fine, but my brain finds it hard to suddenly context switch away from a project. In the last few weeks, I've started shuffling things around to find more time - I got this and my server recap written just in time. My partner has been amazing - if I need an evening for a call or social event, she'll happily cover for me, but I can't lean on that all the time.

#Miscellaneous

As usual, life is made up of big events and small alike. If I talked about everything in great details, I'd be here until 2027. So instead, here's a quick short list in no particular order - a lightning round of sorts:

• Had the worst flu I've ever experienced
• My first fathers day as a father
• Tried growing Basil, with mixed results
• Helped run 3 robotics competitions
• Bought a lot of furniture and tools
• Found a bug in a punnet of blueberries, and only got £2.50 back from Tesco
• Introduced my colleagues to my partner and my son - in person

#2026

If 2025 goes anything like 2024, it's going to be quite the roller coaster.

Oh how right I was.

2025 was yet another life-changing year. Much of it I wouldn't change for the world. Given my current trajectory, 2026 is either going to be incredible, or burn me out of everything I love. To stay on the right side and enjoying life, here are my goals:

More writing. Much like 2025, I've written a few interesting posts, both here and on other sites, but I still want to do more myself. Every time I write something and click "Publish", I feel a sense of accomplishment - like I've not only done something which makes me happy, but also shared something interesting with other like-minded (hopefully) people. In 2026, I want more of that. I've got lots of projects in my head, technical or otherwise, and I want to get them done and write about them for others to enjoy my journey (or know what not to do).

More switching off. Mental health has been a challenge for me over the last few years, with everything going on. It's time I slow down a little and focus on me. On the plus side, my previous habits of sitting on the sofa neither relaxing nor being productive have almost completely disappeared. However, that's mostly because I don't have the time to sit and stop. In the last few weeks, I've started formulating plans for managing my own time and energy, so I maximise my time as much as possible. Spend time with my family, without losing who I am as an individual, and all without burning out. I think the first step towards that for me is learning how to properly switch off and recharge, and build myself back up from there. If you have any recommendations for balancing family and self, I'd love to hear them.

Oh, that new website I keep talking about - it's been in the works for most of this year, ticking away in the background. I'm hoping to release it soon...