Come wreck your photos :)

There's a small photo site on the internet where your pictures come back worse than you sent them, and you're invited.

It's called phlog.space. It's free, it has no ads, and it doesn't watch you. You upload a photo, it gets shrunk to 400 pixels and then one of 35 effects, picked at random, has its way with it. Your sunset might come back as a fax. Your cat might come back as a Game Boy screen. You only find out after you hit post, and honestly, that's the best part.

I wrote about how phlog.space works a couple of weeks ago. This time I want to show you what's new, and open the hood a little, because the way it's put together is half the charm.

A website from another decade, on purpose #

Every member gets a home page at phlog.space/~yourname, with the tilde, like the university pages of the nineties. There's a guestbook for friends to sign, a hit counter at the bottom, an archive by month, RSS for everyone, and a background picked at random from a pile of more than 700 old tiles, so the site rarely looks the same twice. People can leave one "nice" and a short comment on each photo. There's no algorithm. The front page is just the newest photos, in order.

What's new #

phlog.space keeps growing, slowly and on purpose. Here's what arrived in the last few weeks.

Follow people, and a top 8. You can now follow other members from their profile, and there's a page with only the newest photos from the people you follow. In your settings you can pick up to eight of them to show on your profile, MySpace style, each with their name and their latest photo. Yes, the top 8 drama is back.

Webmentions. When a blog or website links to a photo or a profile on phlog.space, the mention shows up underneath as "mentioned in", with the page title and the author. The site checks on its own that the link really exists, and the mention disappears if the link is removed. The owner of the photo can delete any mention, and a deleted mention never comes back. It's a small piece of the IndieWeb, and it makes the site feel connected to the rest of the web.

Descriptions for screen readers. When you upload or edit a photo, there's an optional field to describe what's in it, for people who browse with a screen reader.

Photos in your feed reader. RSS items now come with a thumbnail of each photo.

Mastodon verification. The profile tips explain how to use your phlog.space page to verify your Mastodon account.

Even less tracking. If you're only visiting, phlog.space doesn't set a single cookie. A cookie shows up only when you log in or fill out a form. The IP addresses and emails used to fight abuse and count visits are now stored scrambled, in a way that can't be reversed, and they're deleted after a day. The terms of use explain all of it in plain words. There was also a round of security fixes, including one that stops a profile from dressing up as the site itself to trick visitors.

And underneath all of this, the code is as old-fashioned as the look. Here are a few things about it that I think are fun.

Zero JavaScript. Really zero. #

There isn't a single line of JavaScript on phlog.space. The site's security header actually forbids scripts from running at all, so even if someone tried to sneak one in, the browser would refuse it. Every interaction, from posting a photo to signing a guestbook, is a plain HTML form followed by a redirect, the way the web worked when forms were the most exciting thing on a page.

The whole design is a single stylesheet. The retro feel comes from ordinary images: those 700-something background tiles, GIF digits for the hit counter, and a classic 88x31 button you can put on your own site.

The effects are hand-painted #

All 35 effects (VHS, fax, Game Boy, Kodachrome, Super 8, cyanotype and the rest) are written by hand, reading and painting the photo one pixel at a time. Together they come to about 1,100 lines of PHP. There's no ImageMagick, no FFmpeg, no ready-made filter library. Everything comes from GD, the image library that already ships with PHP.

The strangest one is databending. It doesn't touch the pixels at all. It opens the compressed JPEG as raw bytes, scrambles a few of them, and then tries to open whatever is left. When it works, you get those blocky, colorful tears that look like a broken digital camera from 2004.

The whole database is one file #

phlog.space runs on SQLite, which means the entire database is a single file sitting next to the code. Members, photos, nices, comments, guestbooks and the rest live in a handful of tables, and the schema is short enough to read in one sitting.

The nicest detail is that the database creates itself on the first visit. Installing the site is literally copying the files to a server and setting the URL.

Plain PHP, nothing else #

The site is written in plain PHP, version 8.1 or newer, with no framework. There's no Composer, no dependencies to download and no build step. The code in the repository is exactly the code that runs. Each address on the site is its own PHP file, and the templates are just PHP too.

For local development, PHP's built-in web server is enough, plus a ten-line router that handles the /~name profile addresses. In production, two rewrite rules do the same job. Email goes out through PHP's own mail() function, and during development the messages land in a log file instead of anyone's inbox.

Security uses only what PHP already offers: proper password hashing, protected session cookies, a CSRF token on every form, rate limiting stored in the same SQLite file, and an allowlist that cleans the HTML members write on their profile pages. Yes, you can write HTML on your profile, even CSS, and yes, marquee is allowed.

What's missing, on purpose #

The list of things phlog.space doesn't have is longer than the list of things it does: no framework, no ORM, no JavaScript, no CDN, no analytics, no job queue, no external cache. The whole site is a few thousand lines of PHP and CSS, released under the MIT license.

It's a reminder that a website can still be small enough to read in an afternoon, and still be a real place where real people post real things.

Come and join #

Here's how to get in:

1. Go to phlog.space and click register.
2. Pick a name. It becomes your address, phlog.space/~yourname, and it can't be changed later, so choose with love.
3. Add an email, a password and a few words about yourself.
4. Check your inbox and click the confirmation link.
5. Wait a little. New accounts are approved by hand, which keeps the spam out and the place cozy. You'll get an email when you're in.

Then bring a photo you like, any JPEG or PNG, and see what happens to it. It's free. If you'd rather keep a picture as it is, there's a switch in settings that turns the effects off.

If you have a site of your own, grab the little button and put it on your links page:

See you there. Sign my guestbook at phlog.space/~murad, and maybe you'll end up in my top 8.

phlog.space