diff --git a/README.md b/README.md
index 4b12e3bd..880be14a 100644
--- a/README.md
+++ b/README.md
@@ -1598,6 +1598,10 @@ interact with copyparty using non-browser clients
 
 * sharex (screenshot utility): see [./contrib/sharex.sxcu](contrib/#sharexsxcu)
 
+* contextlet (web browser integration); see [contrib contextlet](contrib/readme.md#send-to-cppcontextletjson)
+
+* [igloo irc](https://iglooirc.com/): Method: `post` Host: `https://you.com/up/?want=url&pw=hunter2` Multipart: `yes` File parameter: `f`
+
 copyparty returns a truncated sha512sum of your PUT/POST as base64; you can generate the same checksum locally to verify uplaods:
 
     b512(){ printf "$((sha512sum||shasum -a512)|sed -E 's/ .*//;s/(..)/\\x\1/g')"|base64|tr '+/' '-_'|head -c44;}
@@ -1616,7 +1620,7 @@ the commandline uploader [u2c.py](https://github.com/9001/copyparty/tree/hovudst
 
 alternatively there is [rclone](./docs/rclone.md) which allows for bidirectional sync and is *way* more flexible (stream files straight from sftp/s3/gcs to copyparty, ...), although there is no integrity check and it won't work with files over 100 MiB if copyparty is behind cloudflare
 
-* starting from rclone v1.63 (currently [in beta](https://beta.rclone.org/?filter=latest)), rclone will also be faster than u2c.py
+* starting from rclone v1.63, rclone is faster than u2c.py on low-latency connections
 
 
 ## mount as drive
@@ -1625,7 +1629,7 @@ a remote copyparty server as a local filesystem;  go to the control-panel and cl
 
 alternatively, some alternatives roughly sorted by speed (unreproducible benchmark), best first:
 
-* [rclone-webdav](./docs/rclone.md) (25s), read/WRITE ([v1.63-beta](https://beta.rclone.org/?filter=latest))
+* [rclone-webdav](./docs/rclone.md) (25s), read/WRITE (rclone v1.63 or later)
 * [rclone-http](./docs/rclone.md) (26s), read-only
 * [partyfuse.py](./bin/#partyfusepy) (35s), read-only
 * [rclone-ftp](./docs/rclone.md) (47s), read/WRITE
diff --git a/contrib/README.md b/contrib/README.md
index dbb23e5c..50627b09 100644
--- a/contrib/README.md
+++ b/contrib/README.md
@@ -22,6 +22,11 @@ however if your copyparty is behind a reverse-proxy, you may want to use [`share
 * `URL`: full URL to the root folder (with trailing slash) followed by `$regex:1|1$`
 * `pw`: password (remove `Parameters` if anon-write)
 
+### [`send-to-cpp.contextlet.json`](send-to-cpp.contextlet.json)
+* browser integration, kind of? custom rightclick actions and stuff
+* rightclick a pic and send it to copyparty straight from your browser
+* for the [contextlet](https://addons.mozilla.org/en-US/firefox/addon/contextlets/) firefox extension
+
 ### [`media-osd-bgone.ps1`](media-osd-bgone.ps1)
 * disables the [windows OSD popup](https://user-images.githubusercontent.com/241032/122821375-0e08df80-d2dd-11eb-9fd9-184e8aacf1d0.png) (the thing on the left) which appears every time you hit media hotkeys to adjust volume or change song while playing music with the copyparty web-ui, or most other audio players really
 
diff --git a/contrib/send-to-cpp.contextlet.json b/contrib/send-to-cpp.contextlet.json
new file mode 100644
index 00000000..c6988181
--- /dev/null
+++ b/contrib/send-to-cpp.contextlet.json
@@ -0,0 +1,11 @@
+{
+    "code": "// https://addons.mozilla.org/en-US/firefox/addon/contextlets/\n// https://github.com/davidmhammond/contextlets\n\nvar url = 'http://partybox.local:3923/';\nvar pw = 'wark';\n\nvar xhr = new XMLHttpRequest();\nxhr.msg = this.info.linkUrl || this.info.srcUrl;\nxhr.open('POST', url, true);\nxhr.setRequestHeader('Content-Type', 'application/x-www-form-urlencoded;charset=UTF-8');\nxhr.setRequestHeader('PW', pw);\nxhr.send('msg=' + xhr.msg);\n",
+    "contexts": [
+        "link"
+    ],
+    "icons": null,
+    "patterns": "",
+    "scope": "background",
+    "title": "send to cpp",
+    "type": "normal"
+}
\ No newline at end of file
diff --git a/docs/changelog.md b/docs/changelog.md
index 156acd31..4e8a689e 100644
--- a/docs/changelog.md
+++ b/docs/changelog.md
@@ -1,3 +1,34 @@
+▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀  
+# 2023-1231-1849  `v1.9.28`  eo2023
+
+was hoping to finish the IdP stuff during 37c3 but that fell through, so here's all the other recent fixes instead -- happy newyears
+
+## new features
+
+* #66 new permission `.` to grant access to see dotfiles (hidden files) to specific users
+  * and new volflag `dots` to grant access to all users with `r`ead
+  * `-ed` still behaves like before (anyone with `r` can see dotfiles in all volumes)
+* #70 new permission `A` (alias of `rwmda.`) grants read/write/move/delete/admin/dotfiles
+* #67 folder thumbnails can be dotfiles (`.cover.jpg`, `.folder.png`) if the database is enabled (`-e2dsa`)
+* new option `--u2j` to specify default number of parallel file uploads in the up2k browser client
+  * default (2) is good on average; 16 can be good when most uploaders are overseas
+* curl gets plaintext 404/403 messages
+
+## bugfixes
+
+* cors-checking is disabled if the `PW` header is provided, just like the [readme](https://github.com/9001/copyparty#cors) always claimed
+* server would return `200 OK` while trying to return a file that is unreadable due to filesystem permissions
+* `--xdev` still doesn't work on windows, but at least now it doesn't entirely break filesystem indexing
+* fix tiny resource leak due to funky dualstack on macos
+
+## other changes
+
+* logfiles are padded to align messages when `-q` is specified, similar to current/previous behavior without `-q`
+* `--hdr-au-usr` was renamed to `--idp-h-usr` in preparation for other `--idp` things
+  * any mentions of `--hdr-au-usr` are translated to the new name on startup
+
+
+
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀  
 # 2023-1208-2133  `v1.9.27`  another dedup bug