Honeypot.net

This morning the US Supreme Court ruled for Google in Oracle’s case against them. This is wonderful news for American software engineering as the opposite ruling would have been disastrous for the entire industry.

Consider a comprehensive, albeit farfetched, analogy that illustrates how the API is actually used by a programmer. Imagine that you can, via certain keystrokes, instruct a robot to move to a particular file cabinet, to open a certain drawer, and to pick out a specific recipe. With the recipe in hand, the robot then moves to your kitchen and gives it to a cook to prepare the dish. This example mirrors the API’s task-related organizational system. Through your simple command, the robot locates the right recipe and hands it off to the cook. In the same way, typing in a method call prompts the API to locate the correct implementing code and hand it off to your computer. And importantly, to select the dish that you want for your meal, you do not need to know the recipe’s contents, just as a programmer using an API does not need to learn the implementing code. In both situations, learning the simple command is enough.

I think that’s a great analogy, if I do say so myself.

I think Copied is the best clipboard manager available for Apple devices.

I use Copied constantly. It lets me copy 3 different things I see on a web page, then quickly paste them into a text editor without bouncing between the two apps several times. It lets me search my history for stuff I’ve copied earlier, even if I’ve done other things since then. It’s one of the first apps I install on a new device.

I have a few a hard requirements for a clipboard manager:

• It must sync across all my devices. Sometimes I start work on my iPad, or even my iPhone, and later move to a Mac. Other times I start on my Mac then switch to a portable device. I want the things I’ve copied to be available in all these places.
• It has to be rock solid. When I’ve become used being able to access my clipboard history, and then discover it’s not available because the app has crashed and hasn’t been recording, I’m not happy.
• It’s got to be quick. If I’m in the zone working on a project, I want to summon the app with a key press, select the item I want to paste with my keyboard, paste it with my keyboard, then have the app go away.
• The user interface has to be simple. See above. A clipboard manager is a tool that I want to use for one thing and have it disappear until the next time I need it. I don’t want to spend more time playing with its interface than is necessary. It’s not an app I’m going to have open for a while as I poke around in it.

Copied meets all those requirements, and a one time $6 purchase (with family sharing!) covers Mac, iPad, and iPhone apps that sync together with iCloud. It’s simple, quick, reliable, and available everywhere I work. And did I mention it’s a one time purchase? There’s nothing more I could want.

Note that development had paused for a long time after its version 3 came out, and the app stopped working on macOS Catalina. In late 2020 the author released an updated version 4 that works perfectly with Catalina and Big Sur. A few old reviews lament that it broke with an OS upgrade but that’s old information.

If you’ve wished you could copy several things in a row and paste them, or recall something you copied last week, install Copied. It’s great.

Alternatives

Apple’s own Universal Clipboard is excellent, but limited: it uses only Bluetooth to sync directly between devices and requires them to be near each other, it doesn’t keep a history of previously copied items, and it doesn’t support older devices. You can’t beat free, though.

Paste is another great app, but it has two things I don’t like:

• The user interface is pretty but much more complex. This is a matter of personal taste but I find it too powerful. Again, I want to pop in and out of a clipboard manager as quickly as possible, and don’t want anything that slows this down or breaks me out of my thinking.
• It’s hella expensive at $10 per year, or $15 per year for the family plan. That’s way more than I want to spend for a utility that spends almost all its time in the background.

Pastebot is a wonderful Mac-only app. If it had iOS and iPad apps that it synced with, I’d have a hard time deciding between it and Copied. Alas, it doesn’t.

Gladys, Anybuffer, Yoink, and Unclutter are beautiful shelf apps, but are way more complicated than I want in a clipboard manager, and not as good at that specific task as the dedicated apps are. Several of these don’t have cross-platform sync.

Update 2022-03-29: From what I can tell, Copied is dead. Its web page is empty and it’s no longer available in the app store. That’s a pity and I miss it. Until a better option comes along, I’ve bitten the bullet and subscribed to Paste.

Progress bars suck at predicting how long things will take. I’ll tell you what I want (what I really really want): a system-wide resource that receives a description of what the progress bar will be measuring and uses it to make an informed estimate the entire process’s duration. For example, suppose that an application installer will do several things in series, one after another. Perhaps an explanation of that process could be written in a machine-readable format like this:

vendor: Foo Corp
name: My Cool App installer
stages:
- Downloading files:
  - resource: internet
    size: 1000  # Number of MB to download
- Extracting files:
  - resource: disk_read
    size: 1000  # Size of the downloaded archive file, in MB
  - resource: disk_write
    size: 2000  # Size of the extracted archive file, in MB
- Copying files into place:
  - resource: disk_read
    size: 2000  # Now we read the extracted files...
  - resource: disk_write
    size: 2000  # and copy them elsewhere.
- Configuring:
  - resource: cpu
    size: 100  # Expected CPU time in some standard-ish unit

Because I’ve used the progress bar resource before, it knows about how long each of those things might take:

• Since I’m currently on my fast home Internet, that download will probably last about 20 seconds.
• I have a fast SSD, so the “Extracting files” step might be 6 seconds long.
• “Copying files into place” will run at about the same speed, for another 8 second.
• My shiny new CPU can chew through 100 CPU units in 10 seconds.

Ta-da! The whole installation should run about 44 seconds. When the installer runs, instead of updating the progress bar manually like

update_progress_bar(percent=23)

it would tell the resource how far it had gotten in its work with a series of updates like

update_progress_bar('Downloading files', internet=283)
...
update_progress_bar('Copying files into place', disk_read=500)
update_progress_bar('Copying files into place', disk_write=500)
...
update_progress_bar('Configuring', cpu=30)

The app itself would not be responsible for knowing how what percent along it is. How could it? It knows nothing about my system! Furthermore, statistical modeling could lead to more accurate predictions with observations like “Foo Corp always underestimates how many CPU units something will take compared to every other vendor so add 42% to their CPU numbers” or “Bar, Inc.’s website downloads are always slow, so cap the Internet speed at 7MB/s for them.” Hardware vendors could ship preconfigured numbers for new systems based on their disk and CPU speeds where the system can make decent estimates right out of the box. But once a new system is deployed, it gathers observations about its real performance to make better predictions that evolve as it’s used.

We should be able to do a much better job at better job of guessing how long it’s going to take to install an app. This solution needs to exist.

To sign kids up for our city’s Little League baseball program, you have to prove that they’re residents, which is reasonable. What’s not reasonable is the amount of information you have to provide on the registration website. You have to upload scans of a document in each of 3 categories:

Proof of Residency 1 Choose one of the following: Driver’s license, School records, Vehicle records, Employment records, Insurance documents

Proof of Residency 2 Choose one of the following: Welfare/child care records, Federal records, State records, Local records, Support payment records, Homeowner or tenant records, Military records

Proof of Residency 3 Choose one of the following: Voter’s registration, Utility bills, Financial records, Medical records, Internet, cable, or satellite bills

That alone is ripe for identity theft, but couple it with their privacy policy which includes this (emphasis mine):

Without limitation, this typically requires the use of certain personal information, including registration data, event data, and other personal information, to provide program information, special offers or services through Little League and/or its trusted sponsors, partners, or licensees, to fulfill your requests for information or products/services, to maintain a list of verified and eligible participants, to maintain a list of volunteers and provide them with the operating tools to manage leagues, or to respond to your inquiries about our programs.

In other words, you have to upload your most private information and agree to allow them to do as they like with it, including sharing it with whomever they like for any reason they choose.

This is unacceptable.

Update 2021-05-20

I contacted the company that manages Little League’s registrations and asked them to delete the documents I uploaded in order to sign up. They replied that their policy is to do that as soon as they’ve been evaluated. I asked the company to verify that they’d deleted our documents specifically. They replied with a video demonstrating that the files were no longer available. Great! The video included the PII of the families on either side of us on the list. Not great!

And that’s one big reason why I didn’t want to trust them with our information in the first place.

My favorite new command is zoxide. It’s like a faster z, autojump, or fasd.

In summary, it learns which directories you visit often with your shell’s cd command, then lets you jump to them based on pattern matching. In the event of a tie it picks the one you’ve used most frequently and recently. For instance, if I type z do then it executes cd "~/Library/Application Support/MultiDoge" for me because that’s the best match for “do” in recent history. An optional integration with fzf lets you interactively search your directory history before jumping to one.

It’s lightning fast and integrates perfectly with common shells (even Fish which is my favorite).

I didn’t even know I’d been missing a tool like this.

If you use OmniFocus, you should check out Paul Sahner’s Let’s Fix OmniFocus post:

But lately there has been a growing demand for the company to rethink the user experience and interface of OmniFocus. As popular competitors like Things win acclaim for their clean, modern appearance, OmniFocus – for all of its power – appears stuck in another time period. So I wanted to see what it might take to re-imagine the OmniFocus suite of apps. The answer, it turns out, is not so simple.

Simple or not, Paul’s idea of how a unified Mac / iPad / iPhone interface might work is absolutely gorgeous. I didn’t know I could want this so badly.

I’ve heard a lot of online arguments about whether you should host your Git-based projects in GitHub or GitLab, but a lot of them miss an obvious option. Is this repo for your own personal work that you don’t intend to share with others? Great! You can host unlimited, free, completely private repositories on your own system. Here’s the complete process:

$ mkdir -p ~/src/myproject
$ cd ~/src/myproject
$ git init --bare
$ cd ~
$ git clone ~/src/myproject
$ cd myproject

There, you’re done. Now you have a 100% fully functional Git repo that doesn’t require a network connection and supports every single Git feature. Pull it, push it, branch it, revert it, whatever: it’s your own repo and you can do whatever you want with it. And you don’t have to sign up for anything, or agree to a Terms of Service, or share your work, or trust a company you don’t know very well.

If you want to move your repo to another server later, you can copy ~/src/myproject to its new home via whatever means you find most convenient, use git remote set-url origin [...] to point your existing work toward the new location, and then go on about your business as usual without changing any of your workflow.

GitHub and GitLab have a lot of nice features that may be totally irrelevant if you’re not collaborating with a team. Never forget that you can host Git projects yourself, easily and for free.

Oh, and if you do find yourself needing to work with a handful of people and don’t need all of the integration features of the commercial options, I highly recommend Gitea. It’s a tiny little service you can host yourself and it takes very few resources. I use it whenever I need my Git repo to be accessible across the Internet.

In late August 2020, I bought my kid a new Dell SE2419HX monitor for his birthday. School was starting back and his laptop’s built-in screen was turning out to be too small for him to use for remote schooling. (If you’re reading about this in the far future, this was the year of COVID.) It arrived a few days later and we plugged it into his computer, sat it on his desk, and watched him happily use it for the next few months.

In February 2021, the monitor stopped working. Although it would still turn on, it had a little window on the screen saying “No HDMI signal from your device”. I swapped in a few known working HDMI cables and even tried connecting it to another computer. Nothing worked, so it seemed clear that its HDMI port was busted. We gave the kid an older TV to use temporarily while I worked through Dell’s warranty process. This involved a few days of back-and-forth with their support department, and they eventually asked me for two pieces of information:

1. The receipt from purchasing the monitor
2. A photo of the support case number, my name, and the current date written on a piece of paper and held next to the monitor’s serial number sticker to prove that it really existed

The next day they replied with a terse email:

We have received an update from our internal team and unfortunately, we are unable to process the request for the Monitor replacement as the account information of the system does not match with your information.

Please contact the store/person where you purchased the system for further assistance. Proof of Possession seems to be Invalid/tampered with/fake.

What? I replied that this must be a mistake and asked them to review the evidence again. I got back a nearly identical copy of the prior email, with an apology “for any inconvenience this may have caused you”. I replied again: yes, but there’s been a mistake on Dell’s end, and please fix this. I got back another nearly-identical with the same apology, plus a cryptic “WE have limited access”.

At this point my confusion was turning to anger. I replied to insist that they fix my broken monitor, problems on their end be damned. The same support supervisor replied:

We apologize but we cannot warranty support this monitor with the available information.

At this point I vented a little on Twitter, and the @DellCares account replied to me to ask me to send them a direct message. I did, explaining the situation. They replied with a copy-and-paste of the last unhelpful email I’d received.

The happy resolution to Dell’s utter failure to honor their warranty is that Amazon made good on it. Even though the purchase was outside their normal return window, because Dell was so horrible, Amazon made an exception and allowed me to return it for a full refund. For that, I greatly thank them.

I have a guarantee of my own: under no circumstances will I allow Dell junk into my home again.

I use the Hugo website generator to create this website out of a bunch of Markdown fils. A lot has been written about this approach, but the main advantages are that the site can load quickly even when it’s serving a lot of traffic, and you don’t have to worry about bugs in the blog software when there isn’t any. The downside is that you can’t post to it as easily when you’re out and about on a mobile device.

I wired up a nice little workflow for making it as easy easy to post here with my iPad as to a Wordpress site:

• I write the blog post in Markdown in the Drafts app.
• When done, I run an action that triggers a Shortcut which adds it to a Git repo in the Working Copy app, commits it, and pushes it to my Gitea server.
• A cron job on the web server runs a git pull from Gitea, runs Hugo to generate the site, then copies the output to the web server.

So the plumbing is a little more complicated than just opening a website form and clicking a “post” button, but from the user’s perspective it’s every bit as simple. iOS and iPadOS are starting to get a nice ecosystem of Unix-style “do one thing and do it well” tools that can be strung together with scripting.

My company is going through its annual HIPAA privacy and security refresher training. This is a good thing and I wholeheartedly support it, as it’s always nice to be reminded of some of the details. “Oh, I forgot that we’re allowed to do X! That’s good to know.”

But the most irksome thing in the world is when you know the right answer to a test question but are required to give the wrong one to pass it. For instance, we were asked:

If you then connect with a VPN, will that ensure a file sent via email will be secure all the way through to its destination? Yes / No / Maybe

Test says: maybe! If you change nothing about your setup except adding a VPN into the mix, you may now be able to send email securely.

I say: The correct answer is “of course not”. Our company uses a “split tunnel” VPN so that only connections to certain services go over the VPN but the rest of our traffic goes over the open Internet? Do we need to route someone’s after-hours Netflix viewing through an encrypted connection? No thank you. But even without that, once you send an email to your own server, you have no control over what happens next. Does the recipient’s server support TLS connections? Are emails stored on that server encrypted at rest? Does their email app require TLS? Who knows! You sure won’t. So no, a VPN absolutely does not guarantee an email will be secure all the way through to its destination.

If you encrypt the file you are emailing, will that ensure a file sent via email will be secure all the way through to its destination?

Test says: yes! If you encrypt an email to an employee at another company, it’s guaranteed to be secure.

I say: Maybe, sure. I’d even go so far as saying it probably will. However, for all I know the recipient’s company uses some key escrow thing that lets them decrypt and analyze all inbound mail, and Joe from IT occasionally sells the interesting ones to North Korea.

Thing is, our particular training program is for the most part pretty decent, as far as such things go. Again, I’m glad we’re doing it. I just wish their post-training exams were a little more carefully worded.