Ideally any software like Cisco AnyConnect should support TouchID on macOS, so as to make it conveninent for users to use these security tools. Unfortunately, AnyConnect does not yet support TouchID.
Below are the shell functions I have written to keep my VPN connection always
connected. In a terminal window, I run the function vpn_keep_connected and it
polls the status of the VPN every few seconds. When it detects a disconnection
(perhaps because the laptop is waking up from sleep), it reinitiates the VPN
connection, and instead of having to type in my looong password, I just use
TouchID to login.
Please note that this intgrates with, and depends on, the TouchID based password management setup I documented in my previous blog post. This combination ensures that you will not be prompted for the VPN password; instead, you will be prompted for TouchID veification, and if that succeeds the VPN password will be retrieved from the PasswordStore.
function vpn_connect()
{
local user="userid";
local password="$(pass show vpn_password)";
# Connect to VPN using CLI
printf "$user\n$password\n" | /opt/cisco/secureclient/bin/vpn -s connect myaccess.oraclevpn.com
# Start the App, so that its icon shows in the macOS menu bar to represent connection status
open /Applications/Cisco/Cisco\ Secure\ Client.app/
}
function vpn_disconnect()
{
# Disconnect VPN client, if already connected
/opt/cisco/secureclient/bin/vpn disconnect
# Kill the App, if running
kill $(ps ax | grep -e '[C]isco Secure Client' | cut -f 1 -d?)
}
function vpn_reconnect()
{
vpn_disconnect
vpn_connect
}
function vpn_is_disconnected()
{
/opt/cisco/secureclient/bin/vpn status | grep -q 'state: Disconnected';
return $?;
}
function vpn_keep_connected()
{
if vpn_is_disconnected; then
echo "INFO: VPN is disconnected. Reinitiating connection."
vpn_reconnect
fi
while true; do
echo INFO: Waiting until VPN is disconnected.
while ! vpn_is_disconnected; do
sleep 5
done
echo "INFO: VPN is disconnected. Reinitiating connection."
vpn_reconnect
done
}
Open Source security tools abound, but common people don’t use them becuase these tools cause inconvenience. If you give an average person a choice between security and conveninence, they’ll always end up choosing convenience.
If you have done the right thing and set a strong password to protect your GPG keys, unlocking GPG keys requires entering the (loooo…ng) password every time you want to unlock the private key. And because that is very inconvenient, an average person will choose to not use GPG keys. I am a prime example of this; everytime I tried to use GPG for something in past, after dedicating significant time to setting it up, I used to end up not using it because of the complexity, inconvenience, and never being sure if I’m doing the right thing in terms of security posture.
We’ll see how one can store their passwords locally, in encrypted form, and protect those passwords with a GPG key. And to make it all extremely convenient to use, the password used to protect the GPG private key is protected by a mere touch of TouchID, so you won’t have to tediously type your long passwords.
Below I will show how to use PasswordStore CLI (a.k.a pass) to
securely store all your passwords locally, and protect them with TouchID. In
essence, your TouchID will protect the GPG key passwords (stored in the macOS
login Keychain), which in turn will protect the GPG private key, which in turn
will protect the passwords stored in PasswordStore.
My use case was that I wanted to automate connection and reconnection of my VPN,
but did not want to be bothered to provide the long cryptic password every time.
Upon searching for TouchID-based soutions, I came across this blog post
which mentioned that pinentry-touchid can be used for this purpose, but the
post did not have much details on installation and configuration of the tools. I
spent significant amount of time in understanding and configuring these
utilities, so I thought of documenting the precise instructions for others to
use.
With the implementation shown below, now whenever my scripts want to access the VPN password, or any other secret stored in my PasswordStore, I get prompted with the TouchID to unlock their access. As an added bonus, if you choose to, the encrypted passwords can be managed in, and shared using Git.
Hopefully the below instructions and explanation will make it convenient for you to make use of GPG and PasswordStore.
Update (2024/06/13): I now use this setup to automatically reconnect my VPN connection, if it ever gets disconnected. Please see this blog post for the shell functions I wrote for this automation.
# Install the packages using Homebrew
brew install gnupg
brew install pinentry
brew install pinentry-mac
brew install pass
brew tap jorgelbg/tap
brew install pinentry-touchid
# Perform a check to see if `pinentry-mac` is the default pinentry
# mechanism.
pinentry-touchid -check
# Expect to see a failure output as shown below.
#
# ❌ /opt/homebrew/opt/pinentry/bin/pinentry is a symlink that resolves to
# /opt/homebrew/Cellar/pinentry/1.3.0/bin/pinentry-curses not to pinentry-mac
# By default, `pinentry` is a link to `pinentry-ncurses`. The following command
# will make the link point to `pinentry-mac`. Thereafter, `pinentry-mac` will
# become the default program that gpg-agent will use to unlock the GPG keys.
#
# If you ever _reinstall_ gpg package, the link will be reset back to point to
# `pinentry-ncurses`. You should run `pinentry-touchid -check` to see if it
# succeeds, and run it with `-fix` option, like below, to fix the link, if
# needed.
pinentry-touchid -fix
# Perform the check again. This time it should pass.
pinentry-touchid -check
# Generate a new private+public keypair.
#
# If unsure of which of the choices to pick, accept the defaults indicated in
# the options shown by gpg. When asked for a password to ptorect the private
# key, use a very strong password; the private key being generated will protect
# all your passwords, so make sure it's not easy to guess the password that
# protects it.
#
# To fully understand how to manage and backup your GPG keys, please read the
# 'GPG Keys Management' section in Fedora documentation linked below.
#
# https://docs.fedoraproject.org/en-US/quick-docs/create-gpg-keys/
#
# If you already have a private+public keypair, you can use that instead of
# creating a new one. In that case, skip this command.
gpg --full-generate-key
# Note the KeyID of the key you created above, or the one you want to use. For
# example, in the following output, 0xDA0564F36822B15B on the first line is the
# KeyID.
#
# pub ed25519/0xDA0564F36822B15B 2024-06-08 [SC] [expires: 2025-06-08]
# Key fingerprint = FFD9 2569 B7A2 D3B5 9EAD 4BC4 DA05 64F3 6822 B15B
# uid [ultimate] John Doe (GPG key for Work) <john.doe@expmple.com>
# sub cv25519/0xB08D23EF71423D97 2024-06-08 [E] [expires: 2025-06-08]
gpg --list-keys --fingerprint --keyid-format 0xlong
# Initialize PasswordStore's storage, `~/.passsword-store/`, replacing $KEYID
# with the KeyID of the key you generated or chose above.
pass init $KEY_ID
# (Optional) Have PasswordStore track and log password changes in a Git
# repository. If you choose to do this, every addition or removal of a password
# in the PasswordStore will create a Git commit in the Git repository stored at
# `~/.password-store/`.
pass git init
# Tell `pinentry-mac` (a product of GPGTools) to not store the passwords it
# decrypts in the Keychain.
#
# Instead, `pinentry-touchid` will perform the storage operations on the
# Keychain, hence it will be treated as the owner of the values it stores in
# Keychain. Which means `pinentry-touchid` can then read these values from
# Keychain without triggering a macOS password prompt to the user.
defaults write org.gpgtools.common DisableKeychain -bool yes
# Set `pinentry-touchid` as the default pinentry-program in `gpg-agent`'s config
# file.
echo "pinentry-program $(which pinentry-touchid)" >> ~/.gnupg/gpg-agent.conf
# Tell `gpg-agent` to reload the config file changes made above.
gpg-connect-agent reloadagent /bye
# Check that encryption works.
#
# You will _not_ be prompted for the password to unlock the GPG private key.
# Encryption of the secrets/passwords does not require private key. This step
# uses your public key, which is not protected, to perform the encryption.
#
# Create a test password and store it in PasswordStore.
pass insert VPNpassword
# Retrieve the value of VPNpassword. You will now be prompted to provide the
# password to unlock the private key.
#
# This should display a dialog box (created by `pinentry-touchid`) asking for
# the password to unlock your GPG private key; provide the password you used in
# `gpg --full-generate-key` step.
#
# If your provided password successfully unlocks the private key, then your
# password will be stored in the macOS' Keychain. To verify this, in the
# 'KeyChain Access' app, under 'login' Keychain, search for 'GnuPG'.
#
# Because this entry in the login Kaychain is created by the `pinentry-touchid`
# program, `pinentry-touchid` is always allowed to read its value. To verify
# this, open 'Keychain Access' app, search for 'GnuPG', right-click on the
# password entry shown in results, then click on 'Get Info', and then on
# 'Access Control'. You should see `pinentry-touchid` listed in the list under
# 'Always allow access by these applicatons'.
pass show VPNpassword
# The private key password has now been stored in Keychain by TouchID.
# If you try to `show` this password again, you will _not_ be prompted to unlock
# the PGP key, because it was cached by `gpg-agent` after the command above.
pass show VPNpassword
# The private key password, after it has been retrieved from Keychain, is cached
# by `gpg-agent`. So, usually you won't be prompted to unlock the private key
# for the next few minutes.
#
# But since we want to see the ultimate benefit, that of using TouchID to fetch
# the private key password, we will force the `gpg-agent` to drop its cached
# values of private key passwords.
#
# Tell `gpg-agent` to reload config (even though the config hasn't changed), and
# it will additionally forget all cached private keys.
gpg-connect-agent reloadagent /bye
# After dropping `gpg-agent`'s cached passwords, trying to `show` any password
# in PasswordStore should prompt for the TouchID dialog. You will _not_ be
# prompted for GPG private key password; the GPG private key password is now
# stored in the login Keychain, and protected by your TouchID, thanks to
# `pinentry-touchid`.
pass show VPNpassword
# Since this was just for demo purposes, delete the `VPNpassword`.
pass rm VPNpassword
# In essence, now your TouchID protects the GPG key passwords stored in the
# macOS login Keychain, which in turn protect the GPG private keys, which in
# turn protect the passwords stored in PasswordStore.
# If you performed the optional `pass git init` command shown above, all changes
# to the PasswordStore are now tracked in Git. This Git repository can now be
# managed and shared just like any other Git repository.
#
# See the log of changes done to the PasswordStore.
( cd ~/.password-store/; git log )
# You should see output similar to the one below.
#
# commit 89fca136b832a0a829a0ee8f04197cc7147cb12d
# Author: Gurjeet Singh <gurjeet@singh.im>
# Date: Sun Jun 9 21:17:33 2024 -0700
#
# Remove VPNpassword from store.
#
# commit 41e950a6284e8f423a3f634d762038b77ff25df7
# Author: Gurjeet Singh <gurjeet@singh.im>
# Date: Sun Jun 9 21:16:56 2024 -0700
#
# Add given password for VPNpassword to store.
#
# commit 583e38474f3c341e648df666fce7b039712cb1cd
# Author: Gurjeet Singh <gurjeet@singh.im>
# Date: Sun Jun 9 21:16:39 2024 -0700
#
# Configure git repository for gpg file diff.
#
# commit a34b400171220fab8e3543afd01a917b38dc5da9
# Author: Gurjeet Singh <gurjeet@singh.im>
# Date: Sun Jun 9 21:16:39 2024 -0700
#
# Add current contents of password store.
In my quest to ensure the best educational opportunities for my daughter, I recently embarked on a deep dive into the Rosetta Institute of Biomedical Research. Their website, RosettaInstitute.org, promotes summer programs in partnership with prestigious institutions like UC Berkeley, UC San Diego, Columbia University, and Imperial College London. Despite the impressive affiliations and promising courses for high school students, my research led me to several concerning findings.
A significant red flag arose when I couldn’t find a physical address linked to the Rosetta Institute. Their website vaguely lists Alameda, California, as their location. However, this general reference didn’t satisfy my need for concrete details. Determined to uncover more, I explored multiple avenues:
Several student-focused websites list the Rosetta Institute as a summer program option, echoing the same marketing language found on Rosetta’s own site. Despite the widespread promotion, none of these listings provided a physical address. Furthermore, the name Ryan George appeared repeatedly, both on the institute’s website and in email correspondence. However, a deeper dive into Ryan George’s connections revealed some troubling details:
Despite some online presence on LinkedIn and other social media platforms, the lack of a physical address and transparent credentials raised significant doubts:
Given these findings, I am not comfortable proceeding with the $3,500 payment for a two-week program at the Rosetta Institute. The combination of a vague location, questionable business history, and lack of verifiable credentials makes it too risky. While the program may be legitimate in terms of providing educational experiences, the surrounding uncertainties are too significant to ignore.
I hope this detailed account of my research and findings helps others who are considering the Rosetta Institute of Biomedical Research. It’s crucial to thoroughly vet educational programs, especially when they demand substantial financial and personal commitments. Stay informed and prioritize transparency and credibility to ensure the best outcomes for your child’s educational investments.
Disclosure: The above blog was generated using ChatGPT. To see my original notes, see the HTML contents of this page.
Below are most of the URLs/links of searches and webpages I looked at, during this research.
The address they shared for sending the check, the non-descript builiding, as seen on Google maps Street View: 2177 Harbor Bay Pkwy, Alameda, CA, 94502 https://www.google.com/maps/place/2177+Harbor+Bay+Pkwy,+Alameda,+CA+94502
https://twitter.com/RosettaBio
https://www.linkedin.com/in/ryan-g-holzer-85111144/
https://www.google.com/search?q=site%3Aberkeley.edu+ryan+holzer
https://www.google.com/search?q=columbia+university+rosetta+institute
https://www.rosettainstitute.org/biomedical-summer-camps/
https://www.rosettainstitute.org/biomedical-summer-camps/curriculum/
https://www.rosettainstitute.org/biomedical-summer-camps/benefits-of-attendance/
https://www.rosettainstitute.org/
https://www.forbes.com/sites/kristenmoon/2023/11/10/10-winter-camps-for-high-school-students/
https://www.rosettainstitute.org/contact/
https://www.rosettainstitute.org/biomedical-summer-camps/faq/
https://www.google.com/maps/search/rosetta+institute+of+biomedical+research
https://www.berkeley.edu/search/?q=%22rosetta+institute%22
https://www.berkeley.edu/search/?q=rosetta+institute
https://www.google.com/search?q=site%3Aberkeley.edu+%22rosetta+institute%22
https://www.google.com/search?q=rosetta+institute+alameda+ca+-site%3Arosettainstitute.org
https://www.google.com/search?q=%22rosetta+institute%22+-site%3Arosettainstitute.org
https://www.google.com/search?q=%222177+Harbor+Bay+Pkwy%22
https://www.alamedaca.gov/files/assets/public/v/1/finance/current-businesses-february-2019.pdf
https://www.corporationwiki.com/p/2ew92x/ryan-george-holzer
https://www.corporationwiki.com/p/2kssl6/rosetta-medical-research-institute-inc
https://www.summercamps.com/camp/rosetta-institute-molecular-medicine-summer-camps/
https://www.yelp.com/biz/tata-enterprises-alameda
https://www.google.com/search?q=california+list+of+registered+companies
https://bizfileonline.sos.ca.gov/search/business
https://www.activityhero.com/biz/rosetta-institute-of-biomedical-research
https://portolapilot.com/summer-programs-are-a-waste-of-time-and-money/
https://talk.collegeconfidential.com/t/rosetta-institutes-cancer-neuroscience-camps/1685720/44
]]>I am sharing this unsuccessful experiment to embrace the spirit of acknowledging and learning from our failed attempts. In a feature request discussion on HackerNews, a user named danielheath proposed the idea of a Postgres data type that would allow assigning a specific position to an item/row in a table. The expectation was that Postgres would automatically adjust the positions of other items in the list to accommodate the assigned position.
An example scenario presented was managing a playlist, where a user wants to move a song to a particular position, such as position 3. This feature would relieve the programmer from the burden of manually rearranging the list and allow assigning the desired position directly. When retrieving the results, the item should appear at the assigned position.
Although several solutions were proposed at the time, it was unclear if any of them met the exact requirements of the request. I pondered over possible implementations and eventually devised a method that I believed could achieve the desired outcome. Motivated by this, I decided to code the solution using plain SQL over the weekend, hoping that if successful, I could propose it as a feature for inclusion in the Postgres project.
Below, you can find the code for the solution I developed. The fundamental idea was to dynamically assign positions at runtime. When an update request arrived, I used the requested position along with the current timestamp to assign a value for sorting the results.
Initially, the solution seemed to work, but its limitations soon became
apparent. Towards the end, you can observe that the solution fails to set the
position of ‘Song B’ to 3 under certain conditions. The problem with this
approach, as well as any other potential solutions, is that we require a sorted
list of elements before we can place an item at a desired position. In an
attempt to address this, I partially implemented the set_song_position_v2()
function. However, even if this function were complete and handled all possible
edge cases, it would not fulfill the requested feature. A proper solution
necessitates working with a pre-sorted list, which contradicts the essence of
the feature request—to easily assign the desired position without additional
effort.
In simpler terms, this issue is analogous to trying to obtain the max() value of a column without maintaining an index containing all the rows.
/*
* The playlists table holds all the playlists, and the songs in those
* playlists. This table is denormalized, and it does not have any indexes, to
* keep the code simple and readable.
*
* The position_ts column records the timestamp when the operation occurred.
* This column is then used to resolve conflicts when the song_position of 2
* or more songs is the same.
*/
create table playlists(
playlist_name text,
song_name text,
song_position integer,
position_ts timestamptz default clock_timestamp()
);
> CREATE TABLE
create or replace function update_playlist_position_ts()
returns trigger as
$$
begin
new.position_ts = clock_timestamp();
return new;
end;
$$ language plpgsql;
> CREATE FUNCTION
create or replace trigger update_position_ts
before update of song_position on playlists
for each row
execute function update_playlist_position_ts();
> CREATE TRIGGER
create or replace view playlists_numbered as
select row_number() over (partition by playlist_name order by song_position asc, position_ts desc) as position,
playlist_name,
song_name
from (select playlist_name,
song_name,
song_position,
position_ts
from playlists);
> CREATE VIEW
-- Simpler view definition with similar (but not the same) results as the
-- playlists_numbered view.
create or replace view playlists_ordered as
select row_number() over () as position, *
from (select playlist_name,
song_name
from playlists
order by
playlist_name,
song_position asc,
position_ts desc);
> CREATE VIEW
-- Set the position of a song within a playlist
create or replace function set_song_position(playlist text, song text, new_position int)
returns void as
$$
-- Simply set the 'song_positon' to the desired value; the
-- trigger and the View will do the rest to actually show
-- this song at a position relative to other songs within
-- the playlist.
--
-- TODO: should it throw error if song is not already in the
-- playlist?
update playlists
set song_position = $3
where playlist_name = $1
and song_name = $2;
$$
language sql;
> CREATE FUNCTION
insert into playlists values
('Playlist A', 'Song A', 1),
('Playlist A', 'Song B', 2),
('Playlist A', 'Song C', 3),
('Playlist B', 'Song X', 1),
('Playlist B', 'Song Y', 2);
> INSERT 0 5
select * from playlists_numbered;
> position | playlist_name | song_name
> ----------+---------------+-----------
> 1 | Playlist A | Song A
> 2 | Playlist A | Song B
> 3 | Playlist A | Song C
> 1 | Playlist B | Song X
> 2 | Playlist B | Song Y
> (5 rows)
select set_song_position('Playlist A', 'Song C', 2);
> set_song_position
> -------------------
>
> (1 row)
select * from playlists_numbered
where playlist_name = 'Playlist A';
> position | playlist_name | song_name
> ----------+---------------+-----------
> 1 | Playlist A | Song A
> 2 | Playlist A | Song C
> 3 | Playlist A | Song B
> (3 rows)
select set_song_position('Playlist A', 'Song B', 1);
> set_song_position
> -------------------
>
> (1 row)
select * from playlists_numbered
where playlist_name = 'Playlist A';
> position | playlist_name | song_name
> ----------+---------------+-----------
> 1 | Playlist A | Song B
> 2 | Playlist A | Song A
> 3 | Playlist A | Song C
> (3 rows)
-- Setting a song position to a value more than the number of
-- songs will place the song last.
select set_song_position('Playlist A', 'Song A', 99);
> set_song_position
> -------------------
>
> (1 row)
select * from playlists_numbered
where playlist_name = 'Playlist A';
> position | playlist_name | song_name
> ----------+---------------+-----------
> 1 | Playlist A | Song B
> 2 | Playlist A | Song C
> 3 | Playlist A | Song A
> (3 rows)
-- Inserting a new song at an in-between position places the new
-- song before the song at position 99.
insert into playlists values('Playlist A', 'Song D', 4);
> INSERT 0 1
select * from playlists_numbered
where playlist_name = 'Playlist A';
> position | playlist_name | song_name
> ----------+---------------+-----------
> 1 | Playlist A | Song B
> 2 | Playlist A | Song C
> 3 | Playlist A | Song D
> 4 | Playlist A | Song A
> (4 rows)
-- This fails. We want Song B to be at position 3, but the
-- result shows that Song D shows up at position 3.
select set_song_position('Playlist A', 'Song B', 3);
> set_song_position
> -------------------
>
> (1 row)
select * from playlists_numbered
where playlist_name = 'Playlist A';
> position | playlist_name | song_name
> ----------+---------------+-----------
> 1 | Playlist A | Song C
> 2 | Playlist A | Song B
> 3 | Playlist A | Song D
> 4 | Playlist A | Song A
> (4 rows)
create or replace function set_song_position_v2(p_playlist text, p_song text, p_position int)
returns void as
$$
declare
pos int := 0;
begin
pos := (
select coalesce(min(song_position), p_position) as pos from (
select row_number() over (partition by playlist_name order by song_position asc, position_ts desc) as position,
playlist_name,
song_name,
song_position
from (select playlist_name,
song_name,
song_position,
position_ts
from playlists
where playlist_name = p_playlist
and song_name <> p_song -- exclude the song we're manipulating
))
where position >= p_position
);
raise notice 'Position is %', pos;
update playlists
set song_position = pos
where playlist_name = p_playlist
and song_name = p_song;
end;
$$ language plpgsql;
> CREATE FUNCTION
-- Clean up
drop table playlists cascade; -- cascade drops views of the table
psql:playlists.sql:133: NOTICE: drop cascades to 2 other objects
DETAIL: drop cascades to view playlists_numbered
drop cascades to view playlists_ordered
> DROP TABLE
drop function update_playlist_position_ts();
> DROP FUNCTION
drop function set_song_position(text, text, int);
> DROP FUNCTION
drop function set_song_position_v2(text, text, int);
> DROP FUNCTION
On macOS, Podman runs inside a virtual machine. And it exposes its
communication channel as a Unix Domain Socket. So you can set the DOCKER_HOST
environment variable to point to Podman server’s socket, and the Doccker CLI
utiliies will all work with Podman.
export DOCKER_HOST="unix://$(podman machine inspect --format '{{.ConnectionInfo.PodmanSocket.Path}}')"
Rather than remembering that incantation, I turned it into a Bash function with an easy-to-remember name, and some helpful diagnostics.
function docker_set_host_to_podman_socket()
{
local socket_path="$(podman machine inspect --format '{{.ConnectionInfo.PodmanSocket.Path}}')"
local unix_domain_socket="unix://$socket_path"
echo "Setting DOCKER_HOST=$unix_domain_socket"
export DOCKER_HOST="$unix_domain_socket"
}
Yesterday I joined Supabase; they provide Backend-as-a-Service, which is developed on top of their Postgres-as-a-Service offering. They provide many features, utilities, libraries, and services around the Postgres database that makes it very easy to develop applications.
I’m very happy to say that they have very generously allowed me to focus explicitly on contributing to the Postgres community. This is truly a dream come true!
If you happen to be a Firebase customer, but miss the powers of the SQL language, do check out Supabase.
Here’s the announcement I posted to the Postgres Hackers mailing list, with some more details and a statement from the founders of Supabase.
]]>It is very difficult to pin down the date when Postgres (a.k.a PostgreSQL) project was born. If you look at the official history on the Postgres website, you’d see a few years mentioned, as early as the year 1986, but no specific dates.
If we go by the timestamp of the first commit in Postgres code repository, the project was started at ‘Tue Jul 9 06:22:35 1996 +0000’. Going by that date, today the Postgres project turns 25 years old.
$ psql -c "select age(now(), 'Tue Jul 9 06:22:35 1996 +0000')"
age
------------------------------------------
24 years 11 mons 30 days 22:39:46.830704
(1 row)
Oh, it’s so close…
Don’t be like this
If you haven’t been following the progress of the Postgres project, I implore you to do so now (see below). The future of the Postgres project is very bright. Its feature set has been growing steadily, while retaining its legendary commitment to stability and correctness.
We have these awesome contributors, and many others who are not listed there, to thank for the current state of their projects, and their tireless work.
These contributors, and many others, blog regularly about what’s happening in the Postgres world, and those blog posts are aggregated at Planet Postgres. Feel free to subscribe to any of the many RSS feeds there (even by an author you may be interested in).
Here are many other channels to engage with Postgres community:
The app has a unique pricing model that I haven’t seen anyone else offer. They offer the app for free to anyone who asks. Here’s the poicy in Sam’s own words (captured from their video). I couldn’t find this written anywhere on their website, so I typed it up and published it here.
]]>So I want to take a moment to explain our business philosophy.
Our intent is for everyone who wants access to all the content on the app to have it.
So while we’re running a business, we believe that money should never be the reason why someone can’t gain access to Waking Up. We also don’t want you to feel you’re risking anything by subscribing.
So here’s our pricing policy: if you can’t afford a subscription, just request a free account.
You can do this directly at wakingup.com. There’s a “request a free account” link or, you can contact support within the app, or you can send an email to support@wakingup.com. And if you do one of these things, will provide you with a free year on the app.
And if you’re uncertain about whether this policy applies to you, here’s how I think about it. If subscribing to Waking Up will prevent you from spending money on something else, in other words, if you have to do the math to see how the cost of a membership can fit into your life, please don’t do that. This free policy is for you.
I don’t want anyone’s subscription to Waking Up to be a source of financial stress. And I consider myself immensely lucky to be running a digital business where we can have a policy like this. And this policy is not for the COVID-19 pandemic. It’s been our policy since the day we launched. So the only judge of whether you can afford a subscription is you.
We don’t ask any questions, and we grant 100 per cent of these requests. And if your luck hasn’t changed at the end of your first year, just ask for another one.
For everyone else a subscription to Waking Up is truly risk-free. If you don’t find the app valuable, just contact support, and will give you a full refund, again, no questions asked.
So whatever your financial situation, there’s no reason not to fully explore Waking Up to see how it impacts your life.
So I encourage you to just start with the Introductory Course, and feel free to go at your own pace. And needless to say, you can always go back and repeat sessions as many times as you want. And please realize there’s a world of difference between practicing, even only occasionally, and not practicing at all.
Once again, welcome to Waking Up, and I want to thank you in advance for the effort you put in here. I think you’ll find that it’s worth it.
It is a well written and in-depth look at the rot inside the Golang ecosystem. Make sure to read to the end and notice that the rot started at the core contributors level.
Golang’s tagline, from their repository, is “Go is an open source programming language that makes it easy to build simple, reliable, and efficient software.”
Reading this post by Amos should make it clear to you that Golang has succeeded ONLY in the “simple” part of the claim; unless written with extreme care, programs written in Golang are neither reliable, nor efficient.
Amos presents some examples of why I have disliked Golang since the beginning. After having used Golang for a few years seriously, I disliked it enough to start a fork of the language named GoFY. I named the language as such because, since the beginning when I saw some of initial presentations by Rob Pike specifically, and some others’ presentations and blog posts generally, they had an air of ego when dismissing others’ opinions and concerns, and appeared to say “these are our decisions, that is how it is, and if you don’t like it, Go F*** Yourself”. So the project name was a GoFY to them back, from me.
I’m sure it looks a great language from afar, and for newcomers. But as a seasoned developer who has seen a few other languages in thier lifetime, you will quickly begin to see the problems with the language and the ecosystem around it. The astute among you may notice that in my post yesterday I did not claim to be an expert in Golang; it’s hard to be an expert in something that’s fragile, flaky and full of special cases. For the same reason I never took up using MySQL; I have heard enough stories of its flakiness and special cases that it never looked like a solid technology to me. I openly and whole-heartedly recommend learning and using Postgres to anyone who would listen.
Fortunately I did not invest any more time in it other than to document a few times in section “GoFY Desired Differences” as to what I would like to see different in the GoFY language, which in turn would make it better than Golang, at least for long-time systems developers like myself. I am glad I didn’t burn any oil on it because creating a new language, even a fork, is neither easy nor quick.
]]>Somebody recently wrote on Hacker News that the knowledge gained through hard work is the one that sticks with you. So I wanted to present some data points to back my agreement with that sentiment.
I am a known person in Postgres community* (commits; emails), and it did not happen by accident. Some 15 years ago, after changing employers (for personal reasons) from Oracle to CommVault, I was attracted towards Postgres database project, so I started exploring its code and participating in their conversations outside of work. Within a few months I was pursued by EnterpriseDB to work on their Postgres-based product full-time.
Bulk of my contributions to Postgres happened during my time at EnterpriseDB, and most of my contributions were simply something I wanted to work on. Delivering on any of these required turning off distractions and diving deep and removing one blocker after another until there was something polished enough for me to feel satisfied with, and presentable to the Postgres community. The same is true of any significant contributions I’ve made to my employers’ projects. The formula is simple: turn off distractions, and slog it out. Now, there may be many reasons to not want to achieve a goal, but if you want to achive it, that’s the only formula.
More recently, I have been enamored by the core principle of the Nix package manager. I first got seriously impressed by it in September of 2018, and tried to learn and use it. But like most others, every attempt of mine to learn it at any depth proved futile, primarily because the learning curve is extremely steep; the functional programming language, Nix, being the first hurdle. Despite the benefits it brings to the table, it is a serious undertaking for any individual, and hence even more difficult to adopt in a company, at your job and start leveraging its advantages; this is especially true of a technology like Nix that is novel, but is simply replacing something that generally works and people/companies have learned to live with.
When I got a new personal laptop a few months ago, I decided to use Nix instead of Homebrew to install the packages I needed. The journey has been smooth so far, and am able to get on with my personal work just fine.
Over the winter break I was working on a side project and I hit a snag in my Vim
usage. I had recently uninstalled the vim package and replaced it with
vim_configurable, because the latter provided Python3 support which I needed
for some of my Vim plugins. So, like any other developer (and like Hal), I
got sidetracked to fix my Vim. It took me 3 days but I finally made my
first non-trivial contribution to Nixpkgs; yes, as the world was celebrating
new year, I was creating the pull/merge-request in the middle of the night**.
It could’ve taken me less than a day if I had just posted what I wanted to get fixed on one of the various avenues the NixOS/Nixpkgs people hang out in. They would have given me a neat trick to solve my problem and let me get on with life. And frankly I have done that so many times in the past where, to be able to get on with whatever I am doing, I would ask around on the internet, wait for a decent answer that works, and move on.
But I took it upon myself to get exactly what I need. As usual, I started with trial and error based on what’s already in Nixpkgs. When that didn’t work I searched online for a problem similar enough to mine. When that did not help me fix my problem, I found the good Nix/NixOS teaching videos in my YouTube history and spent ~6 hours watching those and noticing things that hadn’t made sense the first time. Followed along doing the small exercises on their slides. All this while taking care of other life stuff happening on the side; but my side-project had been suspended while I tired all this. After 3 days of learning, 40+ tabs still open in my browser, I finally felt confident enough to try writing the Nix code I needed. I still hit a few bumps, but I was able to reason about the error messages, debug and resolve the errors.
The things that I learned about Nix and Nixpkgs over these 3 days, I could not
have learnt, and definitely could not have retained that knowledge, had I simply
asked someone else to solve my problem. Now, given my knowledge, I feel
confident that I will be able to apply this in other projects and benefit from
it; I may still be slower than the Nix gurus, but I can get it done. As they
say, I now know enough to be dangerous :) For example, I now intuitively know
why nix-env -iA xxx is so much faster than nix-env -i xxx; answer: because
the -A switch lets Nix pick just the variable you’re interested in, and lazily
evaluate just that expression, rather than evaluate all the expressions in
Nixpkgs and search for a package named xxx.
Over my 20 years of experience I have seen this to be the case, it’s only now that I realized the pattern where I have reaped huge rewards from small but difficult investments. Without even realizing it, I have invested my efforts like this time and again, and gained significant expertise in the C language, Git, Docker, Kubernetes, and Postgres. There have been some things that I was interested in (RISC-V comes to mind) but I never invested enough time beyond cursory participation, and as a result I don’t have enough knowledge to call myslef an expert in them.
Not to say that all time spent in such deep/in-the-zone work always bears a fruit, and to give an idea of how time spent like this, many a times goes to waste… Over this same 3 day period I encountered a behaviour in Postgres’ psql utility that seemed like a bug, or at least a surprising behaviour. So I carefully developed a test case that would demonstrate the problem, studied the psql code and found the place where code would need to be fixed. I stopped short of developing a patch before starting to write email to pgsql-hackers mailing list. While I was writing the email, on a whim I decided to read the documentation. A cursory read of the docs wouldn’t have caught it, but because I was reading the docs to look for mention of the exact behaviour I was seeing, I found that it was an expected behaviour. Even though the psql behaviour violated POLA, I could not report the bug because it was known and expected behaviour. All the effort spent in doing that went down the drain.
In essence,
footnote +: If your field of work has techniques, that means it’s a technology to be learnt and mastered; so in my veiw, fields like art and politics are also technologies. The technology in these fields may not move fast, but it is still a technology to learn and improve on.
footnote *: even though I haven’t contributed to the community in any significant capacity in the last few years.
footnote **: I was home alone, since my family is on a trip to India. To be fair, that was one of the big reasons it took 3 days and not 3 weeks, and very likely why I did not give up on the goal.
]]>