Okay, first things first: I wrote this article on August 25th. That’s important.¹

Now the disclaimer: I woke up on August 26th and found out that I won an iPad from Hover.

Now the clarity: I don’t get paid to blog. I’ve never been shy about writing articles about software and expecting nothing in return. I’ve written posts about desktop software such as Scrivener, web apps such as Posterous, and even web-based “service-like” companies such as Iterasi. I’ve even written about how amazing the Microsoft Visual Studio system is… and I freakin’ hate Microsoft anything. If I see something I like, I write about it. Hover is no different.

Hopefully, that’s enough evidence that I don’t write for return. I write because I love writing. If you don’t believe that, then you might want to move on.

Now the post

Hover rocks. Full stop.

I have a lot of domain names. I don’t have a lot of them because I sit on them hoping they will be worth something, I have working domain names. Everything from this site and johnmetta.com to organizational sites like RubyGorge to halfway joking web applications like kwisatz.hadera.ch.

Dozens of working domains, all pointing different places.

Anyone who has a lot of domains, or even many people that have a single domain, know that domain management can be a pain. For years, I’ve used GoDaddy.

Why? Because I love sticking needles in my eyes.

GoDaddy is run by vampires

GoDaddy has the tools I need. The problem with GoDaddy is that it’s worse than MySpace. I’ve had super savvy tech folks ask me how the hell to find simple DNS management tools on the GoDaddy website– and I’ve actually had to ask GoDaddy tech support myself. The answer is invariably something like this:

“You go here, click this link, go here, go there, oh, watch out for the minotaur, then go here… Now you’re on the Accounts front page, okay from there go here and…”

Trying to finding anything on the GoDaddy site is like trying to find a contact lens that you dropped on the dance floor of an 80′s throwback disco dance party… in a basement… with vampires.

Ugh.

I actually think that GoDaddy is run by vampires. And not those emo-goth-pussy-I-really-don’t-want-to-drink-your-blood-honest-I-don’t Twilight vampires either. GoDaddy people are violent-ass-Lost-Boys-bite-into-your-skull-with-fangs-and-throw-your-carcass-off-a-cliff vampires.

Or, rather, bite into your wallet with fangs. Whatever.

The main problem with that is that GoDaddy does it right. Their purpose is not to let you buy and manage domains. Their purpose is to make you buy everything else: “Would you like to add a personalized monkey voice to your new GoDaddy ‘email to fax to voicemail™’ service for an extra $9/month?”

To GoDaddy, management of domains is not a feature, it is an interesting byproduct of their vampire disco dance party sales strategy.

Laughter at a party

I first heard of Hover while at the Gnomedex conference. They were among the sponsors and one of the many announcements was “Go to Hover.com and register a domain name, use the code Gnomedex for a 50% discount and a chance to win an iPad.”² I didn’t think about them again until a bunch of us were chatting about funny stories of their childhood that all arose because no-one talked to us about sex.

I know, interesting topic, right. Wow, no possible negative ramifications there!

We were all laughing and telling stories about awkward things that happened to us as kids and Chris Pirillo said something like “this would make such a funny website: Stupid things I would not have done if someone had just told me what sex was.”³ Because we’re all laughing and drinking, I decided to grab my Android and go to the hover.com site and register a domain- after some wine infused suggestions, we all came up with wankmylife.com as the funniest name.⁴

Waking up to Hover

I only used Hover because we were at the Gnomedex party, and I did want to try to support Chris Pirillo by supporting the sponsors. It wasn’t until the next morning that I realized what Hover really was.

Remember 1996? Remember going to Yahoo! to try to search for something?

“Is that the search box, or is that another blinking HTML tag telling me how to get a stupid monkey voice for my answering machine?”

Then you found Google. And you suddenly realized that you could breath again.

Google did one thing: Search.

It was beautiful.

Going from GoDaddy to Hover was much the same experience. It was like a breath of fresh air. I’d registered the site on my phone, but don’t like squatter sites and those stupid announcements like “blahblah hasn’t created a webpage, but until they do, would you like to have a vampire monkey singing on a great email to fax to voicemail service?⁵ I wanted to point it to my home page as soon as possible, so woke up the next morning, opened my laptop, and went to Hover.com.

There were no sales, there were no tantalizing pictures of Danika Patrick unzipping her leather GoDaddy jacket. There were no vampires or monkey voice email services.

Nothing.

There was a minimalistic white page with a big button that said “Manage DNS.” I clicked that big button expecting Danika Patrick and a monkey, but was brought immediately to- as unexpected as it sounds- a DNS management pane.

Suddenly, I realized that I could breath.

Hover’s site let’s you manage your domains. Full stop. In fact, there’s not actually much else on this site that you can do. When you go to hover, you don’t have many options. You can register a domain, or you can quickly manage the domain you have. That’s it.

Wow.

I love Hover. While so many other registrars are trying to upsell you everything they possibly can, Hover just wants to do one thing, and do it well. I’ve pretty much decided to move all my domains to Hover.⁶ The time spent moving them all will be more than made up by the time saved by never having to tell Danika Patrick that I don’t want monkey voices.

If you have a single domain, check out Hover. I’m pretty sure you’ll be pleasantly surprised.

1. My plan was to polish the grammar, test out the jokes again, and publish it this morning. I wish I’d done it last night, but I didn’t, shame.
2. Ugh. I hate those stupid sweepstakes. Whenever I see “…chance to win an iPad” I loose interest completely. I’m not going to win, I don’t have time for your stupid sweepstakes, leave me alone and let me get the hell out of this stupid 80s vampire disco dance party!
3. Interestingly, this is all up in the air now. Why? Because if you just have anyone writing these stories– well. Look, I was thinking of something that would be educational, enlightening and tasteful, while still being just roll-on-the-floor funny as hell. Not sure that’s so easy to pull off. You need really good writers for that.
4. we actually went and consulted with Violet Blue, who was a Gnomedex speaker, because we wondered if the word “wank” translated well enough to– well, nevermind. Anyway, it was a joke, honestly, but I immediately thought that it could be a pretty funny-yet-illuminating illustration of why sex education is A Good Thing™.
5. Honestly, Hover has the nicest “this isn’t a real page” yet site I’ve ever seen. It’s simple and clean, like the rest of their site.
6. I say “pretty much” because they don’t seem to offer offsite DNS, which means my non-US domains are still on the dance floor in a basement being stepped on by vampires dressed like Flock of Seagulls

Today, I created an outline, but more on that later. Right now, I want to talk about WordPress.

I love WordPress.

WordPress is a dream come true. It’s a great writer’s platform, it’s a great programmer’s platform, it’s a great tinker’s platform…

It’s also a total and complete pain in the ass.

Like many great things, it’s virtually perfect. And, like many great things, it can be finicky, sometimes contemptible, and often frustrating as hell.

Why?

Because it attracts tinkerers, and tinkerers break things, and breaking things is frustrating.

Honestly, not all the frustration that people have with WordPress is the WordPress team’s fault. It’s the fault of the system. It’s a function of a system and philosophy that allows people to have as many options as they can.

That’s a problem.

WordPress is almost infinitely customizable, totally hackable and utterly configurable. That’s the beauty and the curse. Whenever something has that many buttons to press and levers to pull, something is always going to break… eventually

I’m Speaking at WordCamp Portland

This year, I have been honored by being invited to speak at WordCampPDX. Actually, “honored” is a bit of an understatement. I’m overjoyed. Getting up in a room full of people who love WordPress in order to talk about WordPress is pretty damn exciting. It might even be the most exciting speaking engagement I’ve ever had, and I’ve spoken a lot.

What will I talk about?

Well, there’s that whole “double-edged” sword aspect of WordPress that I’ve just been describing. How you can do anything you want to with it, but how that means that it will always break. That’s really the most interesting thing to me. But, that’s just a description of a problem. That’s a complaint.

So, I’m talking about a solution.

WordPress & Source Control

Source control management (SCM) is a concept that is as natural as breathing to most developers. But it’s not something that WordPress users often think of.¹ Hovever, anyone who has ever modified a theme, fiddled with a plugin, or wanted to change the way WordPress works for them in any way could find it valuable.

It’s strange to me that more WordPress users don’t actually use an SCM system, but then again, I’m a programmer. SCM may be as natural as breathing to a developer, but it’s about as natural as breathing underwater to a non-programmer.

But it doesn’t have to be like breathing underwater.

So I’m speaking on ways to integrate Source Control and WordPress, to make your life easier and make it much safer to play around and tinker. Hopefully, after my talk, even non-programmers who want to tinker in the WordPress code will feel confident that they won’t break things.

Or, rather, that they will break things, but that breaking things is okay and a good way to learn– assuming you can fix them.

Getting Excited

Today I created an outline.

It’s day zero of the first of my three WordPressPDX countdown timers. Today was “outline” day.

15 days from now is “Presentation” day- the day I need to be done with my presentation (so that I have enough time to test it, tweak it, and maybe break it)

30 days from now is WordCampPDX!

Today I created an outline, and it’s a pretty good one. We’ll look at messing about with WordPress themes and plugins, we’ll create Github repositories, and we’ll break things.

We’ll even– crazy thought– hack the WordPress core!!

But it’ll all be okay, because we’ll have a safety net.

You don’t need to know PHP, you don’t need to know about source control. All you need is the desire to fiddle with stuff and see if it breaks.

And you need a love of WordPress, but if you’re coming to WordCampPDX, you already have that base covered.

Yay for WordCampPDX!!

1. despite the fact that there is a revision control system built into the WordPress editor

This is mostly a post for my memory and to aid the searches.

Say you’re building an Android application using Eclipse, and you screw up your XML file, and then you FIX your XML file and try to run your app, but get an error window with Eclipse telling you that you have an error in your application and that it can’t launch and that you should check your console.

But there’s nothing in the console, and you have no errors.

Look in your Problems window and you’ll probably see an error that says something like this:

Unparsed aapt error(s)! Check the console for output.

It took me a while to figure this out, with a couple re-starts of Eclipse, before I accidentally stumbled onto the fact that if you simply delete the error message, you can build and run like normal.

WTH?

Inexplicable;

Looking to figure out if this was my problem or Eclipse’s, I found Issue 10012 on the Android Google Code site.

I’ll check out the Eclipse bug system when I get a chance, because it seems like it might be an Eclipse issue rather than an Android SDK issue- could be wrong, but it seems like the aapt is fine from the Android Dev issue text.

Not sure this’ll help someone else, but it’ll at least help me remember.

I took a trip to Portland recently to traipse through OSCON. I was mostly in the exhibition hall with all the great schwag and company booths– many which had posted job announcements. While there, I was once again frustrated by a trend I keep seeing. The trend can be described as an “arms race of job announcements,” and has gotten to the point where it’s difficult to find a development job listed by a company that is not seeking a “ninja,” or a “rockstar,” or some similarly absurdly described candidate.

Smart and Gets Things Done

As best I can tell, this trend really took off– even if it didn’t start– with Joel Spolsky’s blog article titled “The Guerrilla Guide to Interviewing.” In that article, he stated that there was one primary requirement for working at Fog Creek Software: “Smart, and gets things done.”

His basic argument, with which I tend to agree, is that it doesn’t really matter what your past qualifications are as much as it matters that you can do to things: 1) Learn shit, and 2) Actually do shit.

His point? If you can’t learn, you’ll be stuck trying to write software in Visual Basic and someone will eventually shove you off of a roof out of frustration. Furthermore, if you don’t actually DO anything, but rather just talk about it, or think about it, or tell others why you could do it better– then you won’t even write software in Visual Basic. You won’t write any software at all, and someone will eventually shove you off of a roof out of frustration.

But if you can learn, it doesn’t matter what you come into the job knowing, because that’s merely a starting point. It’s how your knowledge and skills translate over time that’s important. You can learn <insert whatever you need to do your job here> quickly. I say quickly because you are a DOER, and doers always learn new stuff, so they can DO more stuff.

The most important thing here: The job will probably change, and when it changes, it’s the people who can LEARN, ADAPT and DO that will help the company succeed. The person who came to the job with one incredible skill but can’t learn probably has that one incredible skill in a stupid technology like Visual Basic, and someone will eventually shove–

well, you get the idea.

The problem with catchy words

So, herein lies a bit of the problem. Joel also talks about hiring the best people, treating them like “rockstars,” etc. Again, I think he has a point, but that there are a great deal of people who are stupidly picking up the hot new terms like “rockstar” and “ninja” and using the words, basically, without using their brains.

I see them a lot. Those posting that sound all hip and cool: “Are you a Python Guru?” or “We’re looking for a Ruby Rockstar for-” or “We want a PHP ninja to-” Everytime I see one of them I want to slap them in the head with the nearest O’Reilly book and then vomit.

This type of job posting proves one thing to the very people that you want hire: That they don’t want to work for you.

Why?

Because the very people you want to hire are the ones who describe themselves as “hard working” or “with a lot to learn” or even “not as good as many, but loyal, friendly and likes to learn new things.”

Do you really want to hire a ninja?

What’s a ninja?

It’s such a stupid, overused buzzword! Do you even know what it means? It’s either an assassin or a stupid 14 year old jumping out of a dumpster brandishing a medieval sword.

You don’t want either of those things!

Ninja: It's a word that's THIS overused

Yes, there’s some evidence that a well trained ninja was, if absolutely nothing else, a competent assassin (though the Samurai made fun of them). A ninja is basically a person who does one single thing really well, they kill people, and the rest of life- including the whole “getting along with people” part- they could give a rat’s ass about.

Human interaction to a ninja is “kill them!”

Conflict resolution to a ninja: “Kill them!”

For those who miss my subtly: A ninja programmer’s response to pretty much anything is going to be this: “Do it my way and no-one gets stabbed in the face with my medieval sword.”¹

Think about it. Do you really want to hire someone who does one single thing really well? To the exclusion of things like “showering” and, say “talking to other human beings?”

Ninjas are Zombies!

Here’s a neat trick: think of another stupid, overused buzzword: Zombie. What if I told you that ninjas are just zombies with black bags over their heads?

They do one thing really well: kill people (eating their brains- mostly the brains of your team if you hire them), and they could give a rat’s ass about things like “human interaction” and “conflict resolution.” What’s their solution to everything? “Kill them! (and, since we’re here, we could maybe snack on their brains too…)”

Ninjas are zombies! They’re mindless idiots going around trying to do one thing.

That’s it.

When you say “I want a ninja” you’re saying “you can be a complete asshole, refuse to learn anything new, refuse to respond to other human needs or the needs of the business, and also be a social trainwreck. Oh, and you don’t really need to know, or care, about 90% of programming or computer work, but if you can sit in your hole and <do that one thing well> and not talk to anyone, you’re the guy for us!”

You want a ninja-zombie as your lead developer, don’t you? Admit it.

Rockstars: They go to 11

Alright, I think you get my point, but let me touch upon rockstars for a moment. Here’s another place where I think Joel’s point was completely missed by a lot of people. Joel says “hire the best people you can find and treat them like rockstars” and in pure politician-like “I don’t really want to put any actual cognitive thought into this process, so I’ll just pull a buzzword”-style, job announcements start popping up for undefinable qualities such as “Ruby Rockstar.”

You want these guys in your company?

The mistake here is that all the corporate bozos think “Hey, ‘Rockstar’ is the current buzzword, so I’ll use that too!” without stopping to think about one thing: “Rockstars don’t usually make the best employee material.”

Think of the words “punctual” and “hardworking.” Okay, now, keep those words in your head, and think of the word “rockstar.”

Yeah, your neck hurts doesn’t it?

See what happens when you take things out of context? Joel’s statement was “treat them like rockstars.” In otherwords, treat them like they mean something, like they matter, like the company depends on their happiness… so they will be happy… and do really good work… and make you more money.

The line was emphatically NOT “Make them into rockstars.”

Seriously! Think about your average caricature of a rockstar.² They show up late, drunk, stoned, with a 16 year old’s bra stuck to their belt, and give you a loud, shitty performance of something they don’t feel like playing before hopping back into the bus for more sex, booze, and food.

Okay people, repeat this after me:

“I don’t want to hire a Rockstar!”

A rockstar is probably worse than a ninja, because at least a ninja- or a zombie, for that matter- can do one freakin’ thing well. The only thing the rockstar can do is pray to god that the sound team can mix together the shit they call a studio performance, and that the stage crew can hit blow the fireworks early to cover the guitarist tripping and falling because they’re too freakin stoned to remember that there’s a drumset behind them.

They think of themselves as the best thing that’s ever happened to you, and if you tell them otherwise, they’ll freak out.

Rockstars look good. Full stop.

You know who the rockstar is? It’s the young programmer I met at the Open Source Bridge conference who immediately berated me for using a different database strategy than him– without ever stopping to listen to the problem I was solving, to hear about my application’s design, or to learn why I would choose one over the other.

I was wrong, they were right, and I should really just stop being stupid and do it their way.

Yeah, that’s who I want on my team.

Fucking rockstars.

Are you an incompetent programmer with an overblown sense of self-worth?

Here’s the part that bugs me the most: The people posting these job announcements are actively selecting for people with a tendency to overstate their abilities while understating their faults.

It’s called the Dunning-Kruger effect and it’s well documented in both the scientific literature andpopular journalism.

The basic Gist is this: Incompetent people tend to overstate their abilities and think they are amazing, while highly competent people tend to downplay their skills and think that they are less than amazing.

And you know it’s true.

Go pick the first male rockstar-ninja-zombie programmer you can find and I’ll pick the first quiet, understated female programmer I can find. Then we’ll see which one can actually shut the hell up about how great they are and get something done.

The best people for the job are not the ones who are going to feel comfortable applying for the “Amazing Rockstar!!1!” position for the very reason that they are the ones that you want to hire: because they are too busy being amazed at all the stuff they don’t know to be rockstars who tell you everything that they do know.

They don’t think they know everything. In fact, with everything there is out there, they realize that they know basically nothing. Most importantly: They know that there’s a lot to learn, and they are trying to learn it.

The rockstars? The ninjas? They already know it, and they’ll tell you.

In fact, They’re more than happy to tell you how much they know.

Every single time you interact with them.

Folk Developer: Will learn and be nice for food

I don’t apply to any of these positions because, while there are a lot of things that I am and can do, there are certain things that I am emphatically not. A partial list of the things that I’m not is:

• Rockstar
• Ninja
• Zombie
• Best person in the world at <fill in whatever you want here>

Me, I’m not any of that. And that makes me think, from the majority of jobs I see lately, that I won’t be good enough to make the cut. And let’s face it, if they’re advertising for a rockstar, then I am probably not, because I do a lot of things competently, not one thing better than everyone else including you.

See here’s the thing: I’ve been programming for 25+ years, I’m competent in at least 10 different languages, and really good in at least 4.³ I’ve built everything from robotic control systems to mathematical models, from spatial applications to social web applications. I’ve taught programming, and am about to do so again, and I do other things like start a Ruby users group.

By many-if-not-all accounts, I’d be one hell of a developer to have on a team; yet many teams are seeking rockstars.

I am not a rockstar.

I’m not the guy on stage with lights and explosions and a screaming electric guitar.

I’m the guy who goes to a party and sits on the couch singing a song on a guitar. A really fun song, with really good guitar work, but not anything that needs lights and explosions. I may also pick up a banjo or back someone up on a number of other instruments, but mostly I just stay at the party and hang out with people.

No lights. No explosions.

I’m a folk developer.

I’m a seeker, I’m a learner. I’m a hard worker who will spend his free time coming up to speed on a technology for curiosity as well as success. I’m loyal, I’m friendly, I’ve got a sense of humor and would much rather laugh at myself than at anyone else. I spend my off time programming, like lots of people who love programming, but I also spend my off time playing the Irish flute and banjo, cycling, brewing cider and mead, working in community theater, and lots of other social pursuits.

Despite this (or, rather, because of it) I see myself as little more than “a decent programmer who’s probably not as good as most, but might be better than some.” In fact, I don’t have enough fingers to count the number of jobs I’ve actually turned down because I thought that I was probably not good enough– only to find that someone else was hired whom I actually know that I can outperform.

I am not going to apply for a job as a Python ninja or a Ruby Rockstar, because I’m not a ninja or a rockstar. I’m a person who knows a heck of a lot less about Ruby than many other Ruby programmers.

I’m a person with a lot to learn.

Exactly zero of my qualities describe a rockstar.

Are you an incompetent company with an overblown sense of self-worth?

And I know that’s also true of many of my developer friends and colleagues. Companies select for people who are not them.

Here’s the clincher. Most of those companies who are hiring ninjas and rockstars are probably doing so because they see themselves as ninja and rockstar companies.

They are the companies that say things like “do you want to work in our cool-ass company where everything is better than any other company you’ve ever worked for, where we have foosball all day and are all awesome and badass about everything we do?”

Sound familiar? I’ll bet it does.

It sounds like a rockstar of a company.

1. No, don’t ask your ninja programmer why they have a European weapon, you’ll get stabbed in the face.
2. which is all we’re really talking about in either case- neither Joel or you are talking about Dar Williams, here.
3. 5 if we count Ruby, which I’m learning more about every day

This is just a post that may help me stop being stupid. Writing it may help carve it into the permanent portion of my memory instead of the “forget about it and then periodically have to think twice and remember that you did something stupid” portion.

It’s a small thing, more of an annoyance than a real problem. Something like my tendency to forget “end” after blocks (a Python holdover) and to assume that zero equals false (a sort of “everything else” holdover).

It boils down to this:

belongs_to is singular,  you stupid dipshit! Stop being a mindless screwhead and remember that for a change, John!

Honestly, it only takes me a second once I get the ever familiar error, but it’s just better to not get the error at all, right? Efficiency and correctness.

If anyone reads this and runs into me later, I wouldn’t mind if you repeat that statement to me.

More reminders couldn’t hurt.

There are plenty of times when I want to grab either one or many random records from a database in Rails. For instance, one random user, one random post, 5 random items, etc. Honestly, it’s one of those things I do in nearly every app I’ve written, so a while ago I created a module to add to any ActiveRecord class that gave me one() and some() methods. This way, I can just include Randomizer and have the methods. Everyone probably already has their method– I actually got this from somewhere else and modified it a bit– I figured I’d post mine in case someones searching the innerwebs.¹

1. It’s one of those things that could be in a plugin or gem, but I’m getting really sick of gems and plugins that carry all the infrastructure to support being gems or plugins when they are really simply a wee bit of code in one small file. Thus, I’m starting to just publish Gists and add them manually to my lib directory. They’re not really gems– they’re more like ungems. Maybe shards.

Ahh, security. It’s it’s like flossing and using condoms. We all know we should do it but… well, it’s business time!

We’ve all got the same issues. “Use strong passwords!” which means “don’t use just words” is something we all try to take seriously, but it just ends up being something like “c00lp455″ with even the most basic cracker program would handle easily– replacing letters with numbers was maybe a good strategy in 1988, but you might as well just use “coolpass” today, because that’s not any easier than using numbers for any attack.

“Don’t use the same password often,” “Use passwords with enough entropy (randomness),” “Use passwords longer than 8 characters with upper and lower case letters, numbers AND PUNCTUATION!!”

Whatever.

It basically comes down to this: We all have one password we use for freakin’ everything, and that password is probably something like “mysillyp455.”

Sigh.

I’ve been wanting to get away from this lately, but have been generally disappointed at the options.

There are dozens of password managers out there, and hundreds or thousands of password generators. I have issues with all of them, and recently decided to address them in a bit of a crazy way: By completely re-thinking how I handle passwords.

Password generators suck

You know it’s true. They come up with the most ridiculous passwords that you’ll ever see. Who the hell is gonna remember ’5+b(*|$1e8+8@’ is their password?

Oh, right you want pronounceable passwords, because ‘m4k1tw0rk’ is going to work better than ‘makeitwork.’ Right. See above.

I mean, they do their job, sure, but password generators generating random strings are not really very useful to me, because I’ll never be able to recreate the password, which means I have to write it down somewhere or store it in a password manager…

Password managers suck

Yeah, I know, you’re a dedicated 1password user and you think I’m an idiot. It’s a decent solution¹ but it, like any manager, still suffers from some serious flaws.

One is, of course, that if you’re somewhere or somehow don’t have that manager available, it’s absolutely impossible to get your password. This has recently happened to me while trying to use an app called LastPass, which generated really nice, ridiculously hard passwords for all kinds of stuff, that I could then never remember and I couldn’t get later when I screwed up my master password.

Reminder emails galore!

Here’s another problem: My passwords are stored on somebody else’s webapp database. Oh, sure, they’re stored ‘securely,’ but how the hell do I know that’s true (read the TOS people, they limit their liability for a reason).

If the pentagon can get hacked, some 24 year old start-up geek is certainly vulnerable.

Single points of failure suck

The biggest things about all of these is the ‘single point of failure’ issue. Password managers store passwords in encrypted files, so that’s nice. But what if someone gets your all important 1password that secures all your other passwords? You are, in a word, fscked.

So, the basic problem with all of these is that they are not actually as secure as we think, and when they are, they’re not easy. So we either have secure and hard as hell, or we have easy and fundamentally flawed, right?

Maybe not.

Password generation as password management

Okay, no lie, this came to me while somewhat tipsy and pouring down beer at a local pub:

What if your password wasn’t stored anywhere, ever. What if you could simply have a way to securely recall those ridiculous passwords that generators come up with out of thin air?

Think about it. 5+b(*|$1e8+8@ is probably a pretty damn secure password– if you used that for anything, you’d be pretty safe, but you’d never remember it. But what if that was, in a way, mnemonically generated?

Enter Passfish.²

Passfish is a program (actually, it’s an idea)³ that generates passwords from the combination of words, a secret key file, and (optionally) name and passphrase parameters. Using this combination of items, Passfish will generate a high entropy password.

$ passfish 'name@email.com'
 9!b%e+70

Now, that password is not stored anywhere, not in any encrypted file, nowhere.

Furthermore, if you use the Bash shell’s ability to ignore certain commands, that won’t even be in your Bash history. No-one can get it in a file, no-one can see what you’ve typed. It’s ephemeral. You call it up, and then it goes away.

But it’s still insecure as hell, right? I mean, anyone can figure out that name@email.com turns into SOMETHING.

Generation and modification of hashes on the fly

Keyfiles solve this. When you have a private keyfile, the string name@email.com is combined with the contents of this file, a hash is generated from that combined string, and the hash is modified in a repeatable way. This means that you can have super simple “passwords” (e.g. name@email.com) and even write them down on your forehead, and no-one will be able to generate your actual password without having your same keyfile.

But wait, there’s more!

$ passfish 'email' --name 'work'
(|@+#^7b
$ passfish 'email' --name 'home'
$1e8+8@

You can specify an additional parameter, a name. This allows you to increase the security because you could have the same “password” for multiple accounts. You can also have passphrases:

$ passfish 'email' --passphrase 'I hate Dirty Dancing!'
$1e8+8@

This allows even more security!

There’s also a length parameter:

$ passfish 'email' --name 'work' --length 13
$1e8+8@$1e8+8

Simple mnemonics for complex passwords

One of the things many people do when thinking of passwords, is create devices that they use in ALL of their passwords. For instance, start with an @ and end with a $, then capitalize the first letter, so a password could be something like ‘@Email$’.

What Passfish allows you to do is to create similar mnemonics, but use them wisely to create truely complex passwords. For instance, it’s a website that I use at work called “workstuff.com”

$ passfish "workstuff.com" -n "website" -p "at work"
$1e8+8@

Thus, the password is not stored anywhere, but I have an easy way to remember it.

No single points of failure

This way, even if someone steals my computer, they can’t get my passwords unless they have ALL of the following:

1. The password identifier
2. The understanding that I’m using some stupid geeks weird Passfish program
3. Access to my private key file (which could be any file I choose)
4. Knowledge of the name, passphrase and password length

Rather than a single point of failure, there are multiple points for each password, because even if someone got your private key file figured out, they’d still have to spend considerable time getting each password– and access to one password makes it no easier to access another password! It’s not an all-or-nothing proposition.

The Status & Future

So, what’s the status? Well, it’s currently an open source application on Github, and it’s little more than a proof of concept. All it does now is combine all the parameters together into a string, hash it, and modify the hash. Pretty stupid, I know. (The plan is to do things better, like use the passphrase parameter to strengthen or change the hashing, etc.)

And as for the “but that’s stupid and hard” people, the other plan is to create apps that tie in with this underlying generator for things like Android and LaunchBar. For instance, a LaunchBar plugin that lets you type the identifier, name and passphrase, and then automatically copies the generated password to the clipboard, so that you don’t have to even see it, much less go to a terminal window to use Passfish.

So, it’s new, it’s still pretty dumb, but as a proof of concept, I throw it out there as an idea, knowing that– because it’s open source– any serious vulerabilities or blindspots will be illuminated.

Check it out, fork, modify, correct. Throw me ideas and comments or ignore it altogether.

1. or at least it would be if they’d make a freakin’ Android app!
2. Disclaimer: this is a proof of concept. A crazy scheme. It needs work, so I wouldn’t jump into using it. At least not yet.
3. actually-actually, it’s planned to be an algorithm, but right now it’s simply a quick hack as a proof of concept

It looks like the folks on the Twitter API team have built their own URL shortener and will soon wrap all URLs to protect against fishing and collect stats:

Additionally, as we mentioned at our Chirp developer conference in April, if you want to share a link through Twitter, there currently isn’t a way to automatically shorten it and we want to fix this. It should be easy for people to share shortened links from the Tweet box on Twitter.com.

To meet both of these goals, we’re taking small steps to expand the link service currently available in Direct Messages to links shared through all Tweets. We’re testing this link service now with a few Twitter employee accounts.

The title of this post is what I find most interesting: “Links and Twitter: Length Shouldn’t Matter.” It harkens back to the old saying “it’s not the size of your wand that counts, it’s the magic you can perform with it.”¹

In this case, it is the magic. I ran a URL shortener for a while, mostly as an experiment, and the thing that makes them great is the stats and pre- and post-processing you can perform on the URLs. They could get those links if they wanted to. Twitter already has every link we send to them in their database– their in the status messages after all– but this is subtly different.

Just like with any URL shortener, someone will hit http://t.co/y4d4 and be instantly redirected to the shortened URL. But prior to that redirect, Twitter can filter phishing attempts or scams (effectively nullifying any attempt). More importantly, hits on that URL will be tracked, just like bit.ly tracks stats on URLs so that you know how many people clicked the link to the latest photo of Sarah Palin in a mini-skirt.

And there’s the magic.²

There’s a lot of data going through Twitter, and building a system that effectively injects links and stats directly into a database is sauce.³ It not only allows them to say “That’s a link to a Nigerian phishing scam,” it allows them to say “Hey, New York Times, we have a record of 75 thousand visitors per hour to your article on Sarah Palin’s legs… you wanna talk about a strategic partnership?”

See? Magic.

Who said Twitter didn’t have a monetization strategy?

1. We’ll leave out the joking about who says that… but it’s not my wife!
2. no, not Sarah Palin’s legs! (though they are… nevermind)
3. Spicy sauce, as spicy as Sarah Palin’s– nevermind.

It’s pretty silly, and wasted more time than I needed to, but I’m really very incredibly “oh my god I’m so sick of this I could puke” bored with Lorem Ipsum text. You know what I’m talking about, that placeholder text you use when you just need to fill a paragraph with something, and don’t feel like typing shaesthstnsahoestha?

This:

Lorem ipsum dolor sit amet, consectetur adipisicing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat.

It’s a damn useful thing to developers and programmers, but it’s just so freakin boring!

Well, recently I was reading (for about the 7th time) the Dune series and saw words like Jacurutu and Muad’dib and thought “That would make fun Lorem Ipsum text.” Then, because Ruby and Rails makes building a web application about as easy as making a peanut butter and jelly sandwich, I got to work.

Kwisatz Haderach

Instead of Lorem Ipsum, I created Kwisatz Haderach.¹ Unbelievably, the domain hadera.ch was free, which is cool, because with a subdomain it becomes http://kwisatz.hadera.ch.

Instead of random latin-looking text that doesn’t mean anything, the site generates paragraphs of text from words in various Science Fiction and Fantasy universes. Here’s a sample pulling from the Dune and Doctor Who universes:

Suk hajra Bela Tegeuse liban maula TARDIS Tabr Harkonnen plasteel butlerian suk sadus crysknife fai caid Poritrin gom jabbar dalek Faufreluches crysknife sirat baradye. Minimic Film Palimbasha Arrakeen Irulan Panoplia Propheticus kitab al-ibar wali kulon Lankiveil Alia Muad’dib.

Nothing Special

It’s nothing spectacular, barely worthy even of a blog post. It’s nothing that an experienced Rails developer couldn’t do in about 30 minutes, and a novice Rails developer in about 2 hours.

But it’s one of those cool ideas that you think about, and might never get around to actually building. It’s just for fun. Much more fun than stupid Lorem Ipsum.

So go check it out, and if you want to, you can throw together a quick wordlist for a universe of your choosing. Some great ones to have would be Harry Potter, Star Wars, Star Trek, even things like Fraggle Rock. Wikipedia even has a great List of Fictional Universes² if you want to see some fun ones you may have forgotten about.

1. for those who don’t know Dune, here’s a reference.
2. Thanks to @wajiii for that pointer!

This post is mostly a whiny diatribe on how I’m a stupid idiot.

Mostly, when I code, I focus on logic: algorithms, object models and other back-end stuff. All the stuff that’s hard and doesn’t give any sort of gratification to the front-end developers or users because, well, it’s not on the front-end. The stuff I like to code are the elegant binary-keyed dictionary structures that route water in multiple simultaneous directions in a hydrologic model. It’s the stuff no-one sees.

Consequently, because I hate the design side,¹ my apps generally look extremely rough, almost unusable, but damn do they do some cool shit. If it’s something that needs a front-end, I either do that last, or get the back-end working and then ship it out.

Recently, I took on a project for a fellow who’d been working for months with a developer. I pretty much thought I was going to “parachute in” and take this developer’s code and bring it to launch. Well, it turned out that the previous developer didn’t actually write any code. None. Zip. Instead, what they did was create long “what we should do” lists and emails.

And, they got a design.

So, the “code” I was given was not code at all. Rather, it was a really nice design from a third-party designer. Thus, rather than build the back-end to the site, I had a design that I just had to plug into. I decided to break up that design into views and plug them into my new Rails app directory before I started build models.

This, as it turns out, was a very serious mistake.

Because it seems that I have a certain workflow, and that workflow is to develop an object model based on the logic that is needed, and that logic is based on the function that the application is to perform. That’s why I work so well on the backend without a design. The bare scaffolding allows me to think about the object and not the layout.

In this case, I made the mistake of applying this design before creating even my first model. That was bad. Very bad.

The thing is, designs have all kinds of embedded assumptions. Usually, when the design is based on the logic, the assumption is “it has to provide an interface for this logic.” However, when the design is created in absence of the logic, then the assumption is something more along the lines of “well, hell, I guess it might need one of these.”

I didn’t ever realize it until very recently, but I now know that what I was doing was some weird, disconnected hybrid of design reasoning. It was something between “This is the most robust-yet-simple object model that I can start with and build from” and “well, the design says it has an X button, so I guess I’d better build an X model.”

Yeah, I know it’s stupid. The thing was, it all happened so subtly that I didn’t even realize it! I guess that, in other projects, by time the design is applied, the object model is solidified. Thus, if there’s a button, you can be damn sure it needs to be hooked up. In this case, there are buttons that pretty much everyone sees and thinks “Yeah, I don’t know why that’s there.”

So, today I was trying to work around 7 polymorphic models and at the same time I was thinking “this would be easier if I didn’t have to scroll past all the glitzy site images to see this whenever I look at it.”

That was when it hit me. I don’t. And more than that, the 7 polymorphic models I have are really only there because there’s this navigation bar, immediately above the glitzy site images, that says they should be.

So, believe it or not, I did the crazy thing. New repository, new Rails scaffold. Start over.

So now, it’s 4th down in the 4th quarter, there’s like 5 minutes to play until this prototype is due, and I’m dropping back to punt with a new Rails app that doesn’t have a design applied.

And I’m hopeful, because it’s actually a fairly simple app, just with a complicated design. But as a simple app, I know it’ll be simple for me to whip out, now that I have a clean understanding of the object model, and no design cluttering my thoughts.

Damn, it’s late in the game to come to this play, but at least I know better now.

1. I don’t actually hate it. I just take 7 hours playing around with 2 px changes in CSS files and then finally give up