The Art Of Not Asking Why

This is another test post, to see what posts here do with my existing mastodon account which I created for feeds. https://fosstodon.org/@jtr_feed

No, I don’t mean the new “hack” from Cellebrite, which still seems to make waves¹. There’s a more fundamental issue at hand, a result of Signal being secure, not because it’s flawed somehow.

Privacy as Ownership

I’ve been thinking about privacy for a while, if that’s not evident from my recent blog posts. The word is so widely used these days it lost tangible meaning. What does privacy even mean anymore?

To me, privacy is the option to share information. To have a choice. This post I’m writing right now, for example. I can keep it to myself, deep in my journal pages, where it will never be shared. Or I can push it to my repository on GitLab, which will cause Netlify to pull it and build a post on its virtual Hugo environment, with DNS pointing to my domain, for the whole world to see.

In order to have this choice, I first need to own my data. In the old days, I used to have a blog on WordPress.com. There was no local copy; I’d just log into the website, work on my draft, and publish. I never truly owned my data, despite whatever WordPress might say. They could have shut down my account without a second thought, and all of my posts would have been gone forever, no matter how loud I’d yelled. No data ownership, no choice, no privacy².

Can I Own my Data on Signal…?

At this point, you can see what I’m getting at: with Signal, I don’t own my data. Sure, my conversations are end-to-end encrypted. Sure, no one besides me and the person I’m talking to, not even Signal, can read these conversations. But the WordPress problem I described above still exists: I don’t own the conversation.

Even though the conversation itself is stored locally in a database on my phone, it is fully encrypted (as it should be), and even if I decrypt it (in a similar manner Cellebrite did³, it is still not laid out conveniently. It looks like lines in a table. After all, it’s a database you’re looking at.

As far as I know, Signal doesn’t have the option to export conversations⁴. To do so would be a security risk for sure, especially for non-informed users who just want to have an encrypted chat client on their phone. However, I believe there’s room for such a feature, perhaps with limited access. Maybe for developers or folks who want to build Signal from source, which I think is still possible (Signal has their repository on Github).

Footnotes

¹ If you’re curious if there’s truth in these claims, start by reading Signal’s official response and follow up on Reddit for a few entertaining remarks.

² You could argue that having my post hosted on GitLab is not much different than WordPress, and you’d be right, with one important exception: all my posts are local before they ever get pushed to GitLab. GitLab, and the post you’re now reading, are just a copy of my original content, which I do my best to preserve with encrypted backups. If GitLab closes my account tomorrow, I won’t lose anything. I could probably relocate to a new repository within the same day.

³ The retracted blog post on their site showed how they decrypted the local database on an Android device. In a way, it was pretty informative. The big problem with it was that it was no hack at all: they described a way to decrypt the information using an unlocked phone. The equivalent of breaking into a house after you have already unlocked the front door with the key you happen to have.

⁴ There’s an option to creak a local encrypted backup, but this backup is meant to be used with Signal. If you don’t have Signal, you can’t use this option.

I was listening to some Brahms music and I was thinking I should find myself some more, but I forgot how hard it is to get a proper classical music CD.

Searching is always difficult, and then my NYPL card doesn’t work anymore. When I do find a CD, I need to pick it up from the library and record the tracks to mp3 of flac files.

Why not just listen to streaming music? Because it seems every musician and his grandma create some Brahms cover (this is much worse of course for Beethoven, or Mozart) and you end up listening to some electrical guitar mix with drums that some 20-year-old thought was cool.

Comment from 2024-12-12: Since then, I’ve learned and subscribed to Idagio, an online lossless streaming service that keeps my classical music cravings satisfied

• Belladonna of Sadness
• Oblivion
• The Mule

• Leonor Will Never Die

I read a good argument in a NYTimes opinion piece by Laura Vanderkam in favor of flexible work hours.

The article contains a couple of interviews with people who adjusted to work with flexibility. Here’s the part that resonates with me:

I hope we can begin to understand that, for many, work is a collection of tasks, not a collection of hours in a certain place. And time is a finite resource, but one that cannot always be neatly divided into “work time” and “free time.” Taking time for yourself during the work day doesn’t make you lazy, and working a bit on vacation doesn’t make you a workaholic. Dispensing with strict time boundaries should also mean ditching the guilt you might feel for either. In org-mode, I measure time by clocking in and out of tasks. These can take days, weeks, or months. Other projects repeat and become routines. I don’t particularly care “when” these hours take place. The nature of the job, not to mention COVID-19, have long deemed most of the “where” irrelevant. I often work outside my dedicated work hours, sometimes as early as 5 in the morning or as late as 9 in the evening. The flip side of this is taking long lunch breaks or leave the office a bit early. It goes both ways.

One of my good work “hacks” are quick naps, from 10 minutes to about half an hour. In return, these breaks allow me to be alert and productive at work, often working beyond the minimal requirements of a certain task. I enjoy what I do, so what’s the big deal?

New York’s Last Movie Clerk Knows More Than You Do nytimes.com

Read: www.nytimes.com

Last weekend, I ran a DnD session. Three curious players stepped into a fantasy world I created for the first time in over 20 years, took whatever plans I had for them, shredded them to bits, and apparently left satisfied and wanting more. So if you’re curious, this is a chance to understand what’s the fuss about from a perspective of a guy who’s starting it all over again.

DnD (easier to type than D&D) is a phenomenon that has seen a renaissance in the last decade or so. I believe that’s because most of the folks who played the game as teens (myself included) are now old enough to pass the hobby down to the kids: either their own or those who matured after the 90s.

Because DnD is essentially an act of communal storytelling, you can make it whatever you want. This means you don’t have to be a kid to participate; the story can be adult-oriented with everything you’d expect from a good book. While DnD is usually set in a medieval fantasy world, it doesn’t have to be this way (one such example is the unsleeping city, a DnD setting in modern-day New York City).

To me, the story aspect of DnD is primary to everything else, which means the people who create it are of utmost importance. I was on the lookout for a while. I couldn’t just pick a random group online and join a game: sharing the world inside my head is an invitation to a private, intimate domain. I had to pick and choose people that I felt I could open up to and be comfortable with.

The requirements from these people were not easy, especially during these times of COVID. They needed to be geeky, even dorky. They needed to be open-minded and comfortable exploring darker themes, sexual elements, and questionable philosophies. I needed people who are familiar with the game and understand that I haven’t led an adventure in over two decades and that I don’t have the vocabulary they do for medieval terms or the knowledge of the rules. It was also important to me to meet these people face to face and talk to them over a drink or two, pick their brains, and see if they have what it takes¹ (more accurately, if I have what it takes). In short, I had to make new friends.

I said led the game, and this is somewhat misleading. A better description of a DM (dungeon master) might be a host. Just like a host, the DM invites the players to play (in my case, the invitation extended to my physical home and the one in my mind). Once the players come, the DM serves as a foundation of a story for the players to take and do what they wish. A good host tries to make their guests feel comfortable and open up, be themselves, and have a good time; a DM’s role should be the same.

Usually, a good game session is full of good laughs, excitement, and a table with snacks and drinks. When a successful meeting ends, the players may ask when is the next session, and the gang you’ve brought together keeps exploring the world you’ve all just built together in chats until the next meeting. These were the moments that gave me satisfaction beyond just the joy of the game. It was the kind of happiness you feel after you feed a group of hungry people with homemade food.

There is more to being a DM than just being a good host. In fact, there is so much more I’d like to talk about just from this one gaming session, I don’t even know how to start (that’s right, I didn’t even start yet). DnD is a game spread over hundreds of pages of content and rules; yet, when it came to just sitting down and creating an adventure, I found that I was drawing from my intuition and past experiences and not so much from the official content. It felt as if there was very little there for me, and the little that I found was not what was needed².

How does one create a good story? How do you even know you want to? And when you have an idea, how do you bring it to life? Do you just write down a list of bullet points? Start typing until smoke comes out of your fingertips? Do you draw the map first, or do you create NPCs (Non-Player Characters)? Do you know why there are monsters there, and are they automatically the “bad guys”? How do you tell a good story, and how do you roleplay?

I haven’t a clue. Seriously, I don’t. However, asking these questions is rewarding. It’s the stuff that would get your juices flowing and your imagination working as it hasn’t in years.

What I hope to do is to explore what I’ve done so far (which is both barely anything and way too much to write about at the same time) and recapture my passion for this game.

Footnotes

1. These are my requirements, which may be a bit much. Those who just want to pick up the game and play can find it in many places online, from Twitch to roll20 to meetup groups. You can always try to play first and learn what you feel comfortable with later.

2. The DMG (Dungeon Master’s Guide) is filled with good advice and rules, not to mention other additions like Xanathar’s Guide to Everything or Tasha’s Cauldron of Everything. This is not what I’m talking about here, as it will hopefully become clear. There’s an excellent discussion on Reddit about this, as well.

When I started researching privacy more seriously, I didn’t know what I was looking at was the face of a forlorn path that seems to go nowhere. I picked it up as a challenge, and within a few days it became clear that privacy is a journey of hard sacrifices.

When I asked for help on Reddit’s privacy community I was blocked from posting because my freshly-created account specifically for this purpose was too new and thus, too suspicious. It was just one stop of many I’ve made in the last two months. Article after article from Medium to Lifehacker was filled with beginner tips like “use VPN” or “search with Duck Duck Go.” As I kept digging deeper, looking for more specifics and advanced techniques, the more it seemed that the internet I use every day suddenly had an end. A wall.

Everything on the screen had a sense of purpose. I was supposed to follow the answers in front of me. Buy a Visa gift card with your credit card; submit your phone number to get a discount; surrender your verified email address to chat with an agent. Not a single website gave additional options. Everywhere I looked, I had to give up a piece of my privacy or lie and hope for the best. I chose the latter option whenever I could. The feeling that I was doing something wrong intensified.

Then there was the loneliness. I haven’t logged into Facebook for years. I stopped using Twitter last year, and with it, I stopped following trends and celebrities in my industry. Most recently, I stopped using Instagram and lost touch with those who like my photos, a window to the outside world, especially during the pandemic. On the other hand, getting in touch with me became more difficult since I insist on less popular apps that no one wants to download. When I try to explain why, it often feels like I’m speaking a different language even with those close to me the most.

This is the price of privacy. I am almost at a breaking point, and I’ve only started. I understand now why there is so little real information about true privacy. Those who stay out of the familiar platforms live in the shadows. It’s not that they hide, but by resisting selling their lives away they can’t reach us or we them. You can’t Google them, friend them on Facebook, or follow them on Twitter. They don’t exist to us, criminal by association with the cryptic “dark web.”

So much of what we do, what we are, is not even ours to share but instead borrowed, hosted somewhere unknown to us, supplied only if we sign an agreement to give ourselves up. And we can’t be bothered to know. After all, when was the last time you read Facebook’s terms of service? Twitter’s? Google’s? Apple’s?

I wish I could tell you this is all a cheap Matrix ripoff. The problem is that I can’t unlearn what I’ve learned or unread what I’ve read. Instead, I’m figuring out how to bend the rules just enough to be more than a sheepish user. I’m starting to see the invisible walls of the digital cell.

I received my new Pixel 4a on Friday before last, and after a week, I can say this with confidence: this is the best smartphone Google has ever made. I also hope it will be the last phone I buy from Google.

If you want to read more about the Pixel4a, There are plenty of reviews on the web, both written and videos (here’s a recent in-depth one from arstechnica, and a quicker video from the Verge). Here I’m going to focus on why I like this phone.

Let’s start with the obvious: the price. At $350, Google is back where it has always been best: supplying top tech at a price that doesn’t twists people’s arms. At hard times like this, with folks losing their jobs, this is a welcome change from the $800-plus flagships.

The Pixel 4a is not a statement of class like the iPhone, and it’s far from delivering the latest and greatest. That’s fine because I don’t need the latest and greatest, I need a damn phone. The iPhone 8 Plus, which I have for work, still sells for about $500 today(1)

The iPhone 8 Plus is too heavy and too big, yet somehow the screen on it is smaller than the one on the Pixel 4a. This makes a big difference. The Pixel doesn’t fall out of my hand when I pick it up like the iPhone 8 Plus does. I can reach the corners of the screen without doing crazy hands acrobatics. It doesn’t stick out of my pocket for everyone on the street to see. It fits into my pouch when I go for a run. These may look like insignificant details, but the overall experience is liberating.

As a bonus, the pixel comes with an earphone jack. I can carry my FLAC files with me on the phone and listen to my higher-end earphones at the office now. The Bluetooth headphones are good for meetings and streaming music, but if I want to get lost in some good stuff, I need an audio cable(2). It’s also nice to plug in my good set and charge my phone at the same time when I’m at my computer.

I know the argument for/against Pixel phones is all about the camera, the better battery life, lack of better water resistance, Android sucks/rules, blah blah blah. I don’t care about those. While I don’t particularly care about looks, the Pixel does look nice. The edge-to-edge screen without bezels, the crisp image, and thefabric cases to match, it puts the iPhone in perspective.

I used to marvel at Google’s utilitarian vanilla Android and scoff at anything that isn’t a pure Android experience. Now, after a couple of years in IT working with Android, iOS, macOS, Windows, and of course Linux, I’m moving forward.

It’s called GrapheneOS. A mobile OS that strips the Pixel from what makes it Google. It’s a mobile OS built for privacy geeks who want a smartphone that doesn’t call back to the mothership. I want to wipe this phone clean and see if I can live without Google on me all the time.

But I’m cheating. I still have my iPhone. I’ve decided that all the apps that need to “spy” on me can be on my work phone. Bank app? I don’t mind if my job, which pays my salary, sees my bank statements. Google Maps? If I travel, I can’t leave work completely behind anyway. Phone calls? I barely call people anymore and most of my contacts are on iPhone, so I don’t mind using Facetime. Everything private however will live on the Pixel. My org notes in Orgzly, my contacts on Signal(3), my media, passwords, etc.

Right now, this is a challenge I want to take. I still have my old Pixel 2, and I’m planning to use it first as a “demo” version to see how this works out - or fails. By the time I’m done, I believe GrapheneOS will already have a working Pixel 4a version.

Why? Well, why not? This blog is called the art of not asking why, after all.

(1) This price came up for a refurbished iPhone 8+ on Apple’s website.

(2) I find that I don’t need my amplifier when I connect directly to the jack. With the USB-C dangle, which looks terrible and prevents charging at the same time (so the phone slowly runs out of juice), I need to use an AMP as well. Visualize this: an audio cable from the headset goes into an adapter, which goes into the AMP, which goes into the phone. I want to say there’s a slight difference in sound quality without the amp, but I don’t have a professional-grade headset to detect that sort of thing.

(3) This will be tricky since Signal is not exactly open source, but I’m aware there’s a way to install the APK anyway. Actually, Signal puts out its APK on its website.

At first, I only noticed an increase in back pains. Then, there was general restlessness that didn’t allow me to concentrate on long-term projects at work. There was a nagging feeling of “I miss something” coming from my body, not so much my brain. Then, one day at the office during my on-site duty, I pulled up my screen and keyboard to its standing position, and it hit me: I need to stand.

In the past, a standing desk was a gimmick I contributed to yoga-types and others who had back or posture issues¹. When a co-worker left us for another place, I adopted his Ergotron Workfit because it had two keyboard trays which I needed (I work with a Mac and a Windows workstation at the same time). I thought standing up would be a nice “perk” since I often just enjoy walking around or talk to people while standing.

What I didn’t know is that shifting my weight helped me concentrate and became a big part of my morning ritual. The habit of standing up in the morning when I get to the office was so hard-wired that even my manager said at one point he couldn’t talk to me before I pulled up my desk to a standing position and prepared my oatmeal cup, another ritual of mine.

The Research

The research was fun. A full-standing desk at home was out of the question because of its price and the fact that I already had a nice IKEA desk that fit my NYC-size room nicely. I knew I was looking for a standing desk converter, a fancy term for a keyboard-mouse-screen elevator. Indeed, I first aimed for cheap options from Amazon because I didn’t think a converter would be more than that.

My go-to website for information about quality products when several options are offered is the New York Times’s Wirecutter. While it tends to lean more toward expensive things in general (it feels like sometimes they do it just so they have a “budget option” to add to the review), it is a good place to get a general idea. Their best standing desk converters review was helpful.

At the time, the investment seemed like a lot of money for something I could just use a bunch of boxes for, so after reading the full article (you need to keep scrolling past the “The Research” part), I carefully did some Goolging Duck-duck-going and stumble unto Work While Standing. This website seemed like a shallow review site full of ads at start, but as I read more into their reviews, I saw that wasn’t the case. Their “What is a Standing Desk Converter?” introduction was very informative and showed me what each type of converter does, what it’s good for, and why sit-stand desks tend to be more expensive…².

The information on both sites helped me realize a sit-stand converter is a three-in-one solution for me:

1. My ultra-wide monitor’s³ stand that came with it was a piece of junk. It barely supported the monitor’s weight, and I was already searching for a better stand that wouldn’t let it wiggle and wobble at every slight movement (including typing just typing on my keyboard!)

2. I realized that, as Wirecutter noted, the screen does need to be higher up when you stand than when you sit down (try it - you’ll see that when you stand, there’s more space between your eyes and your typing hands). This has been an issue that has been bothering me for some time in the office.

3. My narrow IKEA desk and room setup meant I didn’t want a desk that would push forward as I raised it. I also didn’t like how the Z-shape legs of the other converters looked on the desk, blocking off the area under the desk in its upper position like a cage. I wanted something cleaner looking.

from there, it was easy to conclude that the Kangaroo pro model from Ergo Desktop was right for me: it included the extra feature that allowed the screen to move independently from the tray, but at the same time, I didn’t need the Elite series which included an electric motor for it.

The final tune-in was the measurements: it turns out that the Kangaroo Pro Junior’s depth was the perfect fit for my desk; the bigger Pro would be too wide, with its tray pushing out toward my chest and covering the drawers of my desk. The desk had a clean, industrial look to it that I liked. I also found a coupon online just before I placed my purchase, reducing the cost of the desk by $20. Shipping was free of charge. Nice.

Set Up and Some Hacking

The Junior Pro came in a large, flat, heavy box, kind of like a flat TV screen. Because I don’t trust USPS to ship anything to my home address (that’s a long story), I shipped it to my office instead and took it home from there. I’d say I’m in a rather OK shape, and I handled the box OK, but I wouldn’t recommend carrying the box a long distance or up the stairs without help. It was just heavy enough to be a bit much.

Assembly was easy enough. There weren’t many parts, and the instructions were clearly printed in full colors (you can also view the PDF on their website). The only tough part was the monitor: because of its size, it was difficult to hold it with one hand while adjusting the stand so the screw holes fit just right. This is also when I ran into more problems with my screen.

As it turns out, my ultra-wide monitor has its VERSA screw holes a bit lower than they should be. The Kangaroo’s screen-tilt lock doesn’t provide much friction as is, and it wasn’t possible to lock the screen at a straight angle. It kept tilting downwards, hanging on the adjustable tilt screw. Another issue was the screen’s HDMI socket location, straight in the back, where it hit the metal shaft of the stand. This is a known issue with the monitor, judging from the complaints on the Amazon page, where people ran into this issue while trying to mount the monitor against a wall. In short, this is a problem with the monitor, not the desk.

I fixed the problem temporally by placing Styrofoam between the screen’s mounting stem, which was sticking out a bit, and the metal shaft of the screen raiser. I contacted Ergo directly about my issue and got a reply the next day: they were shipping me another screw which was supposed to replace the tilt break. After playing around with it, I found that it was better to use the screw they sent as a stopper, which fit in one of the grooves of the metal shaft than a replacement for the break, as they suggested. This locks the screen tilt in one position, but I’m fairly comfortable with how it stands now, and I don’t need it to move. The result is a wobbly-less typing environment both for standing and sitting.

A few More Words

Getting a standing desk converter is easily the biggest upgrade for my work environment in recent years. At start I didn’t want to spend so much money on something that seemed to be a “perk,” but the quality of the product, the way it makes the whole room look, and the inviting feeling I get every morning when I stand at it with my fresh cup of coffee are priceless. Still, this is a highly personal choice. I can’t recommend this standing desk solution for everyone: too much depends on individual quirks, measurements, budget, etc.

Of course, This post wouldn’t be complete without praising org-mode again. A picture is worth a thousand words, so here, have a look:

You’re only seeing half of it since my thoughts (under the closed headers) are too long to fit here. Org-mode made it easy to write down details while browsing and reading, kept me organized with my thoughts, and prevented me from remaking conclusions.

Footnotes

¹: An interesting irony, I realize: I am one of these folks myself. ²: That’s because sit-stand converters effectively include a stand for the screen. Other converters are essentially just a raised tray on which you also put the screen with the keyboard and mouse; with sit-stands, the screen mounts to the back. Better models include independent raising mechanism. ¹: Probably another post in itself, an ultra-wide monitor is another must-have in my setup today. It is not as heavy and messy as having two monitors while providing much-needed work space, not to mention good gaming experience (which is horrible on a dual screens in my opinion).

This is my first attempt at explaining a full (though simple) script I wrote. I always say I’m no programmer (or scripter). Despite that, I somehow ended up creating a couple of useful scripts on my Linux machine. My elementary scripts are work in progress. I keep tweaking them as I learn and create new ones. I’d love to hear from experienced scripters just as I’d love to hear from those of you who never opened Nano before. Feedback is always welcome.

Newcomers: Few Basic Requirements

Before we dive in, a few scripting points to cover:

• A script is nothing more than a text file containing a list of commands in Bash (Linux’s default shell). You can use any text editor you’d like to create the file, it doesn’t matter. I use Emacs.
• Speaking text editors: if you use Linux (or a Mac), you have Nano built-in. Just type “nano” in terminal to bring it up. It has a slight learning curve with its weird key bindings, so Here’s a quick guide to get you started.
• In Linux, it doesn’t matter what extension your file has. That world belongs to Windows and MacOs. You can save your script as “myfirstscript” and it will run fine without an extension.¹
• What is important though is permissions in Linux, a whole topic in itself. In order to allow a text file to run as an executable chain of commands, you need to permit it to do so. To do this, type in your terminal “chmod +x [your script path and name here]"² to tell Linux this is an executable file.
• You can’t just run your script by typing it in your terminal and hit Enter. That’s because it’s not part of your system’s path configuration, which tells Linux where are the scripts and programs you can run are.³ You have to be specific and write out the entire path “[path/to/your/script/script here]” or be in the same directory as the script and execute it with “./[script name here]”. Hopefully the above makes sense. If not, don’t worry about it for now, just try to follow the instructions.

The Script

OK then, here it is: #!/bin/bash filename=wdate +%V_%y init_mon=date +%Y-%m-%d cp /media/pispace/Documents/Archive/weekly-template.org /media/pispace/Documents/Archive/$filename.org sed -i “1s/^/#+TITLE: Week Starting Monday $init_mon\n/” /media/pispace/Documents/Archive/$filename.org Keep in mind that the website layout breaks the source code artificially; the two segments toward the end, the cp and the sed, should be in two long lines. I need to correct this. I’ll go line by line to explain what it does and hopefully how it works. What does it do? A practical little thing, this script creates a new .org file every week⁴ from a template and changes its title to “Week Starting Monday [date]” where the date is updated based on that week’s date. So for example, on 02-09-2019 (at 3:00 AM specifically), my Raspberry Pi created a new org file. The first line in that file, which is the title, reads “Week Starting Monday 2019-09-02” (I like my dates in a yyyy-mm-dd format).
How does it do it? Ah. Well, this is what this post is about. Let’s dive in:

The Shebang

The very first line, #!/bin/bash, is called shebang (or hashbang, but shebang seems to be more popular). Every script in Linux should (though there are ways around it, it’s just good practice) start with a shebang. What does this cryptic line do? We’re just on the first line and it already seems like we need to learn another language! No worries. Everything looks big and scary at first, that’s why you break it down to parts you understand. The # sign is usually used to enter a comment into your script. This means this line is not meant to be run as a command and should be skipped. When combined with a ! it creates a special combo⁵ called the interpreter directive, which tells Linux how to interpret the script we’re about to write - or more precisely, where is the interpreter located so the computer can find it and use it to interpret the command. Since we’re about to write a script in Bash, we need to tell our computer: “OK, this file is written in Bash, here’s where you find bash” which is exactly what the next part is: /bin/bash. this is where bash is, in your /etc/bash folder. If it was in a folder named giraffe, for example, it would be #!/giraffe/bash.

Variables

This is probably one of the most popular phrases used in scripting. A variable (or var for short) is a container for a piece of data, usually called a string (string is one type of data, but for our purposes here let’s keep it simple). Our script contains two variables: filename and init-mon. It makes sense if you look at how it’s written: filename=[something...] and init_mon=[something...], like saying my_name=Josh-T-Rollins, for example. In Bash, as soon as we place a = after a name like that, Bash knows this is a variable. Simple. OK, so what exactly goes into these containers? We’re going to find out. By the way, you can define variables anywhere in the script (as long as it’s before you use them, of course), but it’s considered good practice to write them at the beginning of the script.

The Date Command, and Reading the Manual

This is our first command. If you copy date +%V_%y and run it in your terminal, you’d get a number, an underscore, and another number. If I type this today (which happens to be September 3, 2019), I’d get “36₁₉”. Did you notice the plus sign before the options (these are the letters with the percent sign)? it’s important: in the manual, it says to use a plus sign when specifying a specific format to display. We know a command named “date” is probably giving us date related output, and I just gave you today’s date… can you guess what this command does? What are these numbers? To be sure, let’s run the manual command (man) for the date command. Type “man date” in your terminal. This is the manual for the date command (most commands in Linux come with a manual, isn’t this awesome?) The most important bits of info to get from the manual are the name and the synopsis. The name tells us what the command does right there: “print or set the system date and time”, and then the description which is the same thing. Go ahead and run “date” without any format options (that is, without the “+%” something) part and see what it prints out by default; you’d notice it’s the same as specified under the “Synopsis” part of the manual. In our case, we use the date command with specific formatting options. In the manual for the command, scroll down to “Format” to find these. Do you see how many options the date command has? You can print out the current century or even the number of seconds since the beginning of 1970⁶. The options used in the script, %V and %y, give out the week number in the year and the year’s last two digits. The underscore in between is nothing but a separator that will later show in the file name, to get the following format: [week number]_[year’s two digits], which gets us something like “12_19.org”. The other variable, init_mon, is another way to get output from the date command. Go ahead and try to figure out the options used on your own this time. Why do I need this second date? We will find out shortly.

The Copy Command and Using Variables

the next line starts with “cp”. This is simply us writing out a command, nothing fancy. cp stands for copy in Linux, a command that copies files and directories. Don’t take my word for it, check the manual! The command then says to copy my weekly org template (I talked about org files as templates previously) from the origin directory to the destination directory (this format, of writing the origin location first, space, target location, is also noted in the manual. You have to follow this order), as a file named… “filename”.org. And filename is the name of our variable, from earlier. We tell Bash we want to use the data in a variable (remember, it’s just a container) by writing a dollar sign in front of the name of the variable we want to use. I added “.org⁷” at the end because - you got it - this is going to be a .org file.

The sed Command

The sed command stands for “stream editor”. This is one powerful command, which I’m only scratching the surface of here. It allows you to manipulate text in all kinds of ways, but probably one of it’s most popular usages (as in this script) is to substitute a piece of text with another piece (in Bashspeak, we call these strings) We call the command, sed, with option -i which tells it not to produce output. Basically “just do it, don’t show me.” This is because we don’t want to see the replacement on the screen, we just want to manipulate the text. The rest looks a bit crazy, but hang on, it makes sense:

sed: Using Quotation Marks

We’re going to use the quotation marks to include our entire stream and options (you can see it ends at the very end of the line). It’s our way of telling the script to take “this” where “this” is everything included in quotation lines⁸. We need to use it here because our substation includes spaces, and these usually interpret as a workflow instruction. Remember the cp command, and how it uses space to differentiate between the origin and the target? Well, something similar happens in sed, so if we just include spaces without the quotation marks, sed will do something else.

sed: Selecting the Right Text

Next, we have 1s/. This is actually two in one combo. 1 for first line and s which tells sed we want to do a substitution. Then we have a forward slash which is how we tell sed this is the expression we want to replace. In other words, we are selecting the text from here going forward, until the next forward slash. Now wait a second. Didn’t we already use quotation marks to tell sed what parts we want to work with? Kind of. Not really. The quotation marks acted as a wrapper for the whole expression, the text we want to replace (which is missing in this script, I will talk about this in a second), the text we want to replace with, variables… the whole shebang (sorry, couldn’t resist). See, quotation marks work in Bash as “wrappers” as they do here. The forward slash, on the other hand, is specific for the expressions inside the command here, sed. Think about it like a sandwich: when you order one you get it in a wrapping paper and a plastic bag. You don’t eat those, that’s just how you carry it home. Once you take it out, you still have a sandwich, and this sandwich includes the good stuff inside. The quotation marks are the plastic bag and the wrapping paper, while the slashes represent the slices of the bread. you eat those, they are part of the “food” command, the bag and paper are not. Both act as wrappers, but for different purposes. The last part of selecting the text is the caret (^) sign. This is a regex expression (short for “regular expression”) which says “go to the very first part of the line”. Regex expressions are a whole world of their own, a powerful way to explain text strings to the computer. I explored a bit of regex earlier if you’re interested. It’s a good example to show when this comes in handy. Combined with the 1s from earlier, it tells sed to select the first line, at the beginning.

sed: Replacing Text and Placing in a File

Above, we went over how to direct sed to the right text we want it to replace, but we didn’t tell it what to replace, and what to replace with. This is what’s coming up next. Remember how forward slashes represent the pieces of the sandwich for the sed command? These are called delimiters. Sed substitution defines our sandwich like so: “replace /this/ with /this/.” The syntax looks like /this/this/. The first part tells sed what’s getting replaced, the second part what it’s replaced with. In our script above, we told sed to replace the text with nothing at the beginning of the line (there’s nothing there after the ^ sign) with “#+TITLE: Week Starting Monday $init_mon\n/”. Because we specified nothing as what we want to replace, sed will simply replace the whole line. It won’t search for anything specific. And to make sure it starts right at the beginning of that line, we specified the carot from before. If you use org-mode like me, you’d recognize this bit of text: it’s org-mode’s syntax for specifying a title for an org file. So, our sed goes to the very beginning of the very first line and replaces the entire line there with the “#TITLE…” line. You’d recall from before, where I discussed variables, what the dollar sign is: we’re calling our init-mon variable here, which contains the full date every Monday: The title is “Week Starting Monday " and then the date as I explained above. Then, we have a special bit of regex again after we finished the replacing job (the forward slash after the variable): \n. This means, “start a new line please” - just like pressing enter on your keyboard. And… done, we just finished our sandwich, wrappers and all. Finally, we have space (it’s a new line) which specifies the target of the whole sed command. This is where I specify the file where this line of text should be added. In our case, the file we copied from our template above. So the sed command takes a generic line in the template that is served as a title holder (I simply typed in “#+TITLE: Week Starting Monday -—” but it could have said “pink rabbit” or simply nothing, doesn’t matter, since this entire line is replaced) and replaces it with what we’ve done here.

sed: More About the sed Command

I’ve used different sources when I wrote this post, and I’d just like to mention a few in case you’re curious and want to go down the many rabbit holes of this awesome and complex command. First, there’s the GNU manual for this command which goes beyond the man page. Just so you get an idea, it’s .5MB of a PDF file with almost 40 pages. Don’t say I didn’t warn you.
Then there’s this excellent tutorial that came up first in a search. It’s long and thorough, with a touch of sense of humor. A bit more advanced. If you want to read up more about regex, I found this as a helpful reminder. And then you can always use stackoverflow for specific questions such as “What does sed -i option do?”

Conclusion

That’s it. If you followed along, you probably wondered where’s the part that automates the whole thing, so I get it every Monday. The way it is now, I have to remember to run the script every week. What’s the point in that? I mentioned in the footnotes, the automotive part is cron, and it will be discussed next time. You may have more questions now than you had before reading the post. That’s a good thing - you now have specific questions which are more likely to give you specific answers. I hope to get many of these questions myself so I can update and modify the post to help more folks. Linux and Bash is a wonderful thing. You get all this power to automate and create things completely for free. I spent over a week writing this post, and one of the reasons is that I kept getting distracted by “why is that?” and then looking for answers. The research is one part of the fun, sharing it is another. Thank you for reading!

Footnotes

¹ If you ever write scripts to execute in Mac or Windows (say, in another program) you’ll notice these files has a “.sh” extension. But again, in Linux, this doesn’t matter. Later you will notice that the script creates a file with a .org extension. What’s this hypocrisy you ask? It has to do with the way Emacs is built. Emacs can open any file, but org-mode files (this is the “plug-in” in Emacs that opens org files) are identified by .org extension for sake of convenience. You can include a special line in a file that would tell Emacs this is an org-mode file as well, but using .org is just more natural. ² chmod (change file mode) is a powerful and important command in Linux, outside of the scope of this post. You should check the manual for it (you should know how if you read through this post). This will take you down a rabbit hole regarding Linux file permissions, and you can read more about it here (one of many links available). Wikipedia also has a good section to get you started. ³ The path in Linux is a variable (you’ll learn about those in a bit) which contains all the directories where your Linux knows to finds scripts and commands. OK, but what does that mean? I can’t get into it here (because I’ll never get to publish this post) but enough to say that the script you’re writing is not a part of the “Linux default” commands package, so Linux doesn’t know it’s a command. Imagine telling a person who never shook hands before to just “shake hands.” You’d have to explain it, and then that person could remember how to shake hands. Linux’s way to remember how to shake hands (in this example) is to add it to the list of directories that include such constrictions. This list is the path. ⁴ Automating tasks in Linux are done by a different component, called cron. It takes a specific set of instructions written out in a string and translates it to a specific time loop (for me when using this script, on Monday, 3AM, every week). Cron is something I hope to expand on in a future post. ⁵ This special combo is called a “magic number”, a unique value in ASCII that the computer understands as a direct command. I am not sure how many magic numbers like these exist. Sounds like something interesting to find out. ⁶ Turns out that this date (1/1/1970) is known as “The Unix Epoch.” A quick search led me to this this discussion. Turns out such dates are common in the computing world… read and learn! ⁷ When scripting, certain special characters (like our $ above) are reserved. This means that if we wanted to call our variable “$usd” for example, we couldn’t. There are certain ways to tell Bash we want to use the character as a character, not as a “special signal.” As a matter of fact, the period in my .org is a bit dangerous because the period also has a special meaning. I should have typed out something more specific telling Bash the period here is meant as just a period, not a signal – but at this point I’m not sure how the syntax would look like. I’m learning these things myself, after all. ⁸ Those of you who look carefully might find yourself asking, “OK, but the quotation marks include the command syntax, not just the text we want to use, what’s up with that? Why isn’t it 1s/^/"#+TITLE: Week Starting...”? And I have a good answer: I don’t know. It doesn’t make sense to me either at the moment, but in all documentation I find, this is how the syntax works.

I’ve been using LastPass for the last 5 years and have been happy with it. I recommended it to friends, family, and co-workers. I tried to sell it through its convenience: once set up, LastPass auto-fills the user and password fields, and can even log you into a website directly. LastPass creates complicated passwords automatically and is available on every major browser, iPhones, and Android.

But it seems like even LastPass’s time has come.

As we know, Convenience usually comes at the price of Security. LastPass auto-fill is quick and effective but also makes it easy for someone else to grab your laptop, find your bank website in your history, and log in with your saved credentials. To resolve this issue, LastPass has a couple of built-in options such as logging you out after a certain amount of time or logging off when the browser is closed. These features need to be activated in each new installation of LastPass.

LastPass was an obvious choice for my mom’s new Chromebook. I thought I’d set her up with a new account and share passwords with her this way. I wanted her to learn to trust the app and start creating new secure passwords instead of using the same two or three she’s been using for years. But instead, I discovered a problem.

The option to log off automatically if chrome is closed was ignored. I’ve checked and asked other users on Reddit, but all I got is the generic troubleshooting advice to make sure Chrome completely exists for the auto logoff to work. Exiting Chrome is possible on Windows, Mac, and Linux (for which the guide was written) but, as it turned out, not possible on a Chromebook. I summoned the ChromeOS task manager with shift+esc (this is different than the Chrome browser’s task manager, which is accessible from inside Chrome) and saw that Chrome was still running even after I exited the app. I couldn’t force chrome to quit either: The button to do so was grayed out when I had Chrome highlighted on the list.

This means the only thing blocking someone from accessing all your passwords is your Google Password with a lock screen enabled. Perhaps I’m paranoid, but for me, that’s not enough. I disabled the extension and asked myself these two questions:

1. Is it worth using LastPass over Chrome’s built-in password manager?
2. Is LastPass a good option to save passwords securely?

The first answer is “not really.” If you’re a LastPass power user with a family plan (which allows you to share passwords), then yes, LastPass gives you more features. However, Chrome’s Password Manager now allows you to create secure passwords and sync them with your Google Profile, which means you will have access to those anywhere you log in, including your Phone. Since on a Chromebook your security is already handled by Google, there’s not much sense in creating another account with LastPass which doesn’t offer much.

The second question is harder to answer. LastPass is a company that makes its business in securing passwords all day every day. They have a good product. They are, overall, pretty transparent with their security breaches when they happen and apply patches and fixes fast.

But LastPass' browser extension is also its weakest point. To be fair, the same can be said for any password manager that has an extension built into the browser. Various vulnerabilities have been listed before and some were listed by LastPass themselves. If you’re really concerned about the security of your passwords, you should not use a browser extension. However, if I am hard-pressed between choosing Chrome’s built-in password solution and a third party’s solution that is built into Chrome, I will go with Chrome’s built-in solution. It’s native to the application and hence (hopefully) more secure.

But. The real answer here is that you shouldn’t use a browser extension at all. And that’s what I do these days.

My favorite solution is to use good ol' KeePass, which has been around for about 15 years. I like KeePass for a couple of reasons:

1. It’s a standalone program with a simple GUI and flexibility. It works and looks better than LastPass’s more complicated controls and does not rely on cookies.
2. The only person with my passwords is me, which makes me sleep better at night. This has been my general trend since I started using Linux. It’s not about privacy and less about security, a proud feeling of owning my on data, something I feel we don’t do enough these days.
3. KeePass is old, open-sourced, free, and probably not going anywhere. I’d like to say the same thing about LastPass, but companies such as these constantly get eaten by greedy corporations that inject them with crap in turn.
4. With its combination of using key files and different ciphers (at least via plugins), it feels solid and secure. Not that LastPass security is not good enough. It should also be mentioned that LastPass has two-factor authentication.

Because KeePass doesn’t have a browser extension (at least not out of the box), I use xdotool to auto-type passwords into websites' text fields. The workflow: I click the user field on a website, Alt+Tab back to KeePass, hit the auto-type shortcut, and watch KeePass putting in my credentials as if I’m typing them from memory. Because I can customize the auto-input macro (KeePass2 and up), eventually this makes it even more reliable than LastPass' auto-fill feature, which sometimes doesn’t work well with fancy animated menus.

LastPass is another tool I didn’t think about replacing when I transitioned into Linux, and for a long time, I kept using it in Linux as well. When I switched away from Chrome and stopped being logged into Google all the time, Chrome’s extensions stayed behind. Like many other products (Gmail, Google Docs, Dropbox…) I’m slowly but surely finding good open-source options which are often better.

Last Saturday I had an encounter with dear ol' Aunt Dee. She’s like a lifelong buddy, never too far. Shy and quiet, she sneaks up on you undetected. You only realize she’s around after her long scrawny arms reach around you, hugging, her perfume brings back a daze of nostalgia.

I was playing another round of Cities Skylines, and realized I’m not into the game anymore. As a matter of fact, I was forcing it for the last hour. I promised myself to go to the gym while a part of me was trying to use any possible excuse to keep me glued to my chair. It was gray and cold outside, a weekend after a hard week, I wasn’t in the mood, I didn’t eat enough, bla bla bla. Suddenly, I recognized this train of thought: “Ah! I know you, you depression you, how have you been?”

So, I checked my list of depression indicators. I think anyone who’s been with dear Aunt Dee long enough has a similar list.

As a result, Sunday was different. The first thing I did was go back to my elements. This means, without getting all fancy about my life philosophy, that I did my morning exercise (few stretches, pull-ups, little weights) and meditation. I took my time before I sat at the computer: first, there was one round of exercise, then I made coffee, then a second round of exercise. Then, there was meditation, which started with a mind dump. I talked to myself about things that are important to me, things that I’ve neglected. Then, the meditation itself, a series of deep breaths while counting.

One of my life facts is that when meditation is really needed, there’s always strong resistance to it at the start, but then I don’t want to finish it. Putting my mind in a neutral state after emphasizing to myself things I care about is powerful.

After that, Sunday started taking shape. I know so because my room started looking like my room again. First (it’s always first), the bed. Then laundry. Then, the closet, which was something I hadn’t dealt with in a while. Cleaning my room is similar to cleaning my head. It’s odd that making my bed makes me feel so much better. I don’t know why, but I don’t argue; it works. Later on, I went to the gym again, this time without a long struggle. Later still, I enjoyed sharing a different video game, The Return of the Obra Dinn, with my partner.

This time, I didn’t play alone. It was a nice mutual experience of puzzle solving. It reminded me of my grandparents playing Bridge together, only with more high fives and laughs. The laughter was therapeutic.

Somewhere between the meditation, the game, and the avocado salad/guacamole I made, I found content. Aunt Dee was gone, out of town, see-you-next-time. I had a good day at work yesterday (not excellent, not awesome, just good). It’s important that I mention it for myself, for next time, and for you, the other relatives of Aunt Dee who might find comfort in this.

Have a good rest of the week!