I’ve been a member of Mastodon for a long time, but I had been using Twitter more at the time and did not use it much. But since Twitter began to make a number of changes (even before it was acquired), and because it started to devolve into chaos, I have been using Mastodon much more, especially in the past year. However, this past year saw a lot more reposts/boosts on my Mastodon instead of original content. I’m hoping to change that behavior in 2026.
I’ve been a user of Instagram for a while, but in late September I decided to finally walk away from the platform. I found that I was doomscrolling more and more, and the platform did not help my mental state. Also, with hostile changes at Meta with regard to content ownership, AI use, and privacy intrusions, I felt that it was better to not give the platform any more of myself. Given that, I decided that the best thing for me would be to put it away for a while (if not indefinitely). While I did not close my account, I decided to archive the Instagram app on my phone.
This year has seen a number of changes to my blog, and I hope that I will be able to continue to improve things here over the course of the next year. I have plans to bring back commenting, but in a way that reduces reliance on external vendors while still maintaining the ability to host this blog using Jekyll. In terms of content, I want to try to spend more time writing out some things I’ve learned at work and other thoughts in more long-form, especially since I would like to start learning new programming languages again.
In conclusion, while there is a fair amount here, things were pretty stagnant for me personally in 2025. I do look forward to 2026 where there are a number of signficant events planned, so we’ll see how things go.
]]>As a software engineer and now team lead for the product lane I work within, I’ve inherited a large codebase that has existed for well over a decade and a half. There are tons of things in the backlog that our small team has never been able to get to, and a lot of them are unfortunately bugs. Since I’ve been working with the codebase for over 11 years now, I have both seen the bugs, the reports and filed my own share of them. Now that I am the technical lead for the team, my hope is that I can try to steer development to pay down some of the tech and bug debt and improve the code and product quality overall. But, it doesn’t mean I can’t have a little fun responding to others about some of the work that hasn’t yet been completed.
I recently read this page about how passive-aggressive websites like Let Me Google That For You and No Hello are socially counter-productive, and I can definitely appreciate the argument being made there, but the intent of isthisbugfixed isn’t to solely be the response for a question about whether or not a bug is fixed, but rather as an addendum to the conversation with the inquirer and using the page as a way to bring a little bit of simple levity to an otherwise disappointing response. And I hope that the team that I have worked together with for many years can come to see my responses with this new page with the same level of sarcastic humor that I am known for.
My hope is that other developers might be able to use the site too to add a little bit of humor to their own responses when a bug isn’t yet fixed due to prioritization of other things and there is a bit of disappointment they feel with that fact, but I also hope the site is not abused in the same way that some things like Let Me Google That For You and other similar sites are used as a tool for dismissing conversations.
]]>During the pandemic, I watched the YouTube music videos from There I Ruined It with amusement as the voices of musicians were either manipulated or completely generated using AI to match the tune of completely different melodies, singing songs that they definitely wouldn’t have performed. It was amazing to see and hear these, but did start a growing concern in my mind as it did with a wide host of its audience, that while it demonstrated that it was now technically feasible to fake a person’s voice to say whatever you wanted for entertainment purposes, it was not a far leap to see how the same technology could be developed, refined and used in more serious use cases.
In fact, entertainment industry professionals were concerned about its use by production studios to utilize actors’ and actresses’ likeness and voices in completely computer-generated material without the human person receiving compensation for it. More worryingly, with the increasing political polarization of the entertainment industry, the entertainment industry expressed additional concern that an actor’s visual likeness or voice could be used to promote content or agendas that do not align with the actor’s personal beliefs. In fact, in a similar vein, this was recently demonstrated with a completely generated viral video2 depicting a number of famous individuals flipping off the camera in protest of Kanye West and some of his recent anti-semitic comments online.
Furthermore, while listening to episode 298 of the Defensive Security Podcast, the hosts Jerry Bell and Andrew Kalet discussed how the tech was beginning to be used for more sophisticated phishing attacks on businesses and individuals, and how there still were not very good and widely-adopted practices to combat these new vectors of attack. In the podcast, they also referenced an interesting and fear-inducing demonstration on 60 Minutes by Rachel Tobac of Social Proof Security wherein she demonstrated a novel social engineering attack utilizing Generative AI to generate vocal speech that sounded like a journalist in order to phish sensitive information from a fellow journalist.
While researching the links for this post, I came across the Artificial Intelligence Incident Database, which is an interesting timeline collection of AI-related news articles illustrating some of the difficulties around AI right now. I recommend having a look if you’re interested.
One of the major human problems with Generative AI and the technologies around deepfakes is that there is not currently a way to adequately detect when someone is being exploited by a deepfake during an active, real-time attack. Humans have used speech recognition and visual confirmation as methods of verification and validation of the legitimacy of a person for millennia, and only recently (relatively in human history) started to use shared secrets as social proofs to combat social engineering attacks.
At someone who deals with personal and protected health information at work, I’ve gone through many different trainings discussing how to spot phishing and other social engineering attacks, such as the training materials that discuss the infamous cases of CEOs or other executive-types demanding funds transfers or access requests be completed quickly via some form of text-based interaction such as text messages or emails. The trainings often discuss how to spot these sort of exploits, and some try to to drive home the point that processes should be followed to avoid being lured and exploited and potentially causing a costly incident. While these points still hold true today in the business world even in the context of Generative AI, they often don’t really help the employee in their daily interactions outside of work with their own personal contacts, where things like funds transfer processes either are not established ahead of time, or don’t really exist at all. So while security training exists for businesses to teach employees how to spot bad actors and prevent costly security incidents, these trainings largely benefit and protect the business but don’t do an adequate job of supplying employees with adequate skills and tools to protect themselves against bad actors who may be impersonating friends or family members.
So, during the last couple years where I’ve watched these huge advancements made to the technology, I’ve been trying to think of some somewhat easier-to-adopt processes that both business and ordinary people could adopt to protect ourselves from actors who intend to misuse the technology for unlawful gain. In particular, I wanted to solve the problem of how we could adopt a process that validates the legitimacy of another person during a live conversation, such as over text messages and over phone or video calls.
People are often not too willing to change their habits and routines, and really only respond to changes in processes at work as there are financial incentives motivating them to adopt and adhere to policies. Because of this resistance to change, I believe it will be difficult to come up with a solution that will be widely adopted. I feel this way because, even after repeated recommendation by many well-respected security professionals and prominent news broadcasts and articles, adoption of password managers and the use of randomly-generated, unique passwords for each unique login is still a practice a large number of people have still not yet adopted.
To this, any solution that I came up with must be:
As a software engineer, it is often a reflex to think that because no exact solution exists or is widely-adopted, then I could create a solution to fulfill the need. However in this particular case, I felt that the problem didn’t require an overly-technical solution as the problem is largely a human one. The tech space is already filled with many highly technical solutions utilizing encryption, so I don’t feel that any technical solution that I could come up with would necessarily benefit in an already crowded space. Furthermore, as a human problem, I don’t feel that a technical solution would really be appropriate because technical solutions often do not stick well.
Now, you may be asking yourself: “Okay, Sean, you are a technical professional and you’ve written a lot already and I’ve just spent the last several minutes reading this post expecting a novel technical solution, but now you’re saying that you think that there isn’t a technical solution. Are you wasting my time?” My response is definitely “No, I’m not wasting your time.” Please bear with me as I explain.
In short, my solution involves the use of a modern password manager to allow a shared secret value to be stored by two individuals and whose value can be independently accessed and communicated to each other whenever those individuals need to validate the other person’s legitimacy. Moreover, the shared value should change periodically automatically, so that if the shared secret value were to be leaked, its validity is relatively short-lived. Now, if you have been reading into that closely, it sounds a lot like the One-Time Passcodes (OTP) that are commonly-used by websites online alongside a username and password as a form of Two-Factor Authentication, and you definitely would be correct.
But, you may have some concerns because, what if the vault containing these OTPs is compromised? Here is my added layer: the vault does not contain just a single OTP that each person can refer to, but instead there would be a set of them, and determining which of them to use is based on some criteria that each individual establishes independently outside of the vault.
For example, suppose a couple needs to protect their shared bank account, and sometimes the couple discusses maintenance of the bank account over the phone, such as one calling the other to have them transfer money to one of their creditors as they’ve forgotten to pay a bill before they set off for business travel and it is now due. In a situation such as this, the person on the end of the line needs to verify the other person asking to perform the funds transfer is actually their partner. They do have a secret code or phrase, but as the person is traveling and not in a place they feel comfortable revealing this secret phrase, they instead both log into a shared password vault on their phones and pull up the entry they’ve designated for these proof challenges. The entry has 14 OTPs that rotate every minute. Now, before the travel, the couple discussed that if they had to use this entry, the pattern they would use to determine which of the 14 OTPs they would say to each other was that they would use the OTP corresponding to the day of the week, skipping every other entry. Since it was a Wednesday and their pattern starts on a Sunday, they would choose the 7th entry (Sunday = 1, Monday = 3, Tuesday = 5, Wednesday = 7, etc.) and the traveling partner would say the digits of the entry to the other over the phone without revealing which one they were saying. The other partner could listen to their partner reading off the digits and visually confirm it in their own phone’s display, allowing the partner to be reasonably assured that the person on the other end of the phone is actually their partner and the request could be completed.
This practice can also be used in duress situations, where a separate pattern for the OTPs could be established to signal that one person is under duress. Leveraging the example above, if the traveling partner was asking to have funds wired to a specific bank account while they were traveling because, for instance, they said they lost their wallet, but in reality they were being extorted and were threatened not to reveal the situation to their partner, the partner could instead read off even entries that were previously discussed as being entries used to indicate duress, so they read off the 8th entry instead. This allowed the discussion to continue but to indicate to the partner that they need help but can’t explicitly ask for it due to the sensitive situation.
The two-factor social proof solution I outlined and demonstrated above is simple enough to be utilized by people with at least a working understanding of how to use password managers, but it is far from perfect and there are still a number of problems that it does not address and I’ve not yet figured out. For instance:
I feel Generative AI is still in its infancy and while it continues to improve, and find its place in the tech space, I think the human culture around it has yet to fully understand its affect on society and human-to-human interaction, and as a result I feel that a large percentage of people are at risk of being exploited with it, especially older generations who are less familiar with modern technology and are not as mentally agile to adjust to its rapid changes as their younger peers. I think people should begin to take personal security more seriously and start adopting common security practices in order to protect themselves and their peers from the increasingly sophisticated social engineering attacks of bad actors. I know that my proposed solution is far from a perfect one, but I hope that my ideas here start some conversations among security professionals and technologists to help create more secure and human-friendly approaches to protections against exploitation in this era of Generative AI, but also the journalists and creators who may be better equipped with the skills to translate these ideas into formats that are more easily digested so that people can elevate their personal security hygiene.
I encourage others who would like to have a conversation on this to comment on this Mastodon post related to this post.
]]>After some musings about it, I’d finally decided to sit down for nearly a day (well, a day spanning part of one night and an afternoon the next day) and migrate things across.
The first challenge I ran across was related to my old Docker container that I
used to build and preview the site. For some reason, the official Jekyll Docker container
no longer wanted to function and would crash during build. I attributed it to
the fact that I was trying to run it on my Apple Silicon Macbook Pro (M2 Max),
and there may have been some sort of MacOS update that broke the container
(which is marked x86_64 and thus runs in emulation mode using Rosetta). After
spending an hour trying different things in Docker Desktop, I decided to shelve
the investigation and instead focus on trying to get some sort of container
running with Jekyll so that I could build and preview changes.
Not wanting to spend a ton of time figuring out how to create a container with
Ruby and Jekyll, I came across this Gist containing a useable
Dockerfile that I could quickly build and run Jekyll. After a few tweaks to
use a slightly more-recent version of Ruby and Jekyll (3.2.2 and 4.4.1,
respectively), and adding a simple script to update and call jekyll serve, I
was finally able to get the Jekyll container running and was able to bring up
my site locally.
After that side-quest, I was finally able to start working on migrating the site to a new theme. Initially I was hoping to use some of the git-fu techniques from this StackOverflow post, but I ran into some significant issues where some parts migrated fine but then individual posts were looked at, the old theme would appear for the post. Not great.
Again, I didn’t want to side-quest with trying to figure out what was going on, I decided to shortcut and create an orphan branch, used Hydejack’s starter kit and then just start moving over my posts, assets and other things into the site, making sure the Jekyll build worked with each major step.
Next was updating a few assets (e.g. sidebar background) and configuring various pieces, such as my social media links (or, at least the ones I wanted to publish).
Finally, I tweaked a few things and got it where I felt comfortable as an MVP.
There was just one thing that I had to do that was a bit more involved: maintaining
my Mastodon page verification. Mastodon verification uses an rel="me"
attribute on links to the Mastodon profiles in order to verify ownership. This
allows Mastodon to automatically verify that you own a page since the link listed
in your Mastodon profile matches the link to your profile on your page. Its a
neat trick to allow decentralized ownership validation without human intervention.
The problem here, though, was that the Hydejack template for social media links
did not know about how to add the rel="me" attribute for Mastodon links.
I knew I needed to compensate for this, but I’ve never written Ruby or worked
with the Liquid template engine before, but thankfully the change I needed was
small and did not need too much understanding of the syntax to complete. I
created a copy of the social-list-item.html from the Hydejack project and
added the following:
// File: "_includes/components/social-list-item.html"
{% if platform == "mastodon" %}
{% assign rel = 'rel="me"' %}
{% else %}
{% assign rel = '' %}
{% endif %}
<li>
<a href="" title="" class="no-mark-external">
<span class=""></span>
<span class="sr-only"></span>
</a>
</li>
With this, I was able to have the template engine add the rel="me" for just
the Mastodon link and not for the other links I have listed.
So, I’m pretty happy now with how things have turned out. I am sure there are still other things that I’ve broken, but I hopefully will find those over time.
I would still like to get comments back and working and, as I mentioned in my last post, I would like to have those comments sourced from the Fediverse, but that will be a project for another day.
]]>I decided to post it to the /r/TeslaModel3 subreddit and have received some requests for the source wallpaper.
Here are a couple that I can share. Please do me a solid and keep the attribution of the image. I did my best to keep the watermark as small in the bottom-left corner as I could - at least keep it there if you end up re-sharing it. Thanks!
]]>A couple weeks ago, as part of the year-end review process, my boss asked me to submit a brief list of what I considered my biggest accomplishments were for 2017. Surprisingly, it was actually a bit difficult to think back about the entire year. Because I never delete any emails (save for spam - that goes immediately to the trash), I had to scan through all the emails I received in 2017 to jog my memory. And once I started to accumulate a list of things that I had done (and achieved), summarizing was difficult - and that was just the professional side of my life!
Personally, things were a haze - a constant navigation through a series of changes, missteps and challenges. Thankfully, through it all, I emerged relatively unscathed and stronger than I had at the beginning of the year, largely thanks to family, friends and colleagues. But thanks to the sheer volume of things that happened this year and my inability to remember even 10% of what happened without combing through emails, text messages and social posts, I have chosen to instead try to look forward to 2018 and the goals that I want to achieve there.
This past year has been fraught with fear and anxiety, and having spent the entire year dealing with it, I don’t want to deal with it any more. Its unnecessary baggage and only works to undermine my happiness and leaves me exhausted. Instead, I want to fight for happiness and sanity for myself, my family, friends and colleagues in 2018.
Here is a quick rundown of my goals that I want for myself in the coming year:
Overall, I want to continue to push the boundaries that I’ve already proven to myself that I can go beyond. I want to see where the limits of my potential are - without putting strain on myself and my family. I want to continue to contribute where I can, and improve the lives of others using the skills I’ve learned thus far.
In 2017, I felt I let the year dictate things, but for next year, I’d like to reverse the roles. For 2018, I want to take control and define how I would like the year to be remembered.
]]>The year has been particularly difficult, with a lot of losses, and the cosmos apparently tried to warn me at the beginning. But there were a few positive things this year:
Overall, the year has been a little bittersweet, and this tweet accurately defines the year. I just hope 2017 is better, not just for myself, but for all of us.
]]>Considering switching to a Mac because of the consistency of platform with the environments I frequently interact with (*nix systems), and MacBooks are some of the best performing laptops I’ve ever seen, able to handle my current needs. Though I still feel dirty even considering the platform switch.
Just as the title says, recently I’ve been considering replacing my personal laptop with a MacBook Pro, and it makes me feel dirty. People who have known me for a long time or who have been reading my blog for a while know that I have been ardently opposed to Apple products for a very long time. However, when I started working at PatientSafe Solutions, I was outfitted with a MacBook Pro to perform my work, mainly because our flagship product is a specialized iPhone and corresponding suite of apps for the hospital. This was the first time I’d had to work with a Mac, and it took a while to get used to. However, like my days with Windows, I eventually started to get used to the environment and began pushing the edges of customization to suit my needs: I started adding customizations around how I interact with the filesystem, and began adding more and more utility scripts to make my work system behave the way I needed it to accomplish the work I had to complete.
Personally, I enjoy working inside of Linux environments. They are more reliable, robust and cheaper to maintain and being that I work with them often both at home and at work, it is very familiar to me. However, with my hobbies I also need a robust UI environment that is consumer-friendly - one that responds quickly, has a multitude of features, and a large application library, both commercial and open-source. In my personal time, I also develop applications for *nix-based platforms (Linux, Android) in JVM-based languages (Java, Kotlin). I also do photography, using Photoshop to edit and compose my photos. And recently I have added flying drones to my set of personal hobbies (with a DJI Phantom 3 & other smaller drones, both for stunts and indoor flying). In all, my needs vary quite a bit, but a common theme exists in all cases: I need a fast system with quick access to various things, both through a UI and through the command-line.
Recently, I’ve also wanted an environment that is consistent with the environments I work with at work and at home, allowing me to “write-once- run-everywhere” both in tooling and workflows. Over the last few years I’ve been working a lot with Docker containers and have even started to use them with my own home server, allowing me to develop custom services locally and spin them up on my home server for “production” use, or even use services “off-the-shelf”, and with the recent releases for Docker on Windows or Mac, working with containers locally is now even easier than ever before.
So this brings me to the rationale for considering the switch to a Mac: the OSX kernel is Unix-based (Mach to be specific), and contains at the heart of a system extremely close to that of a Linux-based system; it also has a very fast and un-intrusive UI with one feature that I have loved since I first worked it in very early versions of Windows and in most Linux UIs: multiple desktops. The other thing I have come to really appreciate about the MacBook I work with is its shear speed. Though I don’t really like tight hardware integrations in general, on a laptop it only makes sense, and when the OS is designed & tested with specific hardware on a laptop in mind, the result can be very performant, and this is certainly the case with the MacBook I work with. And finally, I have been generally unimpressed with Microsoft recently.
They recently seem to be changing things for change-sake and not really improving things (much the same way Apple has been going about their offerings since Jobs passed away). In fact, its very telling that Microsoft is struggling as their flagship OS has undergone 3 major revisions in the span of time that I got the laptop I’m looking to replace, and I have yet to upgrade from Windows 7 on it since I’ve seen no benefit to doing so.
So, if I’ve been using Windows 7 since I got my last laptop and am still using it, why change at all at this point? Well, I’m starting to have problems: I’m having trouble with the power connector on the laptop and it just can’t keep up anymore. On the power connector side, while the system is on and plugged in, the power connector applies power and disconnects a short time later, causing the system to speed-step up and down a lot. Moreover, because of this frequent power connected-disconnected cycling, I can no longer use the laptop for extended periods of time since the battery can no longer charge and/or run off the AC power while the laptop is on. On the performance front, it has become slow, and, despite my best efforts to increase speed, and applications I use on it thrash badly because core services are now consuming tons of memory (it has 8GB, but after startup I have only 4GB to use and I can’t increase it further). Also, trying to view the recorded videos from my Phantom 3 is frustratingly difficult as none of the players I have on the machine (VLC included) can handle the HD video that the Phantom 3 can record (1080p@60fps). In fact, Ashley’s Surface Pro 3 performs better than it now. Unfortunately, it is to be expected of a 4-year-old laptop.
So, you may be asking, why another laptop? Why not switch to a desktop platform? Because my life is very dynamic. I visit meetups where I need my laptop to work or demonstrate things. I also sometimes bring my laptop to family functions to demo things to other geeky family members, or sometimes even try to rush-edit family photos to allow me to distribute them to family members while they are physically there with me.
In conclusion, the reason I’ve been considering going to other other side isn’t because everyone else is doing it or that the Apple offerings are superior or that its trendy. Its because my needs have grown, and currently Apple produces some of the most performant laptops I’ve seen to date - due greatly to the fact that the OSX operating system is tuned to work with the hardware, and vice versa. And though I lose the ability to use much of the application library I’ve amassed over the years, it would still end up losing it since some of the applications would no longer work on newer versions of Windows. But, for some of the major commercial applications I use (IntelliJ IDEA, Photoshop), I still have the ability to use them on OSX. As for Office? Well, Google Docs replaced that for me long ago. So unless I find a Windows-based laptop anytime soon that meets and exceeds my needs anytime soon, you might start seeing me sporting a Mac. But you won’t see me donning a black turtleneck anytime soon - its just a means to an end, not a shift in preference. I still prefer Linux over anything else, but for UI and application library support, its frustratingly still not there. Though maybe my next laptop will finally be Linux through-and-through.
]]>
