iOS Universal Links and Privacy

animated GIF of ios showing link opening ebay application

Introduced in iOS 9, Universal Links allow iOS developers to claim ownership of domain names (including wildcards) that can be processed by that developer's iOS app. When an iOS user taps on a link to a URL of that domain name in any app, such as Safari or Mail, and the user has that 3rd party app installed, that 3rd party app is immediately launched to service the URL.

For web browsing apps on iOS that route traffic through VPNs or Tor, this feature can cause traffic to be sent outside of the VPN/Tor network without warning. For instance, if one has the eBay app installed and taps on this link from within Safari or any other web browsing app on iOS, the eBay app will be opened to load that auction page.

Continue reading 995 words...

OpenBSD (not) on the Surface Pro 4

I recently had access to a Surface Pro 4 and tried to boot OpenBSD on it. It did not go well, so I am just putting this here for posterity.

The 2016 Surface Pro 4 is basically just a keyboard-less x86 (Core i5 on the model I had) tablet with some tightly integrated (read: not upgradeable) components. Its optional Surface Type Cover is just a USB-attached keyboard and trackpad, which magnetically secure to the bottom of the device.

Continue reading 640 words...

The 2016 MacBook Pro

I've been using an 11" MacBook Air as my primary computer for six years. It's a great computer that satisfied a lot of requirements I had for a laptop: thin, lightweight, small form factor, excellent keyboard and touchpad, mostly silent, but not an Atom or Core M processor.

I've done a lot on this little computer, like compiling and maintaining an Android ROM, writing the Rails, iOS, and Android apps for Pushover, creating Lobsters, recording and editing 40 episodes of Garbage, and lots of OpenBSD development.

Continue reading 2,058 words...

OpenBSD on the Chromebook Pixel (2015)

The Chromebook Pixel LS (2015) has an Intel Core i7 processor (Broadwell) at 2.4 GHz, 16 GB of RAM, a 2560x1700 400-nit IPS screen (239ppi), and Intel 802.11ac wireless. It has a Kingston 64 GB flash chip, of which about 54 GB can be used by OpenBSD when dual-booting with a 1 GB Chrome OS partition.

chromebook pixel running openbsd showing three terminal windows

Continue reading 3,250 words...

Creating a BBS in 2015

Although it fooled nobody, yesterday for April Fools' Day, Lobsters users that normally saw a boring list of story titles and links were greeted with a BBS-style interface to the site complete with story and comment browsing, private message reading and sending, and a multi-user chat area.

The BBS remains active at https://lobste.rs/bbs (you can login as "guest").

screenshot of lobsters BBS login terminal

Continue reading 2,822 words...

Remotely Installing OpenBSD on a Headless Linux Server

I recently activated a new dedicated server that came preinstalled with Linux, as the hosting provider didn't support OpenBSD. Since they also didn't provide an IP-based KVM without purchasing a dedicated hardware module (though most of the IP-KVMs I've used recently require interfacing with some terrible Java-based monstrosity anyway), I needed a way to remotely install OpenBSD over the running Linux server.

Continue reading 996 words...

Adventures in Toronto

I spent a week in Toronto, Canada attending the OpenBSD t2k13 hackathon hosted at the University of Toronto. While these events are put on every year in random places, I have not attended one since c2k7 in Calgary back in 2007. I tried to go to the Portugal hackathon last year but my travel plans got all screwed up.

I wrote about the technical details of what I accomplished at this event at the OpenBSD Journal so I won't duplicate it here, but it was a fairly productive week for me. I remember at c2k7 I didn't really have much to work on and felt out of place but this time I had more things to do than I had time.

Continue reading 723 words...

An Update on Pushover

It's been a little over 6 months since I released Pushover, the notification service with Android and iOS apps. I've been asked to post an update on how things have been going since then.

Shortly after the initial release, I received some great feedback from Chad Etzel, one of the creators of Notifo, the notification service that I used until it was shut down (which prompted me to create Pushover in the first place). Chad asked for Pushover to support sending messages with URLs that can open external apps, and Pushover soon gained supplementary URL support which required changes in the API and on both Android and iOS apps.

Continue reading 1,766 words...

Hellbanned from Hacker News

Yesterday I submitted a post on Hacker News out of frustration at moderators pedantically changing post titles. After quickly rising to the number two spot on the front page with 482 points and 37 comments, the post was deleted by a moderator, presumably the operator of the site, Paul Graham.

Continue reading 816 words...

Counting Pull-ups

I'm a big fan of my Fitbit pedometer because it does most of its work without any interaction. I clip it onto my pocket and it counts my steps and flights of stairs as I walk throughout the day, then automatically, wirelessly uploads the data to Fitbit's website whenever I'm within range of its USB dongle plugged into one of my computers. The whole thing works without having to think about it or plug anything in. The battery lasts for about a week, and when it finally runs low, my low battery notifier sends a message to my phone through Pushover telling me to put it on its charger for a few hours.

To add to my step data, I got a Withings scale last year which logs my weight and BMI on Withings' website automatically every time I step on the scale. Fitbit's website syncs this data from Withings, so now I'm able to track my steps, flights of stairs, weight, and BMI, all automatically, all on Fitbit's website. I use this data mainly as a motivation to walk more and not get fat, just as my Wii Fit motivated me to exercise every day by tracking all of the data. When I know my Fitbit is counting my steps, I'll avoid hopping on the bus or train to get home and just walk. A few times I've left the house and upon noticing my Fitbit wasn't there, walked all the way back and got it just so the steps I was going to take that day would "count".

Continue reading 871 words...

Building Pushover

On March 7th, 2012, I announced the launch of Pushover, a simple mobile notification service with device clients available for Android and iOS. I kept some notes during the development process, which mostly occurred in the evenings and weekends around my other work.

I had been using Notifo for a year or so to receive push notifications on my phone from my custom network monitor, but last year the free service announced it was shutting down. When I switched back to my Android phone a few months ago, I was unable to download Notifo's Android app which never made it out of beta.

Continue reading 4,264 words...

On Android

The source code to Android 4.0, nicknamed Ice Cream Sandwich, was made available last Monday. For developers of Android ROMs like my Blandroid project, these source code releases enable us to release our own modified versions of Android to users that prefer to use our software on their phones. The source code to the previous major version, Android 3.0, was not made available1 and was only given to certain tablet manufacturers like Motorola.

Continue reading 2,824 words...

An Ecobee Automation Hack

I've had an Ecobee thermostat in my house and now in my apartment for a number of years. It's a touchscreen thermostat equipped with 802.11 wireless that can be remotely adjusted and monitored from Ecobee's website as well as iPhone and Android applications. While the expected use case might be monitoring the temperature of one's home while at work, I often lazily use the phone applications while at home when I'm too cold to get out of bed to turn the heat up. With some Ruby code and SNMP, I am now able to automatically detect when I am home and when I leave the apartment, and adjust the temperature automatically.

Continue reading 1,099 words...

A Man-in-the-Middle Attack in the Wild

Last night I tried to visit one of the websites that I host on one of my dedicated servers, and to my surprise, I saw this instead of the usual content:

My first reaction was that the gzip compression had possibly broken on my server, or that it was a weird compatibility issue with Firefox 6.0 to which I had just upgraded. I enabled Firefox's Web Console to see what was actually being received (highlighting mine):

Continue reading 978 words...