Safari invalid certificate handling sucks

Last week I filed three bugs with Apple regarding how Safari handles invalid certificates.

Bug #1 (Mac OS and iOS): It’s way too easy for a user to bypass a certificate warning. There’s a bunch of text no one will read and a big friendly “Continue” button. Invalid certificates are serious and should not be ignored lightly. Your average user doesn’t know this. It’s the responsibility of the browser to treat invalid certificates with appropriate gravitas. Safari fails here.

Screenshot of Safari's invalid certificate warning on Mac OS

Screenshot of Safari’s invalid certificate warning on Mac OS

Screenshot of Safari's invalid certificate warning on iOS

Screenshot of Safari’s invalid certificate warning on iOS

Bug #2 (iOS): After continuing through a certificate warning, the address bar displays a closed padlock icon. This falsely indicates to the user that their interactions with the page are secure.

Screenshot of Safari after continuing through an invalid certificate warning

Screenshot of Safari after continuing through an invalid certificate warning

Bug #3 (iOS): If a user continues through a certificate warning, this decision should expire at some point. Maybe if the user visits the site in a new browser window. Maybe after a certain amount of time has gone by. As far as I can tell the cert bypass is remembered indefinitely.

Combined, these three issues greatly undermine the effectiveness of https on iOS. I’d wager that it’s significantly easier to perform a man-in-the-middle attack of an https site on an iOS Safari user than an iOS Chrome user.

Apple: You’re one of the biggest companies in the world. You command huge shares of the consumer computer and mobile device markets. Fix your shit.

Posted in Computers | 2 Comments

Nighttime music

When Ruby was a little younger, before we started sleep training, the three of us would sometimes sit in her room at the end of the day and listen to music. I tried to pick music that was soft and calming. Here’s the list of albums we listened to, one each night:

  • Sarah Harmer, You Were Here
  • David Gray, Greatest Hits
  • Gary Peacock Trio, Now This
  • Dave Matthews Band, Under the Table and Dreaming
  • Erlend Øye, Unrest
  • Hooverphonic, Sit Down and Listen to Hooverphonic
  • Marvin Gaye, What’s Going On
  • Rilo Kiley, Take Offs and Landings
  • Natalie Merchant, Ophelia
  • Marvin Gaye, Here, My Dear
  • Sade, Lovers Rock
  • Sting, Fields of Gold: The Best of Sting 1984-1994
Posted in All | Leave a comment

Tips for Caltrain riders, or: “We’re all in this together”

I’ve been commuting on Caltrain five days a week for eighteen months, usually taking my bike on board. To San Francisco from either Sunnyvale or San Mateo.

These are suggestions for how to be courteous to other riders. They’re more important on busy rush hour trains, and even then they’re not strict rules—use common sense (e.g. standing in an aisle is obviously fine if you’re waiting in line to detrain).

General tips

If you’ll be riding more than a few times, use a Clipper card. It’s way easier than buying paper tickets. Just be sure to tag off. Set a countdown timer or alarm on your phone if you’re afraid you’ll forget.

When standing on the platform preparing to board, leave a generous amount of room for people detraining, especially when boarding a bike car.

Avoid standing in the entrance/exit area if you’re not getting off at the next stop. This blocks the way for other people which slows the boarding process which delays the train. This is especially true for the bike car.

Rush hour trains are busy—be ready. Make your way toward the door before the train arrives at your station.

Avoid sitting on the steps or any other walkway or on the floor of the bike car. Especially true for the gallery cars because the walkways are narrower. This blocks the way for other people which slows the boarding process which delays the train. No one should ever have to ask you to allow them to get by.

If the train is standing room only and you’re standing, move all the way to the back of the car. Otherwise there will not be enough room for people to board which slows the boarding process which delays the train. In extreme cases this might prevent someone from boarding. No one wants to get bumped to the next train—we’ve all got somewhere to be.

Avoid sitting in a bike car if you don’t have a bike. Cyclists should be allowed to sit near their bikes. Why, you ask? So they can keep an eye on them as a theft deterrent. So they don’t have to go as far to find a seat or retrieve their bike when getting off. So they can help organize bikes, if needed.

Talking on a phone is officially allowed, but please speak softly.

Don’t put your feet, shoes, or socks on seats. Shoes are filthy—they step in streets where animals pee and poop. No one wants to sit in pee and poop.

If the train is crowded, don’t put your bag in a seat. Seats are for people.

Be kind. If the train is full, you have a seat, someone looks uncomfortable standing, and you’re a strapping young buck or doe, consider standing.

For cyclists on busy trains

All rush hour trains are busy, especially in spring, summer and fall. The train might be empty when you board, but it’s going to be standing room only by the time it gets to SF. Be respectful to people boarding after you. The following suggestions are more important for Gallery cars. Many of the busier rush hour trains have switched to Bombardier trains with three bike cars and congestion is greatly improved.

If you’ll be taking your bike on the train more than a few times, ask a conductor for a yellow bike tag, label it in large, clear, writing, and attach it to your bike.

When deciding which rack to put your bike on, check the yellow bike tags and avoid blocking in a bike that will be getting off before you.

Don’t stop and leave your bike at the first rack when boarding if there’s a line of cyclists behind you waiting to board. Move further into the car to allow those behind you to board.

Be conscientious when putting your bike on a rack. If you need to, flip your bike around so the handlebars fit better. Rotate the pedals so they fit through a gap in the frame of the bike they’re leaning against instead of the spokes. Avoid smashing other people’s derailleurs (they’re somewhat delicate). Don’t be sloppy. Neat racks can fit more bikes. Messy bike racks mean someone else is going to get bumped to the next train, and no one wants to get bumped to the next train—we’ve all got somewhere to be.

If you’re getting off soon (other than the last stop), make your way to your bike early because you might need to shuffle some bikes around or navigate your bike out of a crowded car.

If you’re sitting upstairs and detraining at the last stop and your bike is against a window, please stay upstairs until most people downstairs have gotten off. Otherwise you’ll just get in the way and slow the process for everyone.

If you’re sitting upstairs and detraining at the last stop and your bike is blocking other bikes, consider making your way downstairs early so you can move your bike out of the way. Use your best judgement based on how many bikes you’re blocking and how crowded it already is downstairs.

When detraining at the last stop, avoid shuffling bikes around to get to yours if another bike is on top of it. This slows the detraining process for everyone. Just wait a few minutes for the owner of the other bike to come get it.

When there’s an incident

If a train breaks down, sometimes two trains will be combined into one. It’s a disaster when this happens during rush hour. Especially for cyclists. Rush hour trains are already standing room only—doubling the number of people just isn’t possible. If you have an alternate form of transportation, consider taking it.

If there was a fatality, due to a pedestrian or a car being struck by a train, trains tend to be delayed for one to two hours. It’s a slow process. A coroner must go to the scene, investigate, and decide when it’s OK to start allowing trains through again. Typically only a single track will be opened initially, which means trains can only pass through in one direction at a time. And typically they’re only allowed to move through the area slowly. When there are four trains waiting to pass from each direction it can take a while before your train gets through.

From past experience conductors tend to say things like, “we’re hoping it will be just 10 more minutes.” Sometimes they’re correct, sometime they aren’t. Sometimes it will take significantly longer.

Another thing that happens is northbound trains get blocked south of the accident and can’t make it to SF, then later there won’t be enough trains or conductors or engineers to fill the schedule, so they’ll delay leaving SF until trains arrive. Or they’ll combine trains. Or both. I imagine the same scenario plays out in reverse in San Jose, depending on where the accident is.

You can check Twitter for potentially useful status updates. My public Caltrain twitter list follows the relevant accounts. You can also subscribe to alerts on the Caltrain website.

If your train gets stopped and you’re close to your destination, consider getting off and taking another form of transportation (Uber, Lyft, have someone pick you up, bike the last few miles, etc).

If there are delays and you’re not on a train yet, consider staying where you are. Work from home. Stay at work longer. Grab dinner before heading home. There are many better uses of your time than sitting on a train.

Terminology

Conductors sometimes state that Caltrain is a “proof of payment system.” This means that you must purchase a ticket before boarding, and you must keep the ticket with you while on the train.

Clipper – A convenient card-based payment system used by Caltrain. Clipper cards can also be used for BART, SF buses, and a few other public transit systems.

When paying for a ride with Clipper, you must “tag on” before boarding and “tag off” after detraining. “Tagging” is done by holding your card against a Clipper card reader for a second. There are a few Clipper card readers at each station.

A “protected” crossing – Trains must go through a road or sidewalk crossing slowly, possibly because a crossing gate is broken.

Limited service – The train doesn’t stop at all stations—check the schedule.

Baby bullet – A train operating on the most express schedule (fewest stops) between San Jose and San Francisco.

This train will express to [some station] – The train will skip at least one station before stopping at the named station. Though conductors occasionally accidentally say this out of habit even when it isn’t true.

Gallery – The shiny metal train cars. One door per car per side. Two narrow walkways upstairs each with a row of single seats.

Bombardier – The light gray and red train cars. Two doors per car per side. Many pods of four seats, some with tables. Smoother suspension.

Consist – The type of train car making up a given train. For example, “#SB370 is running with a 5-car gallery consist instead of a 6-car Bombardier consist. #Caltrain.

Rolling stock – The cars and engines used on the tracks.

Posted in All | Leave a comment

Commuter bikes

Popular attributes

Around eighteen months ago I replaced my commuter bike and have been bringing it onboard Caltrain and to my office in San Francisco. Since then I’ve kept my eyes out for decent commuter bikes. Popular commuter bike attributes:

  • Inexpensive. Could get stolen or banged around. City streets tend to have poor quality pavement, potholes, etc., and it’s harder to avoid rough road when riding in traffic, so you want sturdy wheels rather than light and delicate wheels.
  • Single speed. Lower maintenance. No need to spend any brain power thinking about gears while focusing on avoiding cars. Note: If you get a single speed and ride it with a freewheel rather than a fixed gear, I recommend two brakes (front and rear) for redundancy in case one fails. Watch out here—some bikes sold as fixies only have a front brake.
  • Internal gearing. Cleaner, lower maintenance, and more reliable than traditional derailleur due to being enclosed and protected from dirt and impacts. If you want to read more the Wikipedia article has a great list of advantages and disadvantages.
  • Belt drive instead of chain. Cleaner and lower maintenance.
  • Chain guard. Keeps your pants from getting dirty.
  • Fenders. Keep your clothes clean when biking through puddles.
  • Weight. Depending on your usage this may or may not matter to you. Lighter bikes are always nice but they generally cost more. I carry my bike up and down a few steps at home, at my office, and getting on and off of the train. That’s a lot of lifting, so for me 20 lbs vs 25 lbs is a huge difference. But if you’re a heavy guy biking from your home garage to a local shopping center with not many hills in between then a few extra pounds on the bike won’t matter much. Also, lighter weight generally means better quality steel and better quality steel generally means a more pleasant ride.

Brands

You could of course use any bike. There’s no shortage of great entry level city bikes from the major brands (Trek, Fuji, Specialized, Cannondale, Novara, Scattante, Marin, etc.). But if you’re looking for something with more personality you might want to consider a smaller brand. Here are a few options sorted from least to most expensive. Asterisks next to the brands that are a little more appealing to me.

  • Brilliant Bicycle Co. They’re pretty. One, three, or seven speeds. Frames are made of cheap steel (SAE 1020 aka “hi-ten”) and too heavy for my taste (25.5 lbs and up). $300 and up.
  • State* – Single speed. Choose your preferred handlebar style, seat, and pedals. Frame steel is SAE 4130 (aka chromoly) and a decent weight (22 lbs). A coworker bought one and it seemed to be poorly assembled (guy at the local bike shop said there was no grease in the bottom bracket and maybe a screw somewhere had been cross threaded, but take this with a grain of salt—this is second hand info and it sounded like the guy was very anti mail-order bicycle to begin with). $390 and up. They also have an aluminum single speed and some mountain bikes.
  • Bigshot* – Custom fixies and single speeds. Frame steel is SAE 4130 (aka chromoly) and their bikes nudge into the heavy end of the spectrum (23 to 25 lbs). $400 for a custom build. As low as $300 for one of the pre-chosen builds.
  • Priority Bicycles – Belt drives. Three or eight speeds. Aluminum frame. Casual geometry and handlebars (which isn’t my style, but this is a matter of taste). $400 and up.
  • Wabi Cycles* – Quality steel (Reynolds 725 and Columbus Spirit). A few single speed options. Lighter than many other bikes on this list (the Wabi Lightning single speed is only 17.5 lbs!). Can choose your gear ratio, which is nice if you plan to bike up hills. Classically pretty. $750 and up. My personal favorite on this list. If I had to get another commuter I’d absolutely go with a Wabi Classic, and I’d be heartbroken if it got stolen. I love the understated and elegant style. I get the impression the builder is experienced and cares about the bikes he makes.
  • Spot Brand Bicycles – Belt drives. A lot of options. Hubs with various numbers of internal gears. Step through and non step through frames. Steel and aluminum. Too expensive for me to choose as a commuter bike but a decent option if gears are important to you. $1,200 and up.
  • Vanhawks – Belt drives. Single or variable speed. Carbon fiber. Lots of technology. Too expensive for me to choose as a commuter bike and the tech doesn’t particularly interest me. $1,550 and up.

The above are just brands I’ve seen with my own eyes. There are many more. Some brands that I’ve stumbled across and know nothing about:

And you can find many more digging through the archives of Momentum Mag.

Posted in All, Cycling | Leave a comment

Living with a Roomba

Emily and I bought a Roomba after we moved last year. I didn’t want to vacuum or dust mop/Swiffer the whole place on a regular basis. I’ve been mostly happy with the Roomba—I think it saves us time. I think it’s worth the cost as long as it lasts a long time.

It’s quieter than our full upright vacuum and our Chihuahua Toro is less afraid of it, though he still keeps his distance.

We try to be careful to pick things up off the floor before it runs. Phone charger cables, socks, blankets, etc. We also place a blockade line around Toro’s water bowl, ala the Toblerone Line.

It’s scheduled to run once a week. We typically close the doors to our bedrooms to make the coverage area smaller. It usually runs for about an hour before making its way back to the dock. On separate occasions we’ll put it in a bedroom and start it manually.

Our new carpet and rugs shed a lot, which fills up the Roomba’s bin pretty quickly. It has gotten better over the past year, but the bin is still fairly full by the end of a run.

One distinct advantage of the Roomba is that it’s short enough to fit under our couch and another piece of furniture— places that would otherwise never get vacuumed.

Room For Improvement

The biggest downside is that hair gets wrapped around the spinning brushes and needs to be cleaned regularly. I spend about 30 minutes (while watching TV) each month removing the brushes and cutting hair out. It’s not terrible, but it does take away from the time saved by having an automated vacuum. The more expensive Roomba models are supposed to handle this better (we have the cheapest—the 650). Also, I don’t know what would happen if I didn’t clean it. Maybe it’d be fine? I suspect something would eventually break. Or it would clean less efficiently. Or both.

I wish it was smarter about remembering the floor plan and noticing dirt and cleaning dirty areas more thoroughly. For example, our entryway and kitchen tend to have a lot of dirt and it would be great if the Roomba spent more time in those areas. The more expensive Roomba models might be better about this, too.

I think the small spinner brush in the front right side is leaving a horizontal line of scuff marks across our baseboards. Especially when it traps itself in a bathroom. Not surprising, but still unfortunate. It would be better if this brush was made out of a softer material, even if that meant it had to be periodically replaced. I’ve accepted the fact that we’ll have to repaint our baseboards when we eventually move out—not the end of the world.

The Roomba’s suction is weaker than our upright vacuum, but not detrimentally so.

Posted in All | Leave a comment

Hiking with Ruby

Today Emily and I hiked 7.7 miles with Ruby at Purisima Creek Redwoods Open Space Preserve. From Skyline Blvd at an elevation of 2,000ft down to Purisima Creek Rd at an elevation of 430ft, and back. You can see info about the hike on Strava. The “Flyby” viewer is cool—you can press the play button and see a replay.

Purisima Creek Redwoods OSP is in the Santa Cruz Mountains between San Mateo and the Pacific Ocean. There are redwood trees, creeks, ferns, lots of valleys, and a few views of the ocean. The trails we took were mostly shaded. It’s a nice place, though the trails do have quite a bit of elevation change.

This was the third hike we’ve done with Ruby. The other two were shorter, at Water Dog Lake Park in Belmont (hike 1, hike 2). Ruby can’t walk yet (come on, Ruby! get with the program!) so I’ve been carrying her on my chest in a Babybjörn. She weighs around 12 pounds and the Babybjörn adds another pound or two. We look like this:

Me and Ruby hiking

She seems pretty happy in there. It’s snug and padded and warm next to my chest. She mostly either sleeps or looks at all the green. We cover her head and arms with a blanket when we’re in the sun.

Today we both wore hiking packs and CamelBaks. I carried our three legged camping stools and we stopped twice to feed Ruby and eat. We did one diaper change… we probably should have done two. With our food water, stools, and baby supplies my pack was around 20 pounds and Emily’s was 10 or 15.

Toro didn’t join us today. Although he does enjoy spending time outdoors with us, the length and steepness of this hike would have been hard for him.

We had a good time and got a great workout.

Posted in All | Leave a comment

Great albums, volume 3

One cool thing about scrobbling all music played from my home and work computers is that I have a pretty good record of what music I’ve listened to the most. Here’s a list of some albums that I think are fantastic (continuing a trend from 2005 and 2008).

Adele, 19
Bill Withers, Greatest Hits
Céu, Vagarosa
Florence + the Machine, Lungs
Foster the People, Torches
Madonna, The Immaculate Collection
No Doubt, Tragic Kingdom
Paolo Nutini, These Streets
Ra Ra Riot, The Rhumb Line
Rodrigo y Gabriela, 11:11
The xx, xx

Also I think it’s funny to see a picture of Bach in here:
screenshot of Last.fm top artists

Posted in All | Leave a comment

Blue Apron

I’ve been doing a lot of cooking this week while Emily cares for our new daughter. Blue Apron meals, mostly. Seven of them (we got a little behind while in the hospital).

Blue Apron is a service that once a week sends you a box of ingredients and recipes for three different meals. I find that it takes around two hours on average to chop, cook, put dishes in the dishwasher, and clean the kitchen. Way more time than I’d choose to spend preparing food, but if this is appealing to you then you should totally try it. They do a good job. The food is usually pretty good and it’s an effective way to learn about new ingredients and cooking techniques.

I’ve done more cooking over the past week than at any other point in my life. I blanched things. Used an oven on more than one occasion. Ate goat cheese a few times. Bedlam.

Shiitake Mushroom & Cabbage Dumplings

Spicy Orange Chicken Wings

Broccolini & Goat Cheese Polenta

Fresh Beet Linguine

Posted in All | Leave a comment