There’s more than a whiff here of the thing Dan and I (and others) keep kicking around, this idea of “OK, what’s next?”, that needs a bit more exploration…

Here’s some Twitter conversation on the subject. Tim Bray provided some more context for the origins of “Desperate Perl Hacker”. Piers Cawley weighed in and chromatic provided some advice on writing maintainable Perl.

(If you read nothing else; read what Piers has to say. Rafe, I tried to add a link to Piers’ post in a comment to this post of yours but your comment system apparently hates me.)

First, let’s get the good stuff out of the way: it’s pretty cool, it Just Works, the battery seems to last a pretty long time, it recharges pretty quickly, it’s very unobtrusive, hanging on your belt, and did I mention it’s pretty cool getting stats on stuff like how active you are over the course of the day and how much you’re sleeping versus how much you’re thrashing around not sleeping? (Here’s my public profile page, if you’re curious — there’s more stats than that available to me that I’ve chosen to not share.)

Next, the slightly dodgy stuff: mine was back-ordered for quite a while (over a month, and well past when they originally indicated it was going to ship). It finally shipped after I started tweeting about it semi-daily, including @fitbit, bitching about how I wanted an update to the shipping status. (I’m not saying that’s what got my unit shipped; it’s possible things would have worked out the same without me doing that — but maybe not.) Finally, the color on the unit they shipped me wasn’t the same as what I’d ordered — not a huge deal, but at the time of my order, they were showing a black model with a silver highlight; the one I got has a turquoise highlight instead. Didn’t bother me enough to return it, but your mileage may vary. (Their Wikipedia page indicates that they’ve got a bit of a history of not delivering stuff on time, so I guess my experience was par for the course.)

And finally, the ugly: as Raster does a good job of pointing out, the way they have the system designed, all your data gets shipped back to the mother ship in the cloud — their cloud. You seem to have access to all of it through their flashy (and Flash-y) web interface, but if you want access to the actual numbers, you’re pretty much out of luck unless you’re willing to dig into one of the unofficial libraries that have reverse-engineered that Flash interface to get access to the XML feeds that are providing the raw data. The part about that approach that makes me nervous is that those XML feeds aren’t documented anywhere, and there’s no guarantee they won’t be radically changed or blocked off without any notice. (Disclosure: I’ve been hacking on one of those libraries myself…)

Finally, another bit of ugly that deserves a special mention: Fitbit has recently announced “premium” fee-based subscription services. They’ve been somewhat aggressive about pushing and up-selling these through their web interface — which, again, you’re pretty much required to use, since there’s no other way to get at your data. The lack of a published API is slightly annoying. Purchasing a piece of hardware merely to be turned into a captive audience for a service up-sell is extremely annoying.

So, to summarize, at this point in time, based on the recent (apparent) change in business model and the lack of a way to access the data from the device without the advertising for “premium” services (and the future potential of a mandatory subscription for the web site), I’m reluctant to recommend anybody buy one of these at this point in time.

On the one hand, it is a cool little toy and I think it can help make you more aware of your sleep patterns and overall activity levels, particularly if you’re a desk jockey like yours truly. On the other hand, $100 (the current purchase price) is outside, or at least on the upper end of, the “eh, what the hell” purchase range for most people. So, unless $100 falls firmly into “petty cash” territory for you, or you don’t care about raw data access or the possibility of future required subscription changes, hold off on the Fitbit for the moment.

‘st’ is an alias for ‘git status’; ‘d’ is an alias for ‘git diff’; ‘push’ is an alias for ‘git push’…

(via)

Set up your own by following the instructions at this repo.

My attempts at compartmentalization have failed. There is only one inbox.

On the down side (that was the up side), there is no “off the clock.” There is no “not on company time.” There is no “not speaking on behalf of…” Disclaimers to the contrary are commonplace, well-rehearsed, and futile. Technologies that “help” us to link our disparate personas will inevitably intertwine them with our impersonas too. There are no “strictly personal venues.” And when nothing can be said without being misconstrued, there is nothing left to be said.

My attempts at compartmentalization have failed. There is only one outbox.

I am big tired.

Read the whole thing; read the comment thread too. Ponder.

(not speaking for my employer.)

Go right from the inspiration — the vision — to actually making it. Don’t think it through. Don’t talk about it. Don’t plan it. Dive in and start making it happen. If you do that — if you can start rocking — you’ll get some momentum, and when you have some momentum then the project has a chance, because now you’re into it. It’s going somewhere, it’s tangible. Sure, you’ll still run up against problems to solve and decisions to make, but you’ll approach these in the moment and solve them in the moment. You’ll solve them so you can keep moving.

(via Paper Bits and yeah i used the exact same pullquote he did but dammit it’s the best ‘graph in the whole thing.)

Update: Elf points out that I missed what he was trying to say.

For the tl;dr crowd, an executive summary: the attackers utilized a previously-unknown cross-site scripting bug in a third-party product, masked it by a URL shortener, and then leveraged that into enough access to trap passwords as they were changed, followed by a global “reset your passwords pls” message… and then they got lucky (or somebody in ASF got sloppy). You’ll have to read the whole thing to get the details of the end game, but all told only one box at ASF was rooted, largely due to a fairly stringent set of internal security policies.

The awesome-in-an-evil-way part: the sophistication of this attack as well as the level of detail in the post-mortem is astounding. The Apache Infrastructure team deserves some major props for their writeup, and somewhere there’s a team of black hats that should really think about trying to do something productive — this much smarts applied to something other than breaking and entering would probably do some great things…

The depressing part: the shortened URL that kicked the whole mess off came in from the outside world and was captured in a help desk system — that’s the third party product that had the previously unknown bug. That’s a pretty innocuous attack vector, all things considered — I probably click on dozens of those a day, without even thinking about it.

Imagine how your corporate or organizational security training would need to be updated to make people aware of the risks associated with URL shorteners, as well as what steps can be taken to mitigate those risks, in a way effective enough to have had a chance at preventing this attack. At this point, you’re probably either laughing or crying, so I’ll stop there, but DAMN. It gets more and more amazing to me, each and every day, that the Internet manages to function at all. That it continues to carry on is largely due to the work of people like the Apache Infrastructure team. (Remember this when Sysadmin Day rolls around…)

Note that MooseX::Declare handles the normal unpacking of arguments that would usually be the first line in a Perl subroutine — $self is just there automagically, and the other two arguments that come in via MooseX::App::Cmd are detected and unpacked because of the way the method is declared in line 14. If the command is invoked without a -n or --name option, it will throw an error about a required option being missing, and dump a helpful usage text, like so:

But wait, where are the --configfile and --file options coming in from? The parent App::Booklist::CLI::BASE class, natch. Note that this class is the one actually extending MooseX::App::Cmd::Command, and it’s also using yet another cool Moose extension, MooseX::SimpleConfig, which is where the --configfile option springs from:

Because of that simple with MooseX::SimpleConfig line, I get automagic loading and parsing of a config file in a multitude of formats — so if I have a YAML file that looks like this:

That’s sufficient to override the default embedded in the code, and the config itself can be overridden with a simple --file db/nothisfile.db on the command line when running any command that extends App::Booklist::CLI::BASE.

MooseX::App::Cmd is the goodness, and MooseX::Declare and MooseX::SimpleConfig are pretty sweet too; the next time you need a CLI app with multiple sub commands you should check them all out…

• Okay, I know it’s only January and all, but I think we may have the bug of the year: “The Welcome screen may be displayed for 30 seconds during the logon process after you set a solid color as the desktop background in Windows 7 or in Windows Server 2008 R2” (via Lifehacker)
• Backup or Export Your Facebook Account talks about how to do just that — but the subtext is, most of the information you’ve put into Facebook is public, regardless of your privacy settings.
• The dates for YAPC2010 have been announced: June 21-23. See you there?
• Grass-fed meat, eggs, and diary in Maryland — need to check these out…
• Fed Up: School Lunch Project — a public school teacher eats the public school lunch offering every day for a year, and blogs it. (via Eric Wagoner’s twitter, IIRC…)
• Monsanto GMO corn causes organ damage in mammals — also, pretty much throughout the American food supply at this point. Yummy. (via Eric Snowdeal’s twitter, IIRC…)

Motivated by a desire to take my lunch to work much more frequently, but realizing that the morning chaos isn’t going to get better anytime soon, and inspired by a couple three recent threads on ask.metafilter, I decided to whip up a batch of freezer burritos. I based things off this breakfast burrito recipe, but ended up making some substantial changes.

Obviously, I was looking for lunch burritos, not breakfast, so the eggs were right out. (Also, not a big fan of the egg in general…) Also, I knew that if I made 20 of the exact same thing, I was going to get bored before they were all gone — so I decided to mix it up a bit, and make some chicken, some steak, and some plain bean burritos, then freeze them all together (unlabeled). Now lunch is going to be an adventure every day!

First up, I got a medium-sized chicken (about 3.5 pounds) and roasted it, using this recipe (there is a recipe down there, under the rant). For the cavity, I used a quarter of a large white onion and about 6 smallish garlic cloves. Aside from peeling the outer layers off both, I didn’t do any additional prep there. Cooked for a little over an hour, and it turned out great — I think I’ll probably use this recipe again as the actual meal. This time, however, I pulled all the meat off the carcass, doing some random quality control inspection along the way. (TASTY!)

While the chicken was cooking, I started a skirt steak marinating. I was working off this recipe, but I rapidly went pretty far afield. I crushed 4 good sized garlic cloves, and then mixed in 3 tablespoons lime juice, 1/4 teaspoon cumin, and 1/2 teaspoon salt to make a thin paste. Slathered that on both sides of the steak, and tossed it in the fridge for several hours. Took it out, brushed both sides with olive oil, grilled it for about 3-4 minutes on each side on a very hot skillet, and that was that.

I also whipped up a batch of white rice using a knock-off Chipotle rice recipe that TheWife found. This is really only meh; if and when I do this again, I need to find a better rice recipe (or improve my technique with this one, or something)…

The other component was a bunch of plain canned black beans, rinsed well and drained. Again, if and when I repeat this, I think I’ll take the trouble to start with dry beans and cook them up; it’ll give a bit more control over the spicing and flavor.

Anyway, once all the meat was prepped, actually making the burritos was pretty easy: slap down a spoon or two of beans, a spoon or two of rice, add the meat (or some salsa for the bean variety), add a handful of a shredded cheddar/jack mix, and wrap it up. Once I had a batch rolled, I wrapped each one in plastic wrap, tossed them all in a freezer bag, and slung that into the deep freeze.

I’ll try to report back in a week or two on how this is working out. I’ve also got my eye on a calzone recipe for the next round of mass cooking — maybe some time next month…